22997 lines
873 KiB
HTML
22997 lines
873 KiB
HTML
<!doctype html public "-//W3C//DTD HTML 4.01 Transitional//EN"
|
|
"https://www.w3.org/TR/html4/loose.dtd">
|
|
|
|
<html>
|
|
|
|
<head>
|
|
|
|
<title>Postfix Configuration Parameters </title>
|
|
|
|
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
|
|
<link rel='stylesheet' type='text/css' href='postfix-doc.css'>
|
|
|
|
<script type="text/javascript">
|
|
|
|
// Kludge for https://support.google.com/chrome/thread/11993079
|
|
const isChrome = /Chrome/.test(navigator.userAgent)
|
|
&& /Google Inc/.test(navigator.vendor);
|
|
const hash = window.location.hash;
|
|
if (hash && isChrome) {
|
|
setTimeout(function() {
|
|
window.location.hash = "";
|
|
window.location.hash = hash;
|
|
}, 1000);
|
|
}
|
|
|
|
</script>
|
|
|
|
</head>
|
|
|
|
<body>
|
|
|
|
<h1><img src="postfix-logo.jpg" width="203" height="98" alt="">Postfix Configuration Parameters </h1>
|
|
|
|
<hr>
|
|
|
|
<h2> Postfix main.cf file format </h2>
|
|
|
|
<p> The Postfix main.cf configuration file specifies a very small
|
|
subset of all the parameters that control the operation of the
|
|
Postfix mail system. Parameters not explicitly specified are left
|
|
at their default values. </p>
|
|
|
|
<p> The general format of the main.cf file is as follows: </p>
|
|
|
|
<ul>
|
|
|
|
<li> <p> Each logical line is in the form "parameter = value".
|
|
Whitespace around the "=" is ignored, as is whitespace at the end
|
|
of a logical line. </p>
|
|
|
|
<li> <p> Empty lines and whitespace-only lines are ignored, as are
|
|
lines whose first non-whitespace character is a `#'. </p>
|
|
|
|
<li> <p> A logical line starts with non-whitespace text. A line
|
|
that starts with whitespace continues a logical line. </p>
|
|
|
|
<li> <p> A parameter value may refer to other parameters. </p>
|
|
|
|
<ul>
|
|
|
|
<li> <p> The expressions "$name" and "${name}" are recursively
|
|
replaced with the value of the named parameter. The parameter name
|
|
must contain only characters from the set [a-zA-Z0-9_].
|
|
An undefined parameter value is replaced with the empty value. </p>
|
|
|
|
<li> <p> The expressions "${name?value}" and "${name?{value}}" are
|
|
replaced with "value" when "$name" is non-empty. The parameter name
|
|
must contain only characters from the set [a-zA-Z0-9_]. These forms are
|
|
supported with Postfix versions ≥ 2.2 and ≥ 3.0, respectively.
|
|
</p>
|
|
|
|
<li> <p> The expressions "${name:value}" and "${name:{value}}" are
|
|
replaced with "value" when "$name" is empty. The parameter name must
|
|
contain only characters from the set [a-zA-Z0-9_]. These forms are
|
|
supported with Postfix versions ≥ 2.2 and ≥ 3.0, respectively.
|
|
</p>
|
|
|
|
<li> <p> The expression "${name?{value1}:{value2}}" is replaced
|
|
with "value1" when "$name" is non-empty, and with "value2" when
|
|
"$name" is empty. The "{}" is required for "value1", optional for
|
|
"value2". The parameter name must contain only characters from the
|
|
set [a-zA-Z0-9_]. This form is supported with Postfix versions
|
|
≥ 3.0. </p>
|
|
|
|
<li> <p> The first item inside "${...}" may be a relational expression
|
|
of the form: "{value3} == {value4}". Besides the "==" (equality)
|
|
operator Postfix supports "!=" (inequality), "<", "≤", "≥",
|
|
and ">". The comparison is numerical when both operands are all
|
|
digits, otherwise the comparison is lexicographical. These forms
|
|
are supported with Postfix versions ≥ 3.0. </p>
|
|
|
|
<li> <p> Each "value" is subject to recursive named parameter and
|
|
relational expression evaluation, except where noted. </p>
|
|
|
|
<li> <p> Whitespace before or after each "{value}" is ignored. </p>
|
|
|
|
<li> <p> Specify "$$" to produce a single "$" character. </p>
|
|
|
|
<li> <p> The legacy form "$(...)" is equivalent to the preferred
|
|
form "${...}". </p>
|
|
|
|
</ul>
|
|
|
|
<li> <p> When the same parameter is defined multiple times, only
|
|
the last instance is remembered. </p>
|
|
|
|
<li> <p> Otherwise, the order of main.cf parameter definitions does
|
|
not matter. </p>
|
|
|
|
</ul>
|
|
|
|
<p> The remainder of this document is a description of all Postfix
|
|
configuration parameters. Default values are shown after the
|
|
parameter name in parentheses, and can be looked up with the
|
|
"<b>postconf -d</b>" command. </p>
|
|
|
|
<p> Note: this is not an invitation to make changes to Postfix
|
|
configuration parameters. Unnecessary changes are likely to impair
|
|
the operation of the mail system. </p>
|
|
|
|
<dl>
|
|
<DT><b><a name="2bounce_notice_recipient">2bounce_notice_recipient</a>
|
|
(default: postmaster)</b></DT><DD>
|
|
|
|
<p> The recipient of undeliverable mail that cannot be returned to
|
|
the sender. This feature is enabled with the <a href="postconf.5.html#notify_classes">notify_classes</a>
|
|
parameter. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="access_map_defer_code">access_map_defer_code</a>
|
|
(default: 450)</b></DT><DD>
|
|
|
|
<p>
|
|
The numerical Postfix SMTP server response code for
|
|
an <a href="access.5.html">access(5)</a> map "defer" action, including "<a href="postconf.5.html#defer_if_permit">defer_if_permit</a>"
|
|
or "<a href="postconf.5.html#defer_if_reject">defer_if_reject</a>". Prior to Postfix 2.6, the response
|
|
is hard-coded as "450".
|
|
</p>
|
|
|
|
<p>
|
|
Do not change this unless you have a complete understanding of <a href="https://tools.ietf.org/html/rfc5321">RFC 5321</a>.
|
|
</p>
|
|
|
|
<p>
|
|
This feature is available in Postfix 2.6 and later.
|
|
</p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="access_map_reject_code">access_map_reject_code</a>
|
|
(default: 554)</b></DT><DD>
|
|
|
|
<p>
|
|
The numerical Postfix SMTP server response code for
|
|
an <a href="access.5.html">access(5)</a> map "reject" action.
|
|
</p>
|
|
|
|
<p>
|
|
Do not change this unless you have a complete understanding of <a href="https://tools.ietf.org/html/rfc5321">RFC 5321</a>.
|
|
</p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="address_verify_cache_cleanup_interval">address_verify_cache_cleanup_interval</a>
|
|
(default: 12h)</b></DT><DD>
|
|
|
|
<p> The amount of time between <a href="verify.8.html">verify(8)</a> address verification
|
|
database cleanup runs. This feature requires that the database
|
|
supports the "delete" and "sequence" operators. Specify a zero
|
|
interval to disable database cleanup. </p>
|
|
|
|
<p> After each database cleanup run, the <a href="verify.8.html">verify(8)</a> daemon logs the
|
|
number of entries that were retained and dropped. A cleanup run is
|
|
logged as "partial" when the daemon terminates early after "<b>postfix
|
|
reload</b>", "<b>postfix stop</b>", or no requests for $<a href="postconf.5.html#max_idle">max_idle</a>
|
|
seconds. </p>
|
|
|
|
<p> Specify a non-negative time value (an integral value plus an optional
|
|
one-letter suffix that specifies the time unit). Time units: s
|
|
(seconds), m (minutes), h (hours), d (days), w (weeks).
|
|
The default time unit is h (hours). </p>
|
|
|
|
<p> This feature is available in Postfix 2.7. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="address_verify_default_transport">address_verify_default_transport</a>
|
|
(default: $<a href="postconf.5.html#default_transport">default_transport</a>)</b></DT><DD>
|
|
|
|
<p>
|
|
Overrides the <a href="postconf.5.html#default_transport">default_transport</a> parameter setting for address
|
|
verification probes.
|
|
</p>
|
|
|
|
<p>
|
|
This feature is available in Postfix 2.1 and later.
|
|
</p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="address_verify_local_transport">address_verify_local_transport</a>
|
|
(default: $<a href="postconf.5.html#local_transport">local_transport</a>)</b></DT><DD>
|
|
|
|
<p>
|
|
Overrides the <a href="postconf.5.html#local_transport">local_transport</a> parameter setting for address
|
|
verification probes.
|
|
</p>
|
|
|
|
<p>
|
|
This feature is available in Postfix 2.1 and later.
|
|
</p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="address_verify_map">address_verify_map</a>
|
|
(default: see "postconf -d" output)</b></DT><DD>
|
|
|
|
<p>
|
|
Lookup table for persistent address verification status
|
|
storage. The table is maintained by the <a href="verify.8.html">verify(8)</a> service, and
|
|
is opened before the process releases privileges.
|
|
</p>
|
|
|
|
<p>
|
|
The lookup table is persistent by default (Postfix 2.7 and later).
|
|
Specify an empty table name to keep the information in volatile
|
|
memory which is lost after "<b>postfix reload</b>" or "<b>postfix
|
|
stop</b>". This is the default with Postfix version 2.6 and earlier.
|
|
</p>
|
|
|
|
<p>
|
|
Specify a location in a file system that will not fill up. If the
|
|
database becomes corrupted, the world comes to an end. To recover,
|
|
delete (NOT: truncate) the file and do "<b>postfix reload</b>".
|
|
</p>
|
|
|
|
<p> Postfix daemon processes do not use root privileges when opening
|
|
this file (Postfix 2.5 and later). The file must therefore be
|
|
stored under a Postfix-owned directory such as the <a href="postconf.5.html#data_directory">data_directory</a>.
|
|
As a migration aid, an attempt to open the file under a non-Postfix
|
|
directory is redirected to the Postfix-owned <a href="postconf.5.html#data_directory">data_directory</a>, and a
|
|
warning is logged. </p>
|
|
|
|
<p>
|
|
Examples:
|
|
</p>
|
|
|
|
<pre>
|
|
<a href="postconf.5.html#address_verify_map">address_verify_map</a> = <a href="DATABASE_README.html#types">hash</a>:/var/lib/postfix/verify
|
|
<a href="postconf.5.html#address_verify_map">address_verify_map</a> = <a href="DATABASE_README.html#types">btree</a>:/var/lib/postfix/verify
|
|
</pre>
|
|
|
|
<p>
|
|
This feature is available in Postfix 2.1 and later.
|
|
</p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="address_verify_negative_cache">address_verify_negative_cache</a>
|
|
(default: yes)</b></DT><DD>
|
|
|
|
<p>
|
|
Enable caching of failed address verification probe results. When
|
|
this feature is enabled, the cache may pollute quickly with garbage.
|
|
When this feature is disabled, Postfix will generate an address
|
|
probe for every lookup.
|
|
</p>
|
|
|
|
<p>
|
|
This feature is available in Postfix 2.1 and later.
|
|
</p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="address_verify_negative_expire_time">address_verify_negative_expire_time</a>
|
|
(default: 3d)</b></DT><DD>
|
|
|
|
<p>
|
|
The time after which a failed probe expires from the address
|
|
verification cache.
|
|
</p>
|
|
|
|
<p> Specify a non-zero time value (an integral value plus an optional
|
|
one-letter suffix that specifies the time unit). Time units: s
|
|
(seconds), m (minutes), h (hours), d (days), w (weeks).
|
|
The default time unit is d (days). </p>
|
|
|
|
<p>
|
|
This feature is available in Postfix 2.1 and later.
|
|
</p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="address_verify_negative_refresh_time">address_verify_negative_refresh_time</a>
|
|
(default: 3h)</b></DT><DD>
|
|
|
|
<p>
|
|
The time after which a failed address verification probe needs to
|
|
be refreshed.
|
|
</p>
|
|
|
|
<p> Specify a non-zero time value (an integral value plus an optional
|
|
one-letter suffix that specifies the time unit). Time units: s
|
|
(seconds), m (minutes), h (hours), d (days), w (weeks).
|
|
The default time unit is h (hours). </p>
|
|
|
|
<p>
|
|
This feature is available in Postfix 2.1 and later.
|
|
</p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="address_verify_pending_request_limit">address_verify_pending_request_limit</a>
|
|
(default: see "postconf -d" output)</b></DT><DD>
|
|
|
|
<p> A safety limit that prevents address verification requests from
|
|
overwhelming the Postfix queue. By default, the number of pending
|
|
requests is limited to 1/4 of the <a href="QSHAPE_README.html#active_queue">active queue</a> maximum size
|
|
(<a href="postconf.5.html#qmgr_message_active_limit">qmgr_message_active_limit</a>). The queue manager enforces the limit
|
|
by tempfailing requests that exceed the limit. This affects only
|
|
unknown addresses and inactive addresses that have expired, because
|
|
the <a href="verify.8.html">verify(8)</a> daemon automatically refreshes an active address
|
|
before it expires. </p>
|
|
|
|
<p> This feature is available in Postfix 3.1 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="address_verify_poll_count">address_verify_poll_count</a>
|
|
(default: normal: 3, <a href="STRESS_README.html">overload</a>: 1)</b></DT><DD>
|
|
|
|
<p>
|
|
How many times to query the <a href="verify.8.html">verify(8)</a> service for the completion
|
|
of an address verification request in progress.
|
|
</p>
|
|
|
|
<p> By default, the Postfix SMTP server polls the <a href="verify.8.html">verify(8)</a> service
|
|
up to three times under non-overload conditions, and only once when
|
|
under overload. With Postfix version 2.5 and earlier, the SMTP
|
|
server always polls the <a href="verify.8.html">verify(8)</a> service up to three times by
|
|
default. </p>
|
|
|
|
<p>
|
|
Specify 1 to implement a crude form of greylisting, that is, always
|
|
defer the first delivery request for a new address.
|
|
</p>
|
|
|
|
<p>
|
|
Examples:
|
|
</p>
|
|
|
|
<pre>
|
|
# Postfix ≤ 2.6 default
|
|
<a href="postconf.5.html#address_verify_poll_count">address_verify_poll_count</a> = 3
|
|
# Poor man's greylisting
|
|
<a href="postconf.5.html#address_verify_poll_count">address_verify_poll_count</a> = 1
|
|
</pre>
|
|
|
|
<p>
|
|
This feature is available in Postfix 2.1 and later.
|
|
</p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="address_verify_poll_delay">address_verify_poll_delay</a>
|
|
(default: 3s)</b></DT><DD>
|
|
|
|
<p>
|
|
The delay between queries for the completion of an address
|
|
verification request in progress.
|
|
</p>
|
|
|
|
<p>
|
|
The default polling delay is 3 seconds.
|
|
</p>
|
|
|
|
<p> Specify a non-zero time value (an integral value plus an optional
|
|
one-letter suffix that specifies the time unit). Time units: s
|
|
(seconds), m (minutes), h (hours), d (days), w (weeks).
|
|
The default time unit is s (seconds). </p>
|
|
|
|
<p>
|
|
This feature is available in Postfix 2.1 and later.
|
|
</p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="address_verify_positive_expire_time">address_verify_positive_expire_time</a>
|
|
(default: 31d)</b></DT><DD>
|
|
|
|
<p>
|
|
The time after which a successful probe expires from the address
|
|
verification cache.
|
|
</p>
|
|
|
|
<p> Specify a non-zero time value (an integral value plus an optional
|
|
one-letter suffix that specifies the time unit). Time units: s
|
|
(seconds), m (minutes), h (hours), d (days), w (weeks).
|
|
The default time unit is d (days). </p>
|
|
|
|
<p>
|
|
This feature is available in Postfix 2.1 and later.
|
|
</p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="address_verify_positive_refresh_time">address_verify_positive_refresh_time</a>
|
|
(default: 7d)</b></DT><DD>
|
|
|
|
<p>
|
|
The time after which a successful address verification probe needs
|
|
to be refreshed. The address verification status is not updated
|
|
when the probe fails (optimistic caching).
|
|
</p>
|
|
|
|
<p> Specify a non-zero time value (an integral value plus an optional
|
|
one-letter suffix that specifies the time unit). Time units: s
|
|
(seconds), m (minutes), h (hours), d (days), w (weeks).
|
|
The default time unit is d (days). </p>
|
|
|
|
<p>
|
|
This feature is available in Postfix 2.1 and later.
|
|
</p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="address_verify_relay_transport">address_verify_relay_transport</a>
|
|
(default: $<a href="postconf.5.html#relay_transport">relay_transport</a>)</b></DT><DD>
|
|
|
|
<p>
|
|
Overrides the <a href="postconf.5.html#relay_transport">relay_transport</a> parameter setting for address
|
|
verification probes.
|
|
</p>
|
|
|
|
<p>
|
|
This feature is available in Postfix 2.1 and later.
|
|
</p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="address_verify_relayhost">address_verify_relayhost</a>
|
|
(default: $<a href="postconf.5.html#relayhost">relayhost</a>)</b></DT><DD>
|
|
|
|
<p>
|
|
Overrides the <a href="postconf.5.html#relayhost">relayhost</a> parameter setting for address verification
|
|
probes. This information can be overruled with the <a href="transport.5.html">transport(5)</a> table.
|
|
</p>
|
|
|
|
<p>
|
|
This feature is available in Postfix 2.1 and later.
|
|
</p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="address_verify_sender">address_verify_sender</a>
|
|
(default: $<a href="postconf.5.html#double_bounce_sender">double_bounce_sender</a>)</b></DT><DD>
|
|
|
|
<p> The sender address to use in address verification probes; prior
|
|
to Postfix 2.5 the default was "postmaster". To
|
|
avoid problems with address probes that are sent in response to
|
|
address probes, the Postfix SMTP server excludes the probe sender
|
|
address from all SMTPD access blocks. </p>
|
|
|
|
<p>
|
|
Specify an empty value (<a href="postconf.5.html#address_verify_sender">address_verify_sender</a> =) or <> if you want
|
|
to use the null sender address. Beware, some sites reject mail from
|
|
<>, even though RFCs require that such addresses be accepted.
|
|
</p>
|
|
|
|
<p>
|
|
Examples:
|
|
</p>
|
|
|
|
<pre>
|
|
<a href="postconf.5.html#address_verify_sender">address_verify_sender</a> = <>
|
|
<a href="postconf.5.html#address_verify_sender">address_verify_sender</a> = postmaster@<a href="postconf.5.html#mydomain">mydomain</a>
|
|
</pre>
|
|
|
|
<p>
|
|
This feature is available in Postfix 2.1 and later.
|
|
</p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="address_verify_sender_dependent_default_transport_maps">address_verify_sender_dependent_default_transport_maps</a>
|
|
(default: $<a href="postconf.5.html#sender_dependent_default_transport_maps">sender_dependent_default_transport_maps</a>)</b></DT><DD>
|
|
|
|
<p> Overrides the <a href="postconf.5.html#sender_dependent_default_transport_maps">sender_dependent_default_transport_maps</a> parameter
|
|
setting for address verification probes. </p>
|
|
|
|
<p> This feature is available in Postfix 2.7 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="address_verify_sender_dependent_relayhost_maps">address_verify_sender_dependent_relayhost_maps</a>
|
|
(default: $<a href="postconf.5.html#sender_dependent_relayhost_maps">sender_dependent_relayhost_maps</a>)</b></DT><DD>
|
|
|
|
<p>
|
|
Overrides the <a href="postconf.5.html#sender_dependent_relayhost_maps">sender_dependent_relayhost_maps</a> parameter setting for address
|
|
verification probes.
|
|
</p>
|
|
|
|
<p>
|
|
This feature is available in Postfix 2.3 and later.
|
|
</p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="address_verify_sender_ttl">address_verify_sender_ttl</a>
|
|
(default: 0s)</b></DT><DD>
|
|
|
|
<p> The time between changes in the time-dependent portion of address
|
|
verification probe sender addresses. The time-dependent portion is
|
|
appended to the localpart of the address specified with the
|
|
<a href="postconf.5.html#address_verify_sender">address_verify_sender</a> parameter. This feature is ignored when the
|
|
probe sender addresses is the null sender, i.e. the <a href="postconf.5.html#address_verify_sender">address_verify_sender</a>
|
|
value is empty or <>. </p>
|
|
|
|
<p> Historically, the probe sender address was fixed. This has
|
|
caused such addresses to end up on spammer mailing lists, and has
|
|
resulted in wasted network and processing resources. </p>
|
|
|
|
<p> To enable time-dependent probe sender addresses, specify a
|
|
non-zero time value. Specify a value of at least several hours,
|
|
to avoid problems with senders that use greylisting. Avoid nice
|
|
TTL values, to make the result less predictable. </p>
|
|
|
|
<p> Specify a non-negative time value (an integral value plus an optional
|
|
one-letter suffix that specifies the time unit). Time units: s
|
|
(seconds), m (minutes), h (hours), d (days), w (weeks).
|
|
The default time unit is s (seconds). </p>
|
|
|
|
<p> This feature is available in Postfix 2.9 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="address_verify_service_name">address_verify_service_name</a>
|
|
(default: verify)</b></DT><DD>
|
|
|
|
<p>
|
|
The name of the <a href="verify.8.html">verify(8)</a> address verification service. This service
|
|
maintains the status of sender and/or recipient address verification
|
|
probes, and generates probes on request by other Postfix processes.
|
|
</p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="address_verify_transport_maps">address_verify_transport_maps</a>
|
|
(default: $<a href="postconf.5.html#transport_maps">transport_maps</a>)</b></DT><DD>
|
|
|
|
<p>
|
|
Overrides the <a href="postconf.5.html#transport_maps">transport_maps</a> parameter setting for address verification
|
|
probes.
|
|
</p>
|
|
|
|
<p>
|
|
This feature is available in Postfix 2.1 and later.
|
|
</p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="address_verify_virtual_transport">address_verify_virtual_transport</a>
|
|
(default: $<a href="postconf.5.html#virtual_transport">virtual_transport</a>)</b></DT><DD>
|
|
|
|
<p>
|
|
Overrides the <a href="postconf.5.html#virtual_transport">virtual_transport</a> parameter setting for address
|
|
verification probes.
|
|
</p>
|
|
|
|
<p>
|
|
This feature is available in Postfix 2.1 and later.
|
|
</p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="alias_database">alias_database</a>
|
|
(default: see "postconf -d" output)</b></DT><DD>
|
|
|
|
<p>
|
|
The alias databases for <a href="local.8.html">local(8)</a> delivery that are updated with
|
|
"<b>newaliases</b>" or with "<b>sendmail -bi</b>".
|
|
</p>
|
|
|
|
<p>
|
|
This is a separate configuration parameter because not all the
|
|
tables specified with $<a href="postconf.5.html#alias_maps">alias_maps</a> have to be local files.
|
|
</p>
|
|
|
|
<p>
|
|
Examples:
|
|
</p>
|
|
|
|
<pre>
|
|
<a href="postconf.5.html#alias_database">alias_database</a> = <a href="DATABASE_README.html#types">hash</a>:/etc/aliases
|
|
<a href="postconf.5.html#alias_database">alias_database</a> = <a href="DATABASE_README.html#types">hash</a>:/etc/mail/aliases
|
|
</pre>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="alias_maps">alias_maps</a>
|
|
(default: see "postconf -d" output)</b></DT><DD>
|
|
|
|
<p>
|
|
Optional lookup tables that are searched only with an email address
|
|
localpart (no domain) and that apply only to <a href="local.8.html">local(8)</a> recipients;
|
|
this is unlike <a href="postconf.5.html#virtual_alias_maps">virtual_alias_maps</a> that are often searched with a
|
|
full email address (including domain) and that apply to all recipients:
|
|
<a href="local.8.html">local(8)</a>, virtual, and remote.
|
|
The <a href="postconf.5.html#alias_maps">alias_maps</a> table format and lookups are documented in <a href="aliases.5.html">aliases(5)</a>.
|
|
For an overview of Postfix address manipulations see the
|
|
<a href="ADDRESS_REWRITING_README.html">ADDRESS_REWRITING_README</a> document. </p>
|
|
|
|
<p>
|
|
Specify zero or more "type:name" lookup tables, separated by
|
|
whitespace or comma. Tables will be searched in the specified order
|
|
until a match is found.
|
|
Note: these lookups are recursive.
|
|
</p>
|
|
|
|
<p>
|
|
The default list is system dependent. On systems with NIS, the
|
|
default is to search the local alias database, then the NIS alias
|
|
database.
|
|
</p>
|
|
|
|
<p>
|
|
If you change the alias database, run "<b>postalias /etc/aliases</b>"
|
|
(or wherever your system stores the mail alias file), or simply
|
|
run "<b>newaliases</b>" to build the necessary DBM or DB file.
|
|
</p>
|
|
|
|
<p>
|
|
The <a href="local.8.html">local(8)</a> delivery agent disallows regular expression substitution
|
|
of $1 etc. in <a href="postconf.5.html#alias_maps">alias_maps</a>, because that would open a security hole.
|
|
</p>
|
|
|
|
<p>
|
|
The <a href="local.8.html">local(8)</a> delivery agent will silently ignore requests to use
|
|
the <a href="proxymap.8.html">proxymap(8)</a> server within <a href="postconf.5.html#alias_maps">alias_maps</a>. Instead it will open the
|
|
table directly. Before Postfix version 2.2, the <a href="local.8.html">local(8)</a> delivery
|
|
agent will terminate with a fatal error.
|
|
</p>
|
|
|
|
<p>
|
|
Examples:
|
|
</p>
|
|
|
|
<pre>
|
|
<a href="postconf.5.html#alias_maps">alias_maps</a> = <a href="DATABASE_README.html#types">hash</a>:/etc/aliases, nis:mail.aliases
|
|
<a href="postconf.5.html#alias_maps">alias_maps</a> = <a href="DATABASE_README.html#types">hash</a>:/etc/aliases
|
|
</pre>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="allow_mail_to_commands">allow_mail_to_commands</a>
|
|
(default: alias, forward)</b></DT><DD>
|
|
|
|
<p>
|
|
Restrict <a href="local.8.html">local(8)</a> mail delivery to external commands. The default
|
|
is to disallow delivery to "|command" in :include: files (see
|
|
<a href="aliases.5.html">aliases(5)</a> for the text that defines this terminology).
|
|
</p>
|
|
|
|
<p>
|
|
Specify zero or more of: <b>alias</b>, <b>forward</b> or <b>include</b>,
|
|
in order to allow commands in <a href="aliases.5.html">aliases(5)</a>, .forward files or in
|
|
:include: files, respectively.
|
|
</p>
|
|
|
|
<p>
|
|
Example:
|
|
</p>
|
|
|
|
<pre>
|
|
<a href="postconf.5.html#allow_mail_to_commands">allow_mail_to_commands</a> = alias,forward,include
|
|
</pre>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="allow_mail_to_files">allow_mail_to_files</a>
|
|
(default: alias, forward)</b></DT><DD>
|
|
|
|
<p>
|
|
Restrict <a href="local.8.html">local(8)</a> mail delivery to external files. The default is
|
|
to disallow "/file/name" destinations in :include: files (see
|
|
<a href="aliases.5.html">aliases(5)</a> for the text that defines this terminology).
|
|
</p>
|
|
|
|
<p>
|
|
Specify zero or more of: <b>alias</b>, <b>forward</b> or <b>include</b>,
|
|
in order to allow "/file/name" destinations in <a href="aliases.5.html">aliases(5)</a>, .forward
|
|
files and in :include: files, respectively.
|
|
</p>
|
|
|
|
<p>
|
|
Example:
|
|
</p>
|
|
|
|
<pre>
|
|
<a href="postconf.5.html#allow_mail_to_files">allow_mail_to_files</a> = alias,forward,include
|
|
</pre>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="allow_min_user">allow_min_user</a>
|
|
(default: no)</b></DT><DD>
|
|
|
|
<p>
|
|
Allow a sender or recipient address to have `-' as the first
|
|
character. By
|
|
default, this is not allowed, to avoid accidents with software that
|
|
passes email addresses via the command line. Such software
|
|
would not be able to distinguish a malicious address from a
|
|
bona fide command-line option. Although this can be prevented by
|
|
inserting a "--" option terminator into the command line, this is
|
|
difficult to enforce consistently and globally. </p>
|
|
|
|
<p> As of Postfix version 2.5, this feature is implemented by
|
|
<a href="trivial-rewrite.8.html">trivial-rewrite(8)</a>. With earlier versions this feature was implemented
|
|
by <a href="qmgr.8.html">qmgr(8)</a> and was limited to recipient addresses only. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="allow_percent_hack">allow_percent_hack</a>
|
|
(default: yes)</b></DT><DD>
|
|
|
|
<p>
|
|
Enable the rewriting of the form "user%domain" to "user@domain".
|
|
This is enabled by default.
|
|
</p>
|
|
|
|
<p> Note: as of Postfix version 2.2, message header address rewriting
|
|
happens only when one of the following conditions is true: </p>
|
|
|
|
<ul>
|
|
|
|
<li> The message is received with the Postfix <a href="sendmail.1.html">sendmail(1)</a> command,
|
|
|
|
<li> The message is received from a network client that matches
|
|
$<a href="postconf.5.html#local_header_rewrite_clients">local_header_rewrite_clients</a>,
|
|
|
|
<li> The message is received from the network, and the
|
|
<a href="postconf.5.html#remote_header_rewrite_domain">remote_header_rewrite_domain</a> parameter specifies a non-empty value.
|
|
|
|
</ul>
|
|
|
|
<p> To get the behavior before Postfix version 2.2, specify
|
|
"<a href="postconf.5.html#local_header_rewrite_clients">local_header_rewrite_clients</a> = <a href="DATABASE_README.html#types">static</a>:all". </p>
|
|
|
|
<p>
|
|
Example:
|
|
</p>
|
|
|
|
<pre>
|
|
<a href="postconf.5.html#allow_percent_hack">allow_percent_hack</a> = no
|
|
</pre>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="allow_srv_lookup_fallback">allow_srv_lookup_fallback</a>
|
|
(default: no)</b></DT><DD>
|
|
|
|
<p> When SRV record lookup fails or no SRV record exists, fall back
|
|
to MX or IP address lookup as if SRV record lookup was not enabled. <p>
|
|
|
|
<p> This feature is available in Postfix 3.8 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="allow_untrusted_routing">allow_untrusted_routing</a>
|
|
(default: no)</b></DT><DD>
|
|
|
|
<p>
|
|
Forward mail with sender-specified routing (user[@%!]remote[@%!]site)
|
|
from untrusted clients to destinations matching $<a href="postconf.5.html#relay_domains">relay_domains</a>.
|
|
</p>
|
|
|
|
<p>
|
|
By default, this feature is turned off. This closes a nasty open
|
|
relay loophole where a backup MX host can be tricked into forwarding
|
|
junk mail to a primary MX host which then spams it out to the world.
|
|
</p>
|
|
|
|
<p>
|
|
This parameter also controls if non-local addresses with sender-specified
|
|
routing can match Postfix access tables. By default, such addresses
|
|
cannot match Postfix access tables, because the address is ambiguous.
|
|
</p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="alternate_config_directories">alternate_config_directories</a>
|
|
(default: empty)</b></DT><DD>
|
|
|
|
<p>
|
|
A list of non-default Postfix configuration directories that may
|
|
be specified with "-c <a href="postconf.5.html#config_directory">config_directory</a>" on the command line (in the
|
|
case of <a href="sendmail.1.html">sendmail(1)</a>, with the "-C" option), or via the MAIL_CONFIG
|
|
environment parameter.
|
|
</p>
|
|
|
|
<p>
|
|
This list must be specified in the default Postfix <a href="postconf.5.html">main.cf</a> file,
|
|
and will be used by set-gid Postfix commands such as <a href="postqueue.1.html">postqueue(1)</a>
|
|
and <a href="postdrop.1.html">postdrop(1)</a>.
|
|
</p>
|
|
|
|
<p>
|
|
Specify absolute pathnames, separated by comma or space. Note: $name
|
|
expansion is not supported.
|
|
</p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="always_add_missing_headers">always_add_missing_headers</a>
|
|
(default: no)</b></DT><DD>
|
|
|
|
<p> Always add (Resent-) From:, To:, Date: or Message-ID: headers
|
|
when not present. Postfix 2.6 and later add these headers only
|
|
when clients match the <a href="postconf.5.html#local_header_rewrite_clients">local_header_rewrite_clients</a> parameter
|
|
setting. Earlier Postfix versions always add these headers; this
|
|
may break DKIM signatures that cover non-existent headers.
|
|
The <a href="postconf.5.html#undisclosed_recipients_header">undisclosed_recipients_header</a> parameter setting determines
|
|
whether a To: header will be added. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="always_bcc">always_bcc</a>
|
|
(default: empty)</b></DT><DD>
|
|
|
|
<p>
|
|
Optional address that receives a "blind carbon copy" of each message
|
|
that is received by the Postfix mail system.
|
|
</p>
|
|
|
|
<p>
|
|
Note: with Postfix 2.3 and later the BCC address is added as if it
|
|
was specified with NOTIFY=NONE. The sender will not be notified
|
|
when the BCC address is undeliverable, as long as all down-stream
|
|
software implements <a href="https://tools.ietf.org/html/rfc3461">RFC 3461</a>.
|
|
</p>
|
|
|
|
<p>
|
|
Note: with Postfix 2.2 and earlier the sender will be notified
|
|
when the BCC address is undeliverable.
|
|
</p>
|
|
|
|
<p> Note: automatic BCC recipients are produced only for new mail.
|
|
To avoid mailer loops, automatic BCC recipients are not generated
|
|
after Postfix forwards mail internally, or after Postfix generates
|
|
mail itself. </p>
|
|
|
|
<p> Note: automatic BCC recipients are subject to address
|
|
canonicalization (add missing domain), <a href="postconf.5.html#canonical_maps">canonical_maps</a>, <a href="postconf.5.html#masquerade_domains">masquerade_domains</a>,
|
|
and <a href="postconf.5.html#virtual_alias_maps">virtual_alias_maps</a>. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="anvil_rate_time_unit">anvil_rate_time_unit</a>
|
|
(default: 60s)</b></DT><DD>
|
|
|
|
<p>
|
|
The time unit over which client connection rates and other rates
|
|
are calculated.
|
|
</p>
|
|
|
|
<p>
|
|
This feature is implemented by the <a href="anvil.8.html">anvil(8)</a> service which is available
|
|
in Postfix version 2.2 and later.
|
|
</p>
|
|
|
|
<p>
|
|
The default interval is relatively short. Because of the high
|
|
frequency of updates, the <a href="anvil.8.html">anvil(8)</a> server uses volatile memory
|
|
only. Thus, information is lost whenever the process terminates.
|
|
</p>
|
|
|
|
<p> Specify a non-zero time value (an integral value plus an optional
|
|
one-letter suffix that specifies the time unit). Time units: s
|
|
(seconds), m (minutes), h (hours), d (days), w (weeks).
|
|
The default time unit is s (seconds). </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="anvil_status_update_time">anvil_status_update_time</a>
|
|
(default: 600s)</b></DT><DD>
|
|
|
|
<p>
|
|
How frequently the <a href="anvil.8.html">anvil(8)</a> connection and rate limiting server
|
|
logs peak usage information.
|
|
</p>
|
|
|
|
<p> Specify a non-zero time value (an integral value plus an optional
|
|
one-letter suffix that specifies the time unit). Time units: s
|
|
(seconds), m (minutes), h (hours), d (days), w (weeks).
|
|
The default time unit is s (seconds). </p>
|
|
|
|
<p>
|
|
This feature is available in Postfix 2.2 and later.
|
|
</p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="append_at_myorigin">append_at_myorigin</a>
|
|
(default: yes)</b></DT><DD>
|
|
|
|
<p>
|
|
With locally submitted mail, append the string "@$<a href="postconf.5.html#myorigin">myorigin</a>" to mail
|
|
addresses without domain information. With remotely submitted mail,
|
|
append the string "@$<a href="postconf.5.html#remote_header_rewrite_domain">remote_header_rewrite_domain</a>" instead.
|
|
</p>
|
|
|
|
<p>
|
|
Note 1: this feature is enabled by default and must not be turned off.
|
|
Postfix does not support domain-less addresses.
|
|
</p>
|
|
|
|
<p> Note 2: with Postfix version 2.2, message header address rewriting
|
|
happens only when one of the following conditions is true: </p>
|
|
|
|
<ul>
|
|
|
|
<li> The message is received with the Postfix <a href="sendmail.1.html">sendmail(1)</a> command,
|
|
|
|
<li> The message is received from a network client that matches
|
|
$<a href="postconf.5.html#local_header_rewrite_clients">local_header_rewrite_clients</a>,
|
|
|
|
<li> The message is received from the network, and the
|
|
<a href="postconf.5.html#remote_header_rewrite_domain">remote_header_rewrite_domain</a> parameter specifies a non-empty value.
|
|
|
|
</ul>
|
|
|
|
<p> To get the behavior before Postfix version 2.2, specify
|
|
"<a href="postconf.5.html#local_header_rewrite_clients">local_header_rewrite_clients</a> = <a href="DATABASE_README.html#types">static</a>:all". </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="append_dot_mydomain">append_dot_mydomain</a>
|
|
(default: Postfix ≥ 3.0: no, Postfix < 3.0: yes)</b></DT><DD>
|
|
|
|
<p>
|
|
With locally submitted mail, append the string ".$<a href="postconf.5.html#mydomain">mydomain</a>" to
|
|
addresses that have no ".domain" information. With remotely submitted
|
|
mail, append the string ".$<a href="postconf.5.html#remote_header_rewrite_domain">remote_header_rewrite_domain</a>"
|
|
instead.
|
|
</p>
|
|
|
|
<p>
|
|
Note 1: When disabled (Postfix 3.0 and later), users will not be
|
|
able to send mail to "user@partialdomainname" but will have to
|
|
specify full domain names instead.
|
|
</p>
|
|
|
|
<p> Note 2: with Postfix version 2.2, message header address rewriting
|
|
happens only when one of the following conditions is true: </p>
|
|
|
|
<ul>
|
|
|
|
<li> The message is received with the Postfix <a href="sendmail.1.html">sendmail(1)</a> command,
|
|
|
|
<li> The message is received from a network client that matches
|
|
$<a href="postconf.5.html#local_header_rewrite_clients">local_header_rewrite_clients</a>,
|
|
|
|
<li> The message is received from the network, and the
|
|
<a href="postconf.5.html#remote_header_rewrite_domain">remote_header_rewrite_domain</a> parameter specifies a non-empty value.
|
|
|
|
</ul>
|
|
|
|
<p> To get the behavior before Postfix version 2.2, specify
|
|
"<a href="postconf.5.html#local_header_rewrite_clients">local_header_rewrite_clients</a> = <a href="DATABASE_README.html#types">static</a>:all". </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="application_event_drain_time">application_event_drain_time</a>
|
|
(default: 100s)</b></DT><DD>
|
|
|
|
<p>
|
|
How long the <a href="postkick.1.html">postkick(1)</a> command waits for a request to enter the
|
|
Postfix daemon process input buffer before giving up.
|
|
</p>
|
|
|
|
<p> Specify a non-zero time value (an integral value plus an optional
|
|
one-letter suffix that specifies the time unit). Time units: s
|
|
(seconds), m (minutes), h (hours), d (days), w (weeks).
|
|
The default time unit is s (seconds). </p>
|
|
|
|
<p>
|
|
This feature is available in Postfix 2.1 and later.
|
|
</p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="authorized_flush_users">authorized_flush_users</a>
|
|
(default: <a href="DATABASE_README.html#types">static</a>:anyone)</b></DT><DD>
|
|
|
|
<p>
|
|
List of users who are authorized to flush the queue.
|
|
</p>
|
|
|
|
<p>
|
|
By default, all users are allowed to flush the queue. Access is
|
|
always granted if the invoking user is the super-user or the
|
|
$<a href="postconf.5.html#mail_owner">mail_owner</a> user. Otherwise, the real UID of the process is looked
|
|
up in the system password file, and access is granted only if the
|
|
corresponding login name is on the access list. The username
|
|
"unknown" is used for processes whose real UID is not found in the
|
|
password file. </p>
|
|
|
|
<p>
|
|
Specify a list of user names, "/file/name" or "<a href="DATABASE_README.html">type:table</a>" patterns,
|
|
separated by commas and/or whitespace. The list is matched left to
|
|
right, and the search stops on the first match. A "/file/name"
|
|
pattern is replaced
|
|
by its contents; a "<a href="DATABASE_README.html">type:table</a>" lookup table is matched when a name
|
|
matches a lookup key (the lookup result is ignored). Continue long
|
|
lines by starting the next line with whitespace. Specify "!pattern"
|
|
to exclude a name from the list. The form "!/file/name" is supported
|
|
only in Postfix version 2.4 and later. </p>
|
|
|
|
<p>
|
|
This feature is available in Postfix 2.2 and later.
|
|
</p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="authorized_mailq_users">authorized_mailq_users</a>
|
|
(default: <a href="DATABASE_README.html#types">static</a>:anyone)</b></DT><DD>
|
|
|
|
<p>
|
|
List of users who are authorized to view the queue.
|
|
</p>
|
|
|
|
<p>
|
|
By default, all users are allowed to view the queue. Access is
|
|
always granted if the invoking user is the super-user or the
|
|
$<a href="postconf.5.html#mail_owner">mail_owner</a> user. Otherwise, the real UID of the process is looked
|
|
up in the system password file, and access is granted only if the
|
|
corresponding login name is on the access list. The username
|
|
"unknown" is used for processes whose real UID is not found in the
|
|
password file. </p>
|
|
|
|
<p>
|
|
Specify a list of user names, "/file/name" or "<a href="DATABASE_README.html">type:table</a>" patterns,
|
|
separated by commas and/or whitespace. The list is matched left to
|
|
right, and the search stops on the first match. A "/file/name"
|
|
pattern is replaced
|
|
by its contents; a "<a href="DATABASE_README.html">type:table</a>" lookup table is matched when a name
|
|
matches a lookup key (the lookup result is ignored). Continue long
|
|
lines by starting the next line with whitespace. Specify "!pattern"
|
|
to exclude a user name from the list. The form "!/file/name" is
|
|
supported only in Postfix version 2.4 and later. </p>
|
|
|
|
<p>
|
|
This feature is available in Postfix 2.2 and later.
|
|
</p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="authorized_submit_users">authorized_submit_users</a>
|
|
(default: <a href="DATABASE_README.html#types">static</a>:anyone)</b></DT><DD>
|
|
|
|
<p>
|
|
List of users who are authorized to submit mail with the <a href="sendmail.1.html">sendmail(1)</a>
|
|
command (and with the privileged <a href="postdrop.1.html">postdrop(1)</a> helper command).
|
|
</p>
|
|
|
|
<p>
|
|
By default, all users are allowed to submit mail. Otherwise, the
|
|
real UID of the process is looked up in the system password file,
|
|
and access is granted only if the corresponding login name is on
|
|
the access list. The username "unknown" is used for processes
|
|
whose real UID is not found in the password file. To deny mail
|
|
submission access to all users specify an empty list. </p>
|
|
|
|
<p>
|
|
Specify a list of user names, "/file/name" or "<a href="DATABASE_README.html">type:table</a>" patterns,
|
|
separated by commas and/or whitespace. The list is matched left to right,
|
|
and the search stops on the first match. A "/file/name" pattern is
|
|
replaced by its contents;
|
|
a "<a href="DATABASE_README.html">type:table</a>" lookup table is matched when a name matches a lookup key
|
|
(the lookup result is ignored). Continue long lines by starting the
|
|
next line with whitespace. Specify "!pattern" to exclude a user
|
|
name from the list. The form "!/file/name" is supported only in
|
|
Postfix version 2.4 and later. </p>
|
|
|
|
<p>
|
|
Example:
|
|
</p>
|
|
|
|
<pre>
|
|
<a href="postconf.5.html#authorized_submit_users">authorized_submit_users</a> = !www, <a href="DATABASE_README.html#types">static</a>:all
|
|
</pre>
|
|
|
|
<p>
|
|
This feature is available in Postfix 2.2 and later.
|
|
</p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="authorized_verp_clients">authorized_verp_clients</a>
|
|
(default: $<a href="postconf.5.html#mynetworks">mynetworks</a>)</b></DT><DD>
|
|
|
|
<p> What remote SMTP clients are allowed to specify the XVERP command.
|
|
This command requests that mail be delivered one recipient at a
|
|
time with a per recipient return address. </p>
|
|
|
|
<p> By default, only trusted clients are allowed to specify XVERP.
|
|
</p>
|
|
|
|
<p> This parameter was introduced with Postfix version 1.1. Postfix
|
|
version 2.1 renamed this parameter to <a href="postconf.5.html#smtpd_authorized_verp_clients">smtpd_authorized_verp_clients</a>
|
|
and changed the default to none. </p>
|
|
|
|
<p> Specify a list of network/netmask patterns, separated by commas
|
|
and/or whitespace. The mask specifies the number of bits in the
|
|
network part of a host address. You can also specify hostnames or
|
|
.domain names (the initial dot causes the domain to match any name
|
|
below it), "/file/name" or "<a href="DATABASE_README.html">type:table</a>" patterns. A "/file/name"
|
|
pattern is replaced by its contents; a "<a href="DATABASE_README.html">type:table</a>" lookup table
|
|
is matched when a table entry matches a lookup string (the lookup
|
|
result is ignored). Continue long lines by starting the next line
|
|
with whitespace. Specify "!pattern" to exclude an address or network
|
|
block from the list. The form "!/file/name" is supported only in
|
|
Postfix version 2.4 and later. </p>
|
|
|
|
<p> Note: IP version 6 address information must be specified inside
|
|
<tt>[]</tt> in the <a href="postconf.5.html#authorized_verp_clients">authorized_verp_clients</a> value, and in files
|
|
specified with "/file/name". IP version 6 addresses contain the
|
|
":" character, and would otherwise be confused with a "<a href="DATABASE_README.html">type:table</a>"
|
|
pattern. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="backwards_bounce_logfile_compatibility">backwards_bounce_logfile_compatibility</a>
|
|
(default: yes)</b></DT><DD>
|
|
|
|
<p>
|
|
Produce additional <a href="bounce.8.html">bounce(8)</a> logfile records that can be read by
|
|
Postfix versions before 2.0. The current and more extensible "name =
|
|
value" format is needed in order to implement more sophisticated
|
|
functionality.
|
|
</p>
|
|
|
|
<p>
|
|
This feature is available in Postfix 2.1 and later.
|
|
</p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="berkeley_db_create_buffer_size">berkeley_db_create_buffer_size</a>
|
|
(default: 16777216)</b></DT><DD>
|
|
|
|
<p>
|
|
The per-table I/O buffer size for programs that create Berkeley DB
|
|
hash or btree tables. Specify a byte count.
|
|
</p>
|
|
|
|
<p>
|
|
This feature is available in Postfix 2.0 and later.
|
|
</p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="berkeley_db_read_buffer_size">berkeley_db_read_buffer_size</a>
|
|
(default: 131072)</b></DT><DD>
|
|
|
|
<p>
|
|
The per-table I/O buffer size for programs that read Berkeley DB
|
|
hash or btree tables. Specify a byte count.
|
|
</p>
|
|
|
|
<p>
|
|
This feature is available in Postfix 2.0 and later.
|
|
</p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="best_mx_transport">best_mx_transport</a>
|
|
(default: empty)</b></DT><DD>
|
|
|
|
<p>
|
|
Where the Postfix SMTP client should deliver mail when it detects
|
|
a "mail loops back to myself" error condition. This happens when
|
|
the local MTA is the best SMTP mail exchanger for a destination
|
|
not listed in $<a href="postconf.5.html#mydestination">mydestination</a>, $<a href="postconf.5.html#inet_interfaces">inet_interfaces</a>, $<a href="postconf.5.html#proxy_interfaces">proxy_interfaces</a>,
|
|
$<a href="postconf.5.html#virtual_alias_domains">virtual_alias_domains</a>, or $<a href="postconf.5.html#virtual_mailbox_domains">virtual_mailbox_domains</a>. By default,
|
|
the Postfix SMTP client returns such mail as undeliverable.
|
|
</p>
|
|
|
|
<p>
|
|
Specify, for example, "<a href="postconf.5.html#best_mx_transport">best_mx_transport</a> = local" to pass the mail
|
|
from the Postfix SMTP client to the <a href="local.8.html">local(8)</a> delivery agent. You
|
|
can specify
|
|
any message delivery "transport" or "transport:nexthop" that is
|
|
defined in the <a href="master.5.html">master.cf</a> file. See the <a href="transport.5.html">transport(5)</a> manual page
|
|
for the syntax and meaning of "transport" or "transport:nexthop".
|
|
</p>
|
|
|
|
<p>
|
|
However, this feature is expensive because it ties up a Postfix
|
|
SMTP client process while the <a href="local.8.html">local(8)</a> delivery agent is doing its
|
|
work. It is more efficient (for Postfix) to list all <a href="VIRTUAL_README.html#canonical">hosted domains</a>
|
|
in a table or database.
|
|
</p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="biff">biff</a>
|
|
(default: yes)</b></DT><DD>
|
|
|
|
<p>
|
|
Whether or not to use the local <a href="postconf.5.html#biff">biff</a> service. This service sends
|
|
"new mail" notifications to users who have requested new mail
|
|
notification with the UNIX command "<a href="postconf.5.html#biff">biff</a> y".
|
|
</p>
|
|
|
|
<p>
|
|
For compatibility reasons this feature is on by default. On systems
|
|
with lots of interactive users, the <a href="postconf.5.html#biff">biff</a> service can be a performance
|
|
drain. Specify "<a href="postconf.5.html#biff">biff</a> = no" in <a href="postconf.5.html">main.cf</a> to disable.
|
|
</p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="body_checks">body_checks</a>
|
|
(default: empty)</b></DT><DD>
|
|
|
|
<p> Optional lookup tables for content inspection as specified in
|
|
the <a href="header_checks.5.html">body_checks(5)</a> manual page. </p>
|
|
|
|
<p> Note: with Postfix versions before 2.0, these rules inspect
|
|
all content after the primary message headers. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="body_checks_size_limit">body_checks_size_limit</a>
|
|
(default: 51200)</b></DT><DD>
|
|
|
|
<p>
|
|
How much text in a message body segment (or attachment, if you
|
|
prefer to use that term) is subjected to <a href="postconf.5.html#body_checks">body_checks</a> inspection.
|
|
The amount of text is limited to avoid scanning huge attachments.
|
|
</p>
|
|
|
|
<p>
|
|
This feature is available in Postfix 2.0 and later.
|
|
</p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="bounce_notice_recipient">bounce_notice_recipient</a>
|
|
(default: postmaster)</b></DT><DD>
|
|
|
|
<p>
|
|
The recipient of postmaster notifications with the message headers
|
|
of mail that Postfix did not deliver and of SMTP conversation
|
|
transcripts of mail that Postfix did not receive. This feature is
|
|
enabled with the <a href="postconf.5.html#notify_classes">notify_classes</a> parameter. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="bounce_queue_lifetime">bounce_queue_lifetime</a>
|
|
(default: 5d)</b></DT><DD>
|
|
|
|
<p>
|
|
Consider a bounce message as undeliverable, when delivery fails
|
|
with a temporary error, and the time in the queue has reached the
|
|
<a href="postconf.5.html#bounce_queue_lifetime">bounce_queue_lifetime</a> limit. By default, this limit is the same
|
|
as for regular mail.
|
|
</p>
|
|
|
|
<p> Specify a non-negative time value (an integral value plus an optional
|
|
one-letter suffix that specifies the time unit). Time units: s
|
|
(seconds), m (minutes), h (hours), d (days), w (weeks).
|
|
The default time unit is d (days). </p>
|
|
|
|
<p>
|
|
Specify 0 when mail delivery should be tried only once.
|
|
</p>
|
|
|
|
<p>
|
|
This feature is available in Postfix 2.1 and later.
|
|
</p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="bounce_service_name">bounce_service_name</a>
|
|
(default: bounce)</b></DT><DD>
|
|
|
|
<p>
|
|
The name of the <a href="bounce.8.html">bounce(8)</a> service. This service maintains a record
|
|
of failed delivery attempts and generates non-delivery notifications.
|
|
</p>
|
|
|
|
<p>
|
|
This feature is available in Postfix 2.0 and later.
|
|
</p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="bounce_size_limit">bounce_size_limit</a>
|
|
(default: 50000)</b></DT><DD>
|
|
|
|
<p> The maximal amount of original message text that is sent in a
|
|
non-delivery notification. Specify a byte count. A message is
|
|
returned as either message/rfc822 (the complete original) or as
|
|
text/rfc822-headers (the headers only). With Postfix version 2.4
|
|
and earlier, a message is always returned as message/rfc822 and is
|
|
truncated when it exceeds the size limit.
|
|
</p>
|
|
|
|
<p> Notes: </p>
|
|
|
|
<ul>
|
|
|
|
<li> <p> If you increase this limit, then you should increase the
|
|
<a href="postconf.5.html#mime_nesting_limit">mime_nesting_limit</a> value proportionally. </p>
|
|
|
|
<li> <p> Be careful when making changes. Excessively large values
|
|
will result in the loss of non-delivery notifications, when a bounce
|
|
message size exceeds a local or remote MTA's message size limit.
|
|
</p>
|
|
|
|
</ul>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="bounce_template_file">bounce_template_file</a>
|
|
(default: empty)</b></DT><DD>
|
|
|
|
<p> Pathname of a configuration file with bounce message templates.
|
|
These override the built-in templates of delivery status notification
|
|
(DSN) messages for undeliverable mail, delayed mail, successful
|
|
delivery, or delivery verification. The <a href="bounce.5.html">bounce(5)</a> manual page
|
|
describes how to edit and test template files. </p>
|
|
|
|
<p> Template message body text may contain $name references to
|
|
Postfix configuration parameters. The result of $name expansion can
|
|
be previewed with "<b>postconf -b <i>file_name</i></b>" before the file
|
|
is placed into the Postfix configuration directory. </p>
|
|
|
|
<p> This feature is available in Postfix 2.3 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="broken_sasl_auth_clients">broken_sasl_auth_clients</a>
|
|
(default: no)</b></DT><DD>
|
|
|
|
<p>
|
|
Enable interoperability with remote SMTP clients that implement an obsolete
|
|
version of the AUTH command (<a href="https://tools.ietf.org/html/rfc4954">RFC 4954</a>). Examples of such clients
|
|
are MicroSoft Outlook Express version 4 and MicroSoft Exchange
|
|
version 5.0.
|
|
</p>
|
|
|
|
<p>
|
|
Specify "<a href="postconf.5.html#broken_sasl_auth_clients">broken_sasl_auth_clients</a> = yes" to have Postfix advertise
|
|
AUTH support in a non-standard way.
|
|
</p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="canonical_classes">canonical_classes</a>
|
|
(default: envelope_sender, envelope_recipient, header_sender, header_recipient)</b></DT><DD>
|
|
|
|
<p> What addresses are subject to <a href="postconf.5.html#canonical_maps">canonical_maps</a> address mapping.
|
|
By default, <a href="postconf.5.html#canonical_maps">canonical_maps</a> address mapping is applied to envelope
|
|
sender and recipient addresses, and to header sender and header
|
|
recipient addresses. </p>
|
|
|
|
<p> Specify one or more of: envelope_sender, envelope_recipient,
|
|
header_sender, header_recipient </p>
|
|
|
|
<p> This feature is available in Postfix 2.2 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="canonical_maps">canonical_maps</a>
|
|
(default: empty)</b></DT><DD>
|
|
|
|
<p>
|
|
Optional address mapping lookup tables for message headers and
|
|
envelopes. The mapping is applied to both sender and recipient
|
|
addresses, in both envelopes and in headers, as controlled
|
|
with the <a href="postconf.5.html#canonical_classes">canonical_classes</a> parameter. This is typically used
|
|
to clean up dirty addresses from legacy mail systems, or to replace
|
|
login names by Firstname.Lastname. The table format and lookups
|
|
are documented in <a href="canonical.5.html">canonical(5)</a>. For an overview of Postfix address
|
|
manipulations see the <a href="ADDRESS_REWRITING_README.html">ADDRESS_REWRITING_README</a> document.
|
|
</p>
|
|
|
|
<p>
|
|
Specify zero or more "type:name" lookup tables, separated by
|
|
whitespace or comma. Tables will be searched in the specified order
|
|
until a match is found.
|
|
Note: these lookups are recursive.
|
|
</p>
|
|
|
|
<p>
|
|
If you use this feature, run "<b>postmap /etc/postfix/canonical</b>" to
|
|
build the necessary DBM or DB file after every change. The changes
|
|
will become visible after a minute or so. Use "<b>postfix reload</b>"
|
|
to eliminate the delay.
|
|
</p>
|
|
|
|
<p> Note: with Postfix version 2.2, message header address mapping
|
|
happens only when message header address rewriting is enabled: </p>
|
|
|
|
<ul>
|
|
|
|
<li> The message is received with the Postfix <a href="sendmail.1.html">sendmail(1)</a> command,
|
|
|
|
<li> The message is received from a network client that matches
|
|
$<a href="postconf.5.html#local_header_rewrite_clients">local_header_rewrite_clients</a>,
|
|
|
|
<li> The message is received from the network, and the
|
|
<a href="postconf.5.html#remote_header_rewrite_domain">remote_header_rewrite_domain</a> parameter specifies a non-empty value.
|
|
|
|
</ul>
|
|
|
|
<p> To get the behavior before Postfix version 2.2, specify
|
|
"<a href="postconf.5.html#local_header_rewrite_clients">local_header_rewrite_clients</a> = <a href="DATABASE_README.html#types">static</a>:all". </p>
|
|
|
|
<p>
|
|
Examples:
|
|
</p>
|
|
|
|
<pre>
|
|
<a href="postconf.5.html#canonical_maps">canonical_maps</a> = <a href="DATABASE_README.html#types">dbm</a>:/etc/postfix/canonical
|
|
<a href="postconf.5.html#canonical_maps">canonical_maps</a> = <a href="DATABASE_README.html#types">hash</a>:/etc/postfix/canonical
|
|
</pre>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="cleanup_replace_stray_cr_lf">cleanup_replace_stray_cr_lf</a>
|
|
(default: yes)</b></DT><DD>
|
|
|
|
<p> Replace each stray <CR> or <LF> character in message
|
|
content with a space character, to prevent outbound SMTP smuggling,
|
|
and to make the evaluation of Postfix-added DKIM or other signatures
|
|
independent from how a remote mail server handles such characters.
|
|
</p>
|
|
|
|
<p> SMTP does not allow such characters unless they are part of a
|
|
<CR><LF> sequence, and different mail systems handle
|
|
such stray characters in an implementation-dependent manner. Stray
|
|
<CR> or <LF> characters could be used for outbound
|
|
SMTP smuggling, where an attacker uses a Postfix server to send
|
|
message content with a non-standard End-of-DATA sequence that
|
|
triggers inbound SMTP smuggling at a remote SMTP server.</p>
|
|
|
|
<p> The replacement happens before all other content management,
|
|
and before Postfix may add a DKIM etc. signature; if the signature
|
|
were created first, the replacement could invalidate the signature.
|
|
</p>
|
|
|
|
<p> In addition to preventing SMTP smuggling, replacing stray
|
|
<CR> or <LF> characters ensures that the result of
|
|
signature validation by later mail system will not depend on how
|
|
that mail system handles those stray characters in an
|
|
implementation-dependent manner. </p>
|
|
|
|
<p> Note: this feature is disabled with "<a href="postconf.5.html#receive_override_options">receive_override_options</a> =
|
|
<a href="postconf.5.html#no_header_body_checks">no_header_body_checks</a>". </p>
|
|
|
|
<p> This feature is available in Postfix ≥ 3.9, 3.8.5, 3.7.10,
|
|
3.6.14, and 3.5.24. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="cleanup_service_name">cleanup_service_name</a>
|
|
(default: cleanup)</b></DT><DD>
|
|
|
|
<p>
|
|
The name of the <a href="cleanup.8.html">cleanup(8)</a> service. This service rewrites addresses
|
|
into the standard form, and performs <a href="canonical.5.html">canonical(5)</a> address mapping
|
|
and <a href="virtual.5.html">virtual(5)</a> aliasing.
|
|
</p>
|
|
|
|
<p>
|
|
This feature is available in Postfix 2.0 and later.
|
|
</p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="command_directory">command_directory</a>
|
|
(default: see "postconf -d" output)</b></DT><DD>
|
|
|
|
<p>
|
|
The location of all postfix administrative commands.
|
|
</p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="command_execution_directory">command_execution_directory</a>
|
|
(default: empty)</b></DT><DD>
|
|
|
|
<p> The <a href="local.8.html">local(8)</a> delivery agent working directory for delivery to
|
|
external commands. Failure to change directory causes the delivery
|
|
to be deferred. </p>
|
|
|
|
<p> The <a href="postconf.5.html#command_execution_directory">command_execution_directory</a> value is not subject to Postfix
|
|
configuration parameter $name expansion. Instead, the following
|
|
$name expansions are done on <a href="postconf.5.html#command_execution_directory">command_execution_directory</a> before the
|
|
directory is used. Expansion happens in the context
|
|
of the delivery request. The result of $name expansion is filtered
|
|
with the character set that is specified with the
|
|
<a href="postconf.5.html#execution_directory_expansion_filter">execution_directory_expansion_filter</a> parameter. </p>
|
|
|
|
<dl>
|
|
|
|
<dt><b>$user</b></dt>
|
|
|
|
<dd>The recipient's username. </dd>
|
|
|
|
<dt><b>$shell</b></dt>
|
|
|
|
<dd>The recipient's login shell pathname. </dd>
|
|
|
|
<dt><b>$home</b></dt>
|
|
|
|
<dd>The recipient's home directory. </dd>
|
|
|
|
<dt><b>$recipient</b></dt>
|
|
|
|
<dd>The full recipient address. </dd>
|
|
|
|
<dt><b>$extension</b></dt>
|
|
|
|
<dd>The optional recipient address extension. </dd>
|
|
|
|
<dt><b>$domain</b></dt>
|
|
|
|
<dd>The recipient domain. </dd>
|
|
|
|
<dt><b>$local</b></dt>
|
|
|
|
<dd>The entire recipient localpart. </dd>
|
|
|
|
<dt><b>$<a href="postconf.5.html#recipient_delimiter">recipient_delimiter</a></b></dt>
|
|
|
|
<dd>The address extension delimiter that was found in the recipient
|
|
address (Postfix 2.11 and later), or the system-wide recipient
|
|
address extension delimiter (Postfix 2.10 and earlier). </dd>
|
|
|
|
<dt><b>${name?value}</b></dt>
|
|
|
|
<dt><b>${name?{value}}</b> (Postfix ≥ 3.0)</dt>
|
|
|
|
<dd>Expands to <i>value</i> when <i>$name</i> is non-empty. </dd>
|
|
|
|
<dt><b>${name:value}</b></dt>
|
|
|
|
<dt><b>${name:{value}}</b> (Postfix ≥ 3.0)</dt>
|
|
|
|
<dd>Expands to <i>value</i> when <i>$name</i> is empty. </dd>
|
|
|
|
<dt><b>${name?{value1}:{value2}}</b> (Postfix ≥ 3.0)</dt>
|
|
|
|
<dd>Expands to <i>value1</i> when <i>$name</i> is non-empty,
|
|
<i>value2</i> otherwise. </dd>
|
|
|
|
</dl>
|
|
|
|
<p>
|
|
Instead of $name you can also specify ${name} or $(name).
|
|
</p>
|
|
|
|
<p> This feature is available in Postfix 2.2 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="command_expansion_filter">command_expansion_filter</a>
|
|
(default: see "postconf -d" output)</b></DT><DD>
|
|
|
|
<p>
|
|
Restrict the characters that the <a href="local.8.html">local(8)</a> delivery agent allows in
|
|
$name expansions of $<a href="postconf.5.html#mailbox_command">mailbox_command</a> and $<a href="postconf.5.html#command_execution_directory">command_execution_directory</a>.
|
|
Characters outside the
|
|
allowed set are replaced by underscores.
|
|
</p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="command_time_limit">command_time_limit</a>
|
|
(default: 1000s)</b></DT><DD>
|
|
|
|
<p>
|
|
Time limit for delivery to external commands. This limit is used
|
|
by the <a href="local.8.html">local(8)</a> delivery agent, and is the default time limit for
|
|
delivery by the <a href="pipe.8.html">pipe(8)</a> delivery agent.
|
|
</p>
|
|
|
|
<p>
|
|
Note: if you set this time limit to a large value you must update the
|
|
global <a href="postconf.5.html#ipc_timeout">ipc_timeout</a> parameter as well.
|
|
</p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="compatibility_level">compatibility_level</a>
|
|
(default: 0)</b></DT><DD>
|
|
|
|
<p> A safety net that causes Postfix to run with backwards-compatible
|
|
default settings after an upgrade to a newer Postfix version. </p>
|
|
|
|
<p> With backwards compatibility turned on (the <a href="postconf.5.html">main.cf</a> <a href="postconf.5.html#compatibility_level">compatibility_level</a>
|
|
value is less than the Postfix built-in value), Postfix looks for
|
|
settings that are left at their implicit default value, and logs a
|
|
message when a backwards-compatible default setting is required.
|
|
</p>
|
|
|
|
<blockquote>
|
|
<pre>
|
|
using backwards-compatible default setting <i>name=value</i>
|
|
to [accept a specific client request]
|
|
|
|
using backwards-compatible default setting <i>name=value</i>
|
|
to [enable specific Postfix behavior]
|
|
</pre>
|
|
</blockquote>
|
|
|
|
<p> See <a href="COMPATIBILITY_README.html">COMPATIBILITY_README</a> for specific message details. If such
|
|
a message is logged in the context of a legitimate request, the
|
|
system administrator should make the backwards-compatible setting
|
|
permanent in <a href="postconf.5.html">main.cf</a> or <a href="master.5.html">master.cf</a>, for example: </p>
|
|
|
|
<blockquote>
|
|
<pre>
|
|
# <b>postconf</b> <i>name=value</i>
|
|
# <b>postfix reload</b>
|
|
</pre>
|
|
</blockquote>
|
|
|
|
<p> When no more backwards-compatible settings need to be made
|
|
permanent, the administrator should turn off backwards compatibility
|
|
by updating the <a href="postconf.5.html#compatibility_level">compatibility_level</a> setting in <a href="postconf.5.html">main.cf</a>:</p>
|
|
|
|
<blockquote>
|
|
<pre>
|
|
# <b>postconf <a href="postconf.5.html#compatibility_level">compatibility_level</a>=<i>N</i></b>
|
|
# <b>postfix reload</b>
|
|
</pre>
|
|
</blockquote>
|
|
|
|
<p> For <i>N</i> specify the number that is logged in your <a href="postfix.1.html">postfix(1)</a>
|
|
warning message: </p>
|
|
|
|
<blockquote>
|
|
<pre>
|
|
warning: To disable backwards compatibility use "postconf
|
|
<a href="postconf.5.html#compatibility_level">compatibility_level</a>=<i>N</i>" and "postfix reload"
|
|
</pre>
|
|
</blockquote>
|
|
|
|
<p> Starting with Postfix version 3.6, the compatibility level in
|
|
the above warning message is the Postfix version that introduced
|
|
the last incompatible change. The level is formatted as
|
|
<i>major.minor.patch</i>, where <i>patch</i> is usually omitted and
|
|
defaults to zero. Earlier compatibility levels are 0, 1 and 2. </p>
|
|
|
|
<p> NOTE: this also introduces support for the "<level",
|
|
"<=level", and other operators to compare compatibility levels.
|
|
With the standard operators "<", "<=", etc., compatibility
|
|
level "3.10" would be smaller than "3.9" which is undesirable. </p>
|
|
|
|
<p> This feature is available in Postfix 3.0 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="config_directory">config_directory</a>
|
|
(default: see "postconf -d" output)</b></DT><DD>
|
|
|
|
<p> The default location of the Postfix <a href="postconf.5.html">main.cf</a> and <a href="master.5.html">master.cf</a>
|
|
configuration files. This can be overruled via the following
|
|
mechanisms: </p>
|
|
|
|
<ul>
|
|
|
|
<li> <p> The MAIL_CONFIG environment variable (daemon processes
|
|
and commands). </p>
|
|
|
|
<li> <p> The "-c" command-line option (commands only). </p>
|
|
|
|
</ul>
|
|
|
|
<p> With Postfix commands that run with set-gid privileges, a
|
|
<a href="postconf.5.html#config_directory">config_directory</a> override either requires root privileges, or it
|
|
requires that the directory is listed with the <a href="postconf.5.html#alternate_config_directories">alternate_config_directories</a>
|
|
parameter in the default <a href="postconf.5.html">main.cf</a> file. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="confirm_delay_cleared">confirm_delay_cleared</a>
|
|
(default: no)</b></DT><DD>
|
|
|
|
<p> After sending a "your message is delayed" notification, inform
|
|
the sender when the delay clears up. This can result in a sudden
|
|
burst of notifications at the end of a prolonged network outage,
|
|
and is therefore disabled by default. </p>
|
|
|
|
<p> See also: <a href="postconf.5.html#delay_warning_time">delay_warning_time</a>. </p>
|
|
|
|
<p> This feature is available in Postfix 3.0 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="connection_cache_protocol_timeout">connection_cache_protocol_timeout</a>
|
|
(default: 5s)</b></DT><DD>
|
|
|
|
<p> Time limit for connection cache connect, send or receive
|
|
operations. The time limit is enforced in the client. </p>
|
|
|
|
<p> This feature is available in Postfix 2.3 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="connection_cache_service_name">connection_cache_service_name</a>
|
|
(default: scache)</b></DT><DD>
|
|
|
|
<p> The name of the <a href="scache.8.html">scache(8)</a> connection cache service. This service
|
|
maintains a limited pool of cached sessions. </p>
|
|
|
|
<p> This feature is available in Postfix 2.2 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="connection_cache_status_update_time">connection_cache_status_update_time</a>
|
|
(default: 600s)</b></DT><DD>
|
|
|
|
<p> How frequently the <a href="scache.8.html">scache(8)</a> server logs usage statistics with
|
|
connection cache hit and miss rates for logical destinations and for
|
|
physical endpoints. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="connection_cache_ttl_limit">connection_cache_ttl_limit</a>
|
|
(default: 2s)</b></DT><DD>
|
|
|
|
<p> The maximal time-to-live value that the <a href="scache.8.html">scache(8)</a> connection
|
|
cache server
|
|
allows. Requests that specify a larger TTL will be stored with the
|
|
maximum allowed TTL. The purpose of this additional control is to
|
|
protect the infrastructure against careless people. The cache TTL
|
|
is already bounded by $<a href="postconf.5.html#max_idle">max_idle</a>. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="content_filter">content_filter</a>
|
|
(default: empty)</b></DT><DD>
|
|
|
|
<p> After the message is queued, send the entire message to the
|
|
specified <i>transport:destination</i>. The <i>transport</i> name
|
|
specifies the first field of a mail delivery agent definition in
|
|
<a href="master.5.html">master.cf</a>; the syntax of the next-hop <i>destination</i> is described
|
|
in the manual page of the corresponding delivery agent. More
|
|
information about external content filters is in the Postfix
|
|
<a href="FILTER_README.html">FILTER_README</a> file. </p>
|
|
|
|
<p> Notes: </p>
|
|
|
|
<ul>
|
|
|
|
<li> <p> This setting has lower precedence than a FILTER action
|
|
that is specified in an <a href="access.5.html">access(5)</a>, <a href="header_checks.5.html">header_checks(5)</a> or <a href="header_checks.5.html">body_checks(5)</a>
|
|
table. </p>
|
|
|
|
<li> <p> The meaning of an empty next-hop filter <i>destination</i>
|
|
is version dependent. Postfix 2.7 and later will use the recipient
|
|
domain; earlier versions will use $<a href="postconf.5.html#myhostname">myhostname</a>. Specify
|
|
"<a href="postconf.5.html#default_filter_nexthop">default_filter_nexthop</a> = $<a href="postconf.5.html#myhostname">myhostname</a>" for compatibility with Postfix
|
|
2.6 or earlier, or specify a <a href="postconf.5.html#content_filter">content_filter</a> value with an explicit
|
|
next-hop <i>destination</i>. </p>
|
|
|
|
</ul>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="cyrus_sasl_config_path">cyrus_sasl_config_path</a>
|
|
(default: empty)</b></DT><DD>
|
|
|
|
<p> Search path for Cyrus SASL application configuration files,
|
|
currently used only to locate the $<a href="postconf.5.html#smtpd_sasl_path">smtpd_sasl_path</a>.conf file.
|
|
Specify zero or more directories separated by a colon character,
|
|
or an empty value to use Cyrus SASL's built-in search path. </p>
|
|
|
|
<p> Note: some Debian-based Postfix distributions ignore the
|
|
"<a href="postconf.5.html#cyrus_sasl_config_path">cyrus_sasl_config_path</a>" parameter setting, and force Postfix to
|
|
open the file <code>/etc/postfix/sasl/smtpd.conf</code>. </p>
|
|
|
|
<p> This feature is available in Postfix 2.5 and later when compiled
|
|
with Cyrus SASL 2.1.22 or later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="daemon_directory">daemon_directory</a>
|
|
(default: see "postconf -d" output)</b></DT><DD>
|
|
|
|
<p>
|
|
The directory with Postfix support programs and daemon programs.
|
|
These should not be invoked directly by humans. The directory must
|
|
be owned by root.
|
|
</p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="daemon_table_open_error_is_fatal">daemon_table_open_error_is_fatal</a>
|
|
(default: no)</b></DT><DD>
|
|
|
|
<p> How a Postfix daemon process handles errors while opening lookup
|
|
tables: gradual degradation or immediate termination. </p>
|
|
|
|
<dl>
|
|
|
|
<dt> <b> no </b> (default) </dt> <dd> <p> Gradual degradation: a
|
|
daemon process logs a message of type "error" and continues execution
|
|
with reduced functionality. Features that do not depend on the
|
|
unavailable table will work normally, while features that depend
|
|
on the table will result in a type "warning" message. <br> When
|
|
the <a href="postconf.5.html#notify_classes">notify_classes</a> parameter value contains the "data" class, the
|
|
Postfix SMTP server and client will report transcripts of sessions
|
|
with an error because a table is unavailable. </p> </dd>
|
|
|
|
<dt> <b> yes </b> (historical behavior) </dt> <dd> <p> Immediate
|
|
termination: a daemon process logs a type "fatal" message and
|
|
terminates immediately. This option reduces the number of possible
|
|
code paths through Postfix, and may therefore be slightly more
|
|
secure than the default. </p> </dd>
|
|
|
|
</dl>
|
|
|
|
<p> For the sake of sanity, the number of type "error" messages is
|
|
limited to 13 over the lifetime of a daemon process. </p>
|
|
|
|
<p> This feature is available in Postfix 2.9 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="daemon_timeout">daemon_timeout</a>
|
|
(default: 18000s)</b></DT><DD>
|
|
|
|
<p> How much time a Postfix daemon process may take to handle a
|
|
request before it is terminated by a built-in watchdog timer. </p>
|
|
|
|
<p> Specify a non-zero time value (an integral value plus an optional
|
|
one-letter suffix that specifies the time unit). Time units: s
|
|
(seconds), m (minutes), h (hours), d (days), w (weeks).
|
|
The default time unit is s (seconds). </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="data_directory">data_directory</a>
|
|
(default: see "postconf -d" output)</b></DT><DD>
|
|
|
|
<p> The directory with Postfix-writable data files (for example:
|
|
caches, pseudo-random numbers). This directory must be owned by
|
|
the <a href="postconf.5.html#mail_owner">mail_owner</a> account, and must not be shared with non-Postfix
|
|
software. </p>
|
|
|
|
<p> This feature is available in Postfix 2.5 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="debug_peer_level">debug_peer_level</a>
|
|
(default: 2)</b></DT><DD>
|
|
|
|
<p> The increment in verbose logging level when a nexthop destination,
|
|
remote client or server name or network address matches a pattern
|
|
given with the <a href="postconf.5.html#debug_peer_list">debug_peer_list</a> parameter. </p>
|
|
|
|
<p> Per-nexthop debug logging is available in Postfix 3.6 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="debug_peer_list">debug_peer_list</a>
|
|
(default: empty)</b></DT><DD>
|
|
|
|
<p> Optional list of nexthop destination, remote client or server
|
|
name or network address patterns that, if matched, cause the verbose
|
|
logging level to increase by the amount specified in $<a href="postconf.5.html#debug_peer_level">debug_peer_level</a>.
|
|
</p>
|
|
|
|
<p> Per-nexthop debug logging is available in Postfix 3.6 and later. </p>
|
|
|
|
<p> Specify domain names, network/netmask patterns, "/file/name"
|
|
patterns or "<a href="DATABASE_README.html">type:table</a>" lookup tables. The right-hand side result
|
|
from "<a href="DATABASE_README.html">type:table</a>" lookups is ignored. </p>
|
|
|
|
<p> Pattern matching of domain names is controlled by the presence
|
|
or absence of "<a href="postconf.5.html#debug_peer_list">debug_peer_list</a>" in the <a href="postconf.5.html#parent_domain_matches_subdomains">parent_domain_matches_subdomains</a>
|
|
parameter value. </p>
|
|
|
|
<p>
|
|
Examples:
|
|
</p>
|
|
|
|
<pre>
|
|
<a href="postconf.5.html#debug_peer_list">debug_peer_list</a> = 127.0.0.1
|
|
<a href="postconf.5.html#debug_peer_list">debug_peer_list</a> = example.com
|
|
</pre>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="debugger_command">debugger_command</a>
|
|
(default: empty)</b></DT><DD>
|
|
|
|
<p>
|
|
The external command to execute when a Postfix daemon program is
|
|
invoked with the -D option.
|
|
</p>
|
|
|
|
<p>
|
|
Use "command .. & sleep 5" so that the debugger can attach before
|
|
the process marches on. If you use an X-based debugger, be sure to
|
|
set up your XAUTHORITY environment variable before starting Postfix.
|
|
</p>
|
|
|
|
<p>
|
|
Note: the command is subject to $name expansion, before it is
|
|
passed to the default command interpreter. Specify "$$" to
|
|
produce a single "$" character.
|
|
</p>
|
|
|
|
<p>
|
|
Example:
|
|
</p>
|
|
|
|
<pre>
|
|
<a href="postconf.5.html#debugger_command">debugger_command</a> =
|
|
PATH=/usr/bin:/usr/X11R6/bin
|
|
ddd $<a href="postconf.5.html#daemon_directory">daemon_directory</a>/$<a href="postconf.5.html#process_name">process_name</a> $<a href="postconf.5.html#process_id">process_id</a> & sleep 5
|
|
</pre>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="default_database_type">default_database_type</a>
|
|
(default: see "postconf -d" output)</b></DT><DD>
|
|
|
|
<p>
|
|
The default database type for use in <a href="newaliases.1.html">newaliases(1)</a>, <a href="postalias.1.html">postalias(1)</a>
|
|
and <a href="postmap.1.html">postmap(1)</a> commands. On many UNIX systems the default type is
|
|
either <b>dbm</b> or <b>hash</b>. The default setting is frozen
|
|
when the Postfix system is built.
|
|
</p>
|
|
|
|
<p>
|
|
Examples:
|
|
</p>
|
|
|
|
<pre>
|
|
<a href="postconf.5.html#default_database_type">default_database_type</a> = hash
|
|
<a href="postconf.5.html#default_database_type">default_database_type</a> = dbm
|
|
</pre>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="default_delivery_slot_cost">default_delivery_slot_cost</a>
|
|
(default: 5)</b></DT><DD>
|
|
|
|
<p>
|
|
How often the Postfix queue manager's scheduler is allowed to
|
|
preempt delivery of one message with another.
|
|
</p>
|
|
|
|
<p>
|
|
Each transport maintains a so-called "available delivery slot counter"
|
|
for each message. One message can be preempted by another one when
|
|
the other message can be delivered using no more delivery slots
|
|
(i.e., invocations of delivery agents) than the current message
|
|
counter has accumulated (or will eventually accumulate - see about
|
|
slot loans below). This parameter controls how often the counter is
|
|
incremented - it happens after each <a href="postconf.5.html#default_delivery_slot_cost">default_delivery_slot_cost</a>
|
|
recipients have been delivered.
|
|
</p>
|
|
|
|
<p>
|
|
The cost of 0 is used to disable the preempting scheduling completely.
|
|
The minimum value the scheduling algorithm can use is 2 - use it
|
|
if you want to maximize the message throughput rate. Although there
|
|
is no maximum, it doesn't make much sense to use values above say
|
|
50.
|
|
</p>
|
|
|
|
<p>
|
|
The only reason why the value of 2 is not the default is the way
|
|
this parameter affects the delivery of mailing-list mail. In the
|
|
worst case, delivery can take somewhere between (cost+1/cost)
|
|
and (cost/cost-1) times more than if the preemptive scheduler was
|
|
disabled. The default value of 5 turns out to provide reasonable
|
|
message response times while making sure the mailing-list deliveries
|
|
are not extended by more than 20-25 percent even in the worst case.
|
|
</p>
|
|
|
|
<p> Use <a href="postconf.5.html#transport_delivery_slot_cost"><i>transport</i>_delivery_slot_cost</a> to specify a
|
|
transport-specific override, where <i>transport</i> is the <a href="master.5.html">master.cf</a>
|
|
name of the message delivery transport.
|
|
</p>
|
|
|
|
<p>
|
|
Examples:
|
|
</p>
|
|
|
|
<pre>
|
|
<a href="postconf.5.html#default_delivery_slot_cost">default_delivery_slot_cost</a> = 0
|
|
<a href="postconf.5.html#default_delivery_slot_cost">default_delivery_slot_cost</a> = 2
|
|
</pre>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="default_delivery_slot_discount">default_delivery_slot_discount</a>
|
|
(default: 50)</b></DT><DD>
|
|
|
|
<p>
|
|
The default value for transport-specific _delivery_slot_discount
|
|
settings.
|
|
</p>
|
|
|
|
<p>
|
|
This parameter speeds up the moment when a message preemption can
|
|
happen. Instead of waiting until the full amount of delivery slots
|
|
required is available, the preemption can happen when
|
|
<a href="postconf.5.html#transport_delivery_slot_discount"><i>transport</i>_delivery_slot_discount</a> percent of the required amount
|
|
plus <a href="postconf.5.html#transport_delivery_slot_loan"><i>transport</i>_delivery_slot_loan</a> still remains to be accumulated.
|
|
Note that the full amount will still have to be accumulated before
|
|
another preemption can take place later.
|
|
</p>
|
|
|
|
<p> Use <a href="postconf.5.html#transport_delivery_slot_discount"><i>transport</i>_delivery_slot_discount</a> to specify a
|
|
transport-specific override, where <i>transport</i> is the <a href="master.5.html">master.cf</a>
|
|
name of the message delivery transport.
|
|
</p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="default_delivery_slot_loan">default_delivery_slot_loan</a>
|
|
(default: 3)</b></DT><DD>
|
|
|
|
<p>
|
|
The default value for transport-specific _delivery_slot_loan
|
|
settings.
|
|
</p>
|
|
|
|
<p>
|
|
This parameter speeds up the moment when a message preemption can
|
|
happen. Instead of waiting until the full amount of delivery slots
|
|
required is available, the preemption can happen when
|
|
<a href="postconf.5.html#transport_delivery_slot_discount">transport_delivery_slot_discount</a> percent of the required amount
|
|
plus <a href="postconf.5.html#transport_delivery_slot_loan">transport_delivery_slot_loan</a> still remains to be accumulated.
|
|
Note that the full amount will still have to be accumulated before
|
|
another preemption can take place later.
|
|
</p>
|
|
|
|
<p> Use <a href="postconf.5.html#transport_delivery_slot_loan"><i>transport</i>_delivery_slot_loan</a> to specify a
|
|
transport-specific override, where <i>transport</i> is the <a href="master.5.html">master.cf</a>
|
|
name of the message delivery transport.
|
|
</p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="default_delivery_status_filter">default_delivery_status_filter</a>
|
|
(default: empty)</b></DT><DD>
|
|
|
|
<p> Optional filter in Postfix delivery agents, to replace the
|
|
delivery status code or explanatory text of successful or unsuccessful
|
|
deliveries. This allows the replacement of a temporary error status
|
|
code (4.X.X) with a permanent error status code (5.X.X) or vice
|
|
versa, but does not allow
|
|
the replacement of a successful status code (2.X.X) with an
|
|
unsuccessful status code (4.X.X or 5.X.X) or vice versa. </p>
|
|
|
|
<p> Note: the (smtp|lmtp)_delivery_status_filter is applied only
|
|
once per recipient: when delivery is successful, when delivery is
|
|
rejected with 5XX, or when there are no more alternate MX or A
|
|
destinations. Use <a href="postconf.5.html#smtp_reply_filter">smtp_reply_filter</a> or <a href="postconf.5.html#lmtp_reply_filter">lmtp_reply_filter</a> to inspect
|
|
responses for all delivery attempts. </p>
|
|
|
|
<p> The following parameters can be used to implement a filter for
|
|
specific delivery agents: <a href="postconf.5.html#lmtp_delivery_status_filter">lmtp_delivery_status_filter</a>,
|
|
<a href="postconf.5.html#local_delivery_status_filter">local_delivery_status_filter</a>, <a href="postconf.5.html#pipe_delivery_status_filter">pipe_delivery_status_filter</a>,
|
|
<a href="postconf.5.html#smtp_delivery_status_filter">smtp_delivery_status_filter</a> or <a href="postconf.5.html#virtual_delivery_status_filter">virtual_delivery_status_filter</a>. These
|
|
parameters support the same filter syntax as described here. </p>
|
|
|
|
<p> Specify zero or more "<a href="DATABASE_README.html">type:table</a>" lookup table names, separated
|
|
by comma or whitespace. For each successful or unsuccessful delivery
|
|
to a recipient, the tables are queried in the specified order with
|
|
one line of text that is structured as follows: </p>
|
|
|
|
<blockquote>
|
|
enhanced-status-code SPACE explanatory-text
|
|
</blockquote>
|
|
|
|
<p> The first table match wins. The lookup result must have the
|
|
same structure as the query, a successful status code (2.X.X) must
|
|
be replaced with a successful status code, an unsuccessful status
|
|
code (4.X.X or 5.X.X) must be replaced with an unsuccessful status
|
|
code, and the explanatory text field must be non-empty. Other results
|
|
will result in a warning. </p>
|
|
|
|
<p> Example 1: convert specific soft TLS errors into hard errors,
|
|
by overriding the first number in the enhanced status code. </p>
|
|
|
|
<blockquote>
|
|
<pre>
|
|
/etc/postfix/<a href="postconf.5.html">main.cf</a>:
|
|
<a href="postconf.5.html#smtp_delivery_status_filter">smtp_delivery_status_filter</a> = <a href="pcre_table.5.html">pcre</a>:/etc/postfix/smtp_dsn_filter
|
|
</pre>
|
|
</blockquote>
|
|
|
|
<blockquote>
|
|
<pre>
|
|
/etc/postfix/smtp_dsn_filter:
|
|
/^4(\.\d+\.\d+ TLS is required, but host \S+ refused to start TLS: .+)/
|
|
5$1
|
|
/^4(\.\d+\.\d+ TLS is required, but was not offered by host .+)/
|
|
5$1
|
|
# Do not change the following into hard bounces. They may
|
|
# result from a local configuration problem.
|
|
# 4.\d+.\d+ TLS is required, but our TLS engine is unavailable
|
|
# 4.\d+.\d+ TLS is required, but unavailable
|
|
# 4.\d+.\d+ Cannot start TLS: handshake failure
|
|
</pre>
|
|
</blockquote>
|
|
|
|
<p> Example 2: censor the per-recipient delivery status text so
|
|
that it does not reveal the destination command or filename
|
|
when a remote sender requests confirmation of successful delivery.
|
|
</p>
|
|
|
|
<blockquote>
|
|
<pre>
|
|
/etc/postfix/<a href="postconf.5.html">main.cf</a>:
|
|
<a href="postconf.5.html#local_delivery_status_filter">local_delivery_status_filter</a> = <a href="pcre_table.5.html">pcre</a>:/etc/postfix/local_dsn_filter
|
|
</pre>
|
|
</blockquote>
|
|
|
|
<blockquote>
|
|
<pre>
|
|
/etc/postfix/local_dsn_filter:
|
|
/^(2\S+ delivered to file).+/ $1
|
|
/^(2\S+ delivered to command).+/ $1
|
|
</pre>
|
|
</blockquote>
|
|
|
|
<p> Notes: </p>
|
|
|
|
<ul>
|
|
|
|
<li> <p> This feature will NOT override the <a href="postconf.5.html#soft_bounce">soft_bounce</a> safety net. </p>
|
|
|
|
<li> <p> This feature will change the enhanced status code and text
|
|
that is logged to the maillog file, and that is reported to the
|
|
sender in delivery confirmation or non-delivery notifications.
|
|
</p>
|
|
|
|
</ul>
|
|
|
|
<p> This feature is available in Postfix 3.0 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="default_destination_concurrency_failed_cohort_limit">default_destination_concurrency_failed_cohort_limit</a>
|
|
(default: 1)</b></DT><DD>
|
|
|
|
<p> How many pseudo-cohorts must suffer connection or handshake
|
|
failure before a specific destination is considered unavailable
|
|
(and further delivery is suspended). Specify zero to disable this
|
|
feature. A destination's pseudo-cohort failure count is reset each
|
|
time a delivery completes without connection or handshake failure
|
|
for that specific destination. </p>
|
|
|
|
<p> A pseudo-cohort is the number of deliveries equal to a destination's
|
|
delivery concurrency. </p>
|
|
|
|
<p> Use <a href="postconf.5.html#transport_destination_concurrency_failed_cohort_limit"><i>transport</i>_destination_concurrency_failed_cohort_limit</a> to specify
|
|
a transport-specific override, where <i>transport</i> is the <a href="master.5.html">master.cf</a>
|
|
name of the message delivery transport. </p>
|
|
|
|
<p> This feature is available in Postfix 2.5. The default setting
|
|
is compatible with earlier Postfix versions. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="default_destination_concurrency_limit">default_destination_concurrency_limit</a>
|
|
(default: 20)</b></DT><DD>
|
|
|
|
<p>
|
|
The default maximal number of parallel deliveries to the same
|
|
destination. This is the default limit for delivery via the <a href="lmtp.8.html">lmtp(8)</a>,
|
|
<a href="pipe.8.html">pipe(8)</a>, <a href="smtp.8.html">smtp(8)</a> and <a href="virtual.8.html">virtual(8)</a> delivery agents.
|
|
With a per-destination recipient limit > 1, a destination is a domain,
|
|
otherwise it is a recipient.
|
|
</p>
|
|
|
|
<p> Use <a href="postconf.5.html#transport_destination_concurrency_limit"><i>transport</i>_destination_concurrency_limit</a> to specify a
|
|
transport-specific override, where <i>transport</i> is the <a href="master.5.html">master.cf</a>
|
|
name of the message delivery transport.
|
|
</p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="default_destination_concurrency_negative_feedback">default_destination_concurrency_negative_feedback</a>
|
|
(default: 1)</b></DT><DD>
|
|
|
|
<p> The per-destination amount of delivery concurrency negative
|
|
feedback, after a delivery completes with a connection or handshake
|
|
failure. Feedback values are in the range 0..1 inclusive. With
|
|
negative feedback, concurrency is decremented at the beginning of
|
|
a sequence of length 1/feedback. This is unlike positive feedback,
|
|
where concurrency is incremented at the end of a sequence of length
|
|
1/feedback. </p>
|
|
|
|
<p> As of Postfix version 2.5, negative feedback cannot reduce
|
|
delivery concurrency to zero. Instead, a destination is marked
|
|
dead (further delivery suspended) after the failed pseudo-cohort
|
|
count reaches $<a href="postconf.5.html#default_destination_concurrency_failed_cohort_limit">default_destination_concurrency_failed_cohort_limit</a>
|
|
(or $<a href="postconf.5.html#transport_destination_concurrency_failed_cohort_limit"><i>transport</i>_destination_concurrency_failed_cohort_limit</a>).
|
|
To make the scheduler completely immune to connection or handshake
|
|
failures, specify a zero feedback value and a zero failed pseudo-cohort
|
|
limit. </p>
|
|
|
|
<p> Specify one of the following forms: </p>
|
|
|
|
<dl>
|
|
|
|
<dt> <b><i>number</i> </b> </dt>
|
|
|
|
<dt> <b><i>number</i> / <i>number</i> </b> </dt>
|
|
|
|
<dd> Constant feedback. The value must be in the range 0..1 inclusive.
|
|
The default setting of "1" is compatible with Postfix versions
|
|
before 2.5, where a destination's delivery concurrency is throttled
|
|
down to zero (and further delivery suspended) after a single failed
|
|
pseudo-cohort. </dd>
|
|
|
|
<dt> <b><i>number</i> / concurrency </b> </dt>
|
|
|
|
<dd> Variable feedback of "<i>number</i> / (delivery concurrency)".
|
|
The <i>number</i> must be in the range 0..1 inclusive. With
|
|
<i>number</i> equal to "1", a destination's delivery concurrency
|
|
is decremented by 1 after each failed pseudo-cohort. </dd>
|
|
|
|
</dl>
|
|
|
|
<p> A pseudo-cohort is the number of deliveries equal to a destination's
|
|
delivery concurrency. </p>
|
|
|
|
<p> Use <a href="postconf.5.html#transport_destination_concurrency_negative_feedback"><i>transport</i>_destination_concurrency_negative_feedback</a>
|
|
to specify a transport-specific override, where <i>transport</i>
|
|
is the <a href="master.5.html">master.cf</a>
|
|
name of the message delivery transport. </p>
|
|
|
|
<p> This feature is available in Postfix 2.5. The default setting
|
|
is compatible with earlier Postfix versions. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="default_destination_concurrency_positive_feedback">default_destination_concurrency_positive_feedback</a>
|
|
(default: 1)</b></DT><DD>
|
|
|
|
<p> The per-destination amount of delivery concurrency positive
|
|
feedback, after a delivery completes without connection or handshake
|
|
failure. Feedback values are in the range 0..1 inclusive. The
|
|
concurrency increases until it reaches the per-destination maximal
|
|
concurrency limit. With positive feedback, concurrency is incremented
|
|
at the end of a sequence with length 1/feedback. This is unlike
|
|
negative feedback, where concurrency is decremented at the start
|
|
of a sequence of length 1/feedback. </p>
|
|
|
|
<p> Specify one of the following forms: </p>
|
|
|
|
<dl>
|
|
|
|
<dt> <b><i>number</i> </b> </dt>
|
|
|
|
<dt> <b><i>number</i> / <i>number</i> </b> </dt>
|
|
|
|
<dd> Constant feedback. The value must be in the range 0..1
|
|
inclusive. The default setting of "1" is compatible with Postfix
|
|
versions before 2.5, where a destination's delivery concurrency
|
|
doubles after each successful pseudo-cohort. </dd>
|
|
|
|
<dt> <b><i>number</i> / concurrency </b> </dt>
|
|
|
|
<dd> Variable feedback of "<i>number</i> / (delivery concurrency)".
|
|
The <i>number</i> must be in the range 0..1 inclusive. With
|
|
<i>number</i> equal to "1", a destination's delivery concurrency
|
|
is incremented by 1 after each successful pseudo-cohort. </dd>
|
|
|
|
</dl>
|
|
|
|
<p> A pseudo-cohort is the number of deliveries equal to a destination's
|
|
delivery concurrency. </p>
|
|
|
|
<p> Use <a href="postconf.5.html#transport_destination_concurrency_positive_feedback"><i>transport</i>_destination_concurrency_positive_feedback</a>
|
|
to specify a transport-specific override, where <i>transport</i>
|
|
is the <a href="master.5.html">master.cf</a> name of the message delivery transport. </p>
|
|
|
|
<p> This feature is available in Postfix 2.5 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="default_destination_rate_delay">default_destination_rate_delay</a>
|
|
(default: 0s)</b></DT><DD>
|
|
|
|
<p> The default amount of delay that is inserted between individual
|
|
message deliveries to the same destination and over the same message
|
|
delivery transport. Specify a non-zero value to rate-limit those
|
|
message deliveries to at most one per $<a href="postconf.5.html#default_destination_rate_delay">default_destination_rate_delay</a>.
|
|
</p>
|
|
|
|
<p> The resulting behavior depends on the value of the corresponding
|
|
per-destination recipient limit.
|
|
|
|
</p>
|
|
|
|
<ul>
|
|
|
|
<li> <p> With a corresponding per-destination recipient limit >
|
|
1, the rate delay specifies the time between deliveries to the
|
|
<i>same domain</i>. Different domains are delivered in parallel,
|
|
subject to the process limits specified in <a href="master.5.html">master.cf</a>. </p>
|
|
|
|
<li> <p> With a corresponding per-destination recipient limit equal
|
|
to 1, the rate delay specifies the time between deliveries to the
|
|
<i>same recipient</i>. Different recipients are delivered in
|
|
parallel, subject to the process limits specified in <a href="master.5.html">master.cf</a>.
|
|
</p>
|
|
|
|
</ul>
|
|
|
|
<p> To enable the delay, specify a non-zero time value (an integral
|
|
value plus an optional one-letter suffix that specifies the time
|
|
unit). </p>
|
|
|
|
<p> Time units: s (seconds), m (minutes), h (hours), d (days), w
|
|
(weeks). The default time unit is s (seconds). </p>
|
|
|
|
<p> NOTE: the delay is enforced by the queue manager. The delay
|
|
timer state does not survive "<b>postfix reload</b>" or "<b>postfix
|
|
stop</b>".
|
|
</p>
|
|
|
|
<p> Use <a href="postconf.5.html#transport_destination_rate_delay"><i>transport</i>_destination_rate_delay</a> to specify a
|
|
transport-specific override, where <i>transport</i> is the <a href="master.5.html">master.cf</a>
|
|
name of the message delivery transport.
|
|
</p>
|
|
|
|
<p> NOTE: with a non-zero _destination_rate_delay, specify a
|
|
<a href="postconf.5.html#transport_destination_concurrency_failed_cohort_limit"><i>transport</i>_destination_concurrency_failed_cohort_limit</a> of 10
|
|
or more to prevent Postfix from deferring all mail for the same
|
|
destination after only one connection or handshake error. </p>
|
|
|
|
<p> This feature is available in Postfix 2.5 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="default_destination_recipient_limit">default_destination_recipient_limit</a>
|
|
(default: 50)</b></DT><DD>
|
|
|
|
<p>
|
|
The default maximal number of recipients per message delivery.
|
|
This is the default limit for delivery via the <a href="lmtp.8.html">lmtp(8)</a>, <a href="pipe.8.html">pipe(8)</a>,
|
|
<a href="smtp.8.html">smtp(8)</a> and <a href="virtual.8.html">virtual(8)</a> delivery agents.
|
|
</p>
|
|
|
|
<p> Setting this parameter to a value of 1 affects email deliveries
|
|
as follows:</p>
|
|
|
|
<ul>
|
|
|
|
<li> <p> It changes the meaning of the corresponding per-destination
|
|
concurrency limit, from concurrency of deliveries to the <i>same
|
|
domain</i> into concurrency of deliveries to the <i>same recipient</i>.
|
|
Different recipients are delivered in parallel, subject to the
|
|
process limits specified in <a href="master.5.html">master.cf</a>. </p>
|
|
|
|
<li> <p> It changes the meaning of the corresponding per-destination
|
|
rate delay, from the delay between deliveries to the <i>same
|
|
domain</i> into the delay between deliveries to the <i>same
|
|
recipient</i>. Again, different recipients are delivered in parallel,
|
|
subject to the process limits specified in <a href="master.5.html">master.cf</a>. </p>
|
|
|
|
<li> <p> It changes the meaning of other corresponding per-destination
|
|
settings in a similar manner, from settings for delivery to the
|
|
<i>same domain</i> into settings for delivery to the <i>same
|
|
recipient</i>.
|
|
|
|
</ul>
|
|
|
|
<p> Use <a href="postconf.5.html#transport_destination_recipient_limit"><i>transport</i>_destination_recipient_limit</a> to specify a
|
|
transport-specific override, where <i>transport</i> is the <a href="master.5.html">master.cf</a>
|
|
name of the message delivery transport.
|
|
</p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="default_extra_recipient_limit">default_extra_recipient_limit</a>
|
|
(default: 1000)</b></DT><DD>
|
|
|
|
<p>
|
|
The default value for the extra per-transport limit imposed on the
|
|
number of in-memory recipients. This extra recipient space is
|
|
reserved for the cases when the Postfix queue manager's scheduler
|
|
preempts one message with another and suddenly needs some extra
|
|
recipient slots for the chosen message in order to avoid performance
|
|
degradation.
|
|
</p>
|
|
|
|
<p> Use <a href="postconf.5.html#transport_extra_recipient_limit"><i>transport</i>_extra_recipient_limit</a> to specify a
|
|
transport-specific override, where <i>transport</i> is the <a href="master.5.html">master.cf</a>
|
|
name of the message delivery transport.
|
|
</p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="default_filter_nexthop">default_filter_nexthop</a>
|
|
(default: empty)</b></DT><DD>
|
|
|
|
<p> When a <a href="postconf.5.html#content_filter">content_filter</a> or FILTER request specifies no explicit
|
|
next-hop destination, use $<a href="postconf.5.html#default_filter_nexthop">default_filter_nexthop</a> instead; when
|
|
that value is empty, use the domain in the recipient address.
|
|
Specify "<a href="postconf.5.html#default_filter_nexthop">default_filter_nexthop</a> = $<a href="postconf.5.html#myhostname">myhostname</a>" for compatibility
|
|
with Postfix version 2.6 and earlier, or specify an explicit next-hop
|
|
destination with each <a href="postconf.5.html#content_filter">content_filter</a> value or FILTER action. </p>
|
|
|
|
<p> This feature is available in Postfix 2.7 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="default_minimum_delivery_slots">default_minimum_delivery_slots</a>
|
|
(default: 3)</b></DT><DD>
|
|
|
|
<p>
|
|
How many recipients a message must have in order to invoke the
|
|
Postfix queue manager's scheduling algorithm at all. Messages
|
|
which would never accumulate at least this many delivery slots
|
|
(subject to slot cost parameter as well) are never preempted.
|
|
</p>
|
|
|
|
<p> Use <a href="postconf.5.html#transport_minimum_delivery_slots"><i>transport</i>_minimum_delivery_slots</a> to specify a
|
|
transport-specific override, where <i>transport</i> is the <a href="master.5.html">master.cf</a>
|
|
name of the message delivery transport.
|
|
</p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="default_privs">default_privs</a>
|
|
(default: nobody)</b></DT><DD>
|
|
|
|
<p>
|
|
The default rights used by the <a href="local.8.html">local(8)</a> delivery agent for delivery
|
|
to an external file or command. These rights are used when delivery
|
|
is requested from an <a href="aliases.5.html">aliases(5)</a> file that is owned by <b>root</b>, or
|
|
when delivery is done on behalf of <b>root</b>. <b>DO NOT SPECIFY A
|
|
PRIVILEGED USER OR THE POSTFIX OWNER</b>.
|
|
</p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="default_process_limit">default_process_limit</a>
|
|
(default: 100)</b></DT><DD>
|
|
|
|
<p>
|
|
The default maximal number of Postfix child processes that provide
|
|
a given service. This limit can be overruled for specific services
|
|
in the <a href="master.5.html">master.cf</a> file.
|
|
</p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="default_rbl_reply">default_rbl_reply</a>
|
|
(default: see "postconf -d" output)</b></DT><DD>
|
|
|
|
<p>
|
|
The default Postfix SMTP server response template for a request that is
|
|
rejected by an RBL-based restriction. This template can be overruled
|
|
by specific entries in the optional <a href="postconf.5.html#rbl_reply_maps">rbl_reply_maps</a> lookup table.
|
|
</p>
|
|
|
|
<p>
|
|
This feature is available in Postfix 2.0 and later.
|
|
</p>
|
|
|
|
<p>
|
|
The template does not support Postfix configuration parameter $name
|
|
substitution. Instead, it supports exactly one level of $name
|
|
substitution for the following attributes:
|
|
</p>
|
|
|
|
<dl>
|
|
|
|
<dt><b>$client</b></dt>
|
|
|
|
<dd>The client hostname and IP address, formatted as name[address]. </dd>
|
|
|
|
<dt><b>$client_address</b></dt>
|
|
|
|
<dd>The client IP address. </dd>
|
|
|
|
<dt><b>$client_name</b></dt>
|
|
|
|
<dd>The client hostname or "unknown". See <a href="postconf.5.html#reject_unknown_client_hostname">reject_unknown_client_hostname</a>
|
|
for more details. </dd>
|
|
|
|
<dt><b>$reverse_client_name</b></dt>
|
|
|
|
<dd>The client hostname from address->name lookup, or "unknown".
|
|
See <a href="postconf.5.html#reject_unknown_reverse_client_hostname">reject_unknown_reverse_client_hostname</a> for more details. </dd>
|
|
|
|
<dt><b>$helo_name</b></dt>
|
|
|
|
<dd>The hostname given in HELO or EHLO command or empty string. </dd>
|
|
|
|
<dt><b>$rbl_class</b></dt>
|
|
|
|
<dd>The denylisted entity type: Client host, Helo command, Sender
|
|
address, or Recipient address. </dd>
|
|
|
|
<dt><b>$rbl_code</b></dt>
|
|
|
|
<dd>The numerical SMTP response code, as specified with the
|
|
<a href="postconf.5.html#maps_rbl_reject_code">maps_rbl_reject_code</a> configuration parameter. Note: The numerical
|
|
SMTP response code is required, and must appear at the start of the
|
|
reply. With Postfix version 2.3 and later this information may be followed
|
|
by an <a href="https://tools.ietf.org/html/rfc3463">RFC 3463</a> enhanced status code. </dd>
|
|
|
|
<dt><b>$rbl_domain</b></dt>
|
|
|
|
<dd>The RBL domain (without any <i>=address-filter</i>) where
|
|
$rbl_what is denylisted. </dd>
|
|
|
|
<dt><b>$rbl_reason</b></dt>
|
|
|
|
<dd>The reason why $rbl_what is denylisted, or an empty string. </dd>
|
|
|
|
<dt><b>$rbl_what</b></dt>
|
|
|
|
<dd>The entity that is denylisted (an IP address, a hostname, a domain
|
|
name, or an email address whose domain was denylisted). </dd>
|
|
|
|
<dt><b>$recipient</b></dt>
|
|
|
|
<dd>The recipient address or <> in case of the null address. </dd>
|
|
|
|
<dt><b>$recipient_domain</b></dt>
|
|
|
|
<dd>The recipient domain or empty string. </dd>
|
|
|
|
<dt><b>$recipient_name</b></dt>
|
|
|
|
<dd>The recipient address localpart or <> in case of null address. </dd>
|
|
|
|
<dt><b>$sender</b></dt>
|
|
|
|
<dd>The sender address or <> in case of the null address. </dd>
|
|
|
|
<dt><b>$sender_domain</b></dt>
|
|
|
|
<dd>The sender domain or empty string. </dd>
|
|
|
|
<dt><b>$sender_name</b></dt>
|
|
|
|
<dd>The sender address localpart or <> in case of the null address. </dd>
|
|
|
|
<dt><b>${name?value}</b></dt>
|
|
|
|
<dt><b>${name?{value}}</b> (Postfix ≥ 3.0)</dt>
|
|
|
|
<dd>Expands to <i>value</i> when <i>$name</i> is non-empty. </dd>
|
|
|
|
<dt><b>${name:value}</b></dt>
|
|
|
|
<dt><b>${name:{value}}</b> (Postfix ≥ 3.0)</dt>
|
|
|
|
<dd>Expands to <i>value</i> when <i>$name</i> is empty. </dd>
|
|
|
|
<dt><b>${name?{value1}:{value2}}</b> (Postfix ≥ 3.0)</dt>
|
|
|
|
<dd>Expands to <i>value1</i> when <i>$name</i> is non-empty,
|
|
<i>value2</i> otherwise. </dd>
|
|
|
|
</dl>
|
|
|
|
<p>
|
|
Instead of $name you can also specify ${name} or $(name).
|
|
</p>
|
|
|
|
<p> Note: when an enhanced status code is specified in an RBL reply
|
|
template, it is subject to modification. The following transformations
|
|
are needed when the same RBL response template is used for client,
|
|
helo, sender, or recipient access restrictions. </p>
|
|
|
|
<ul>
|
|
|
|
<li> <p> When rejecting a sender address, the Postfix SMTP server
|
|
will transform a recipient DSN status (e.g., 4.1.1-4.1.6) into the
|
|
corresponding sender DSN status, and vice versa. </p>
|
|
|
|
<li> <p> When rejecting non-address information (such as the HELO
|
|
command argument or the client hostname/address), the Postfix SMTP
|
|
server will transform a sender or recipient DSN status into a generic
|
|
non-address DSN status (e.g., 4.0.0). </p>
|
|
|
|
</ul>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="default_recipient_limit">default_recipient_limit</a>
|
|
(default: 20000)</b></DT><DD>
|
|
|
|
<p>
|
|
The default per-transport upper limit on the number of in-memory
|
|
recipients. These limits take priority over the global
|
|
<a href="postconf.5.html#qmgr_message_recipient_limit">qmgr_message_recipient_limit</a> after the message has been assigned
|
|
to the respective transports. See also <a href="postconf.5.html#default_extra_recipient_limit">default_extra_recipient_limit</a>
|
|
and <a href="postconf.5.html#qmgr_message_recipient_minimum">qmgr_message_recipient_minimum</a>.
|
|
</p>
|
|
|
|
<p> Use <a href="postconf.5.html#transport_recipient_limit"><i>transport</i>_recipient_limit</a> to specify a
|
|
transport-specific override, where <i>transport</i> is the <a href="master.5.html">master.cf</a>
|
|
name of the message delivery transport.
|
|
</p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="default_recipient_refill_delay">default_recipient_refill_delay</a>
|
|
(default: 5s)</b></DT><DD>
|
|
|
|
<p>
|
|
The default per-transport maximum delay between refilling recipients.
|
|
When not all message recipients fit into memory at once, keep loading
|
|
more of them at least once every this many seconds. This is used to
|
|
make sure the recipients are refilled in a timely manner even when
|
|
$<a href="postconf.5.html#default_recipient_refill_limit">default_recipient_refill_limit</a> is too high for too slow deliveries.
|
|
</p>
|
|
|
|
<p> Use <a href="postconf.5.html#transport_recipient_refill_delay"><i>transport</i>_recipient_refill_delay</a> to specify a
|
|
transport-specific override, where <i>transport</i> is the <a href="master.5.html">master.cf</a>
|
|
name of the message delivery transport.
|
|
</p>
|
|
|
|
<p> This feature is available in Postfix 2.4 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="default_recipient_refill_limit">default_recipient_refill_limit</a>
|
|
(default: 100)</b></DT><DD>
|
|
|
|
<p>
|
|
The default per-transport limit on the number of recipients refilled at
|
|
once. When not all message recipients fit into memory at once, keep
|
|
loading more of them in batches of at least this many at a time. See also
|
|
$<a href="postconf.5.html#default_recipient_refill_delay">default_recipient_refill_delay</a>, which may result in recipient batches
|
|
lower than this when this limit is too high for too slow deliveries.
|
|
</p>
|
|
|
|
<p> Use <a href="postconf.5.html#transport_recipient_refill_limit"><i>transport</i>_recipient_refill_limit</a> to specify a
|
|
transport-specific override, where <i>transport</i> is the <a href="master.5.html">master.cf</a>
|
|
name of the message delivery transport.
|
|
</p>
|
|
|
|
<p> This feature is available in Postfix 2.4 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="default_transport">default_transport</a>
|
|
(default: smtp)</b></DT><DD>
|
|
|
|
<p>
|
|
The default mail delivery transport and next-hop destination for
|
|
the <a href="ADDRESS_CLASS_README.html#default_domain_class">default domain</a> class: recipient domains that do not match
|
|
$<a href="postconf.5.html#mydestination">mydestination</a>, $<a href="postconf.5.html#inet_interfaces">inet_interfaces</a>,
|
|
$<a href="postconf.5.html#proxy_interfaces">proxy_interfaces</a>, $<a href="postconf.5.html#virtual_alias_domains">virtual_alias_domains</a>, $<a href="postconf.5.html#virtual_mailbox_domains">virtual_mailbox_domains</a>,
|
|
or $<a href="postconf.5.html#relay_domains">relay_domains</a>. This information will not be used when
|
|
<a href="postconf.5.html#sender_dependent_default_transport_maps">sender_dependent_default_transport_maps</a> returns a result, and may
|
|
be overridden with the <a href="transport.5.html">transport(5)</a> table. </p>
|
|
|
|
<p> For recipient domains in the <a href="ADDRESS_CLASS_README.html#default_domain_class">default domain</a> class: <p>
|
|
|
|
<ul>
|
|
|
|
<li> <p> In order of decreasing precedence, the delivery transport
|
|
is taken from 1) $<a href="postconf.5.html#transport_maps">transport_maps</a>, 2)
|
|
$<a href="postconf.5.html#sender_dependent_default_transport_maps">sender_dependent_default_transport_maps</a> or $<a href="postconf.5.html#default_transport">default_transport</a>.
|
|
</p>
|
|
|
|
<li> <p> In order of decreasing precedence, the nexthop destination
|
|
is taken from 1) $<a href="postconf.5.html#transport_maps">transport_maps</a>, 2)
|
|
$<a href="postconf.5.html#sender_dependent_default_transport_maps">sender_dependent_default_transport_maps</a> or $<a href="postconf.5.html#default_transport">default_transport</a>, 3)
|
|
$<a href="postconf.5.html#sender_dependent_relayhost_maps">sender_dependent_relayhost_maps</a> or $<a href="postconf.5.html#relayhost">relayhost</a> or the recipient
|
|
domain. </p>
|
|
|
|
</ul>
|
|
|
|
<p>
|
|
Specify a string of the form <i>transport:nexthop</i>, where <i>transport</i>
|
|
is the name of a mail delivery transport defined in <a href="master.5.html">master.cf</a>.
|
|
The <i>:nexthop</i> destination is optional; its syntax is documented
|
|
in the manual page of the corresponding delivery agent. In the case of
|
|
SMTP or LMTP, specify one or more destinations separated by comma or
|
|
whitespace (with Postfix 3.5 and later).
|
|
</p>
|
|
|
|
<p>
|
|
Example:
|
|
</p>
|
|
|
|
<pre>
|
|
<a href="postconf.5.html#default_transport">default_transport</a> = uucp:relayhostname
|
|
</pre>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="default_transport_rate_delay">default_transport_rate_delay</a>
|
|
(default: 0s)</b></DT><DD>
|
|
|
|
<p> The default amount of delay that is inserted between individual
|
|
message deliveries over the same message delivery transport,
|
|
regardless of destination. Specify a non-zero value to rate-limit
|
|
those message deliveries to at most one per $<a href="postconf.5.html#default_transport_rate_delay">default_transport_rate_delay</a>.
|
|
</p>
|
|
|
|
<p>Use <a href="postconf.5.html#transport_transport_rate_delay"><i>transport</i>_transport_rate_delay</a> to specify a
|
|
transport-specific override, where the initial <i>transport</i> is
|
|
the <a href="master.5.html">master.cf</a> name of the message delivery transport. </p>
|
|
|
|
<p> Example: throttle outbound SMTP mail to at most 3 deliveries
|
|
per minute. </p>
|
|
|
|
<pre>
|
|
/etc/postfix/<a href="postconf.5.html">main.cf</a>:
|
|
smtp_transport_rate_delay = 20s
|
|
</pre>
|
|
|
|
<p> To enable the delay, specify a non-zero time value (an integral
|
|
value plus an optional one-letter suffix that specifies the time
|
|
unit). </p>
|
|
|
|
<p> Time units: s (seconds), m (minutes), h (hours), d (days), w
|
|
(weeks). The default time unit is s (seconds). </p>
|
|
|
|
<p> NOTE: the delay is enforced by the queue manager. </p>
|
|
|
|
<p> This feature is available in Postfix 3.1 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="default_verp_delimiters">default_verp_delimiters</a>
|
|
(default: +=)</b></DT><DD>
|
|
|
|
<p> The two default VERP delimiter characters. These are used when
|
|
no explicit delimiters are specified with the SMTP XVERP command
|
|
or with the "<b>sendmail -XV</b>" command-line option (Postfix 2.2
|
|
and earlier: <b>-V</b>). Specify characters that are allowed by the
|
|
<a href="postconf.5.html#verp_delimiter_filter">verp_delimiter_filter</a> setting.
|
|
</p>
|
|
|
|
<p>
|
|
This feature is available in Postfix 1.1 and later.
|
|
</p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="defer_code">defer_code</a>
|
|
(default: 450)</b></DT><DD>
|
|
|
|
<p>
|
|
The numerical Postfix SMTP server response code when a remote SMTP
|
|
client request is rejected by the "defer" restriction.
|
|
</p>
|
|
|
|
<p>
|
|
Do not change this unless you have a complete understanding of <a href="https://tools.ietf.org/html/rfc5321">RFC 5321</a>.
|
|
</p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="defer_service_name">defer_service_name</a>
|
|
(default: defer)</b></DT><DD>
|
|
|
|
<p>
|
|
The name of the defer service. This service is implemented by the
|
|
<a href="bounce.8.html">bounce(8)</a> daemon and maintains a record
|
|
of failed delivery attempts and generates non-delivery notifications.
|
|
</p>
|
|
|
|
<p>
|
|
This feature is available in Postfix 2.0 and later.
|
|
</p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="defer_transports">defer_transports</a>
|
|
(default: empty)</b></DT><DD>
|
|
|
|
<p>
|
|
The names of message delivery transports that should not deliver mail
|
|
unless someone issues "<b>sendmail -q</b>" or equivalent. Specify zero
|
|
or more mail delivery transport names that appear in the
|
|
first field of <a href="master.5.html">master.cf</a>.
|
|
</p>
|
|
|
|
<p>
|
|
Example:
|
|
</p>
|
|
|
|
<pre>
|
|
<a href="postconf.5.html#defer_transports">defer_transports</a> = smtp
|
|
</pre>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="delay_logging_resolution_limit">delay_logging_resolution_limit</a>
|
|
(default: 2)</b></DT><DD>
|
|
|
|
<p> The maximal number of digits after the decimal point when logging
|
|
delay values. Specify a number in the range 0..6. </p>
|
|
|
|
<p> To improve readability, delays are logged with only a limited
|
|
number of significant digits: </p>
|
|
|
|
<ul>
|
|
|
|
<li> Delays ≥ 100s are rounded off to an integral number of
|
|
seconds.
|
|
|
|
<li> Delays < 10<sup>-$<a href="postconf.5.html#delay_logging_resolution_limit">delay_logging_resolution_limit</a></sup> are
|
|
rounded off to "0".
|
|
|
|
<li> Other delays are rounded off to two significant digits, or
|
|
fewer if the result would exceed the <a href="postconf.5.html#delay_logging_resolution_limit">delay_logging_resolution_limit</a>.
|
|
|
|
</ul>
|
|
|
|
<p> The format of the "delays=a/b/c/d" logging is as follows: </p>
|
|
|
|
<ul>
|
|
|
|
<li> a = Time from message arrival to last <a href="QSHAPE_README.html#active_queue">active queue</a> entry.
|
|
|
|
<li> b = Time from last <a href="QSHAPE_README.html#active_queue">active queue</a> entry to the beginning of
|
|
connection setup.
|
|
|
|
<li> c = Time in connection setup. With SMTP, that is the time
|
|
before sending the MAIL FROM command: with a new connection, that
|
|
includes DNS lookups, and protocol handshakes with TCP, EHLO, and
|
|
STARTTLS; with a reused connection, that includes DNS lookups,
|
|
connection cache lookup by domain or IP address, and a liveness
|
|
probe with RSET.
|
|
|
|
<li> d = Time in message transmission. With SMTP, that starts with
|
|
sending MAIL FROM.
|
|
|
|
</ul>
|
|
|
|
<p> This feature is available in Postfix 2.3 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="delay_notice_recipient">delay_notice_recipient</a>
|
|
(default: postmaster)</b></DT><DD>
|
|
|
|
<p>
|
|
The recipient of postmaster notifications with the message headers
|
|
of mail that cannot be delivered within $<a href="postconf.5.html#delay_warning_time">delay_warning_time</a> time
|
|
units. </p>
|
|
|
|
<p>
|
|
See also: <a href="postconf.5.html#delay_warning_time">delay_warning_time</a>, <a href="postconf.5.html#notify_classes">notify_classes</a>.
|
|
</p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="delay_warning_time">delay_warning_time</a>
|
|
(default: 0h)</b></DT><DD>
|
|
|
|
<p>
|
|
The time after which the sender receives a copy of the message
|
|
headers of mail that is still queued. The <a href="postconf.5.html#confirm_delay_cleared">confirm_delay_cleared</a>
|
|
parameter controls sender notification when the delay clears up.
|
|
</p>
|
|
|
|
<p>
|
|
To enable this feature, specify a non-zero time value (an integral
|
|
value plus an optional one-letter suffix that specifies the time
|
|
unit).
|
|
</p>
|
|
|
|
<p>
|
|
Time units: s (seconds), m (minutes), h (hours), d (days), w (weeks).
|
|
The default time unit is h (hours).
|
|
</p>
|
|
|
|
<p>
|
|
See also: <a href="postconf.5.html#delay_notice_recipient">delay_notice_recipient</a>, <a href="postconf.5.html#notify_classes">notify_classes</a>, <a href="postconf.5.html#confirm_delay_cleared">confirm_delay_cleared</a>.
|
|
</p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="deliver_lock_attempts">deliver_lock_attempts</a>
|
|
(default: 20)</b></DT><DD>
|
|
|
|
<p>
|
|
The maximal number of attempts to acquire an exclusive lock on a
|
|
mailbox file or <a href="bounce.8.html">bounce(8)</a> logfile.
|
|
</p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="deliver_lock_delay">deliver_lock_delay</a>
|
|
(default: 1s)</b></DT><DD>
|
|
|
|
<p>
|
|
The time between attempts to acquire an exclusive lock on a mailbox
|
|
file or <a href="bounce.8.html">bounce(8)</a> logfile.
|
|
</p>
|
|
|
|
<p> Specify a non-zero time value (an integral value plus an optional
|
|
one-letter suffix that specifies the time unit). Time units: s
|
|
(seconds), m (minutes), h (hours), d (days), w (weeks).
|
|
The default time unit is s (seconds). </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="destination_concurrency_feedback_debug">destination_concurrency_feedback_debug</a>
|
|
(default: no)</b></DT><DD>
|
|
|
|
<p> Make the queue manager's feedback algorithm verbose for performance
|
|
analysis purposes. </p>
|
|
|
|
<p> This feature is available in Postfix 2.5 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="detect_8bit_encoding_header">detect_8bit_encoding_header</a>
|
|
(default: yes)</b></DT><DD>
|
|
|
|
<p> Automatically detect 8BITMIME body content by looking at
|
|
Content-Transfer-Encoding: message headers; historically, this
|
|
behavior was hard-coded to be "always on". </p>
|
|
|
|
<p> This feature is available in Postfix 2.5 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="disable_dns_lookups">disable_dns_lookups</a>
|
|
(default: no)</b></DT><DD>
|
|
|
|
<p>
|
|
Disable DNS lookups in the Postfix SMTP and LMTP clients. When
|
|
disabled, hosts are looked up with the getaddrinfo() system
|
|
library routine which normally also looks in /etc/hosts. As of
|
|
Postfix 2.11, this parameter is deprecated; use <a href="postconf.5.html#smtp_dns_support_level">smtp_dns_support_level</a>
|
|
instead.
|
|
</p>
|
|
|
|
<p>
|
|
DNS lookups are enabled by default.
|
|
</p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="disable_mime_input_processing">disable_mime_input_processing</a>
|
|
(default: no)</b></DT><DD>
|
|
|
|
<p>
|
|
Turn off MIME processing while receiving mail. This means that no
|
|
special treatment is given to Content-Type: message headers, and
|
|
that all text after the initial message headers is considered to
|
|
be part of the message body.
|
|
</p>
|
|
|
|
<p>
|
|
This feature is available in Postfix 2.0 and later.
|
|
</p>
|
|
|
|
<p>
|
|
Mime input processing is enabled by default, and is needed in order
|
|
to recognize MIME headers in message content.
|
|
</p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="disable_mime_output_conversion">disable_mime_output_conversion</a>
|
|
(default: no)</b></DT><DD>
|
|
|
|
<p>
|
|
Disable the conversion of 8BITMIME format to 7BIT format. Mime
|
|
output conversion is needed when the destination does not advertise
|
|
8BITMIME support.
|
|
</p>
|
|
|
|
<p>
|
|
This feature is available in Postfix 2.0 and later.
|
|
</p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="disable_verp_bounces">disable_verp_bounces</a>
|
|
(default: no)</b></DT><DD>
|
|
|
|
<p>
|
|
Disable sending one bounce report per recipient.
|
|
</p>
|
|
|
|
<p>
|
|
The default, one per recipient, is what ezmlm needs.
|
|
</p>
|
|
|
|
<p>
|
|
This feature is available in Postfix 1.1 and later.
|
|
</p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="disable_vrfy_command">disable_vrfy_command</a>
|
|
(default: no)</b></DT><DD>
|
|
|
|
<p>
|
|
Disable the SMTP VRFY command. This stops some techniques used to
|
|
harvest email addresses.
|
|
</p>
|
|
|
|
<p>
|
|
Example:
|
|
</p>
|
|
|
|
<pre>
|
|
<a href="postconf.5.html#disable_vrfy_command">disable_vrfy_command</a> = no
|
|
</pre>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="dns_ncache_ttl_fix_enable">dns_ncache_ttl_fix_enable</a>
|
|
(default: no)</b></DT><DD>
|
|
|
|
<p> Enable a workaround for future libc incompatibility. The Postfix
|
|
implementation of <a href="https://tools.ietf.org/html/rfc2308">RFC 2308</a> negative reply caching relies on the
|
|
promise that res_query() and res_search() invoke res_send(), which
|
|
returns the server response in an application buffer even if the
|
|
requested record does not exist. If this promise is broken, specify
|
|
"yes" to enable a workaround for DNS reputation lookups. </p>
|
|
|
|
<p>
|
|
This feature is available in Postfix 3.1 and later.
|
|
</p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="dnsblog_reply_delay">dnsblog_reply_delay</a>
|
|
(default: 0s)</b></DT><DD>
|
|
|
|
<p> A debugging aid to artificially delay DNS responses. </p>
|
|
|
|
<p> This feature is available in Postfix 2.8. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="dnsblog_service_name">dnsblog_service_name</a>
|
|
(default: dnsblog)</b></DT><DD>
|
|
|
|
<p> The name of the <a href="dnsblog.8.html">dnsblog(8)</a> service entry in <a href="master.5.html">master.cf</a>. This
|
|
service performs DNS allow/denylist lookups. </p>
|
|
|
|
<p> This feature is available in Postfix 2.8 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="dnssec_probe">dnssec_probe</a>
|
|
(default: ns:.)</b></DT><DD>
|
|
|
|
<p> The DNS query type (default: "ns") and DNS query name (default:
|
|
".") that Postfix may use to determine whether DNSSEC validation
|
|
is available.
|
|
</p>
|
|
|
|
<p> Background: DNSSEC validation is needed for Postfix DANE support;
|
|
this ensures that Postfix receives TLSA records with secure TLS
|
|
server certificate info. When DNSSEC validation is unavailable,
|
|
mail deliveries using <i>opportunistic</i> DANE will not be protected
|
|
by server certificate info in TLSA records, and mail deliveries
|
|
using <i>mandatory</i> DANE will not be made at all. </p>
|
|
|
|
<p> By default, a Postfix process will send a DNSSEC probe after
|
|
1) the process made a DNS query that requested DNSSEC validation,
|
|
2) the process did not receive a DNSSEC validated response to this
|
|
query or to an earlier query, and 3) the process did not already
|
|
send a DNSSEC probe. <p>
|
|
|
|
<p> When the DNSSEC probe has no response, or when the response is
|
|
not DNSSEC validated, Postfix logs a warning that DNSSEC validation
|
|
may be unavailable. </p>
|
|
|
|
<p> Example: </p>
|
|
|
|
<pre>
|
|
warning: DNSSEC validation may be unavailable
|
|
warning: reason: <a href="postconf.5.html#dnssec_probe">dnssec_probe</a> 'ns:.' received a response that is not DNSSEC validated
|
|
warning: reason: <a href="postconf.5.html#dnssec_probe">dnssec_probe</a> 'ns:.' received no response: Server failure
|
|
</pre>
|
|
|
|
<p> Possible reasons why DNSSEC validation may be unavailable: </p>
|
|
|
|
<ul>
|
|
|
|
<li> The local /etc/resolv.conf file specifies a DNS resolver that
|
|
does not validate DNSSEC signatures (that's
|
|
$<a href="postconf.5.html#queue_directory">queue_directory</a>/etc/resolv.conf when a Postfix daemon runs in a
|
|
chroot jail).
|
|
|
|
<li> The local system library does not pass on the "DNSSEC validated"
|
|
bit to Postfix, or Postfix does not know how to ask the library to
|
|
do that.
|
|
|
|
</ul>
|
|
|
|
<p> By default, the DNSSEC probe asks for the DNS root zone NS
|
|
records, because resolvers should always have that information
|
|
cached. If Postfix runs on a network where the DNS root zone is not
|
|
reachable, specify a different probe, or specify an empty <a href="postconf.5.html#dnssec_probe">dnssec_probe</a>
|
|
value to disable the feature. </p>
|
|
|
|
<p> This feature is available in Postfix 3.6 and later. It was backported
|
|
to Postfix versions 3.5.9, 3.4.19, 3.3.16. 3.2.21. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="dont_remove">dont_remove</a>
|
|
(default: 0)</b></DT><DD>
|
|
|
|
<p>
|
|
Don't remove queue files and save them to the "saved" mail queue.
|
|
This is a debugging aid. To inspect the envelope information and
|
|
content of a Postfix queue file, use the <a href="postcat.1.html">postcat(1)</a> command.
|
|
</p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="double_bounce_sender">double_bounce_sender</a>
|
|
(default: double-bounce)</b></DT><DD>
|
|
|
|
<p> The sender address of postmaster notifications that are generated
|
|
by the mail system. All mail to this address is silently discarded,
|
|
in order to terminate mail bounce loops. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="duplicate_filter_limit">duplicate_filter_limit</a>
|
|
(default: 1000)</b></DT><DD>
|
|
|
|
<p> The maximal number of addresses remembered by the address
|
|
duplicate filter for <a href="aliases.5.html">aliases(5)</a> or <a href="virtual.5.html">virtual(5)</a> alias expansion, or
|
|
for <a href="showq.8.html">showq(8)</a> queue displays. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="empty_address_default_transport_maps_lookup_key">empty_address_default_transport_maps_lookup_key</a>
|
|
(default: <>)</b></DT><DD>
|
|
|
|
<p> The <a href="postconf.5.html#sender_dependent_default_transport_maps">sender_dependent_default_transport_maps</a> search string that
|
|
will be used instead of the null sender address. </p>
|
|
|
|
<p> This feature is available in Postfix 2.7 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="empty_address_local_login_sender_maps_lookup_key">empty_address_local_login_sender_maps_lookup_key</a>
|
|
(default: <>)</b></DT><DD>
|
|
|
|
<p>
|
|
The lookup key to be used in <a href="postconf.5.html#local_login_sender_maps">local_login_sender_maps</a> tables, instead
|
|
of the null sender address.
|
|
</p>
|
|
|
|
<p> This feature is available in Postfix 3.6 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="empty_address_recipient">empty_address_recipient</a>
|
|
(default: MAILER-DAEMON)</b></DT><DD>
|
|
|
|
<p>
|
|
The recipient of mail addressed to the null address. Postfix does
|
|
not accept such addresses in SMTP commands, but they may still be
|
|
created locally as the result of configuration or software error.
|
|
</p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="empty_address_relayhost_maps_lookup_key">empty_address_relayhost_maps_lookup_key</a>
|
|
(default: <>)</b></DT><DD>
|
|
|
|
<p> The <a href="postconf.5.html#sender_dependent_relayhost_maps">sender_dependent_relayhost_maps</a> search string that will be
|
|
used instead of the null sender address. </p>
|
|
|
|
<p> This feature is available in Postfix 2.5 and later. With
|
|
earlier versions, <a href="postconf.5.html#sender_dependent_relayhost_maps">sender_dependent_relayhost_maps</a> lookups were
|
|
skipped for the null sender address. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="enable_errors_to">enable_errors_to</a>
|
|
(default: no)</b></DT><DD>
|
|
|
|
<p> Report mail delivery errors to the address specified with the
|
|
non-standard Errors-To: message header, instead of the envelope
|
|
sender address (this feature is removed with Postfix version 2.2, is
|
|
turned off by default with Postfix version 2.1, and is always turned on
|
|
with older Postfix versions). </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="enable_idna2003_compatibility">enable_idna2003_compatibility</a>
|
|
(default: no)</b></DT><DD>
|
|
|
|
<p> Enable 'transitional' compatibility between IDNA2003 and IDNA2008,
|
|
when converting UTF-8 domain names to/from the ASCII form that is
|
|
used for DNS lookups. Specify "yes" for compatibility with Postfix
|
|
≤ 3.1 (not recommended). This affects the conversion of domain
|
|
names that contain for example the German sz and the Greek zeta.
|
|
See <a href="https://unicode.org/cldr/utility/idna.jsp">https://unicode.org/cldr/utility/idna.jsp</a> for more examples.
|
|
</p>
|
|
|
|
<p> This feature is available in Postfix 3.2 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="enable_long_queue_ids">enable_long_queue_ids</a>
|
|
(default: no)</b></DT><DD>
|
|
|
|
<p> Enable long, non-repeating, queue IDs (queue file names). The
|
|
benefit of non-repeating names is simpler logfile analysis and
|
|
easier queue migration (there is no need to run "postsuper" to
|
|
change queue file names that don't match their message file inode
|
|
number). </p>
|
|
|
|
<p> Note: see below for how to convert long queue file names to
|
|
Postfix ≤ 2.8. </p>
|
|
|
|
<p> Changing the parameter value to "yes" has the following effects:
|
|
</p>
|
|
|
|
<ul>
|
|
|
|
<li> <p> Existing queue file names are not affected. </p>
|
|
|
|
<li> <p> New queue files are created with names such as 3Pt2mN2VXxznjll.
|
|
These are encoded in a 52-character alphabet that contains digits
|
|
(0-9), upper-case letters (B-Z) and lower-case letters (b-z). For
|
|
safety reasons the vowels (AEIOUaeiou) are excluded from the alphabet.
|
|
The name format is: 6 or more characters for the time in seconds,
|
|
4 characters for the time in microseconds, the 'z'; the remainder
|
|
is the file inode number encoded in the first 51 characters of the
|
|
52-character alphabet. </p>
|
|
|
|
<li> <p> New messages have a Message-ID header with
|
|
<i>queueID</i>@<i><a href="postconf.5.html#myhostname">myhostname</a></i>. </p>
|
|
|
|
<li> <p> The mailq (postqueue -p) output has a wider Queue ID column.
|
|
The number of whitespace-separated fields is not changed. <p>
|
|
|
|
<li> <p> The <a href="postconf.5.html#hash_queue_depth">hash_queue_depth</a> algorithm uses the first characters
|
|
of the queue file creation time in microseconds, after conversion
|
|
into hexadecimal representation. This produces the same queue hashing
|
|
behavior as if the queue file name was created with "<a href="postconf.5.html#enable_long_queue_ids">enable_long_queue_ids</a>
|
|
= no". </p>
|
|
|
|
</ul>
|
|
|
|
<p> Changing the parameter value to "no" has the following effects:
|
|
</p>
|
|
|
|
<ul>
|
|
|
|
<li> <p> Existing long queue file names are renamed to the short
|
|
form (while running "postfix reload" or "postsuper"). </p>
|
|
|
|
<li> <p> New queue files are created with names such as C3CD21F3E90
|
|
from a hexadecimal alphabet that contains digits (0-9) and upper-case
|
|
letters (A-F). The name format is: 5 characters for the time in
|
|
microseconds; the remainder is the file inode number. </p>
|
|
|
|
<li> <p> New messages have a Message-ID header with
|
|
<i>YYYYMMDDHHMMSS.queueid</i>@<i><a href="postconf.5.html#myhostname">myhostname</a></i>, where
|
|
<i>YYYYMMDDHHMMSS</i> are the year, month, day, hour, minute and
|
|
second.
|
|
|
|
<li> <p> The mailq (postqueue -p) output has the same format as
|
|
with Postfix ≤ 2.8. <p>
|
|
|
|
<li> <p> The <a href="postconf.5.html#hash_queue_depth">hash_queue_depth</a> algorithm uses the first characters
|
|
of the queue file name, with the hexadecimal representation of the
|
|
file creation time in microseconds. </p>
|
|
|
|
</ul>
|
|
|
|
<p> Before migration to Postfix ≤ 2.8, the following commands
|
|
are required to convert long queue file names into short names: </p>
|
|
|
|
<pre>
|
|
# postfix stop
|
|
# postconf <a href="postconf.5.html#enable_long_queue_ids">enable_long_queue_ids</a>=no
|
|
# postsuper
|
|
</pre>
|
|
|
|
<p> Repeat the postsuper command until it reports no more queue file
|
|
name changes. </p>
|
|
|
|
<p> This feature is available in Postfix 2.9 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="enable_original_recipient">enable_original_recipient</a>
|
|
(default: yes)</b></DT><DD>
|
|
|
|
<p> Enable support for the original recipient address after an
|
|
address is rewritten to a different address (for example with
|
|
aliasing or with canonical mapping). </p>
|
|
|
|
<p> The original recipient address is used as follows: </p>
|
|
|
|
<dl>
|
|
|
|
<dt> Final delivery </dt> <dd> With "<a href="postconf.5.html#enable_original_recipient">enable_original_recipient</a> =
|
|
yes", the original recipient address is stored in the <b>X-Original-To</b>
|
|
message header. This header may be used to distinguish between
|
|
different recipients that share the same mailbox. </dd>
|
|
|
|
<dt> Recipient deduplication </dt> <dd> With "<a href="postconf.5.html#enable_original_recipient">enable_original_recipient</a>
|
|
= yes", the <a href="cleanup.8.html">cleanup(8)</a> daemon performs duplicate recipient elimination
|
|
based on the content of (original recipient, maybe-rewritten
|
|
recipient) pairs. Otherwise, the <a href="cleanup.8.html">cleanup(8)</a> daemon performs duplicate
|
|
recipient elimination based only on the maybe-rewritten recipient
|
|
address. </dd>
|
|
|
|
</dl>
|
|
|
|
<p> Note: with Postfix ≤ 3.2 the "setting <a href="postconf.5.html#enable_original_recipient">enable_original_recipient</a>
|
|
= <b>no</b>" breaks address verification for addresses that are
|
|
aliased or otherwise rewritten (Postfix is unable to store the
|
|
address verification result under the original probe destination
|
|
address; instead, it can store the result only under the rewritten
|
|
address). </p>
|
|
|
|
<p> This feature is available in Postfix 2.1 and later. Postfix
|
|
version 2.0 behaves as if this parameter is always set to <b>yes</b>.
|
|
Postfix versions before 2.0 have no support for the original recipient
|
|
address. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="enable_threaded_bounces">enable_threaded_bounces</a>
|
|
(default: no)</b></DT><DD>
|
|
|
|
<p> Enable non-delivery, success, and delay notifications that link
|
|
to the original message by including a References: and In-Reply-To:
|
|
header with the original Message-ID value. There are advantages and
|
|
disadvantages to consider. </p>
|
|
|
|
<dl>
|
|
|
|
<dt> <b> advantage </b> </dt> <dd> This allows mail readers to present
|
|
a delivery status notification in the same email thread as the original
|
|
message. </dd>
|
|
|
|
<dt> <b> disadvantage </b> </dt> <dd> This makes it easy for users to
|
|
mistakenly delete the whole email thread (all related messages),
|
|
instead of deleting only the non-delivery notification. </dd>
|
|
|
|
</dl>
|
|
|
|
<p> This feature is available in Postfix 3.6 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="error_notice_recipient">error_notice_recipient</a>
|
|
(default: postmaster)</b></DT><DD>
|
|
|
|
<p> The recipient of postmaster notifications about mail delivery
|
|
problems that are caused by policy, resource, software or protocol
|
|
errors. These notifications are enabled with the <a href="postconf.5.html#notify_classes">notify_classes</a>
|
|
parameter. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="error_service_name">error_service_name</a>
|
|
(default: error)</b></DT><DD>
|
|
|
|
<p>
|
|
The name of the <a href="error.8.html">error(8)</a> pseudo delivery agent. This service always
|
|
returns mail as undeliverable.
|
|
</p>
|
|
|
|
<p>
|
|
This feature is available in Postfix 2.0 and later.
|
|
</p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="execution_directory_expansion_filter">execution_directory_expansion_filter</a>
|
|
(default: see "postconf -d" output)</b></DT><DD>
|
|
|
|
<p> Restrict the characters that the <a href="local.8.html">local(8)</a> delivery agent allows
|
|
in $name expansions of $<a href="postconf.5.html#command_execution_directory">command_execution_directory</a>. Characters
|
|
outside the allowed set are replaced by underscores. </p>
|
|
|
|
<p> This feature is available in Postfix 2.2 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="expand_owner_alias">expand_owner_alias</a>
|
|
(default: no)</b></DT><DD>
|
|
|
|
<p>
|
|
When delivering to an alias "<i>aliasname</i>" that has an
|
|
"owner-<i>aliasname</i>" companion alias, set the envelope sender
|
|
address to the expansion of the "owner-<i>aliasname</i>" alias.
|
|
Normally, Postfix sets the envelope sender address to the name of
|
|
the "owner-<i>aliasname</i>" alias.
|
|
</p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="export_environment">export_environment</a>
|
|
(default: see "postconf -d" output)</b></DT><DD>
|
|
|
|
<p>
|
|
The list of environment variables that a Postfix process will export
|
|
to non-Postfix processes. The TZ variable is needed for sane
|
|
time keeping on System-V-ish systems.
|
|
</p>
|
|
|
|
<p>
|
|
Specify a list of names and/or name=value pairs, separated by
|
|
whitespace or comma. Specify "{ name=value }" to protect whitespace
|
|
or comma in parameter values (whitespace after the opening "{" and
|
|
before the closing "}"
|
|
is ignored). The form name=value is supported with Postfix version
|
|
2.1 and later; the use of {} is supported with Postfix 3.0 and
|
|
later. </p>
|
|
|
|
<p>
|
|
Example:
|
|
</p>
|
|
|
|
<pre>
|
|
<a href="postconf.5.html#export_environment">export_environment</a> = TZ PATH=/bin:/usr/bin
|
|
</pre>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="extract_recipient_limit">extract_recipient_limit</a>
|
|
(default: 10240)</b></DT><DD>
|
|
|
|
<p>
|
|
The maximal number of recipient addresses that Postfix will extract
|
|
from message headers when mail is submitted with "<b>sendmail -t</b>".
|
|
</p>
|
|
|
|
<p>
|
|
This feature was removed in Postfix version 2.1.
|
|
</p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="fallback_relay">fallback_relay</a>
|
|
(default: empty)</b></DT><DD>
|
|
|
|
<p>
|
|
Optional list of relay hosts for SMTP destinations that can't be
|
|
found or that are unreachable. With Postfix 2.3 this parameter
|
|
is renamed to <a href="postconf.5.html#smtp_fallback_relay">smtp_fallback_relay</a>. </p>
|
|
|
|
<p>
|
|
By default, mail is returned to the sender when a destination is
|
|
not found, and delivery is deferred when a destination is unreachable.
|
|
</p>
|
|
|
|
<p> The fallback relays must be SMTP destinations. Specify a domain,
|
|
host, host:port, [host]:port, [address] or [address]:port; the form
|
|
[host] turns off MX lookups. If you specify multiple SMTP
|
|
destinations, Postfix will try them in the specified order. </p>
|
|
|
|
<p> Note: before Postfix 2.2, do not use the <a href="postconf.5.html#fallback_relay">fallback_relay</a> feature
|
|
when relaying mail
|
|
for a backup or primary MX domain. Mail would loop between the
|
|
Postfix MX host and the <a href="postconf.5.html#fallback_relay">fallback_relay</a> host when the final destination
|
|
is unavailable. </p>
|
|
|
|
<ul>
|
|
|
|
<li> In <a href="postconf.5.html">main.cf</a> specify "<a href="postconf.5.html#relay_transport">relay_transport</a> = relay",
|
|
|
|
<li> In <a href="master.5.html">master.cf</a> specify "-o <a href="postconf.5.html#fallback_relay">fallback_relay</a> =" (i.e., empty) at
|
|
the end of the <tt>relay</tt> entry.
|
|
|
|
<li> In transport maps, specify "relay:<i>nexthop...</i>"
|
|
as the right-hand side for backup or primary MX domain entries.
|
|
|
|
</ul>
|
|
|
|
<p> Postfix version 2.2 and later will not use the <a href="postconf.5.html#fallback_relay">fallback_relay</a> feature
|
|
for destinations that it is MX host for.
|
|
</p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="fallback_transport">fallback_transport</a>
|
|
(default: empty)</b></DT><DD>
|
|
|
|
<p>
|
|
Optional message delivery transport that the <a href="local.8.html">local(8)</a> delivery
|
|
agent should use for names that are not found in the <a href="aliases.5.html">aliases(5)</a>
|
|
or UNIX password database.
|
|
</p>
|
|
|
|
<p> The precedence of <a href="local.8.html">local(8)</a> delivery features from high to low
|
|
is: aliases, .forward files, <a href="postconf.5.html#mailbox_transport_maps">mailbox_transport_maps</a>, <a href="postconf.5.html#mailbox_transport">mailbox_transport</a>,
|
|
<a href="postconf.5.html#mailbox_command_maps">mailbox_command_maps</a>, <a href="postconf.5.html#mailbox_command">mailbox_command</a>, <a href="postconf.5.html#home_mailbox">home_mailbox</a>, <a href="postconf.5.html#mail_spool_directory">mail_spool_directory</a>,
|
|
<a href="postconf.5.html#fallback_transport_maps">fallback_transport_maps</a>, <a href="postconf.5.html#fallback_transport">fallback_transport</a> and <a href="postconf.5.html#luser_relay">luser_relay</a>. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="fallback_transport_maps">fallback_transport_maps</a>
|
|
(default: empty)</b></DT><DD>
|
|
|
|
<p> Optional lookup tables with per-recipient message delivery
|
|
transports for recipients that the <a href="local.8.html">local(8)</a> delivery agent could
|
|
not find in the <a href="aliases.5.html">aliases(5)</a> or UNIX password database. </p>
|
|
|
|
<p> The precedence of <a href="local.8.html">local(8)</a> delivery features from high to low
|
|
is: aliases, .forward files, <a href="postconf.5.html#mailbox_transport_maps">mailbox_transport_maps</a>, <a href="postconf.5.html#mailbox_transport">mailbox_transport</a>,
|
|
<a href="postconf.5.html#mailbox_command_maps">mailbox_command_maps</a>, <a href="postconf.5.html#mailbox_command">mailbox_command</a>, <a href="postconf.5.html#home_mailbox">home_mailbox</a>, <a href="postconf.5.html#mail_spool_directory">mail_spool_directory</a>,
|
|
<a href="postconf.5.html#fallback_transport_maps">fallback_transport_maps</a>, <a href="postconf.5.html#fallback_transport">fallback_transport</a> and <a href="postconf.5.html#luser_relay">luser_relay</a>. </p>
|
|
|
|
<p> For safety reasons, this feature does not allow $number
|
|
substitutions in regular expression maps. </p>
|
|
|
|
<p> This feature is available in Postfix 2.3 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="fast_flush_domains">fast_flush_domains</a>
|
|
(default: $<a href="postconf.5.html#relay_domains">relay_domains</a>)</b></DT><DD>
|
|
|
|
<p>
|
|
Optional list of destinations that are eligible for per-destination
|
|
logfiles with mail that is queued to those destinations.
|
|
</p>
|
|
|
|
<p>
|
|
By default, Postfix maintains "fast flush" logfiles only for
|
|
destinations that the Postfix SMTP server is willing to relay to
|
|
(i.e. the default is: "<a href="postconf.5.html#fast_flush_domains">fast_flush_domains</a> = $<a href="postconf.5.html#relay_domains">relay_domains</a>"; see
|
|
the <a href="postconf.5.html#relay_domains">relay_domains</a> parameter in the <a href="postconf.5.html">postconf(5)</a> manual).
|
|
</p>
|
|
|
|
<p> Specify a list of hosts or domains, "/file/name" patterns or
|
|
"<a href="DATABASE_README.html">type:table</a>" lookup tables, separated by commas and/or whitespace.
|
|
Continue long lines by starting the next line with whitespace. A
|
|
"/file/name" pattern is replaced by its contents; a "<a href="DATABASE_README.html">type:table</a>"
|
|
lookup table is matched when the domain or its parent domain appears
|
|
as lookup key. </p>
|
|
|
|
<p> Pattern matching of domain names is controlled by the presence
|
|
or absence of "<a href="postconf.5.html#fast_flush_domains">fast_flush_domains</a>" in the <a href="postconf.5.html#parent_domain_matches_subdomains">parent_domain_matches_subdomains</a>
|
|
parameter value. </p>
|
|
|
|
<p>
|
|
Specify "<a href="postconf.5.html#fast_flush_domains">fast_flush_domains</a> =" (i.e., empty) to disable the feature
|
|
altogether.
|
|
</p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="fast_flush_purge_time">fast_flush_purge_time</a>
|
|
(default: 7d)</b></DT><DD>
|
|
|
|
<p>
|
|
The time after which an empty per-destination "fast flush" logfile
|
|
is deleted.
|
|
</p>
|
|
|
|
<p>
|
|
You can specify the time as a number, or as a number followed by
|
|
a letter that indicates the time unit: s=seconds, m=minutes, h=hours,
|
|
d=days, w=weeks. The default time unit is days.
|
|
</p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="fast_flush_refresh_time">fast_flush_refresh_time</a>
|
|
(default: 12h)</b></DT><DD>
|
|
|
|
<p>
|
|
The time after which a non-empty but unread per-destination "fast
|
|
flush" logfile needs to be refreshed. The contents of a logfile
|
|
are refreshed by requesting delivery of all messages listed in the
|
|
logfile.
|
|
</p>
|
|
|
|
<p>
|
|
You can specify the time as a number, or as a number followed by
|
|
a letter that indicates the time unit: s=seconds, m=minutes, h=hours,
|
|
d=days, w=weeks. The default time unit is hours.
|
|
</p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="fault_injection_code">fault_injection_code</a>
|
|
(default: 0)</b></DT><DD>
|
|
|
|
<p>
|
|
Force specific internal tests to fail, to test the handling of
|
|
errors that are difficult to reproduce otherwise.
|
|
</p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="flush_service_name">flush_service_name</a>
|
|
(default: flush)</b></DT><DD>
|
|
|
|
<p>
|
|
The name of the <a href="flush.8.html">flush(8)</a> service. This service maintains per-destination
|
|
logfiles with the queue file names of mail that is queued for those
|
|
destinations.
|
|
</p>
|
|
|
|
<p>
|
|
This feature is available in Postfix 2.0 and later.
|
|
</p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="force_mime_input_conversion">force_mime_input_conversion</a>
|
|
(default: no)</b></DT><DD>
|
|
|
|
<p> Convert body content that claims to be 8-bit into quoted-printable,
|
|
before <a href="postconf.5.html#header_checks">header_checks</a>, <a href="postconf.5.html#body_checks">body_checks</a>, Milters, and before after-queue
|
|
content filters. This feature does not affect messages that are
|
|
sent into <a href="postconf.5.html#smtpd_proxy_filter">smtpd_proxy_filter</a>. </p>
|
|
|
|
<p> The typical use case is an MTA that applies this conversion
|
|
before signing outbound messages, so that the signatures will remain
|
|
valid when a message is later delivered to an MTA that does not
|
|
announce 8BITMIME support, or when a message line exceeds the SMTP
|
|
length limit. </p>
|
|
|
|
<p> This feature is available in Postfix ≥ 3.9. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="fork_attempts">fork_attempts</a>
|
|
(default: 5)</b></DT><DD>
|
|
|
|
<p> The maximal number of attempts to fork() a child process. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="fork_delay">fork_delay</a>
|
|
(default: 1s)</b></DT><DD>
|
|
|
|
<p> The delay between attempts to fork() a child process. </p>
|
|
|
|
<p> Specify a non-zero time value (an integral value plus an optional
|
|
one-letter suffix that specifies the time unit). Time units: s
|
|
(seconds), m (minutes), h (hours), d (days), w (weeks).
|
|
The default time unit is s (seconds). </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="forward_expansion_filter">forward_expansion_filter</a>
|
|
(default: see "postconf -d" output)</b></DT><DD>
|
|
|
|
<p>
|
|
Restrict the characters that the <a href="local.8.html">local(8)</a> delivery agent allows in
|
|
$name expansions of $<a href="postconf.5.html#forward_path">forward_path</a>. Characters outside the
|
|
allowed set are replaced by underscores.
|
|
</p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="forward_path">forward_path</a>
|
|
(default: see "postconf -d" output)</b></DT><DD>
|
|
|
|
<p> The <a href="local.8.html">local(8)</a> delivery agent search list for finding a .forward
|
|
file with user-specified delivery methods. The first file that is
|
|
found is used. </p>
|
|
|
|
<p> The <a href="postconf.5.html#forward_path">forward_path</a> value is not subject to Postfix configuration
|
|
parameter $name expansion. Instead, the following $name expansions
|
|
are done on <a href="postconf.5.html#forward_path">forward_path</a> before the search actually happens.
|
|
The result of $name expansion is
|
|
filtered with the character set that is specified with the
|
|
<a href="postconf.5.html#forward_expansion_filter">forward_expansion_filter</a> parameter. </p>
|
|
|
|
<dl>
|
|
|
|
<dt><b>$user</b></dt>
|
|
|
|
<dd>The recipient's username. </dd>
|
|
|
|
<dt><b>$shell</b></dt>
|
|
|
|
<dd>The recipient's login shell pathname. </dd>
|
|
|
|
<dt><b>$home</b></dt>
|
|
|
|
<dd>The recipient's home directory. </dd>
|
|
|
|
<dt><b>$recipient</b></dt>
|
|
|
|
<dd>The full recipient address. </dd>
|
|
|
|
<dt><b>$extension</b></dt>
|
|
|
|
<dd>The optional recipient address extension. </dd>
|
|
|
|
<dt><b>$domain</b></dt>
|
|
|
|
<dd>The recipient domain. </dd>
|
|
|
|
<dt><b>$local</b></dt>
|
|
|
|
<dd>The entire recipient localpart. </dd>
|
|
|
|
<dt><b>$<a href="postconf.5.html#recipient_delimiter">recipient_delimiter</a></b></dt>
|
|
|
|
<dd>The address extension delimiter that was found in the recipient
|
|
address (Postfix 2.11 and later), or the 'first' delimiter specified
|
|
with the system-wide recipient address extension delimiter (Postfix
|
|
3.5.22, 3.6.12, 3.7.8, 3.8.3 and later). Historically, this was
|
|
always the system-wide recipient
|
|
address extension delimiter (Postfix 2.10 and earlier). </dd>
|
|
|
|
<dt><b>${name?value}</b></dt>
|
|
|
|
<dt><b>${name?{value}}</b> (Postfix ≥ 3.0)</dt>
|
|
|
|
<dd>Expands to <i>value</i> when <i>$name</i> is non-empty. </dd>
|
|
|
|
<dt><b>${name:value}</b></dt>
|
|
|
|
<dt><b>${name:{value}}</b> (Postfix ≥ 3.0)</dt>
|
|
|
|
<dd>Expands to <i>value</i> when <i>$name</i> is empty. </dd>
|
|
|
|
<dt><b>${name?{value1}:{value2}}</b> (Postfix ≥ 3.0)</dt>
|
|
|
|
<dd>Expands to <i>value1</i> when <i>$name</i> is non-empty,
|
|
<i>value2</i> otherwise. </dd>
|
|
|
|
</dl>
|
|
|
|
<p>
|
|
Instead of $name you can also specify ${name} or $(name).
|
|
</p>
|
|
|
|
<p>
|
|
Examples:
|
|
</p>
|
|
|
|
<pre>
|
|
<a href="postconf.5.html#forward_path">forward_path</a> = /var/forward/$user
|
|
<a href="postconf.5.html#forward_path">forward_path</a> =
|
|
/var/forward/$user/.forward$<a href="postconf.5.html#recipient_delimiter">recipient_delimiter</a>$extension,
|
|
/var/forward/$user/.forward
|
|
</pre>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="frozen_delivered_to">frozen_delivered_to</a>
|
|
(default: yes)</b></DT><DD>
|
|
|
|
<p> Update the <a href="local.8.html">local(8)</a> delivery agent's idea of the Delivered-To:
|
|
address (see <a href="postconf.5.html#prepend_delivered_header">prepend_delivered_header</a>) only once, at the start of
|
|
a delivery attempt; do not update the Delivered-To: address while
|
|
expanding aliases or .forward files. </p>
|
|
|
|
<p> This feature is available in Postfix 2.3 and later. With older
|
|
Postfix releases, the behavior is as if this parameter is set to
|
|
"no". The old setting can be expensive with deeply nested aliases
|
|
or .forward files. When an alias or .forward file changes the
|
|
Delivered-To: address, it ties up one queue file and one cleanup
|
|
process instance while mail is being forwarded. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="full_name_encoding_charset">full_name_encoding_charset</a>
|
|
(default: utf-8)</b></DT><DD>
|
|
|
|
<p> The character set name (also called "charset") that Postfix
|
|
will output when it automatically generates an <a href="https://tools.ietf.org/html/rfc2047">RFC 2047</a> encoded
|
|
full name. Encoding non-ASCII full names can avoid the need to use
|
|
SMTPUTF8, and therefore can avoid incompatibility with sites that
|
|
do not support SMTPUTF8. </p>
|
|
|
|
<p> The encoded names look like "=?charset?q?gibberish?=" with
|
|
quoted-printable encoding, or "=?charset?b?gibberish?=" with base64
|
|
encoding. Postfix uses quoted-printable encoding for a full name
|
|
that is short or mostly printable ASCII, and uses base64 otherwise.
|
|
</p>
|
|
|
|
<p> Background: when a message without a From: header is submitted
|
|
with the Postfix <a href="sendmail.1.html">sendmail(1)</a> command, the Postfix <a href="cleanup.8.html">cleanup(8)</a> daemon
|
|
will add a From: header and will try to use the sender's full name
|
|
specified with the Postfix <a href="sendmail.1.html">sendmail(1)</a> "-F" option, with the Postfix
|
|
<a href="sendmail.1.html">sendmail(1)</a> "NAME" environment variable, or with the GECOS field
|
|
in the UNIX password database. In the latter case, Postfix will
|
|
replace the "&" character with the login name, with a lowercase
|
|
ASCII first character converted to uppercase. </p>
|
|
|
|
<p> NOTE: Postfix does not convert between character sets. The
|
|
<a href="postconf.5.html#full_name_encoding_charset">full_name_encoding_charset</a> parameter specifies the character set
|
|
of the full name in the Postfix sendmail "-F" option, in the Postfix
|
|
sendmail "NAME" environment variable, or in the GECOS field of the
|
|
UNIX password database. The parameter value is also part of the
|
|
encoded full name, and informs a Mail User Agent how to display the
|
|
decoded gibberish. </p>
|
|
|
|
<p> Specify a valid character set name such as "utf-8" or "iso-8859-1
|
|
(specify the latter for full names that use the Latin1 encoding).
|
|
The character set name is case insensitive. When a character set
|
|
name violates <a href="https://tools.ietf.org/html/rfc2047">RFC 2047</a> syntax, Postfix will log a warning and will
|
|
skip the full name. </p>
|
|
|
|
<p> This feature is available in Postfix ≥ 3.10. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="hash_queue_depth">hash_queue_depth</a>
|
|
(default: 1)</b></DT><DD>
|
|
|
|
<p>
|
|
The number of subdirectory levels for queue directories listed with
|
|
the <a href="postconf.5.html#hash_queue_names">hash_queue_names</a> parameter. Queue hashing is implemented by
|
|
creating one or more levels of directories with one-character names.
|
|
Originally, these directory names were equal to the first characters
|
|
of the queue file name, with the hexadecimal representation of the
|
|
file creation time in microseconds. </p>
|
|
|
|
<p> With long queue file names, queue hashing produces the same
|
|
results as with short names. The file creation time in microseconds
|
|
is converted into hexadecimal form before the result is used for
|
|
queue hashing. The base 16 encoding gives finer control over the
|
|
number of subdirectories than is possible with the base 52 encoding
|
|
of long queue file names. </p>
|
|
|
|
<p>
|
|
After changing the <a href="postconf.5.html#hash_queue_names">hash_queue_names</a> or <a href="postconf.5.html#hash_queue_depth">hash_queue_depth</a> parameter,
|
|
execute the command "<b>postfix reload</b>".
|
|
</p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="hash_queue_names">hash_queue_names</a>
|
|
(default: deferred, defer)</b></DT><DD>
|
|
|
|
<p>
|
|
The names of queue directories that are split across multiple
|
|
subdirectory levels.
|
|
</p>
|
|
|
|
<p> Before Postfix version 2.2, the default list of hashed queues
|
|
was significantly larger. Claims about improvements in file system
|
|
technology suggest that hashing of the <a href="QSHAPE_README.html#incoming_queue">incoming</a> and <a href="QSHAPE_README.html#active_queue">active queues</a>
|
|
is no longer needed. Fewer hashed directories speed up the time
|
|
needed to restart Postfix. </p>
|
|
|
|
<p>
|
|
After changing the <a href="postconf.5.html#hash_queue_names">hash_queue_names</a> or <a href="postconf.5.html#hash_queue_depth">hash_queue_depth</a> parameter,
|
|
execute the command "<b>postfix reload</b>".
|
|
</p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="header_address_token_limit">header_address_token_limit</a>
|
|
(default: 10240)</b></DT><DD>
|
|
|
|
<p>
|
|
The maximal number of address tokens are allowed in an address
|
|
message header. Information that exceeds the limit is discarded.
|
|
The limit is enforced by the <a href="cleanup.8.html">cleanup(8)</a> server.
|
|
</p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="header_checks">header_checks</a>
|
|
(default: empty)</b></DT><DD>
|
|
|
|
<p>
|
|
Optional lookup tables for content inspection of primary non-MIME
|
|
message headers, as specified in the <a href="header_checks.5.html">header_checks(5)</a> manual page.
|
|
</p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="header_from_format">header_from_format</a>
|
|
(default: standard)</b></DT><DD>
|
|
|
|
<p> The format of the Postfix-generated <b>From:</b> header. This
|
|
setting affects the appearance of 'full name' information when a
|
|
local program such as /bin/mail submits a message without a From:
|
|
header through the Postfix <a href="sendmail.1.html">sendmail(1)</a> command. </p>
|
|
|
|
<p> Specify one of the following: </p>
|
|
|
|
<dl>
|
|
|
|
<dt><b>standard</b> (default)</dt> <dd> Produce a header formatted
|
|
as "<b>From:</b> <i>name</i><b> <</b><i>address</i><b>></b>".
|
|
This is the default as of Postfix 3.3.</dd>
|
|
|
|
<dt><b>obsolete</b></dt> <dd>Produce a header formatted as "<b>From:</b>
|
|
<i>address</i> <b>(</b><i>name</i><b>)</b>". This is the behavior
|
|
prior to Postfix 3.3. </dd>
|
|
|
|
</dl>
|
|
|
|
<p> Notes: </p>
|
|
|
|
<ul>
|
|
|
|
<li> <p> Postfix generates the format "<b>From:</b> <i>address</i>"
|
|
when <i>name</i> information is unavailable or the envelope sender
|
|
address is empty. This is the same behavior as prior to Postfix
|
|
3.3. </p>
|
|
|
|
<li> <p> In the <b>standard</b> form, the <i>name</i> will be quoted
|
|
if it contains <b>specials</b> as defined in <a href="https://tools.ietf.org/html/rfc5322">RFC 5322</a>, or the "!%"
|
|
address operators. </p>
|
|
|
|
<li> <p> The Postfix <a href="sendmail.1.html">sendmail(1)</a> command gets <i>name</i> information
|
|
from the <b>-F</b> command-line option, from the <b>NAME</b>
|
|
environment variable, or from the UNIX password file. </p>
|
|
|
|
</ul>
|
|
|
|
<p> This feature is available in Postfix 3.3 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="header_size_limit">header_size_limit</a>
|
|
(default: 102400)</b></DT><DD>
|
|
|
|
<p>
|
|
The maximal amount of memory in bytes for storing a message header.
|
|
If a header is larger, the excess is discarded. The limit is
|
|
enforced by the <a href="cleanup.8.html">cleanup(8)</a> server.
|
|
</p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="helpful_warnings">helpful_warnings</a>
|
|
(default: yes)</b></DT><DD>
|
|
|
|
<p>
|
|
Log warnings about problematic configuration settings, and provide
|
|
helpful suggestions.
|
|
</p>
|
|
|
|
<p>
|
|
This feature is available in Postfix 2.0 and later.
|
|
</p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="home_mailbox">home_mailbox</a>
|
|
(default: empty)</b></DT><DD>
|
|
|
|
<p>
|
|
Optional pathname of a mailbox file relative to a <a href="local.8.html">local(8)</a> user's
|
|
home directory.
|
|
</p>
|
|
|
|
<p>
|
|
Specify a pathname ending in "/" for qmail-style delivery.
|
|
</p>
|
|
|
|
<p> The precedence of <a href="local.8.html">local(8)</a> delivery features from high to low
|
|
is: aliases, .forward files, <a href="postconf.5.html#mailbox_transport_maps">mailbox_transport_maps</a>, <a href="postconf.5.html#mailbox_transport">mailbox_transport</a>,
|
|
<a href="postconf.5.html#mailbox_command_maps">mailbox_command_maps</a>, <a href="postconf.5.html#mailbox_command">mailbox_command</a>, <a href="postconf.5.html#home_mailbox">home_mailbox</a>, <a href="postconf.5.html#mail_spool_directory">mail_spool_directory</a>,
|
|
<a href="postconf.5.html#fallback_transport_maps">fallback_transport_maps</a>, <a href="postconf.5.html#fallback_transport">fallback_transport</a> and <a href="postconf.5.html#luser_relay">luser_relay</a>. </p>
|
|
|
|
<p>
|
|
Examples:
|
|
</p>
|
|
|
|
<pre>
|
|
<a href="postconf.5.html#home_mailbox">home_mailbox</a> = Mailbox
|
|
<a href="postconf.5.html#home_mailbox">home_mailbox</a> = Maildir/
|
|
</pre>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="hopcount_limit">hopcount_limit</a>
|
|
(default: 50)</b></DT><DD>
|
|
|
|
<p>
|
|
The maximal number of Received: message headers that is allowed
|
|
in the primary message headers. A message that exceeds the limit
|
|
is bounced, in order to stop a mailer loop.
|
|
</p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="html_directory">html_directory</a>
|
|
(default: see "postconf -d" output)</b></DT><DD>
|
|
|
|
<p>
|
|
The location of Postfix HTML files that describe how to build,
|
|
configure or operate a specific Postfix subsystem or feature.
|
|
</p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="ignore_mx_lookup_error">ignore_mx_lookup_error</a>
|
|
(default: no)</b></DT><DD>
|
|
|
|
<p> Ignore DNS MX lookups that produce no response. By default,
|
|
the Postfix SMTP client defers delivery and tries again after some
|
|
delay. This behavior is required by the SMTP standard. </p>
|
|
|
|
<p>
|
|
Specify "<a href="postconf.5.html#ignore_mx_lookup_error">ignore_mx_lookup_error</a> = yes" to force a DNS A record
|
|
lookup instead. This violates the SMTP standard and can result in
|
|
mis-delivery of mail.
|
|
</p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="ignore_srv_lookup_error">ignore_srv_lookup_error</a>
|
|
(default: no)</b></DT><DD>
|
|
|
|
<p> When SRV record lookup fails, fall back to MX or IP address
|
|
lookup as if SRV record lookup was not enabled. </p>
|
|
|
|
<p> This feature is available in Postfix 3.8 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="import_environment">import_environment</a>
|
|
(default: see "postconf -d" output)</b></DT><DD>
|
|
|
|
<p> The list of environment variables that a privileged Postfix
|
|
process will import from a non-Postfix parent process, or name=value
|
|
environment overrides. Unprivileged utilities will enforce the
|
|
name=value overrides, but otherwise will not change their process
|
|
environment. Examples of relevant environment variables: </p>
|
|
|
|
<dl>
|
|
|
|
<dt><b>TZ</b></dt>
|
|
|
|
<dd>May be needed for sane time keeping on most System-V-ish systems.
|
|
</dd>
|
|
|
|
<dt><b>DISPLAY</b></dt>
|
|
|
|
<dd>Needed for debugging Postfix daemons with an X-windows debugger. </dd>
|
|
|
|
<dt><b>XAUTHORITY</b></dt>
|
|
|
|
<dd>Needed for debugging Postfix daemons with an X-windows debugger. </dd>
|
|
|
|
<dt><b>MAIL_CONFIG</b></dt>
|
|
|
|
<dd>Needed to make "<b>postfix -c</b>" work. </dd>
|
|
|
|
<dt><b>POSTLOG_SERVICE</b></dt>
|
|
|
|
<dd>Needed to make "<b><a href="postconf.5.html#maillog_file">maillog_file</a></b>" work during daemon
|
|
process initialization. </dd>
|
|
|
|
<dt><b>POSTLOG_HOSTNAME</b></dt>
|
|
|
|
<dd>Needed to make "<b><a href="postconf.5.html#maillog_file">maillog_file</a></b>" work during daemon
|
|
process initialization. </dd>
|
|
|
|
</dl>
|
|
|
|
<p> Specify a list of names and/or name=value pairs, separated by
|
|
whitespace or comma. Specify "{ name=value }" to protect whitespace
|
|
or comma in environment variable values (whitespace after the opening "{" and
|
|
before the closing "}"
|
|
is ignored). The form name=value is supported with Postfix version
|
|
2.1 and later; the use of {} is supported with Postfix 3.0 and
|
|
later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="in_flow_delay">in_flow_delay</a>
|
|
(default: 1s)</b></DT><DD>
|
|
|
|
<p> Time to pause before accepting a new message, when the message
|
|
arrival rate exceeds the message delivery rate. This feature is
|
|
turned on by default (it's disabled on SCO UNIX due to an SCO bug).
|
|
</p>
|
|
|
|
<p>
|
|
With the default 100 Postfix SMTP server process limit, "<a href="postconf.5.html#in_flow_delay">in_flow_delay</a>
|
|
= 1s" limits the mail inflow to 100 messages per second above the
|
|
number of messages delivered per second.
|
|
</p>
|
|
|
|
<p>
|
|
Specify 0 to disable the feature. Valid delays are 0..10.
|
|
</p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="inet_interfaces">inet_interfaces</a>
|
|
(default: all)</b></DT><DD>
|
|
|
|
<p> The local network interface addresses that this mail system
|
|
receives mail on. Specify "all" to receive mail on all network
|
|
interfaces (default), "loopback-only" to receive mail on loopback
|
|
network interfaces only (Postfix version 2.2 and later), or zero
|
|
or more IPv4 or IPv6 addresses (IPv6 is supported in Postfix version
|
|
2.2 and later). The parameter also controls whether Postfix will
|
|
accept mail for <tt>user@[ip.address]</tt>, and prevents Postfix
|
|
from delivering mail to a host that has equal or larger MX preference.
|
|
Specify an empty value if Postfix does not receive mail over the
|
|
network, or if all network listeners have an explicit IP address
|
|
in <a href="master.5.html">master.cf</a>. </p>
|
|
|
|
<p>
|
|
Note 1: you need to stop and start Postfix when this parameter changes.
|
|
</p>
|
|
|
|
<p> Note 2: address information may be enclosed inside <tt>[]</tt>,
|
|
but this form is not required here. </p>
|
|
|
|
<p> When <a href="postconf.5.html#smtp_bind_address">smtp_bind_address</a> and/or <a href="postconf.5.html#smtp_bind_address6">smtp_bind_address6</a> are not
|
|
specified, the <a href="postconf.5.html#inet_interfaces">inet_interfaces</a> setting may constrain the source IP
|
|
address for an outbound SMTP or LMTP connection as described below.
|
|
</p>
|
|
|
|
<p> The following text is specific to SMTP and IPv4. The same
|
|
reasoning applies to the IPv6 protocol, and to the Postfix LMTP
|
|
client. To disable IPv4 or IPv6 support in the Postfix SMTP and
|
|
LMTP client, use <a href="postconf.5.html#inet_protocols">inet_protocols</a>. </p>
|
|
|
|
<ul>
|
|
|
|
<li> <p> When <a href="postconf.5.html#inet_interfaces">inet_interfaces</a> specifies one IPv4 address, and that
|
|
is not a loopback address, the Postfix SMTP client uses that as the
|
|
source address for outbound IPv4 connections. </p>
|
|
|
|
<li> <p> Otherwise, the Postfix SMTP client does not constrain the
|
|
source IPv4 address, and connects using a system-chosen source IPv4
|
|
address. This includes the cases where <a href="postconf.5.html#inet_interfaces">inet_interfaces</a> is empty,
|
|
where it specifies <b>all</b>, or where it contains no IPv4 address,
|
|
one IPv4 address that is a loopback address, or multiple IPv4
|
|
addresses. </p>
|
|
|
|
</ul>
|
|
|
|
<p> A Postfix SMTP client may fail to reach some remote SMTP servers
|
|
when the client source IP address is constrained explicitly with
|
|
<a href="postconf.5.html#smtp_bind_address">smtp_bind_address</a> or <a href="postconf.5.html#smtp_bind_address6">smtp_bind_address6</a>, or implicitly with
|
|
<a href="postconf.5.html#inet_interfaces">inet_interfaces</a>. This can happen when Postfix runs on a multi-homed
|
|
system such as a firewall, the Postfix SMTP source client IP address
|
|
is constrained to one specific network interface, and the remote
|
|
SMTP server must be reached through a different interface. Setting
|
|
<a href="postconf.5.html#smtp_bind_address">smtp_bind_address</a> to 0.0.0.0 avoids the potential problem for IPv4,
|
|
and setting <a href="postconf.5.html#smtp_bind_address6">smtp_bind_address6</a> to :: solves the problem for IPv6.
|
|
</p>
|
|
|
|
<p>
|
|
A better solution for multi-homed systems is to leave <a href="postconf.5.html#inet_interfaces">inet_interfaces</a>
|
|
at the default value and instead use explicit IP addresses in
|
|
the <a href="master.5.html">master.cf</a> SMTP server definitions. This preserves the Postfix
|
|
SMTP client's
|
|
loop detection, by ensuring that each side of the firewall knows that the
|
|
other IP address is still the same host. Setting $<a href="postconf.5.html#inet_interfaces">inet_interfaces</a> to a
|
|
single IPv4 and/or IPV6 address is primarily useful with virtual
|
|
hosting of domains on
|
|
secondary IP addresses, when each IP address serves a different domain
|
|
(and has a different $<a href="postconf.5.html#myhostname">myhostname</a> setting). </p>
|
|
|
|
<p>
|
|
See also the <a href="postconf.5.html#proxy_interfaces">proxy_interfaces</a> parameter, for network addresses that
|
|
are forwarded to Postfix by way of a proxy or address translator.
|
|
</p>
|
|
|
|
<p>
|
|
Examples:
|
|
</p>
|
|
|
|
<pre>
|
|
<a href="postconf.5.html#inet_interfaces">inet_interfaces</a> = all (DEFAULT)
|
|
<a href="postconf.5.html#inet_interfaces">inet_interfaces</a> = loopback-only (Postfix version 2.2 and later)
|
|
<a href="postconf.5.html#inet_interfaces">inet_interfaces</a> = 127.0.0.1
|
|
<a href="postconf.5.html#inet_interfaces">inet_interfaces</a> = 127.0.0.1, [::1] (Postfix version 2.2 and later)
|
|
<a href="postconf.5.html#inet_interfaces">inet_interfaces</a> = 192.168.1.2, 127.0.0.1
|
|
</pre>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="inet_protocols">inet_protocols</a>
|
|
(default: see 'postconf -d' output)</b></DT><DD>
|
|
|
|
<p> The Internet protocols Postfix will attempt to use when making
|
|
or accepting connections. Specify one or more of "ipv4"
|
|
or "ipv6", separated by whitespace or commas. The form
|
|
"all" is equivalent to "ipv4, ipv6" or "ipv4", depending
|
|
on whether the operating system implements IPv6. </p>
|
|
|
|
<p> With Postfix 2.8 and earlier the default is "ipv4". For backwards
|
|
compatibility with these releases, the Postfix 2.9 and later upgrade
|
|
procedure appends an explicit "<a href="postconf.5.html#inet_protocols">inet_protocols</a> = ipv4" setting to
|
|
<a href="postconf.5.html">main.cf</a> when no explicit setting is present. This compatibility
|
|
workaround will be phased out as IPv6 deployment becomes more common.
|
|
</p>
|
|
|
|
<p> This feature is available in Postfix 2.2 and later. </p>
|
|
|
|
<p> Note: you MUST stop and start Postfix after changing this
|
|
parameter. </p>
|
|
|
|
<p> On systems that pre-date IPV6_V6ONLY support (<a href="https://tools.ietf.org/html/rfc3493">RFC 3493</a>), an
|
|
IPv6 server will also accept IPv4 connections, even when IPv4 is
|
|
turned off with the <a href="postconf.5.html#inet_protocols">inet_protocols</a> parameter. On systems with
|
|
IPV6_V6ONLY support, Postfix will use separate server sockets for
|
|
IPv6 and IPv4, and each will accept only connections for the
|
|
corresponding protocol. </p>
|
|
|
|
<p> When IPv4 support is enabled via the <a href="postconf.5.html#inet_protocols">inet_protocols</a> parameter,
|
|
Postfix will look up DNS type A records, and will convert
|
|
IPv4-in-IPv6 client IP addresses (::ffff:1.2.3.4) to their original
|
|
IPv4 form (1.2.3.4). The latter is needed on hosts that pre-date
|
|
IPV6_V6ONLY support (<a href="https://tools.ietf.org/html/rfc3493">RFC 3493</a>). </p>
|
|
|
|
<p> When IPv6 support is enabled via the <a href="postconf.5.html#inet_protocols">inet_protocols</a> parameter,
|
|
Postfix will do DNS type AAAA record lookups. </p>
|
|
|
|
<p> When both IPv4 and IPv6 support are enabled, the Postfix SMTP
|
|
client will choose the protocol as specified with the
|
|
<a href="postconf.5.html#smtp_address_preference">smtp_address_preference</a> parameter. Postfix versions before 2.8
|
|
attempt to connect via IPv6 before attempting to use IPv4. </p>
|
|
|
|
<p>
|
|
Examples:
|
|
</p>
|
|
|
|
<pre>
|
|
<a href="postconf.5.html#inet_protocols">inet_protocols</a> = ipv4
|
|
<a href="postconf.5.html#inet_protocols">inet_protocols</a> = all (DEFAULT)
|
|
<a href="postconf.5.html#inet_protocols">inet_protocols</a> = ipv6
|
|
<a href="postconf.5.html#inet_protocols">inet_protocols</a> = ipv4, ipv6
|
|
</pre>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="info_log_address_format">info_log_address_format</a>
|
|
(default: external)</b></DT><DD>
|
|
|
|
<p> The email address form that will be used in non-debug logging
|
|
(info, warning, etc.). As of Postfix 3.5 when an address localpart
|
|
contains spaces or other special characters, the localpart will be
|
|
quoted, for example: </p>
|
|
|
|
<blockquote>
|
|
<pre>
|
|
from=<"name with spaces"@example.com>
|
|
</pre>
|
|
</blockquote>
|
|
|
|
<p> Older Postfix versions would log the internal (unquoted) form: </p>
|
|
|
|
<blockquote>
|
|
<pre>
|
|
from=<name with spaces@example.com>
|
|
</pre>
|
|
</blockquote>
|
|
|
|
<p> The external and internal forms are identical for the vast
|
|
majority of email addresses that contain no spaces or other special
|
|
characters in the localpart. </p>
|
|
|
|
<p> The logging in external form is consistent with the address
|
|
form that Postfix 3.2 and later prefer for most table lookups. This
|
|
is therefore the more useful form for non-debug logging. </p>
|
|
|
|
<p> Specify "<b><a href="postconf.5.html#info_log_address_format">info_log_address_format</a> = internal</b>" for backwards
|
|
compatibility. </p>
|
|
|
|
<p> Postfix uses the unquoted form internally, because an attacker
|
|
can specify an email address in different forms by playing games
|
|
with quotes and backslashes. An attacker should not be able to use
|
|
such games to circumvent Postfix access policies. </p>
|
|
|
|
<p> This feature is available in Postfix 3.5 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="initial_destination_concurrency">initial_destination_concurrency</a>
|
|
(default: 5)</b></DT><DD>
|
|
|
|
<p>
|
|
The initial per-destination concurrency level for parallel delivery
|
|
to the same destination.
|
|
With per-destination recipient limit > 1, a destination is a domain,
|
|
otherwise it is a recipient.
|
|
</p>
|
|
|
|
<p> Use <a href="postconf.5.html#transport_initial_destination_concurrency"><i>transport</i>_initial_destination_concurrency</a> to specify
|
|
a transport-specific override, where <i>transport</i> is the <a href="master.5.html">master.cf</a>
|
|
name of the message delivery transport (Postfix 2.5 and later). </p>
|
|
|
|
<p>
|
|
Warning: with concurrency of 1, one bad message can be enough to
|
|
block all mail to a site.
|
|
</p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="internal_mail_filter_classes">internal_mail_filter_classes</a>
|
|
(default: empty)</b></DT><DD>
|
|
|
|
<p> What categories of Postfix-generated mail are subject to
|
|
before-queue content inspection by <a href="postconf.5.html#non_smtpd_milters">non_smtpd_milters</a>, <a href="postconf.5.html#header_checks">header_checks</a>
|
|
and <a href="postconf.5.html#body_checks">body_checks</a>. Specify zero or more of the following, separated
|
|
by whitespace or comma. </p>
|
|
|
|
<dl>
|
|
|
|
<dt><b>bounce</b></dt> <dd> Inspect the content of delivery
|
|
status notifications. </dd>
|
|
|
|
<dt><b>notify</b></dt> <dd> Inspect the content of postmaster
|
|
notifications by the <a href="smtp.8.html">smtp(8)</a> and <a href="smtpd.8.html">smtpd(8)</a> processes. </dd>
|
|
|
|
</dl>
|
|
|
|
<p> NOTE: It's generally not safe to enable content inspection of
|
|
Postfix-generated email messages. The user is warned. </p>
|
|
|
|
<p> This feature is available in Postfix 2.3 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="invalid_hostname_reject_code">invalid_hostname_reject_code</a>
|
|
(default: 501)</b></DT><DD>
|
|
|
|
<p>
|
|
The numerical Postfix SMTP server response code when the client
|
|
HELO or EHLO command parameter is rejected by the <a href="postconf.5.html#reject_invalid_helo_hostname">reject_invalid_helo_hostname</a>
|
|
restriction.
|
|
</p>
|
|
|
|
<p>
|
|
Do not change this unless you have a complete understanding of <a href="https://tools.ietf.org/html/rfc5321">RFC 5321</a>.
|
|
</p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="ipc_idle">ipc_idle</a>
|
|
(default: version dependent)</b></DT><DD>
|
|
|
|
<p>
|
|
The time after which a client closes an idle internal communication
|
|
channel. The purpose is to allow Postfix daemon processes to
|
|
terminate voluntarily after they become idle. This is used, for
|
|
example, by the Postfix address resolving and rewriting clients.
|
|
</p>
|
|
|
|
<p> With Postfix 2.4 the default value was reduced from 100s to 5s. </p>
|
|
|
|
<p> Specify a non-zero time value (an integral value plus an optional
|
|
one-letter suffix that specifies the time unit). Time units: s
|
|
(seconds), m (minutes), h (hours), d (days), w (weeks).
|
|
The default time unit is s (seconds). </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="ipc_timeout">ipc_timeout</a>
|
|
(default: 3600s)</b></DT><DD>
|
|
|
|
<p>
|
|
The time limit for sending or receiving information over an internal
|
|
communication channel. The purpose is to break out of deadlock
|
|
situations. If the time limit is exceeded the software aborts with a
|
|
fatal error.
|
|
</p>
|
|
|
|
<p> Specify a non-zero time value (an integral value plus an optional
|
|
one-letter suffix that specifies the time unit). Time units: s
|
|
(seconds), m (minutes), h (hours), d (days), w (weeks).
|
|
The default time unit is s (seconds). </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="ipc_ttl">ipc_ttl</a>
|
|
(default: 1000s)</b></DT><DD>
|
|
|
|
<p>
|
|
The time after which a client closes an active internal communication
|
|
channel. The purpose is to allow Postfix daemon processes to
|
|
terminate voluntarily
|
|
after reaching their client limit. This is used, for example, by
|
|
the Postfix address resolving and rewriting clients.
|
|
</p>
|
|
|
|
<p> Specify a non-zero time value (an integral value plus an optional
|
|
one-letter suffix that specifies the time unit). Time units: s
|
|
(seconds), m (minutes), h (hours), d (days), w (weeks).
|
|
The default time unit is s (seconds). </p>
|
|
|
|
<p>
|
|
This feature is available in Postfix 2.1 and later.
|
|
</p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="known_tcp_ports">known_tcp_ports</a>
|
|
(default: lmtp=24, smtp=25, smtps=submissions=465, submission=587)</b></DT><DD>
|
|
|
|
<p> Optional setting that avoids lookups in the services(5) database.
|
|
This feature was implemented to address inconsistencies in the name
|
|
of the port "465" service. The ABNF is:
|
|
</p>
|
|
|
|
<blockquote>
|
|
<p>
|
|
<a href="postconf.5.html#known_tcp_ports">known_tcp_ports</a> = empty | name-to-port *("," name-to-port) <br>
|
|
name-to-port = 1*(service-name "=') port-number
|
|
</p>
|
|
</blockquote>
|
|
|
|
<p> The comma is required. Whitespace is optional but it cannot appear
|
|
inside a service name or port number. </p>
|
|
|
|
<p> This feature is available in Postfix 3.6 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="line_length_limit">line_length_limit</a>
|
|
(default: 2048)</b></DT><DD>
|
|
|
|
<p> Upon input, long lines are chopped up into pieces of at most
|
|
this length; upon delivery, long lines are reconstructed. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="lmdb_map_size">lmdb_map_size</a>
|
|
(default: 16777216)</b></DT><DD>
|
|
|
|
<p>
|
|
The initial OpenLDAP LMDB database size limit in bytes. Each time
|
|
a database becomes full, its size limit is doubled.
|
|
</p>
|
|
|
|
<p>
|
|
This feature is available in Postfix 2.11 and later.
|
|
</p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="lmtp_address_preference">lmtp_address_preference</a>
|
|
(default: ipv6)</b></DT><DD>
|
|
|
|
<p> The LMTP-specific version of the <a href="postconf.5.html#smtp_address_preference">smtp_address_preference</a>
|
|
configuration parameter. See there for details. </p>
|
|
|
|
<p> This feature is available in Postfix 2.8 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="lmtp_address_verify_target">lmtp_address_verify_target</a>
|
|
(default: rcpt)</b></DT><DD>
|
|
|
|
<p> The LMTP-specific version of the <a href="postconf.5.html#smtp_address_verify_target">smtp_address_verify_target</a>
|
|
configuration parameter. See there for details. </p>
|
|
|
|
<p> This feature is available in Postfix 3.0 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="lmtp_assume_final">lmtp_assume_final</a>
|
|
(default: no)</b></DT><DD>
|
|
|
|
<p> When a remote LMTP server announces no DSN support, assume that
|
|
the
|
|
server performs final delivery, and send "delivered" delivery status
|
|
notifications instead of "relayed". The default setting is backwards
|
|
compatible to avoid the infinitesimal possibility of breaking
|
|
existing LMTP-based content filters. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="lmtp_balance_inet_protocols">lmtp_balance_inet_protocols</a>
|
|
(default: yes)</b></DT><DD>
|
|
|
|
<p> The LMTP-specific version of the <a href="postconf.5.html#smtp_balance_inet_protocols">smtp_balance_inet_protocols</a>
|
|
configuration parameter. See there for details. </p>
|
|
|
|
<p> This feature is available in Postfix 3.3 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="lmtp_bind_address">lmtp_bind_address</a>
|
|
(default: empty)</b></DT><DD>
|
|
|
|
<p> The LMTP-specific version of the <a href="postconf.5.html#smtp_bind_address">smtp_bind_address</a> configuration
|
|
parameter. See there for details. </p>
|
|
|
|
<p> This feature is available in Postfix 2.3 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="lmtp_bind_address6">lmtp_bind_address6</a>
|
|
(default: empty)</b></DT><DD>
|
|
|
|
<p> The LMTP-specific version of the <a href="postconf.5.html#smtp_bind_address6">smtp_bind_address6</a> configuration
|
|
parameter. See there for details. </p>
|
|
|
|
<p> This feature is available in Postfix 2.3 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="lmtp_bind_address_enforce">lmtp_bind_address_enforce</a>
|
|
(default: empty)</b></DT><DD>
|
|
|
|
<p> The LMTP-specific version of the <a href="postconf.5.html#smtp_bind_address_enforce">smtp_bind_address_enforce</a>
|
|
configuration parameter. See there for details. </p>
|
|
|
|
<p> This feature is available in Postfix 3.7 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="lmtp_body_checks">lmtp_body_checks</a>
|
|
(default: empty)</b></DT><DD>
|
|
|
|
<p> The LMTP-specific version of the <a href="postconf.5.html#smtp_body_checks">smtp_body_checks</a> configuration
|
|
parameter. See there for details. </p>
|
|
|
|
<p> This feature is available in Postfix 2.5 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="lmtp_cache_connection">lmtp_cache_connection</a>
|
|
(default: yes)</b></DT><DD>
|
|
|
|
<p>
|
|
Keep Postfix LMTP client connections open for up to $<a href="postconf.5.html#max_idle">max_idle</a>
|
|
seconds. When the LMTP client receives a request for the same
|
|
connection the connection is reused.
|
|
</p>
|
|
|
|
<p> This parameter is available in Postfix version 2.2 and earlier.
|
|
With Postfix version 2.3 and later, see <a href="postconf.5.html#lmtp_connection_cache_on_demand">lmtp_connection_cache_on_demand</a>,
|
|
<a href="postconf.5.html#lmtp_connection_cache_destinations">lmtp_connection_cache_destinations</a>, or <a href="postconf.5.html#lmtp_connection_reuse_time_limit">lmtp_connection_reuse_time_limit</a>.
|
|
</p>
|
|
|
|
<p>
|
|
The effectiveness of cached connections will be determined by the
|
|
number of remote LMTP servers in use, and the concurrency limit specified
|
|
for the Postfix LMTP client. Cached connections are closed under any of
|
|
the following conditions:
|
|
</p>
|
|
|
|
<ul>
|
|
|
|
<li> The Postfix LMTP client idle time limit is reached. This limit is
|
|
specified with the Postfix <a href="postconf.5.html#max_idle">max_idle</a> configuration parameter.
|
|
|
|
<li> A delivery request specifies a different destination than the
|
|
one currently cached.
|
|
|
|
<li> The per-process limit on the number of delivery requests is
|
|
reached. This limit is specified with the Postfix <a href="postconf.5.html#max_use">max_use</a>
|
|
configuration parameter.
|
|
|
|
<li> Upon the onset of another delivery request, the remote LMTP server
|
|
associated with the current session does not respond to the RSET
|
|
command.
|
|
|
|
</ul>
|
|
|
|
<p>
|
|
Most of these limitations have been with the Postfix
|
|
connection cache that is shared among multiple LMTP client
|
|
programs.
|
|
</p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="lmtp_cname_overrides_servername">lmtp_cname_overrides_servername</a>
|
|
(default: yes)</b></DT><DD>
|
|
|
|
<p> The LMTP-specific version of the <a href="postconf.5.html#smtp_cname_overrides_servername">smtp_cname_overrides_servername</a>
|
|
configuration parameter. See there for details. </p>
|
|
|
|
<p> This feature is available in Postfix 2.3 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="lmtp_connect_timeout">lmtp_connect_timeout</a>
|
|
(default: 0s)</b></DT><DD>
|
|
|
|
<p> The Postfix LMTP client time limit for completing a TCP connection, or
|
|
zero (use the operating system built-in time limit). When no
|
|
connection can be made within the deadline, the LMTP client tries
|
|
the next address on the mail exchanger list. </p>
|
|
|
|
<p> Specify a non-negative time value (an integral value plus an optional
|
|
one-letter suffix that specifies the time unit). Time units: s
|
|
(seconds), m (minutes), h (hours), d (days), w (weeks).
|
|
The default time unit is s (seconds). </p>
|
|
|
|
<p>
|
|
Example:
|
|
</p>
|
|
|
|
<pre>
|
|
<a href="postconf.5.html#lmtp_connect_timeout">lmtp_connect_timeout</a> = 30s
|
|
</pre>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="lmtp_connection_cache_destinations">lmtp_connection_cache_destinations</a>
|
|
(default: empty)</b></DT><DD>
|
|
|
|
<p> The LMTP-specific version of the <a href="postconf.5.html#smtp_connection_cache_destinations">smtp_connection_cache_destinations</a>
|
|
configuration parameter. See there for details. </p>
|
|
|
|
<p> This feature is available in Postfix 2.3 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="lmtp_connection_cache_on_demand">lmtp_connection_cache_on_demand</a>
|
|
(default: yes)</b></DT><DD>
|
|
|
|
<p> The LMTP-specific version of the <a href="postconf.5.html#smtp_connection_cache_on_demand">smtp_connection_cache_on_demand</a>
|
|
configuration parameter. See there for details. </p>
|
|
|
|
<p> This feature is available in Postfix 2.3 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="lmtp_connection_cache_time_limit">lmtp_connection_cache_time_limit</a>
|
|
(default: 2s)</b></DT><DD>
|
|
|
|
<p> The LMTP-specific version of the
|
|
<a href="postconf.5.html#smtp_connection_cache_time_limit">smtp_connection_cache_time_limit</a> configuration parameter.
|
|
See there for details. </p>
|
|
|
|
<p> This feature is available in Postfix 2.3 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="lmtp_connection_reuse_count_limit">lmtp_connection_reuse_count_limit</a>
|
|
(default: 0)</b></DT><DD>
|
|
|
|
<p> The LMTP-specific version of the <a href="postconf.5.html#smtp_connection_reuse_count_limit">smtp_connection_reuse_count_limit</a>
|
|
configuration parameter. See there for details. </p>
|
|
|
|
<p> This feature is available in Postfix 2.11 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="lmtp_connection_reuse_time_limit">lmtp_connection_reuse_time_limit</a>
|
|
(default: 300s)</b></DT><DD>
|
|
|
|
<p> The LMTP-specific version of the <a href="postconf.5.html#smtp_connection_reuse_time_limit">smtp_connection_reuse_time_limit</a>
|
|
configuration parameter. See there for details. </p>
|
|
|
|
<p> This feature is available in Postfix 2.3 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="lmtp_data_done_timeout">lmtp_data_done_timeout</a>
|
|
(default: 600s)</b></DT><DD>
|
|
|
|
<p> The Postfix LMTP client time limit for sending the LMTP ".",
|
|
and for receiving the remote LMTP server response. When no response
|
|
is received within the deadline, a warning is logged that the mail
|
|
may be delivered multiple times. </p>
|
|
|
|
<p> Specify a non-zero time value (an integral value plus an optional
|
|
one-letter suffix that specifies the time unit). Time units: s
|
|
(seconds), m (minutes), h (hours), d (days), w (weeks).
|
|
The default time unit is s (seconds). </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="lmtp_data_init_timeout">lmtp_data_init_timeout</a>
|
|
(default: 120s)</b></DT><DD>
|
|
|
|
<p>
|
|
The Postfix LMTP client time limit for sending the LMTP DATA command,
|
|
and
|
|
for receiving the remote LMTP server response.
|
|
</p>
|
|
|
|
<p> Specify a non-zero time value (an integral value plus an optional
|
|
one-letter suffix that specifies the time unit). Time units: s
|
|
(seconds), m (minutes), h (hours), d (days), w (weeks).
|
|
The default time unit is s (seconds). </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="lmtp_data_xfer_timeout">lmtp_data_xfer_timeout</a>
|
|
(default: 180s)</b></DT><DD>
|
|
|
|
<p>
|
|
The Postfix LMTP client time limit for sending the LMTP message
|
|
content.
|
|
When the connection stalls for more than $<a href="postconf.5.html#lmtp_data_xfer_timeout">lmtp_data_xfer_timeout</a>
|
|
the LMTP client terminates the transfer.
|
|
</p>
|
|
|
|
<p> Specify a non-zero time value (an integral value plus an optional
|
|
one-letter suffix that specifies the time unit). Time units: s
|
|
(seconds), m (minutes), h (hours), d (days), w (weeks).
|
|
The default time unit is s (seconds). </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="lmtp_defer_if_no_mx_address_found">lmtp_defer_if_no_mx_address_found</a>
|
|
(default: no)</b></DT><DD>
|
|
|
|
<p> The LMTP-specific version of the <a href="postconf.5.html#smtp_defer_if_no_mx_address_found">smtp_defer_if_no_mx_address_found</a>
|
|
configuration parameter. See there for details. </p>
|
|
|
|
<p> This feature is available in Postfix 2.3 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="lmtp_delivery_status_filter">lmtp_delivery_status_filter</a>
|
|
(default: empty)</b></DT><DD>
|
|
|
|
<p> The LMTP-specific version of the <a href="postconf.5.html#smtp_delivery_status_filter">smtp_delivery_status_filter</a>
|
|
configuration parameter. See there for details. </p>
|
|
|
|
<p> This feature is available in Postfix 3.0 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="lmtp_destination_concurrency_limit">lmtp_destination_concurrency_limit</a>
|
|
(default: $<a href="postconf.5.html#default_destination_concurrency_limit">default_destination_concurrency_limit</a>)</b></DT><DD>
|
|
|
|
<p> The maximal number of parallel deliveries to the same destination
|
|
via the lmtp message delivery transport. This limit is enforced by
|
|
the queue manager. The message delivery transport name is the first
|
|
field in the entry in the <a href="master.5.html">master.cf</a> file. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="lmtp_destination_recipient_limit">lmtp_destination_recipient_limit</a>
|
|
(default: $<a href="postconf.5.html#default_destination_recipient_limit">default_destination_recipient_limit</a>)</b></DT><DD>
|
|
|
|
<p> The maximal number of recipients per message for the lmtp
|
|
message delivery transport. This limit is enforced by the queue
|
|
manager. The message delivery transport name is the first field in
|
|
the entry in the <a href="master.5.html">master.cf</a> file. </p>
|
|
|
|
<p> Setting this parameter to a value of 1 changes the meaning of
|
|
<a href="postconf.5.html#lmtp_destination_concurrency_limit">lmtp_destination_concurrency_limit</a> from concurrency per domain into
|
|
concurrency per recipient. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="lmtp_discard_lhlo_keyword_address_maps">lmtp_discard_lhlo_keyword_address_maps</a>
|
|
(default: empty)</b></DT><DD>
|
|
|
|
<p> Lookup tables, indexed by the remote LMTP server address, with
|
|
case insensitive lists of LHLO keywords (pipelining, starttls,
|
|
auth, etc.) that the Postfix LMTP client will ignore in the LHLO
|
|
response
|
|
from a remote LMTP server. See <a href="postconf.5.html#lmtp_discard_lhlo_keywords">lmtp_discard_lhlo_keywords</a> for
|
|
details. The table is not indexed by hostname for consistency with
|
|
<a href="postconf.5.html#smtpd_discard_ehlo_keyword_address_maps">smtpd_discard_ehlo_keyword_address_maps</a>. </p>
|
|
|
|
<p> This feature is available in Postfix 2.3 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="lmtp_discard_lhlo_keywords">lmtp_discard_lhlo_keywords</a>
|
|
(default: empty)</b></DT><DD>
|
|
|
|
<p> A case insensitive list of LHLO keywords (pipelining, starttls,
|
|
auth, etc.) that the Postfix LMTP client will ignore in the LHLO
|
|
response
|
|
from a remote LMTP server. </p>
|
|
|
|
<p> This feature is available in Postfix 2.3 and later. </p>
|
|
|
|
<p> Notes: </p>
|
|
|
|
<ul>
|
|
|
|
<li> <p> Specify the <b>silent-discard</b> pseudo keyword to prevent
|
|
this action from being logged. </p>
|
|
|
|
<li> <p> Use the <a href="postconf.5.html#lmtp_discard_lhlo_keyword_address_maps">lmtp_discard_lhlo_keyword_address_maps</a> feature to
|
|
discard LHLO keywords selectively. </p>
|
|
|
|
</ul>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="lmtp_dns_reply_filter">lmtp_dns_reply_filter</a>
|
|
(default: empty)</b></DT><DD>
|
|
|
|
<p> Optional filter for Postfix LMTP client DNS lookup results.
|
|
See <a href="postconf.5.html#smtp_dns_reply_filter">smtp_dns_reply_filter</a> for details including an example. </p>
|
|
|
|
<p> This feature is available in Postfix 3.0 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="lmtp_dns_resolver_options">lmtp_dns_resolver_options</a>
|
|
(default: empty)</b></DT><DD>
|
|
|
|
<p> The LMTP-specific version of the <a href="postconf.5.html#smtp_dns_resolver_options">smtp_dns_resolver_options</a>
|
|
configuration parameter. See there for details. </p>
|
|
|
|
<p> This feature is available in Postfix 2.8 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="lmtp_dns_support_level">lmtp_dns_support_level</a>
|
|
(default: empty)</b></DT><DD>
|
|
|
|
<p> The LMTP-specific version of the <a href="postconf.5.html#smtp_dns_support_level">smtp_dns_support_level</a>
|
|
configuration parameter. See there for details. </p>
|
|
|
|
<p> This feature is available in Postfix 2.11 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="lmtp_enforce_tls">lmtp_enforce_tls</a>
|
|
(default: no)</b></DT><DD>
|
|
|
|
<p> The LMTP-specific version of the <a href="postconf.5.html#smtp_enforce_tls">smtp_enforce_tls</a> configuration
|
|
parameter. See there for details. </p>
|
|
|
|
<p> This feature is deprecated as of Postfix 3.9. Specify
|
|
<a href="postconf.5.html#lmtp_tls_security_level">lmtp_tls_security_level</a> instead. </p>
|
|
|
|
<p> This feature is available in Postfix 2.3 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="lmtp_fallback_relay">lmtp_fallback_relay</a>
|
|
(default: empty)</b></DT><DD>
|
|
|
|
<p> Optional list of relay hosts for LMTP destinations that can't be
|
|
found or that are unreachable. In <a href="postconf.5.html">main.cf</a> elements are separated by
|
|
whitespace or commas. </p>
|
|
|
|
<p> By default, mail is returned to the sender when a destination is not
|
|
found, and delivery is deferred when a destination is unreachable. </p>
|
|
|
|
<p> The fallback relays must be TCP destinations, specified without
|
|
a leading "inet:" prefix. Specify a host or host:port. Since MX
|
|
lookups do not apply with LMTP, there is no need to use the "[host]" or
|
|
"[host]:port" forms. If you specify multiple LMTP destinations, Postfix
|
|
will try them in the specified order. </p>
|
|
|
|
<p>
|
|
This feature is available in Postfix 3.1 and later.
|
|
</p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="lmtp_generic_maps">lmtp_generic_maps</a>
|
|
(default: empty)</b></DT><DD>
|
|
|
|
<p> The LMTP-specific version of the <a href="postconf.5.html#smtp_generic_maps">smtp_generic_maps</a> configuration
|
|
parameter. See there for details. </p>
|
|
|
|
<p> This feature is available in Postfix 2.3 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="lmtp_header_checks">lmtp_header_checks</a>
|
|
(default: empty)</b></DT><DD>
|
|
|
|
<p> The LMTP-specific version of the <a href="postconf.5.html#smtp_header_checks">smtp_header_checks</a> configuration
|
|
parameter. See there for details. </p>
|
|
|
|
<p> This feature is available in Postfix 2.5 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="lmtp_host_lookup">lmtp_host_lookup</a>
|
|
(default: dns)</b></DT><DD>
|
|
|
|
<p> The LMTP-specific version of the <a href="postconf.5.html#smtp_host_lookup">smtp_host_lookup</a> configuration
|
|
parameter. See there for details. </p>
|
|
|
|
<p> This feature is available in Postfix 2.3 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="lmtp_lhlo_name">lmtp_lhlo_name</a>
|
|
(default: $<a href="postconf.5.html#myhostname">myhostname</a>)</b></DT><DD>
|
|
|
|
<p>
|
|
The hostname to send in the LMTP LHLO command.
|
|
</p>
|
|
|
|
<p>
|
|
The default value is the machine hostname. Specify a hostname or
|
|
[ip.add.re.ss] or [ip:v6:add:re::ss].
|
|
</p>
|
|
|
|
<p>
|
|
This information can be specified in the <a href="postconf.5.html">main.cf</a> file for all LMTP
|
|
clients, or it can be specified in the <a href="master.5.html">master.cf</a> file for a specific
|
|
client, for example:
|
|
</p>
|
|
|
|
<blockquote>
|
|
<pre>
|
|
/etc/postfix/<a href="master.5.html">master.cf</a>:
|
|
mylmtp ... lmtp -o <a href="postconf.5.html#lmtp_lhlo_name">lmtp_lhlo_name</a>=foo.bar.com
|
|
</pre>
|
|
</blockquote>
|
|
|
|
<p>
|
|
This feature is available in Postfix 2.3 and later.
|
|
</p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="lmtp_lhlo_timeout">lmtp_lhlo_timeout</a>
|
|
(default: 300s)</b></DT><DD>
|
|
|
|
<p> The Postfix LMTP client time limit for sending the LHLO command,
|
|
and for receiving the initial remote LMTP server response. </p>
|
|
|
|
<p> Time units: s (seconds), m (minutes), h (hours), d (days), w
|
|
(weeks). The default time unit is s (seconds). </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="lmtp_line_length_limit">lmtp_line_length_limit</a>
|
|
(default: 998)</b></DT><DD>
|
|
|
|
<p> The LMTP-specific version of the <a href="postconf.5.html#smtp_line_length_limit">smtp_line_length_limit</a>
|
|
configuration parameter. See there for details. </p>
|
|
|
|
<p> This feature is available in Postfix 2.3 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="lmtp_mail_timeout">lmtp_mail_timeout</a>
|
|
(default: 300s)</b></DT><DD>
|
|
|
|
<p>
|
|
The Postfix LMTP client time limit for sending the MAIL FROM command,
|
|
and for receiving the remote LMTP server response.
|
|
</p>
|
|
|
|
<p> Specify a non-zero time value (an integral value plus an optional
|
|
one-letter suffix that specifies the time unit). Time units: s
|
|
(seconds), m (minutes), h (hours), d (days), w (weeks).
|
|
The default time unit is s (seconds). </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="lmtp_mime_header_checks">lmtp_mime_header_checks</a>
|
|
(default: empty)</b></DT><DD>
|
|
|
|
<p> The LMTP-specific version of the <a href="postconf.5.html#smtp_mime_header_checks">smtp_mime_header_checks</a>
|
|
configuration parameter. See there for details. </p>
|
|
|
|
<p> This feature is available in Postfix 2.5 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="lmtp_min_data_rate">lmtp_min_data_rate</a>
|
|
(default: 500)</b></DT><DD>
|
|
|
|
<p> The LMTP-specific version of the <a href="postconf.5.html#smtp_min_data_rate">smtp_min_data_rate</a> configuration
|
|
parameter. See there for details. </p>
|
|
|
|
<p> This feature is available in Postfix 3.7 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="lmtp_mx_address_limit">lmtp_mx_address_limit</a>
|
|
(default: 5)</b></DT><DD>
|
|
|
|
<p> The LMTP-specific version of the <a href="postconf.5.html#smtp_mx_address_limit">smtp_mx_address_limit</a> configuration
|
|
parameter. See there for details. </p>
|
|
|
|
<p> This feature is available in Postfix 2.3 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="lmtp_mx_session_limit">lmtp_mx_session_limit</a>
|
|
(default: 2)</b></DT><DD>
|
|
|
|
<p> The LMTP-specific version of the <a href="postconf.5.html#smtp_mx_session_limit">smtp_mx_session_limit</a> configuration
|
|
parameter. See there for details. </p>
|
|
|
|
<p> This feature is available in Postfix 2.3 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="lmtp_nested_header_checks">lmtp_nested_header_checks</a>
|
|
(default: empty)</b></DT><DD>
|
|
|
|
<p> The LMTP-specific version of the <a href="postconf.5.html#smtp_nested_header_checks">smtp_nested_header_checks</a>
|
|
configuration parameter. See there for details. </p>
|
|
|
|
<p> This feature is available in Postfix 2.5 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="lmtp_per_record_deadline">lmtp_per_record_deadline</a>
|
|
(default: no)</b></DT><DD>
|
|
|
|
<p> The LMTP-specific version of the <a href="postconf.5.html#smtp_per_record_deadline">smtp_per_record_deadline</a>
|
|
configuration parameter. See there for details. </p>
|
|
|
|
<p> This feature is available in Postfix 2.9 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="lmtp_per_request_deadline">lmtp_per_request_deadline</a>
|
|
(default: no)</b></DT><DD>
|
|
|
|
<p> The LMTP-specific version of the <a href="postconf.5.html#smtp_per_request_deadline">smtp_per_request_deadline</a>
|
|
configuration parameter. See there for details. </p>
|
|
|
|
<p> This feature is available in Postfix 3.7 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="lmtp_pix_workaround_delay_time">lmtp_pix_workaround_delay_time</a>
|
|
(default: 10s)</b></DT><DD>
|
|
|
|
<p> The LMTP-specific version of the <a href="postconf.5.html#smtp_pix_workaround_delay_time">smtp_pix_workaround_delay_time</a>
|
|
configuration parameter. See there for details. </p>
|
|
|
|
<p> This feature is available in Postfix 2.3 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="lmtp_pix_workaround_maps">lmtp_pix_workaround_maps</a>
|
|
(default: empty)</b></DT><DD>
|
|
|
|
<p> The LMTP-specific version of the <a href="postconf.5.html#smtp_pix_workaround_maps">smtp_pix_workaround_maps</a>
|
|
configuration parameter. See there for details. </p>
|
|
|
|
<p> This feature is available in Postfix 2.4 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="lmtp_pix_workaround_threshold_time">lmtp_pix_workaround_threshold_time</a>
|
|
(default: 500s)</b></DT><DD>
|
|
|
|
<p> The LMTP-specific version of the <a href="postconf.5.html#smtp_pix_workaround_threshold_time">smtp_pix_workaround_threshold_time</a>
|
|
configuration parameter. See there for details. </p>
|
|
|
|
<p> This feature is available in Postfix 2.3 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="lmtp_pix_workarounds">lmtp_pix_workarounds</a>
|
|
(default: empty)</b></DT><DD>
|
|
|
|
<p> The LMTP-specific version of the smtp_pix_workaround
|
|
configuration parameter. See there for details. </p>
|
|
|
|
<p> This feature is available in Postfix 2.4 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="lmtp_quit_timeout">lmtp_quit_timeout</a>
|
|
(default: 300s)</b></DT><DD>
|
|
|
|
<p>
|
|
The Postfix LMTP client time limit for sending the QUIT command,
|
|
and for receiving the remote LMTP server response.
|
|
</p>
|
|
|
|
<p> Specify a non-zero time value (an integral value plus an optional
|
|
one-letter suffix that specifies the time unit). Time units: s
|
|
(seconds), m (minutes), h (hours), d (days), w (weeks).
|
|
The default time unit is s (seconds). </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="lmtp_quote_rfc821_envelope">lmtp_quote_rfc821_envelope</a>
|
|
(default: yes)</b></DT><DD>
|
|
|
|
<p> The LMTP-specific version of the <a href="postconf.5.html#smtp_quote_rfc821_envelope">smtp_quote_rfc821_envelope</a>
|
|
configuration parameter. See there for details. </p>
|
|
|
|
<p> This feature is available in Postfix 2.3 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="lmtp_randomize_addresses">lmtp_randomize_addresses</a>
|
|
(default: yes)</b></DT><DD>
|
|
|
|
<p> The LMTP-specific version of the <a href="postconf.5.html#smtp_randomize_addresses">smtp_randomize_addresses</a>
|
|
configuration parameter. See there for details. </p>
|
|
|
|
<p> This feature is available in Postfix 2.3 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="lmtp_rcpt_timeout">lmtp_rcpt_timeout</a>
|
|
(default: 300s)</b></DT><DD>
|
|
|
|
<p>
|
|
The Postfix LMTP client time limit for sending the RCPT TO command,
|
|
and for receiving the remote LMTP server response.
|
|
</p>
|
|
|
|
<p> Specify a non-zero time value (an integral value plus an optional
|
|
one-letter suffix that specifies the time unit). Time units: s
|
|
(seconds), m (minutes), h (hours), d (days), w (weeks).
|
|
The default time unit is s (seconds). </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="lmtp_reply_filter">lmtp_reply_filter</a>
|
|
(default: empty)</b></DT><DD>
|
|
|
|
<p> The LMTP-specific version of the <a href="postconf.5.html#smtp_reply_filter">smtp_reply_filter</a>
|
|
configuration parameter. See there for details. </p>
|
|
|
|
<p> This feature is available in Postfix 2.7 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="lmtp_rset_timeout">lmtp_rset_timeout</a>
|
|
(default: 20s)</b></DT><DD>
|
|
|
|
<p> The Postfix LMTP client time limit for sending the RSET command,
|
|
and for receiving the remote LMTP server response. The LMTP client
|
|
sends RSET in
|
|
order to finish a recipient address probe, or to verify that a
|
|
cached connection is still alive. </p>
|
|
|
|
<p> Specify a non-zero time value (an integral value plus an optional
|
|
one-letter suffix that specifies the time unit). Time units: s
|
|
(seconds), m (minutes), h (hours), d (days), w (weeks).
|
|
The default time unit is s (seconds). </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="lmtp_sasl_auth_cache_name">lmtp_sasl_auth_cache_name</a>
|
|
(default: empty)</b></DT><DD>
|
|
|
|
<p> The LMTP-specific version of the <a href="postconf.5.html#smtp_sasl_auth_cache_name">smtp_sasl_auth_cache_name</a>
|
|
configuration parameter. See there for details. </p>
|
|
|
|
<p> This feature is available in Postfix 2.5 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="lmtp_sasl_auth_cache_time">lmtp_sasl_auth_cache_time</a>
|
|
(default: 90d)</b></DT><DD>
|
|
|
|
<p> The LMTP-specific version of the <a href="postconf.5.html#smtp_sasl_auth_cache_time">smtp_sasl_auth_cache_time</a>
|
|
configuration parameter. See there for details. </p>
|
|
|
|
<p> This feature is available in Postfix 2.5 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="lmtp_sasl_auth_enable">lmtp_sasl_auth_enable</a>
|
|
(default: no)</b></DT><DD>
|
|
|
|
<p>
|
|
Enable SASL authentication in the Postfix LMTP client.
|
|
</p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="lmtp_sasl_auth_soft_bounce">lmtp_sasl_auth_soft_bounce</a>
|
|
(default: yes)</b></DT><DD>
|
|
|
|
<p> The LMTP-specific version of the <a href="postconf.5.html#smtp_sasl_auth_soft_bounce">smtp_sasl_auth_soft_bounce</a>
|
|
configuration parameter. See there for details. </p>
|
|
|
|
<p> This feature is available in Postfix 2.5 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="lmtp_sasl_mechanism_filter">lmtp_sasl_mechanism_filter</a>
|
|
(default: empty)</b></DT><DD>
|
|
|
|
<p> The LMTP-specific version of the <a href="postconf.5.html#smtp_sasl_mechanism_filter">smtp_sasl_mechanism_filter</a>
|
|
configuration parameter. See there for details. </p>
|
|
|
|
<p> This feature is available in Postfix 2.3 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="lmtp_sasl_password_maps">lmtp_sasl_password_maps</a>
|
|
(default: empty)</b></DT><DD>
|
|
|
|
<p>
|
|
Optional Postfix LMTP client lookup tables with one username:password entry
|
|
per host or domain. If a remote host or domain has no username:password
|
|
entry, then the Postfix LMTP client will not attempt to authenticate
|
|
to the remote host.
|
|
</p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="lmtp_sasl_password_result_delimiter">lmtp_sasl_password_result_delimiter</a>
|
|
(default: :)</b></DT><DD>
|
|
|
|
<p> The LMTP-specific version of the <a href="postconf.5.html#smtp_sasl_password_result_delimiter">smtp_sasl_password_result_delimiter</a>
|
|
configuration parameter. See there for details. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="lmtp_sasl_path">lmtp_sasl_path</a>
|
|
(default: empty)</b></DT><DD>
|
|
|
|
<p> Implementation-specific information that is passed through to
|
|
the SASL plug-in implementation that is selected with
|
|
<b><a href="postconf.5.html#lmtp_sasl_type">lmtp_sasl_type</a></b>. Typically this specifies the name of a
|
|
configuration file or rendezvous point. </p>
|
|
|
|
<p> This feature is available in Postfix 2.3 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="lmtp_sasl_security_options">lmtp_sasl_security_options</a>
|
|
(default: noplaintext, noanonymous)</b></DT><DD>
|
|
|
|
<p> SASL security options; as of Postfix 2.3 the list of available
|
|
features depends on the SASL client implementation that is selected
|
|
with <b><a href="postconf.5.html#lmtp_sasl_type">lmtp_sasl_type</a></b>. </p>
|
|
|
|
<p> The following security features are defined for the <b>cyrus</b>
|
|
client SASL implementation: </p>
|
|
|
|
<dl>
|
|
|
|
<dt><b>noplaintext</b></dt>
|
|
|
|
<dd>Disallow authentication methods that use plaintext passwords. </dd>
|
|
|
|
<dt><b>noactive</b></dt>
|
|
|
|
<dd>Disallow authentication methods that are vulnerable to non-dictionary
|
|
active attacks. </dd>
|
|
|
|
<dt><b>nodictionary</b></dt>
|
|
|
|
<dd>Disallow authentication methods that are vulnerable to passive
|
|
dictionary attacks. </dd>
|
|
|
|
<dt><b>noanonymous</b></dt>
|
|
|
|
<dd>Disallow anonymous logins. </dd>
|
|
|
|
</dl>
|
|
|
|
<p>
|
|
Example:
|
|
</p>
|
|
|
|
<pre>
|
|
<a href="postconf.5.html#lmtp_sasl_security_options">lmtp_sasl_security_options</a> = noplaintext
|
|
</pre>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="lmtp_sasl_tls_security_options">lmtp_sasl_tls_security_options</a>
|
|
(default: $<a href="postconf.5.html#lmtp_sasl_security_options">lmtp_sasl_security_options</a>)</b></DT><DD>
|
|
|
|
<p> The LMTP-specific version of the <a href="postconf.5.html#smtp_sasl_tls_security_options">smtp_sasl_tls_security_options</a>
|
|
configuration parameter. See there for details. </p>
|
|
|
|
<p> This feature is available in Postfix 2.3 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="lmtp_sasl_tls_verified_security_options">lmtp_sasl_tls_verified_security_options</a>
|
|
(default: $<a href="postconf.5.html#lmtp_sasl_tls_security_options">lmtp_sasl_tls_security_options</a>)</b></DT><DD>
|
|
|
|
<p> The LMTP-specific version of the
|
|
<a href="postconf.5.html#smtp_sasl_tls_verified_security_options">smtp_sasl_tls_verified_security_options</a> configuration parameter.
|
|
See there for details. </p>
|
|
|
|
<p> This feature is available in Postfix 2.3 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="lmtp_sasl_type">lmtp_sasl_type</a>
|
|
(default: cyrus)</b></DT><DD>
|
|
|
|
<p> The SASL plug-in type that the Postfix LMTP client should use
|
|
for authentication. The available types are listed with the
|
|
"<b>postconf -A</b>" command. </p>
|
|
|
|
<p> This feature is available in Postfix 2.3 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="lmtp_send_dummy_mail_auth">lmtp_send_dummy_mail_auth</a>
|
|
(default: no)</b></DT><DD>
|
|
|
|
<p> The LMTP-specific version of the <a href="postconf.5.html#smtp_send_dummy_mail_auth">smtp_send_dummy_mail_auth</a>
|
|
configuration parameter. See there for details. </p>
|
|
|
|
<p> This feature is available in Postfix 2.9 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="lmtp_send_xforward_command">lmtp_send_xforward_command</a>
|
|
(default: no)</b></DT><DD>
|
|
|
|
<p>
|
|
Send an XFORWARD command to the remote LMTP server when the LMTP LHLO
|
|
server response announces XFORWARD support. This allows an <a href="lmtp.8.html">lmtp(8)</a>
|
|
delivery agent, used for content filter message injection, to
|
|
forward the name, address, protocol and HELO name of the original
|
|
client to the content filter and downstream LMTP server.
|
|
Before you change the value to yes, it is best to make sure that
|
|
your content filter supports this command.
|
|
</p>
|
|
|
|
<p>
|
|
This feature is available in Postfix 2.1 and later.
|
|
</p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="lmtp_sender_dependent_authentication">lmtp_sender_dependent_authentication</a>
|
|
(default: no)</b></DT><DD>
|
|
|
|
<p> The LMTP-specific version of the <a href="postconf.5.html#smtp_sender_dependent_authentication">smtp_sender_dependent_authentication</a>
|
|
configuration parameter. See there for details. </p>
|
|
|
|
<p> This feature is available in Postfix 2.3 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="lmtp_skip_5xx_greeting">lmtp_skip_5xx_greeting</a>
|
|
(default: yes)</b></DT><DD>
|
|
|
|
<p> The LMTP-specific version of the <a href="postconf.5.html#smtp_skip_5xx_greeting">smtp_skip_5xx_greeting</a>
|
|
configuration parameter. See there for details. </p>
|
|
|
|
<p> This feature is available in Postfix 2.3 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="lmtp_skip_quit_response">lmtp_skip_quit_response</a>
|
|
(default: no)</b></DT><DD>
|
|
|
|
<p>
|
|
Wait for the response to the LMTP QUIT command.
|
|
</p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="lmtp_starttls_timeout">lmtp_starttls_timeout</a>
|
|
(default: 300s)</b></DT><DD>
|
|
|
|
<p> The LMTP-specific version of the <a href="postconf.5.html#smtp_starttls_timeout">smtp_starttls_timeout</a> configuration
|
|
parameter. See there for details. </p>
|
|
|
|
<p> This feature is available in Postfix 2.3 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="lmtp_tcp_port">lmtp_tcp_port</a>
|
|
(default: 24)</b></DT><DD>
|
|
|
|
<p>
|
|
The default TCP port that the Postfix LMTP client connects to.
|
|
Specify a symbolic name (see services(5)) or a numeric port.
|
|
</p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="lmtp_tls_CAfile">lmtp_tls_CAfile</a>
|
|
(default: empty)</b></DT><DD>
|
|
|
|
<p> The LMTP-specific version of the <a href="postconf.5.html#smtp_tls_CAfile">smtp_tls_CAfile</a>
|
|
configuration parameter. See there for details. </p>
|
|
|
|
<p> This feature is available in Postfix 2.3 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="lmtp_tls_CApath">lmtp_tls_CApath</a>
|
|
(default: empty)</b></DT><DD>
|
|
|
|
<p> The LMTP-specific version of the <a href="postconf.5.html#smtp_tls_CApath">smtp_tls_CApath</a>
|
|
configuration parameter. See there for details. </p>
|
|
|
|
<p> This feature is available in Postfix 2.3 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="lmtp_tls_block_early_mail_reply">lmtp_tls_block_early_mail_reply</a>
|
|
(default: empty)</b></DT><DD>
|
|
|
|
<p> The LMTP-specific version of the <a href="postconf.5.html#smtp_tls_block_early_mail_reply">smtp_tls_block_early_mail_reply</a>
|
|
configuration parameter. See there for details. </p>
|
|
|
|
<p> This feature is available in Postfix 2.7 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="lmtp_tls_cert_file">lmtp_tls_cert_file</a>
|
|
(default: empty)</b></DT><DD>
|
|
|
|
<p> The LMTP-specific version of the <a href="postconf.5.html#smtp_tls_cert_file">smtp_tls_cert_file</a>
|
|
configuration parameter. See there for details. </p>
|
|
|
|
<p> This feature is available in Postfix 2.3 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="lmtp_tls_chain_files">lmtp_tls_chain_files</a>
|
|
(default: empty)</b></DT><DD>
|
|
|
|
<p> The LMTP-specific version of the <a href="postconf.5.html#smtp_tls_chain_files">smtp_tls_chain_files</a> configuration
|
|
parameter. See there for details. </p>
|
|
|
|
<p> This feature is available in Postfix 3.4 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="lmtp_tls_ciphers">lmtp_tls_ciphers</a>
|
|
(default: medium)</b></DT><DD>
|
|
|
|
<p> The LMTP-specific version of the <a href="postconf.5.html#smtp_tls_ciphers">smtp_tls_ciphers</a> configuration
|
|
parameter. See there for details. </p>
|
|
|
|
<p> This feature is available in Postfix 2.6 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="lmtp_tls_connection_reuse">lmtp_tls_connection_reuse</a>
|
|
(default: no)</b></DT><DD>
|
|
|
|
<p> The LMTP-specific version of the <a href="postconf.5.html#smtp_tls_connection_reuse">smtp_tls_connection_reuse</a> configuration
|
|
parameter. See there for details. </p>
|
|
|
|
<p> This feature is available in Postfix 3.4 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="lmtp_tls_dcert_file">lmtp_tls_dcert_file</a>
|
|
(default: empty)</b></DT><DD>
|
|
|
|
<p> The LMTP-specific version of the <a href="postconf.5.html#smtp_tls_dcert_file">smtp_tls_dcert_file</a>
|
|
configuration parameter. See there for details. </p>
|
|
|
|
<p> This feature is available in Postfix 2.3 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="lmtp_tls_dkey_file">lmtp_tls_dkey_file</a>
|
|
(default: $<a href="postconf.5.html#lmtp_tls_dcert_file">lmtp_tls_dcert_file</a>)</b></DT><DD>
|
|
|
|
<p> The LMTP-specific version of the <a href="postconf.5.html#smtp_tls_dkey_file">smtp_tls_dkey_file</a>
|
|
configuration parameter. See there for details. </p>
|
|
|
|
<p> This feature is available in Postfix 2.3 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="lmtp_tls_eccert_file">lmtp_tls_eccert_file</a>
|
|
(default: empty)</b></DT><DD>
|
|
|
|
<p> The LMTP-specific version of the <a href="postconf.5.html#smtp_tls_eccert_file">smtp_tls_eccert_file</a> configuration
|
|
parameter. See there for details. </p>
|
|
|
|
<p> This feature is available in Postfix 2.6 and later, when Postfix is
|
|
compiled and linked with OpenSSL 1.0.0 or later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="lmtp_tls_eckey_file">lmtp_tls_eckey_file</a>
|
|
(default: empty)</b></DT><DD>
|
|
|
|
<p> The LMTP-specific version of the <a href="postconf.5.html#smtp_tls_eckey_file">smtp_tls_eckey_file</a> configuration
|
|
parameter. See there for details. </p>
|
|
|
|
<p> This feature is available in Postfix 2.6 and later, when Postfix is
|
|
compiled and linked with OpenSSL 1.0.0 or later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="lmtp_tls_enable_rpk">lmtp_tls_enable_rpk</a>
|
|
(default: yes)</b></DT><DD>
|
|
|
|
<p> The LMTP-specific version of the <a href="postconf.5.html#smtp_tls_enable_rpk">smtp_tls_enable_rpk</a>
|
|
configuration parameter. See there for details. </p>
|
|
|
|
<p> This feature is available in Postfix 3.9 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="lmtp_tls_enforce_peername">lmtp_tls_enforce_peername</a>
|
|
(default: yes)</b></DT><DD>
|
|
|
|
<p> The LMTP-specific version of the <a href="postconf.5.html#smtp_tls_enforce_peername">smtp_tls_enforce_peername</a>
|
|
configuration parameter. See there for details. </p>
|
|
|
|
<p> This feature is available in Postfix 2.3 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="lmtp_tls_exclude_ciphers">lmtp_tls_exclude_ciphers</a>
|
|
(default: empty)</b></DT><DD>
|
|
|
|
<p> The LMTP-specific version of the <a href="postconf.5.html#smtp_tls_exclude_ciphers">smtp_tls_exclude_ciphers</a>
|
|
configuration parameter. See there for details. </p>
|
|
|
|
<p> This feature is available in Postfix 2.3 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="lmtp_tls_fingerprint_cert_match">lmtp_tls_fingerprint_cert_match</a>
|
|
(default: empty)</b></DT><DD>
|
|
|
|
<p> The LMTP-specific version of the <a href="postconf.5.html#smtp_tls_fingerprint_cert_match">smtp_tls_fingerprint_cert_match</a>
|
|
configuration parameter. See there for details. </p>
|
|
|
|
<p> This feature is available in Postfix 2.5 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="lmtp_tls_fingerprint_digest">lmtp_tls_fingerprint_digest</a>
|
|
(default: see "postconf -d" output)</b></DT><DD>
|
|
|
|
<p> The LMTP-specific version of the <a href="postconf.5.html#smtp_tls_fingerprint_digest">smtp_tls_fingerprint_digest</a>
|
|
configuration parameter. See there for details. </p>
|
|
|
|
<p> This feature is available in Postfix 2.5 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="lmtp_tls_force_insecure_host_tlsa_lookup">lmtp_tls_force_insecure_host_tlsa_lookup</a>
|
|
(default: no)</b></DT><DD>
|
|
|
|
<p> The LMTP-specific version of the <a href="postconf.5.html#smtp_tls_force_insecure_host_tlsa_lookup">smtp_tls_force_insecure_host_tlsa_lookup</a>
|
|
configuration parameter. See there for details. </p>
|
|
|
|
<p> This feature is available in Postfix 2.11 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="lmtp_tls_key_file">lmtp_tls_key_file</a>
|
|
(default: $<a href="postconf.5.html#lmtp_tls_cert_file">lmtp_tls_cert_file</a>)</b></DT><DD>
|
|
|
|
<p> The LMTP-specific version of the <a href="postconf.5.html#smtp_tls_key_file">smtp_tls_key_file</a>
|
|
configuration parameter. See there for details. </p>
|
|
|
|
<p> This feature is available in Postfix 2.3 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="lmtp_tls_loglevel">lmtp_tls_loglevel</a>
|
|
(default: 0)</b></DT><DD>
|
|
|
|
<p> The LMTP-specific version of the <a href="postconf.5.html#smtp_tls_loglevel">smtp_tls_loglevel</a>
|
|
configuration parameter. See there for details. </p>
|
|
|
|
<p> This feature is available in Postfix 2.3 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="lmtp_tls_mandatory_ciphers">lmtp_tls_mandatory_ciphers</a>
|
|
(default: medium)</b></DT><DD>
|
|
|
|
<p> The LMTP-specific version of the <a href="postconf.5.html#smtp_tls_mandatory_ciphers">smtp_tls_mandatory_ciphers</a>
|
|
configuration parameter. See there for details. </p>
|
|
|
|
<p> This feature is available in Postfix 2.3 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="lmtp_tls_mandatory_exclude_ciphers">lmtp_tls_mandatory_exclude_ciphers</a>
|
|
(default: empty)</b></DT><DD>
|
|
|
|
<p> The LMTP-specific version of the <a href="postconf.5.html#smtp_tls_mandatory_exclude_ciphers">smtp_tls_mandatory_exclude_ciphers</a>
|
|
configuration parameter. See there for details. </p>
|
|
|
|
<p> This feature is available in Postfix 2.3 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="lmtp_tls_mandatory_protocols">lmtp_tls_mandatory_protocols</a>
|
|
(default: see 'postconf -d' output)</b></DT><DD>
|
|
|
|
<p> The LMTP-specific version of the <a href="postconf.5.html#smtp_tls_mandatory_protocols">smtp_tls_mandatory_protocols</a>
|
|
configuration parameter. See there for details. </p>
|
|
|
|
<p> This feature is available in Postfix 2.3 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="lmtp_tls_note_starttls_offer">lmtp_tls_note_starttls_offer</a>
|
|
(default: no)</b></DT><DD>
|
|
|
|
<p> The LMTP-specific version of the <a href="postconf.5.html#smtp_tls_note_starttls_offer">smtp_tls_note_starttls_offer</a>
|
|
configuration parameter. See there for details. </p>
|
|
|
|
<p> This feature is available in Postfix 2.3 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="lmtp_tls_per_site">lmtp_tls_per_site</a>
|
|
(default: empty)</b></DT><DD>
|
|
|
|
<p> The LMTP-specific version of the <a href="postconf.5.html#smtp_tls_per_site">smtp_tls_per_site</a> configuration
|
|
parameter. See there for details. </p>
|
|
|
|
<p> This feature is deprecated as of Postfix 3.9. Specify
|
|
<a href="postconf.5.html#lmtp_tls_policy_maps">lmtp_tls_policy_maps</a> instead. </p>
|
|
|
|
<p> This feature is available in Postfix 2.3 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="lmtp_tls_policy_maps">lmtp_tls_policy_maps</a>
|
|
(default: empty)</b></DT><DD>
|
|
|
|
<p> The LMTP-specific version of the <a href="postconf.5.html#smtp_tls_policy_maps">smtp_tls_policy_maps</a>
|
|
configuration parameter. See there for details. </p>
|
|
|
|
<p> This feature is available in Postfix 2.3 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="lmtp_tls_protocols">lmtp_tls_protocols</a>
|
|
(default: see 'postconf -d' output)</b></DT><DD>
|
|
|
|
<p> The LMTP-specific version of the <a href="postconf.5.html#smtp_tls_protocols">smtp_tls_protocols</a> configuration
|
|
parameter. See there for details. </p>
|
|
|
|
<p> This feature is available in Postfix 2.6 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="lmtp_tls_scert_verifydepth">lmtp_tls_scert_verifydepth</a>
|
|
(default: 9)</b></DT><DD>
|
|
|
|
<p> The LMTP-specific version of the <a href="postconf.5.html#smtp_tls_scert_verifydepth">smtp_tls_scert_verifydepth</a>
|
|
configuration parameter. See there for details. </p>
|
|
|
|
<p> This feature is available in Postfix 2.3 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="lmtp_tls_secure_cert_match">lmtp_tls_secure_cert_match</a>
|
|
(default: nexthop)</b></DT><DD>
|
|
|
|
<p> The LMTP-specific version of the <a href="postconf.5.html#smtp_tls_secure_cert_match">smtp_tls_secure_cert_match</a>
|
|
configuration parameter. See there for details. </p>
|
|
|
|
<p> This feature is available in Postfix 2.3 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="lmtp_tls_security_level">lmtp_tls_security_level</a>
|
|
(default: empty)</b></DT><DD>
|
|
|
|
<p> The LMTP-specific version of the <a href="postconf.5.html#smtp_tls_security_level">smtp_tls_security_level</a> configuration
|
|
parameter. See there for details. </p>
|
|
|
|
<p> This feature is available in Postfix 2.3 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="lmtp_tls_servername">lmtp_tls_servername</a>
|
|
(default: empty)</b></DT><DD>
|
|
|
|
<p> The LMTP-specific version of the <a href="postconf.5.html#smtp_tls_servername">smtp_tls_servername</a> configuration
|
|
parameter. See there for details. </p>
|
|
|
|
<p> This feature is available in Postfix 3.4 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="lmtp_tls_session_cache_database">lmtp_tls_session_cache_database</a>
|
|
(default: empty)</b></DT><DD>
|
|
|
|
<p> The LMTP-specific version of the <a href="postconf.5.html#smtp_tls_session_cache_database">smtp_tls_session_cache_database</a>
|
|
configuration parameter. See there for details. </p>
|
|
|
|
<p> This feature is available in Postfix 2.3 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="lmtp_tls_session_cache_timeout">lmtp_tls_session_cache_timeout</a>
|
|
(default: 3600s)</b></DT><DD>
|
|
|
|
<p> The LMTP-specific version of the <a href="postconf.5.html#smtp_tls_session_cache_timeout">smtp_tls_session_cache_timeout</a>
|
|
configuration parameter. See there for details. </p>
|
|
|
|
<p> This feature is available in Postfix 2.3 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="lmtp_tls_trust_anchor_file">lmtp_tls_trust_anchor_file</a>
|
|
(default: empty)</b></DT><DD>
|
|
|
|
<p> The LMTP-specific version of the <a href="postconf.5.html#smtp_tls_trust_anchor_file">smtp_tls_trust_anchor_file</a>
|
|
configuration parameter. See there for details. </p>
|
|
|
|
<p> This feature is available in Postfix 2.11 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="lmtp_tls_verify_cert_match">lmtp_tls_verify_cert_match</a>
|
|
(default: hostname)</b></DT><DD>
|
|
|
|
<p> The LMTP-specific version of the <a href="postconf.5.html#smtp_tls_verify_cert_match">smtp_tls_verify_cert_match</a>
|
|
configuration parameter. See there for details. </p>
|
|
|
|
<p> This feature is available in Postfix 2.3 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="lmtp_tls_wrappermode">lmtp_tls_wrappermode</a>
|
|
(default: no)</b></DT><DD>
|
|
|
|
<p> The LMTP-specific version of the <a href="postconf.5.html#smtp_tls_wrappermode">smtp_tls_wrappermode</a> configuration
|
|
parameter. See there for details. </p>
|
|
|
|
<p> This feature is available in Postfix 3.0 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="lmtp_use_tls">lmtp_use_tls</a>
|
|
(default: no)</b></DT><DD>
|
|
|
|
<p> The LMTP-specific version of the <a href="postconf.5.html#smtp_use_tls">smtp_use_tls</a> configuration
|
|
parameter. See there for details. </p>
|
|
|
|
<p> This feature is deprecated as of Postfix 3.9. Specify
|
|
<a href="postconf.5.html#lmtp_tls_security_level">lmtp_tls_security_level</a> instead. </p>
|
|
|
|
<p> This feature is available in Postfix 2.3 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="lmtp_xforward_timeout">lmtp_xforward_timeout</a>
|
|
(default: 300s)</b></DT><DD>
|
|
|
|
<p>
|
|
The Postfix LMTP client time limit for sending the XFORWARD command,
|
|
and for receiving the remote LMTP server response.
|
|
</p>
|
|
|
|
<p>
|
|
In case of problems the client does NOT try the next address on
|
|
the mail exchanger list.
|
|
</p>
|
|
|
|
<p> Specify a non-zero time value (an integral value plus an optional
|
|
one-letter suffix that specifies the time unit). Time units: s
|
|
(seconds), m (minutes), h (hours), d (days), w (weeks).
|
|
The default time unit is s (seconds). </p>
|
|
|
|
<p>
|
|
This feature is available in Postfix 2.1 and later.
|
|
</p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="local_command_shell">local_command_shell</a>
|
|
(default: empty)</b></DT><DD>
|
|
|
|
<p>
|
|
Optional shell program for <a href="local.8.html">local(8)</a> delivery to non-Postfix commands.
|
|
By default, non-Postfix commands are executed directly; commands
|
|
are given to the default shell (typically, /bin/sh) only when they
|
|
contain shell meta characters or shell built-in commands.
|
|
</p>
|
|
|
|
<p> "sendmail's restricted shell" (smrsh) is what most people will
|
|
use in order to restrict what programs can be run from e.g. .forward
|
|
files (smrsh is part of the Sendmail distribution). </p>
|
|
|
|
<p> Note: when a shell program is specified, it is invoked even
|
|
when the command contains no shell built-in commands or meta
|
|
characters. </p>
|
|
|
|
<p>
|
|
Example:
|
|
</p>
|
|
|
|
<pre>
|
|
<a href="postconf.5.html#local_command_shell">local_command_shell</a> = /some/where/smrsh -c
|
|
<a href="postconf.5.html#local_command_shell">local_command_shell</a> = /bin/bash -c
|
|
</pre>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="local_delivery_status_filter">local_delivery_status_filter</a>
|
|
(default: $<a href="postconf.5.html#default_delivery_status_filter">default_delivery_status_filter</a>)</b></DT><DD>
|
|
|
|
<p> Optional filter for the <a href="local.8.html">local(8)</a> delivery agent to change the
|
|
status code or explanatory text of successful or unsuccessful
|
|
deliveries. See <a href="postconf.5.html#default_delivery_status_filter">default_delivery_status_filter</a> for details. </p>
|
|
|
|
<p> This feature is available in Postfix 3.0 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="local_destination_concurrency_limit">local_destination_concurrency_limit</a>
|
|
(default: 2)</b></DT><DD>
|
|
|
|
<p> The maximal number of parallel deliveries via the local mail
|
|
delivery transport to the same recipient (when
|
|
"<a href="postconf.5.html#local_destination_recipient_limit">local_destination_recipient_limit</a> = 1") or the maximal number of
|
|
parallel deliveries to the same <a href="ADDRESS_CLASS_README.html#local_domain_class">local domain</a> (when
|
|
"<a href="postconf.5.html#local_destination_recipient_limit">local_destination_recipient_limit</a> > 1"). This limit is enforced by
|
|
the queue manager. The message delivery transport name is the first
|
|
field in the entry in the <a href="master.5.html">master.cf</a> file. </p>
|
|
|
|
<p> A low limit of 2 is recommended, just in case someone has an
|
|
expensive shell command in a .forward file or in an alias (e.g.,
|
|
a mailing list manager). You don't want to run lots of those at
|
|
the same time. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="local_destination_recipient_limit">local_destination_recipient_limit</a>
|
|
(default: 1)</b></DT><DD>
|
|
|
|
<p> The maximal number of recipients per message delivery via the
|
|
local mail delivery transport. This limit is enforced by the queue
|
|
manager. The message delivery transport name is the first field in
|
|
the entry in the <a href="master.5.html">master.cf</a> file. </p>
|
|
|
|
<p> Setting this parameter to a value > 1 changes the meaning of
|
|
<a href="postconf.5.html#local_destination_concurrency_limit">local_destination_concurrency_limit</a> from concurrency per recipient
|
|
into concurrency per domain. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="local_header_rewrite_clients">local_header_rewrite_clients</a>
|
|
(default: <a href="postconf.5.html#permit_inet_interfaces">permit_inet_interfaces</a>)</b></DT><DD>
|
|
|
|
<p> Rewrite or add message headers in mail from these clients,
|
|
updating incomplete addresses with the domain name in $<a href="postconf.5.html#myorigin">myorigin</a> or
|
|
$<a href="postconf.5.html#mydomain">mydomain</a>, and adding missing headers. </p>
|
|
|
|
<p> See the <a href="postconf.5.html#append_at_myorigin">append_at_myorigin</a> and <a href="postconf.5.html#append_dot_mydomain">append_dot_mydomain</a> parameters
|
|
for details of how domain names are appended to incomplete addresses.
|
|
</p>
|
|
|
|
<p> See <a href="postconf.5.html#remote_header_rewrite_domain">remote_header_rewrite_domain</a> to optionally rewrite or add
|
|
message headers in mail from other clients. </p>
|
|
|
|
<p> Specify a list of zero or more of the following: </p>
|
|
|
|
<dl>
|
|
|
|
<dt><b><a href="postconf.5.html#permit_inet_interfaces">permit_inet_interfaces</a></b></dt>
|
|
|
|
<dd> Append the domain name in $<a href="postconf.5.html#myorigin">myorigin</a> or $<a href="postconf.5.html#mydomain">mydomain</a> when the
|
|
client IP address matches $<a href="postconf.5.html#inet_interfaces">inet_interfaces</a>. This is enabled by
|
|
default. </dd>
|
|
|
|
<dt><b><a href="postconf.5.html#permit_mynetworks">permit_mynetworks</a></b></dt>
|
|
|
|
<dd> Append the domain name in $<a href="postconf.5.html#myorigin">myorigin</a> or $<a href="postconf.5.html#mydomain">mydomain</a> when the
|
|
client IP address matches any network or network address listed in
|
|
$<a href="postconf.5.html#mynetworks">mynetworks</a>. This setting will not prevent remote mail header
|
|
address rewriting when mail from a remote client is forwarded by
|
|
a neighboring system. </dd>
|
|
|
|
<dt><b><a href="postconf.5.html#permit_sasl_authenticated">permit_sasl_authenticated</a> </b></dt>
|
|
|
|
<dd> Append the domain name in $<a href="postconf.5.html#myorigin">myorigin</a> or $<a href="postconf.5.html#mydomain">mydomain</a> when the
|
|
client is successfully authenticated via the <a href="https://tools.ietf.org/html/rfc4954">RFC 4954</a> (AUTH)
|
|
protocol. </dd>
|
|
|
|
<dt><b><a href="postconf.5.html#permit_tls_clientcerts">permit_tls_clientcerts</a> </b></dt>
|
|
|
|
<dd> Append the domain name in $<a href="postconf.5.html#myorigin">myorigin</a> or $<a href="postconf.5.html#mydomain">mydomain</a> when the
|
|
remote SMTP client TLS certificate fingerprint or public key fingerprint
|
|
(Postfix 2.9 and later) is listed in $<a href="postconf.5.html#relay_clientcerts">relay_clientcerts</a>.
|
|
The fingerprint digest algorithm is configurable via the
|
|
<a href="postconf.5.html#smtpd_tls_fingerprint_digest">smtpd_tls_fingerprint_digest</a> parameter (hard-coded as md5 prior to
|
|
Postfix version 2.5). </dd>
|
|
|
|
<dd> The default algorithm is <b>sha256</b> with Postfix ≥ 3.6
|
|
and the <b><a href="postconf.5.html#compatibility_level">compatibility_level</a></b> set to 3.6 or higher. With Postfix
|
|
≤ 3.5, the default algorithm is <b>md5</b>. The best-practice
|
|
algorithm is now <b>sha256</b>. Recent advances in hash function
|
|
cryptanalysis have led to md5 and sha1 being deprecated in favor of
|
|
sha256. However, as long as there are no known "second pre-image"
|
|
attacks against the older algorithms, their use in this context, though
|
|
not recommended, is still likely safe. </dd>
|
|
|
|
<dt><b><a href="postconf.5.html#permit_tls_all_clientcerts">permit_tls_all_clientcerts</a> </b></dt>
|
|
|
|
<dd> Append the domain name in $<a href="postconf.5.html#myorigin">myorigin</a> or $<a href="postconf.5.html#mydomain">mydomain</a> when the
|
|
remote SMTP client TLS certificate is successfully verified, regardless of
|
|
whether it is listed on the server, and regardless of the certifying
|
|
authority. </dd>
|
|
|
|
<dt><b><a name="check_address_map">check_address_map</a> <i><a href="DATABASE_README.html">type:table</a></i> </b></dt>
|
|
|
|
<dt><b><i><a href="DATABASE_README.html">type:table</a></i> </b></dt>
|
|
|
|
<dd> Append the domain name in $<a href="postconf.5.html#myorigin">myorigin</a> or $<a href="postconf.5.html#mydomain">mydomain</a> when the
|
|
client IP address matches the specified lookup table.
|
|
The lookup result is ignored, and no subnet lookup is done. This
|
|
is suitable for, e.g., pop-before-smtp lookup tables. </dd>
|
|
|
|
</dl>
|
|
|
|
<p> Examples: </p>
|
|
|
|
<p> The Postfix < 2.2 backwards compatible setting: always rewrite
|
|
message headers, and always append my own domain to incomplete
|
|
header addresses. </p>
|
|
|
|
<blockquote>
|
|
<pre>
|
|
<a href="postconf.5.html#local_header_rewrite_clients">local_header_rewrite_clients</a> = <a href="DATABASE_README.html#types">static</a>:all
|
|
</pre>
|
|
</blockquote>
|
|
|
|
<p> The purist (and default) setting: rewrite headers only in mail
|
|
from Postfix sendmail and in SMTP mail from this machine. </p>
|
|
|
|
<blockquote>
|
|
<pre>
|
|
<a href="postconf.5.html#local_header_rewrite_clients">local_header_rewrite_clients</a> = <a href="postconf.5.html#permit_inet_interfaces">permit_inet_interfaces</a>
|
|
</pre>
|
|
</blockquote>
|
|
|
|
<p> The intermediate setting: rewrite header addresses and append
|
|
$<a href="postconf.5.html#myorigin">myorigin</a> or $<a href="postconf.5.html#mydomain">mydomain</a> information only with mail from Postfix
|
|
sendmail, from local clients, or from authorized SMTP clients. </p>
|
|
|
|
<p> Note: this setting will not prevent remote mail header address
|
|
rewriting when mail from a remote client is forwarded by a neighboring
|
|
system. </p>
|
|
|
|
<blockquote>
|
|
<pre>
|
|
<a href="postconf.5.html#local_header_rewrite_clients">local_header_rewrite_clients</a> = <a href="postconf.5.html#permit_mynetworks">permit_mynetworks</a>,
|
|
<a href="postconf.5.html#permit_sasl_authenticated">permit_sasl_authenticated</a> <a href="postconf.5.html#permit_tls_clientcerts">permit_tls_clientcerts</a>
|
|
<a href="postconf.5.html#check_address_map">check_address_map</a> <a href="DATABASE_README.html#types">hash</a>:/etc/postfix/pop-before-smtp
|
|
</pre>
|
|
</blockquote>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="local_login_sender_maps">local_login_sender_maps</a>
|
|
(default: <a href="DATABASE_README.html#types">static</a>:*)</b></DT><DD>
|
|
|
|
<p> A list of lookup tables that are searched by the UNIX login name,
|
|
and that return a list of allowed envelope sender patterns separated
|
|
by space or comma. These sender patterns are enforced by the Postfix
|
|
<a href="postdrop.1.html">postdrop(1)</a> command. The default is backwards-compatible:
|
|
every user may specify any sender envelope address. </p>
|
|
|
|
<p> When no UNIX login name is available, the <a href="postdrop.1.html">postdrop(1)</a> command will
|
|
prepend "<b>uid:</b>" to the numerical UID and use that instead. </p>
|
|
|
|
<p> This feature ignores address extensions in the user-specified
|
|
envelope sender address. </p>
|
|
|
|
<p> Note: to enforce that the From: header address matches the envelope
|
|
sender (MAIL FROM) address, specify an external filter such as a Milter,
|
|
with the <a href="postconf.5.html#non_smtpd_milters">non_smtpd_milters</a> parameter. For example:
|
|
<a href="https://github.com/magcks/milterfrom">https://github.com/magcks/milterfrom</a>. </p>
|
|
|
|
<p> The following sender patterns are special; these cannot be used
|
|
as part of a longer pattern. </p>
|
|
|
|
<dl compact>
|
|
|
|
<dt> <b> * </b> <dd> This pattern allows any envelope sender address.
|
|
</dd>
|
|
|
|
<dt> <b> <> </b> </dt> <dd> This pattern allows the empty
|
|
envelope sender address. See the
|
|
<a href="postconf.5.html#empty_address_local_login_sender_maps_lookup_key">empty_address_local_login_sender_maps_lookup_key</a> configuration
|
|
parameter. </dd>
|
|
|
|
<dt> <b> @</b><i>domain</i> </dt> <dd> This pattern allows an
|
|
envelope sender address when the '<b>@</b>' and <i>domain</i> part
|
|
match. </dd>
|
|
|
|
</dl>
|
|
|
|
<p> Examples: </p>
|
|
|
|
<pre>
|
|
/etc/postfix/<a href="postconf.5.html">main.cf</a>:
|
|
# Allow root and postfix full control, anyone else can only
|
|
# send mail as themselves. Use "uid:" followed by the numerical
|
|
# UID when the UID has no entry in the UNIX password file.
|
|
<a href="postconf.5.html#local_login_sender_maps">local_login_sender_maps</a> =
|
|
<a href="DATABASE_README.html#types">inline</a>:{ { root = * }, { postfix = * } },
|
|
<a href="pcre_table.5.html">pcre</a>:/etc/postfix/login_senders
|
|
</pre>
|
|
|
|
<pre>
|
|
/etc/postfix/login_senders:
|
|
# Allow both the bare username and the user@domain forms.
|
|
/(.+)/ $1 $1@example.com
|
|
</pre>
|
|
|
|
<p> This feature is available in Postfix 3.6 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="local_recipient_maps">local_recipient_maps</a>
|
|
(default: <a href="proxymap.8.html">proxy</a>:unix:passwd.byname $<a href="postconf.5.html#alias_maps">alias_maps</a>)</b></DT><DD>
|
|
|
|
<p> Lookup tables with all names or addresses of valid local
|
|
recipients. A recipient address is local when its domain matches
|
|
$<a href="postconf.5.html#mydestination">mydestination</a>, $<a href="postconf.5.html#inet_interfaces">inet_interfaces</a> or $<a href="postconf.5.html#proxy_interfaces">proxy_interfaces</a>. </p>
|
|
|
|
<p> If the <a href="postconf.5.html#local_recipient_maps">local_recipient_maps</a> parameter value is non-empty (the
|
|
default), then the Postfix SMTP server queries <a href="postconf.5.html#local_recipient_maps">local_recipient_maps</a>
|
|
as specified in "<a href="LOCAL_RECIPIENT_README.html#format">Local
|
|
recipient table query format</a>", and rejects mail for unknown
|
|
local recipients. Other Postfix interfaces such as the Postfix
|
|
<a href="sendmail.1.html">sendmail(1)</a> command may still accept an "unknown" recipient. </p>
|
|
|
|
<p> The default <a href="postconf.5.html#local_recipient_maps">local_recipient_maps</a> setting assumes that <a href="postconf.5.html#local_transport">local_transport</a>
|
|
specifies the UNIX-compatible <a href="local.8.html">local(8)</a> delivery agent which queries
|
|
the UNIX passwd database (typically, /etc.passwd) and the local
|
|
aliases database (typically, /etc/aliases). The <a href="proxymap.8.html">proxy</a>: agent allows
|
|
the Postfix SMTP server to access the UNIX passwd database from
|
|
outside a chroot jail. </p>
|
|
|
|
<p> For other local mail delivery configurations, see "<a href="LOCAL_RECIPIENT_README.html#change">When you need to
|
|
change the local_recipient_maps setting in main.cf</a>". </p>
|
|
|
|
<p>
|
|
Technically, tables listed with $<a href="postconf.5.html#local_recipient_maps">local_recipient_maps</a> are used as
|
|
lists: The Postfix SMTP server needs to know only if a lookup string
|
|
is found or not, but it does not use the result from table lookup. </p>
|
|
|
|
<p>
|
|
Specify zero or more "type:name" lookup tables, separated by
|
|
whitespace or comma. Tables will be searched in the specified order
|
|
until a match is found.
|
|
</p>
|
|
|
|
<p>
|
|
To turn off local recipient checking in the Postfix SMTP server,
|
|
specify "<a href="postconf.5.html#local_recipient_maps">local_recipient_maps</a> =" (i.e. empty).
|
|
</p>
|
|
|
|
<p>
|
|
Examples:
|
|
</p>
|
|
|
|
<pre>
|
|
<a href="postconf.5.html#local_recipient_maps">local_recipient_maps</a> =
|
|
</pre>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="local_transport">local_transport</a>
|
|
(default: <a href="local.8.html">local</a>:$<a href="postconf.5.html#myhostname">myhostname</a>)</b></DT><DD>
|
|
|
|
<p> The default mail delivery transport and next-hop destination
|
|
for final delivery to domains listed with <a href="postconf.5.html#mydestination">mydestination</a>, and for
|
|
[ipaddress] destinations that match $<a href="postconf.5.html#inet_interfaces">inet_interfaces</a> or $<a href="postconf.5.html#proxy_interfaces">proxy_interfaces</a>.
|
|
This information can be overruled with the <a href="transport.5.html">transport(5)</a> table. </p>
|
|
|
|
<p>
|
|
By default, local mail is delivered to the transport called "local",
|
|
which is just the name of a service that is defined the <a href="master.5.html">master.cf</a> file.
|
|
</p>
|
|
|
|
<p>
|
|
Specify a string of the form <i>transport:nexthop</i>, where <i>transport</i>
|
|
is the name of a mail delivery transport defined in <a href="master.5.html">master.cf</a>.
|
|
The <i>:nexthop</i> destination is optional; its syntax is documented
|
|
in the manual page of the corresponding delivery agent.
|
|
</p>
|
|
|
|
<p>
|
|
Beware: if you override the default local delivery agent then you
|
|
need to review the <a href="LOCAL_RECIPIENT_README.html">LOCAL_RECIPIENT_README</a> document, otherwise the
|
|
SMTP server may reject mail for local recipients.
|
|
</p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="luser_relay">luser_relay</a>
|
|
(default: empty)</b></DT><DD>
|
|
|
|
<p>
|
|
Optional catch-all destination for unknown <a href="local.8.html">local(8)</a> recipients.
|
|
By default, mail for unknown recipients in domains that match
|
|
$<a href="postconf.5.html#mydestination">mydestination</a>, $<a href="postconf.5.html#inet_interfaces">inet_interfaces</a> or $<a href="postconf.5.html#proxy_interfaces">proxy_interfaces</a> is returned
|
|
as undeliverable.
|
|
</p>
|
|
|
|
<p>
|
|
The <a href="postconf.5.html#luser_relay">luser_relay</a> value is not subject to Postfix configuration
|
|
parameter $name expansion. Instead, the following $name expansions
|
|
are done:
|
|
</p>
|
|
|
|
<dl>
|
|
|
|
<dt><b>$domain</b></dt>
|
|
|
|
<dd>The recipient domain. </dd>
|
|
|
|
<dt><b>$extension</b></dt>
|
|
|
|
<dd>The recipient address extension. </dd>
|
|
|
|
<dt><b>$home</b></dt>
|
|
|
|
<dd>The recipient's home directory. </dd>
|
|
|
|
<dt><b>$local</b></dt>
|
|
|
|
<dd>The entire recipient address localpart. </dd>
|
|
|
|
<dt><b>$recipient</b></dt>
|
|
|
|
<dd>The full recipient address. </dd>
|
|
|
|
<dt><b>$<a href="postconf.5.html#recipient_delimiter">recipient_delimiter</a></b></dt>
|
|
|
|
<dd>The address extension delimiter that was found in the recipient
|
|
address (Postfix 2.11 and later), or the system-wide recipient
|
|
address extension delimiter (Postfix 2.10 and earlier). </dd>
|
|
|
|
<dt><b>$shell</b></dt>
|
|
|
|
<dd>The recipient's login shell. </dd>
|
|
|
|
<dt><b>$user</b></dt>
|
|
|
|
<dd>The recipient username. </dd>
|
|
|
|
<dt><b>${name?value}</b></dt>
|
|
|
|
<dt><b>${name?{value}}</b> (Postfix ≥ 3.0)</dt>
|
|
|
|
<dd>Expands to <i>value</i> when <i>$name</i> is non-empty. </dd>
|
|
|
|
<dt><b>${name:value}</b></dt>
|
|
|
|
<dt><b>${name:{value}}</b> (Postfix ≥ 3.0)</dt>
|
|
|
|
<dd>Expands to <i>value</i> when <i>$name</i> is empty. </dd>
|
|
|
|
<dt><b>${name?{value1}:{value2}}</b> (Postfix ≥ 3.0)</dt>
|
|
|
|
<dd>Expands to <i>value1</i> when <i>$name</i> is non-empty,
|
|
<i>value2</i> otherwise. </dd>
|
|
|
|
</dl>
|
|
|
|
<p>
|
|
Instead of $name you can also specify ${name} or $(name).
|
|
</p>
|
|
|
|
<p>
|
|
Note: <a href="postconf.5.html#luser_relay">luser_relay</a> works only for the Postfix <a href="local.8.html">local(8)</a> delivery agent.
|
|
</p>
|
|
|
|
<p>
|
|
Note: if you use this feature for accounts not in the UNIX password
|
|
file, then you must specify "<a href="postconf.5.html#local_recipient_maps">local_recipient_maps</a> =" (i.e. empty)
|
|
in the <a href="postconf.5.html">main.cf</a> file, otherwise the Postfix SMTP server will reject mail
|
|
for non-UNIX accounts with "User unknown in local recipient table".
|
|
</p>
|
|
|
|
<p>
|
|
Examples:
|
|
</p>
|
|
|
|
<pre>
|
|
<a href="postconf.5.html#luser_relay">luser_relay</a> = $user@other.host
|
|
<a href="postconf.5.html#luser_relay">luser_relay</a> = $local@other.host
|
|
<a href="postconf.5.html#luser_relay">luser_relay</a> = admin+$local
|
|
</pre>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="mail_name">mail_name</a>
|
|
(default: Postfix)</b></DT><DD>
|
|
|
|
<p>
|
|
The mail system name that is displayed in Received: headers, in
|
|
the SMTP greeting banner, and in bounced mail.
|
|
</p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="mail_owner">mail_owner</a>
|
|
(default: postfix)</b></DT><DD>
|
|
|
|
<p>
|
|
The UNIX system account that owns the Postfix queue and most Postfix
|
|
daemon processes. Specify the name of an unprivileged user account
|
|
that does not share a user or group ID with other accounts, and that
|
|
owns no other files
|
|
or processes on the system. In particular, don't specify nobody
|
|
or daemon. PLEASE USE A DEDICATED USER ID AND GROUP ID.
|
|
</p>
|
|
|
|
<p>
|
|
When this parameter value is changed you need to re-run "<b>postfix
|
|
set-permissions</b>" (with Postfix version 2.0 and earlier:
|
|
"<b>/etc/postfix/post-install set-permissions</b>".
|
|
</p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="mail_release_date">mail_release_date</a>
|
|
(default: see "postconf -d" output)</b></DT><DD>
|
|
|
|
<p>
|
|
The Postfix release date, in "YYYYMMDD" format.
|
|
</p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="mail_spool_directory">mail_spool_directory</a>
|
|
(default: see "postconf -d" output)</b></DT><DD>
|
|
|
|
<p>
|
|
The directory where <a href="local.8.html">local(8)</a> UNIX-style mailboxes are kept. The
|
|
default setting depends on the system type. Specify a name ending
|
|
in / for maildir-style delivery.
|
|
</p>
|
|
|
|
<p>
|
|
Note: maildir delivery is done with the privileges of the recipient.
|
|
If you use the <a href="postconf.5.html#mail_spool_directory">mail_spool_directory</a> setting for maildir style
|
|
delivery, then you must create the top-level maildir directory in
|
|
advance. Postfix will not create it.
|
|
</p>
|
|
|
|
<p>
|
|
Examples:
|
|
</p>
|
|
|
|
<pre>
|
|
<a href="postconf.5.html#mail_spool_directory">mail_spool_directory</a> = /var/mail
|
|
<a href="postconf.5.html#mail_spool_directory">mail_spool_directory</a> = /var/spool/mail
|
|
</pre>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="mail_version">mail_version</a>
|
|
(default: see "postconf -d" output)</b></DT><DD>
|
|
|
|
<p>
|
|
The version of the mail system. Stable releases are named
|
|
<i>major</i>.<i>minor</i>.<i>patchlevel</i>. Experimental releases
|
|
also include the release date. The version string can be used in,
|
|
for example, the SMTP greeting banner.
|
|
</p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="mailbox_command">mailbox_command</a>
|
|
(default: empty)</b></DT><DD>
|
|
|
|
<p>
|
|
Optional external command that the <a href="local.8.html">local(8)</a> delivery agent should
|
|
use for mailbox delivery. The command is run with the user ID and
|
|
the primary group ID privileges of the recipient. Exception:
|
|
command delivery for root executes with $<a href="postconf.5.html#default_privs">default_privs</a> privileges.
|
|
This is not a problem, because 1) mail for root should always be
|
|
aliased to a real user and 2) don't log in as root, use "su" instead.
|
|
</p>
|
|
|
|
<p>
|
|
The following environment variables are exported to the command:
|
|
</p>
|
|
|
|
<dl>
|
|
|
|
<dt><b>CLIENT_ADDRESS</b></dt>
|
|
|
|
<dd>Remote client network address. Available in Postfix version 2.2 and
|
|
later. </dd>
|
|
|
|
<dt><b>CLIENT_HELO</b></dt>
|
|
|
|
<dd>Remote client EHLO command parameter. Available in Postfix version 2.2
|
|
and later.</dd>
|
|
|
|
<dt><b>CLIENT_HOSTNAME</b></dt>
|
|
|
|
<dd>Remote client hostname. Available in Postfix version 2.2 and later.
|
|
</dd>
|
|
|
|
<dt><b>CLIENT_PROTOCOL</b></dt>
|
|
|
|
<dd>Remote client protocol. Available in Postfix version 2.2 and later.
|
|
</dd>
|
|
|
|
<dt><b>DOMAIN</b></dt>
|
|
|
|
<dd>The domain part of the recipient address. </dd>
|
|
|
|
<dt><b>ENVID</b></dt>
|
|
|
|
<dd>The optional <a href="https://tools.ietf.org/html/rfc3461">RFC 3461</a> envelope ID. Available in Postfix version
|
|
3.9 and later</dd>
|
|
|
|
<dt><b>EXTENSION</b></dt>
|
|
|
|
<dd>The optional address extension. </dd>
|
|
|
|
<dt><b>HOME</b></dt>
|
|
|
|
<dd>The recipient home directory. </dd>
|
|
|
|
<dt><b>LOCAL</b></dt>
|
|
|
|
<dd>The recipient address localpart. </dd>
|
|
|
|
<dt><b>LOGNAME</b></dt>
|
|
|
|
<dd>The recipient's username. </dd>
|
|
|
|
<dt><b>ORIGINAL_RECIPIENT</b></dt>
|
|
|
|
<dd>The entire recipient address, before any address rewriting or
|
|
aliasing. </dd>
|
|
|
|
<dt><b>RECIPIENT</b></dt>
|
|
|
|
<dd>The full recipient address. </dd>
|
|
|
|
<dt><b>SASL_METHOD</b></dt>
|
|
|
|
<dd>SASL authentication method specified in the remote client AUTH
|
|
command. Available in Postfix version 2.2 and later. </dd>
|
|
|
|
<dt><b>SASL_SENDER</b></dt>
|
|
|
|
<dd>SASL sender address specified in the remote client MAIL FROM
|
|
command. Available in Postfix version 2.2 and later. </dd>
|
|
|
|
<dt><b>SASL_USER</b></dt>
|
|
|
|
<dd>SASL username specified in the remote client AUTH command.
|
|
Available in Postfix version 2.2 and later. </dd>
|
|
|
|
<dt><b>SENDER</b></dt>
|
|
|
|
<dd>The full sender address. </dd>
|
|
|
|
<dt><b>SHELL</b></dt>
|
|
|
|
<dd>The recipient's login shell. </dd>
|
|
|
|
<dt><b>USER</b></dt>
|
|
|
|
<dd>The recipient username. </dd>
|
|
|
|
</dl>
|
|
|
|
<p>
|
|
Unlike other Postfix configuration parameters, the <a href="postconf.5.html#mailbox_command">mailbox_command</a>
|
|
parameter is not subjected to $name substitutions. This is to make
|
|
it easier to specify shell syntax (see example below).
|
|
</p>
|
|
|
|
<p>
|
|
If you can, avoid shell meta characters because they will force
|
|
Postfix to run an expensive shell process. If you're delivering
|
|
via "procmail" then running a shell won't make a noticeable difference
|
|
in the total cost.
|
|
</p>
|
|
|
|
<p>
|
|
Note: if you use the <a href="postconf.5.html#mailbox_command">mailbox_command</a> feature to deliver mail
|
|
system-wide, you must set up an alias that forwards mail for root
|
|
to a real user.
|
|
</p>
|
|
|
|
<p> The precedence of <a href="local.8.html">local(8)</a> delivery features from high to low
|
|
is: aliases, .forward files, <a href="postconf.5.html#mailbox_transport_maps">mailbox_transport_maps</a>, <a href="postconf.5.html#mailbox_transport">mailbox_transport</a>,
|
|
<a href="postconf.5.html#mailbox_command_maps">mailbox_command_maps</a>, <a href="postconf.5.html#mailbox_command">mailbox_command</a>, <a href="postconf.5.html#home_mailbox">home_mailbox</a>, <a href="postconf.5.html#mail_spool_directory">mail_spool_directory</a>,
|
|
<a href="postconf.5.html#fallback_transport_maps">fallback_transport_maps</a>, <a href="postconf.5.html#fallback_transport">fallback_transport</a> and <a href="postconf.5.html#luser_relay">luser_relay</a>. </p>
|
|
|
|
<p>
|
|
Examples:
|
|
</p>
|
|
|
|
<pre>
|
|
<a href="postconf.5.html#mailbox_command">mailbox_command</a> = /some/where/procmail
|
|
<a href="postconf.5.html#mailbox_command">mailbox_command</a> = /some/where/procmail -a "$EXTENSION"
|
|
<a href="postconf.5.html#mailbox_command">mailbox_command</a> = /some/where/maildrop -d "$USER"
|
|
-f "$SENDER" "$EXTENSION"
|
|
</pre>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="mailbox_command_maps">mailbox_command_maps</a>
|
|
(default: empty)</b></DT><DD>
|
|
|
|
<p>
|
|
Optional lookup tables with per-recipient external commands to use
|
|
for <a href="local.8.html">local(8)</a> mailbox delivery. Behavior is as with <a href="postconf.5.html#mailbox_command">mailbox_command</a>.
|
|
</p>
|
|
|
|
<p> The precedence of <a href="local.8.html">local(8)</a> delivery features from high to low
|
|
is: aliases, .forward files, <a href="postconf.5.html#mailbox_transport_maps">mailbox_transport_maps</a>, <a href="postconf.5.html#mailbox_transport">mailbox_transport</a>,
|
|
<a href="postconf.5.html#mailbox_command_maps">mailbox_command_maps</a>, <a href="postconf.5.html#mailbox_command">mailbox_command</a>, <a href="postconf.5.html#home_mailbox">home_mailbox</a>, <a href="postconf.5.html#mail_spool_directory">mail_spool_directory</a>,
|
|
<a href="postconf.5.html#fallback_transport_maps">fallback_transport_maps</a>, <a href="postconf.5.html#fallback_transport">fallback_transport</a> and <a href="postconf.5.html#luser_relay">luser_relay</a>. </p>
|
|
|
|
<p>
|
|
Specify zero or more "type:name" lookup tables, separated by
|
|
whitespace or comma. Tables will be searched in the specified order
|
|
until a match is found.
|
|
</p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="mailbox_delivery_lock">mailbox_delivery_lock</a>
|
|
(default: see "postconf -d" output)</b></DT><DD>
|
|
|
|
<p>
|
|
How to lock a UNIX-style <a href="local.8.html">local(8)</a> mailbox before attempting delivery.
|
|
For a list of available file locking methods, use the "<b>postconf
|
|
-l</b>" command.
|
|
</p>
|
|
|
|
<p>
|
|
This setting is ignored with <b>maildir</b> style delivery,
|
|
because such deliveries are safe without explicit locks.
|
|
</p>
|
|
|
|
<p>
|
|
Note: The <b>dotlock</b> method requires that the recipient UID or
|
|
GID has write access to the parent directory of the mailbox file.
|
|
</p>
|
|
|
|
<p>
|
|
Note: the default setting of this parameter is system dependent.
|
|
</p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="mailbox_size_limit">mailbox_size_limit</a>
|
|
(default: 51200000)</b></DT><DD>
|
|
|
|
<p> The maximal size of any <a href="local.8.html">local(8)</a> individual mailbox or maildir
|
|
file, or zero (no limit). In fact, this limits the size of any
|
|
file that is written to upon local delivery, including files written
|
|
by external commands that are executed by the <a href="local.8.html">local(8)</a> delivery
|
|
agent. The value cannot exceed LONG_MAX (typically, a 32-bit or
|
|
64-bit signed integer).
|
|
</p>
|
|
|
|
<p>
|
|
This limit must not be smaller than the message size limit.
|
|
</p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="mailbox_transport">mailbox_transport</a>
|
|
(default: empty)</b></DT><DD>
|
|
|
|
<p>
|
|
Optional message delivery transport that the <a href="local.8.html">local(8)</a> delivery
|
|
agent should use for mailbox delivery to all local recipients,
|
|
whether or not they are found in the UNIX passwd database.
|
|
</p>
|
|
|
|
<p> The precedence of <a href="local.8.html">local(8)</a> delivery features from high to low
|
|
is: aliases, .forward files, <a href="postconf.5.html#mailbox_transport_maps">mailbox_transport_maps</a>, <a href="postconf.5.html#mailbox_transport">mailbox_transport</a>,
|
|
<a href="postconf.5.html#mailbox_command_maps">mailbox_command_maps</a>, <a href="postconf.5.html#mailbox_command">mailbox_command</a>, <a href="postconf.5.html#home_mailbox">home_mailbox</a>, <a href="postconf.5.html#mail_spool_directory">mail_spool_directory</a>,
|
|
<a href="postconf.5.html#fallback_transport_maps">fallback_transport_maps</a>, <a href="postconf.5.html#fallback_transport">fallback_transport</a> and <a href="postconf.5.html#luser_relay">luser_relay</a>. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="mailbox_transport_maps">mailbox_transport_maps</a>
|
|
(default: empty)</b></DT><DD>
|
|
|
|
<p> Optional lookup tables with per-recipient message delivery
|
|
transports to use for <a href="local.8.html">local(8)</a> mailbox delivery, whether or not the
|
|
recipients are found in the UNIX passwd database. </p>
|
|
|
|
<p> The precedence of <a href="local.8.html">local(8)</a> delivery features from high to low
|
|
is: aliases, .forward files, <a href="postconf.5.html#mailbox_transport_maps">mailbox_transport_maps</a>, <a href="postconf.5.html#mailbox_transport">mailbox_transport</a>,
|
|
<a href="postconf.5.html#mailbox_command_maps">mailbox_command_maps</a>, <a href="postconf.5.html#mailbox_command">mailbox_command</a>, <a href="postconf.5.html#home_mailbox">home_mailbox</a>, <a href="postconf.5.html#mail_spool_directory">mail_spool_directory</a>,
|
|
<a href="postconf.5.html#fallback_transport_maps">fallback_transport_maps</a>, <a href="postconf.5.html#fallback_transport">fallback_transport</a> and <a href="postconf.5.html#luser_relay">luser_relay</a>. </p>
|
|
|
|
<p>
|
|
Specify zero or more "type:name" lookup tables, separated by
|
|
whitespace or comma. Tables will be searched in the specified order
|
|
until a match is found.
|
|
</p>
|
|
|
|
<p> For safety reasons, this feature does not allow $number
|
|
substitutions in regular expression maps. </p>
|
|
|
|
<p> This feature is available in Postfix 2.3 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="maillog_file">maillog_file</a>
|
|
(default: empty)</b></DT><DD>
|
|
|
|
<p> The name of an optional logfile that is written by the Postfix
|
|
<a href="postlogd.8.html">postlogd(8)</a> service. An empty value selects logging to syslogd(8).
|
|
Specify "/dev/stdout" to select logging to standard output. Stdout
|
|
logging requires that Postfix is started with "postfix start-fg".
|
|
</p>
|
|
|
|
<p> Note 1: The <a href="postconf.5.html#maillog_file">maillog_file</a> parameter value must contain a prefix
|
|
that is specified with the <a href="postconf.5.html#maillog_file_prefixes">maillog_file_prefixes</a> parameter. </p>
|
|
|
|
<p> Note 2: Some Postfix non-daemon programs may still log information
|
|
to syslogd(8), before they have processed their configuration
|
|
parameters and command-line options. </p>
|
|
|
|
<p> This feature is available in Postfix 3.4 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="maillog_file_compressor">maillog_file_compressor</a>
|
|
(default: gzip)</b></DT><DD>
|
|
|
|
<p> The program to run after rotating $<a href="postconf.5.html#maillog_file">maillog_file</a> with "postfix
|
|
logrotate". The command is run with the rotated logfile name as its
|
|
first argument. </p>
|
|
|
|
<p> This feature is available in Postfix 3.4 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="maillog_file_permissions">maillog_file_permissions</a>
|
|
(default: 0600)</b></DT><DD>
|
|
|
|
<p> The file access permissions that will be set when the file
|
|
$<a href="postconf.5.html#maillog_file">maillog_file</a> is created for the first time, or when the file is
|
|
created after an existing file is rotated. Specify one of: <b>0600</b>
|
|
(only super-user read/write access), <b>0640</b> (adds 'group' read
|
|
access), or <b>0644</b> (also adds 'other' read access). The leading
|
|
'0' is optional. </p>
|
|
|
|
<p> This feature is available in Postfix 3.9 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="maillog_file_prefixes">maillog_file_prefixes</a>
|
|
(default: /var, /dev/stdout)</b></DT><DD>
|
|
|
|
<p> A list of allowed prefixes for a <a href="postconf.5.html#maillog_file">maillog_file</a> value. This is a
|
|
safety feature to contain the damage from a single configuration
|
|
mistake. Specify one or more prefix strings, separated by comma or
|
|
whitespace. </p>
|
|
|
|
<p> This feature is available in Postfix 3.4 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="maillog_file_rotate_suffix">maillog_file_rotate_suffix</a>
|
|
(default: %Y%m%d-%H%M%S)</b></DT><DD>
|
|
|
|
<p> The format of the suffix to append to $<a href="postconf.5.html#maillog_file">maillog_file</a> while rotating
|
|
the file with "postfix logrotate". See strftime(3) for syntax. The
|
|
default suffix, YYYYMMDD-HHMMSS, allows logs to be rotated frequently.
|
|
</p>
|
|
|
|
<p> This feature is available in Postfix 3.4 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="mailq_path">mailq_path</a>
|
|
(default: see "postconf -d" output)</b></DT><DD>
|
|
|
|
<p>
|
|
Sendmail compatibility feature that specifies where the Postfix
|
|
<a href="mailq.1.html">mailq(1)</a> command is installed. This command can be used to
|
|
list the Postfix mail queue.
|
|
</p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="manpage_directory">manpage_directory</a>
|
|
(default: see "postconf -d" output)</b></DT><DD>
|
|
|
|
<p>
|
|
Where the Postfix manual pages are installed.
|
|
</p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="maps_rbl_domains">maps_rbl_domains</a>
|
|
(default: empty)</b></DT><DD>
|
|
|
|
<p>
|
|
Obsolete feature: use the <a href="postconf.5.html#reject_rbl_client">reject_rbl_client</a> feature instead.
|
|
</p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="maps_rbl_reject_code">maps_rbl_reject_code</a>
|
|
(default: 554)</b></DT><DD>
|
|
|
|
<p>
|
|
The numerical Postfix SMTP server response code when a remote SMTP
|
|
client request is blocked by the <a href="postconf.5.html#reject_rbl_client">reject_rbl_client</a>, <a href="postconf.5.html#reject_rhsbl_client">reject_rhsbl_client</a>,
|
|
<a href="postconf.5.html#reject_rhsbl_reverse_client">reject_rhsbl_reverse_client</a>, <a href="postconf.5.html#reject_rhsbl_sender">reject_rhsbl_sender</a> or
|
|
<a href="postconf.5.html#reject_rhsbl_recipient">reject_rhsbl_recipient</a> restriction.
|
|
</p>
|
|
|
|
<p>
|
|
Do not change this unless you have a complete understanding of <a href="https://tools.ietf.org/html/rfc5321">RFC 5321</a>.
|
|
</p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="masquerade_classes">masquerade_classes</a>
|
|
(default: envelope_sender, header_sender, header_recipient)</b></DT><DD>
|
|
|
|
<p>
|
|
What addresses are subject to address masquerading.
|
|
</p>
|
|
|
|
<p>
|
|
By default, address masquerading is limited to envelope sender
|
|
addresses, and to header sender and header recipient addresses.
|
|
This allows you to use address masquerading on a mail gateway while
|
|
still being able to forward mail to users on individual machines.
|
|
</p>
|
|
|
|
<p>
|
|
Specify zero or more of: envelope_sender, envelope_recipient,
|
|
header_sender, header_recipient
|
|
</p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="masquerade_domains">masquerade_domains</a>
|
|
(default: empty)</b></DT><DD>
|
|
|
|
<p>
|
|
Optional list of domains whose subdomain structure will be stripped
|
|
off in email addresses.
|
|
</p>
|
|
|
|
<p>
|
|
The list is processed left to right, and processing stops at the
|
|
first match. Thus,
|
|
</p>
|
|
|
|
<blockquote>
|
|
<pre>
|
|
<a href="postconf.5.html#masquerade_domains">masquerade_domains</a> = foo.example.com example.com
|
|
</pre>
|
|
</blockquote>
|
|
|
|
<p>
|
|
strips "user@any.thing.foo.example.com" to "user@foo.example.com",
|
|
but strips "user@any.thing.else.example.com" to "user@example.com".
|
|
</p>
|
|
|
|
<p>
|
|
A domain name prefixed with ! means do not masquerade this domain
|
|
or its subdomains. Thus,
|
|
</p>
|
|
|
|
<blockquote>
|
|
<pre>
|
|
<a href="postconf.5.html#masquerade_domains">masquerade_domains</a> = !foo.example.com example.com
|
|
</pre>
|
|
</blockquote>
|
|
|
|
<p>
|
|
does not change "user@any.thing.foo.example.com" or "user@foo.example.com",
|
|
but strips "user@any.thing.else.example.com" to "user@example.com".
|
|
</p>
|
|
|
|
<p> Note: with Postfix version 2.2, message header address masquerading
|
|
happens only when message header address rewriting is enabled: </p>
|
|
|
|
<ul>
|
|
|
|
<li> The message is received with the Postfix <a href="sendmail.1.html">sendmail(1)</a> command,
|
|
|
|
<li> The message is received from a network client that matches
|
|
$<a href="postconf.5.html#local_header_rewrite_clients">local_header_rewrite_clients</a>,
|
|
|
|
<li> The message is received from the network, and the
|
|
<a href="postconf.5.html#remote_header_rewrite_domain">remote_header_rewrite_domain</a> parameter specifies a non-empty value.
|
|
|
|
</ul>
|
|
|
|
<p> To get the behavior before Postfix version 2.2, specify
|
|
"<a href="postconf.5.html#local_header_rewrite_clients">local_header_rewrite_clients</a> = <a href="DATABASE_README.html#types">static</a>:all". </p>
|
|
|
|
<p>
|
|
Example:
|
|
</p>
|
|
|
|
<pre>
|
|
<a href="postconf.5.html#masquerade_domains">masquerade_domains</a> = $<a href="postconf.5.html#mydomain">mydomain</a>
|
|
</pre>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="masquerade_exceptions">masquerade_exceptions</a>
|
|
(default: empty)</b></DT><DD>
|
|
|
|
<p>
|
|
Optional list of user names that are not subjected to address
|
|
masquerading, even when their addresses match $<a href="postconf.5.html#masquerade_domains">masquerade_domains</a>.
|
|
</p>
|
|
|
|
<p>
|
|
By default, address masquerading makes no exceptions.
|
|
</p>
|
|
|
|
<p>
|
|
Specify a list of user names, "/file/name" or "<a href="DATABASE_README.html">type:table</a>" patterns,
|
|
separated by commas and/or whitespace. The list is matched left to
|
|
right, and the search stops on the first match. A "/file/name"
|
|
pattern is replaced
|
|
by its contents; a "<a href="DATABASE_README.html">type:table</a>" lookup table is matched when a name
|
|
matches a lookup key (the lookup result is ignored). Continue long
|
|
lines by starting the next line with whitespace. Specify "!pattern"
|
|
to exclude a name from the list. The form "!/file/name" is supported
|
|
only in Postfix version 2.4 and later. </p>
|
|
|
|
<p>
|
|
Examples:
|
|
</p>
|
|
|
|
<pre>
|
|
<a href="postconf.5.html#masquerade_exceptions">masquerade_exceptions</a> = root, mailer-daemon
|
|
<a href="postconf.5.html#masquerade_exceptions">masquerade_exceptions</a> = root
|
|
</pre>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="master_service_disable">master_service_disable</a>
|
|
(default: empty)</b></DT><DD>
|
|
|
|
<p> Selectively disable <a href="master.8.html">master(8)</a> listener ports by service type
|
|
or by service name and type. Specify a list of service types
|
|
("inet", "unix", "fifo", or "pass") or "name/type" tuples, where
|
|
"name" is the first field of a <a href="master.5.html">master.cf</a> entry and "type" is a
|
|
service type. As with other Postfix matchlists, a search stops at
|
|
the first match. Specify "!pattern" to exclude a service from the
|
|
list. By default, all <a href="master.8.html">master(8)</a> listener ports are enabled. </p>
|
|
|
|
<p> Note: this feature does not support "/file/name" or "<a href="DATABASE_README.html">type:table</a>"
|
|
patterns, nor does it support wildcards such as "*" or "all". This
|
|
is intentional. </p>
|
|
|
|
<p> Examples: </p>
|
|
|
|
<pre>
|
|
# With Postfix 2.6..2.10 use '.' instead of '/'.
|
|
# Turn on all <a href="master.8.html">master(8)</a> listener ports (the default).
|
|
<a href="postconf.5.html#master_service_disable">master_service_disable</a> =
|
|
# Turn off only the main SMTP listener port.
|
|
<a href="postconf.5.html#master_service_disable">master_service_disable</a> = smtp/inet
|
|
# Turn off all TCP/IP listener ports.
|
|
<a href="postconf.5.html#master_service_disable">master_service_disable</a> = inet
|
|
# Turn off all TCP/IP listener ports except "foo".
|
|
<a href="postconf.5.html#master_service_disable">master_service_disable</a> = !foo/inet, inet
|
|
</pre>
|
|
|
|
<p> This feature is available in Postfix 2.6 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="max_idle">max_idle</a>
|
|
(default: 100s)</b></DT><DD>
|
|
|
|
<p>
|
|
The maximum amount of time that an idle Postfix daemon process waits
|
|
for an incoming connection before terminating voluntarily. This
|
|
parameter
|
|
is ignored by the Postfix queue manager and by other long-lived
|
|
Postfix daemon processes.
|
|
</p>
|
|
|
|
<p> Specify a non-zero time value (an integral value plus an optional
|
|
one-letter suffix that specifies the time unit). Time units: s
|
|
(seconds), m (minutes), h (hours), d (days), w (weeks).
|
|
The default time unit is s (seconds). </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="max_use">max_use</a>
|
|
(default: 100)</b></DT><DD>
|
|
|
|
<p>
|
|
The maximal number of incoming connections that a Postfix daemon
|
|
process will service before terminating voluntarily. This parameter
|
|
is ignored by the Postfix queue
|
|
manager and by other long-lived Postfix daemon processes.
|
|
</p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="maximal_backoff_time">maximal_backoff_time</a>
|
|
(default: 4000s)</b></DT><DD>
|
|
|
|
<p>
|
|
The maximal time between attempts to deliver a deferred message.
|
|
</p>
|
|
|
|
<p> This parameter should be set to a value greater than or equal
|
|
to $<a href="postconf.5.html#minimal_backoff_time">minimal_backoff_time</a>. See also $<a href="postconf.5.html#queue_run_delay">queue_run_delay</a>. </p>
|
|
|
|
<p> Specify a non-zero time value (an integral value plus an optional
|
|
one-letter suffix that specifies the time unit). Time units: s
|
|
(seconds), m (minutes), h (hours), d (days), w (weeks).
|
|
The default time unit is s (seconds). </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="maximal_queue_lifetime">maximal_queue_lifetime</a>
|
|
(default: 5d)</b></DT><DD>
|
|
|
|
<p>
|
|
Consider a message as undeliverable, when delivery fails with a
|
|
temporary error, and the time in the queue has reached the
|
|
<a href="postconf.5.html#maximal_queue_lifetime">maximal_queue_lifetime</a> limit.
|
|
</p>
|
|
|
|
<p> Specify a non-negative time value (an integral value plus an optional
|
|
one-letter suffix that specifies the time unit). Time units: s
|
|
(seconds), m (minutes), h (hours), d (days), w (weeks).
|
|
The default time unit is d (days). </p>
|
|
|
|
<p>
|
|
Specify 0 when mail delivery should be tried only once.
|
|
</p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="message_drop_headers">message_drop_headers</a>
|
|
(default: bcc, content-length, resent-bcc, return-path)</b></DT><DD>
|
|
|
|
<p> Names of message headers that the <a href="cleanup.8.html">cleanup(8)</a> daemon will remove
|
|
after applying <a href="header_checks.5.html">header_checks(5)</a> and before invoking Milter applications.
|
|
The default setting is compatible with Postfix < 3.0. </p>
|
|
|
|
<p> Specify a list of header names, separated by comma or space.
|
|
Names are matched in a case-insensitive manner. The list of supported
|
|
header names is limited only by available memory. </p>
|
|
|
|
<p> This feature is available in Postfix 3.0 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="message_reject_characters">message_reject_characters</a>
|
|
(default: empty)</b></DT><DD>
|
|
|
|
<p> The set of characters that Postfix will reject in message
|
|
content. The usual C-like escape sequences are recognized: <tt>\a
|
|
\b \f \n \r \t \v \<i>ddd</i></tt> (up to three octal digits) and
|
|
<tt>\\</tt>. </p>
|
|
|
|
<p> Note 1: this feature does not recognize text that requires MIME
|
|
decoding. It inspects raw message content, just like <a href="postconf.5.html#header_checks">header_checks</a>
|
|
and <a href="postconf.5.html#body_checks">body_checks</a>. </p>
|
|
|
|
<p> Note 2: this feature is disabled with "<a href="postconf.5.html#receive_override_options">receive_override_options</a>
|
|
= <a href="postconf.5.html#no_header_body_checks">no_header_body_checks</a>". </p>
|
|
|
|
<p> Example: </p>
|
|
|
|
<pre>
|
|
<a href="postconf.5.html#message_reject_characters">message_reject_characters</a> = \0
|
|
</pre>
|
|
|
|
<p> This feature is available in Postfix 2.3 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="message_size_limit">message_size_limit</a>
|
|
(default: 10240000)</b></DT><DD>
|
|
|
|
<p>
|
|
The maximal size in bytes of a message, including envelope information.
|
|
The value cannot exceed LONG_MAX (typically, a 32-bit or 64-bit
|
|
signed integer).
|
|
</p>
|
|
|
|
<p> Note: be careful when making changes. Excessively small values
|
|
will result in the loss of non-delivery notifications, when a bounce
|
|
message size exceeds the local or remote MTA's message size limit.
|
|
</p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="message_strip_characters">message_strip_characters</a>
|
|
(default: empty)</b></DT><DD>
|
|
|
|
<p> The set of characters that Postfix will remove from message
|
|
content. The usual C-like escape sequences are recognized: <tt>\a
|
|
\b \f \n \r \t \v \<i>ddd</i></tt> (up to three octal digits) and
|
|
<tt>\\</tt>. </p>
|
|
|
|
<p> Note 1: this feature does not recognize text that requires MIME
|
|
decoding. It inspects raw message content, just like <a href="postconf.5.html#header_checks">header_checks</a>
|
|
and <a href="postconf.5.html#body_checks">body_checks</a>. </p>
|
|
|
|
<p> Note 2: this feature is disabled with "<a href="postconf.5.html#receive_override_options">receive_override_options</a>
|
|
= <a href="postconf.5.html#no_header_body_checks">no_header_body_checks</a>". </p>
|
|
|
|
<p> Example: </p>
|
|
|
|
<pre>
|
|
<a href="postconf.5.html#message_strip_characters">message_strip_characters</a> = \0
|
|
</pre>
|
|
|
|
<p> This feature is available in Postfix 2.3 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="meta_directory">meta_directory</a>
|
|
(default: see 'postconf -d' output)</b></DT><DD>
|
|
|
|
<p> The location of non-executable files that are shared among
|
|
multiple Postfix instances, such as postfix-files, dynamicmaps.cf,
|
|
and the multi-instance template files <a href="postconf.5.html">main.cf</a>.proto and <a href="master.5.html">master.cf</a>.proto.
|
|
This directory should contain only Postfix-related files. Typically,
|
|
the <a href="postconf.5.html#meta_directory">meta_directory</a> parameter has the same default as the <a href="postconf.5.html#config_directory">config_directory</a>
|
|
parameter (/etc/postfix or /usr/local/etc/postfix). </p>
|
|
|
|
<p> For backwards compatibility with Postfix versions 2.6..2.11,
|
|
specify "<a href="postconf.5.html#meta_directory">meta_directory</a> = $<a href="postconf.5.html#daemon_directory">daemon_directory</a>" in <a href="postconf.5.html">main.cf</a> before
|
|
installing or upgrading Postfix, or specify "<a href="postconf.5.html#meta_directory">meta_directory</a> =
|
|
/path/name" on the "make makefiles", "make install" or "make upgrade"
|
|
command line. </p>
|
|
|
|
<p> This feature is available in Postfix 3.0 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="milter_command_timeout">milter_command_timeout</a>
|
|
(default: 30s)</b></DT><DD>
|
|
|
|
<p> The time limit for sending an SMTP command to a Milter (mail
|
|
filter) application, and for receiving the response. </p>
|
|
|
|
<p> Specify a non-zero time value (an integral value plus an optional
|
|
one-letter suffix that specifies the time unit). Time units: s
|
|
(seconds), m (minutes), h (hours), d (days), w (weeks).
|
|
The default time unit is s (seconds). </p>
|
|
|
|
<p> This feature is available in Postfix 2.3 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="milter_connect_macros">milter_connect_macros</a>
|
|
(default: see "postconf -d" output)</b></DT><DD>
|
|
|
|
<p> The macros that are sent to Milter (mail filter) applications
|
|
after completion of an SMTP connection. See <a href="MILTER_README.html">MILTER_README</a>
|
|
for a list of available macro names and their meanings. </p>
|
|
|
|
<p> This feature is available in Postfix 2.3 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="milter_connect_timeout">milter_connect_timeout</a>
|
|
(default: 30s)</b></DT><DD>
|
|
|
|
<p> The time limit for connecting to a Milter (mail filter)
|
|
application, and for negotiating protocol options. </p>
|
|
|
|
<p> Specify a non-zero time value (an integral value plus an optional
|
|
one-letter suffix that specifies the time unit). Time units: s
|
|
(seconds), m (minutes), h (hours), d (days), w (weeks).
|
|
The default time unit is s (seconds). </p>
|
|
|
|
<p> This feature is available in Postfix 2.3 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="milter_content_timeout">milter_content_timeout</a>
|
|
(default: 300s)</b></DT><DD>
|
|
|
|
<p> The time limit for sending message content to a Milter (mail
|
|
filter) application, and for receiving the response. </p>
|
|
|
|
<p> Specify a non-zero time value (an integral value plus an optional
|
|
one-letter suffix that specifies the time unit). Time units: s
|
|
(seconds), m (minutes), h (hours), d (days), w (weeks).
|
|
The default time unit is s (seconds). </p>
|
|
|
|
<p> This feature is available in Postfix 2.3 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="milter_data_macros">milter_data_macros</a>
|
|
(default: see "postconf -d" output)</b></DT><DD>
|
|
|
|
<p> The macros that are sent to version 4 or higher Milter (mail
|
|
filter) applications after the SMTP DATA command. See <a href="MILTER_README.html">MILTER_README</a>
|
|
for a list of available macro names and their meanings. </p>
|
|
|
|
<p> This feature is available in Postfix 2.3 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="milter_default_action">milter_default_action</a>
|
|
(default: tempfail)</b></DT><DD>
|
|
|
|
<p> The default action when a Milter (mail filter) response is
|
|
unavailable (for example, bad Postfix configuration or Milter
|
|
failure). Specify one of the following: </p>
|
|
|
|
<dl compact>
|
|
|
|
<dt>accept</dt> <dd>Proceed as if the mail filter was not present.
|
|
</dd>
|
|
|
|
<dt>reject</dt> <dd>Reject all further commands in this session
|
|
with a permanent status code.</dd>
|
|
|
|
<dt>tempfail</dt> <dd>Reject all further commands in this session
|
|
with a temporary status code. </dd>
|
|
|
|
<dt>quarantine</dt> <dd>Like "accept", but freeze the message in
|
|
the "<a href="QSHAPE_README.html#hold_queue">hold" queue</a>. Available with Postfix 2.6 and later. </dd>
|
|
|
|
</dl>
|
|
|
|
<p> This feature is available in Postfix 2.3 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="milter_end_of_data_macros">milter_end_of_data_macros</a>
|
|
(default: see "postconf -d" output)</b></DT><DD>
|
|
|
|
<p> The macros that are sent to Milter (mail filter) applications
|
|
after the message end-of-data. See <a href="MILTER_README.html">MILTER_README</a> for a list of
|
|
available macro names and their meanings. </p>
|
|
|
|
<p> This feature is available in Postfix 2.3 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="milter_end_of_header_macros">milter_end_of_header_macros</a>
|
|
(default: see "postconf -d" output)</b></DT><DD>
|
|
|
|
<p> The macros that are sent to Milter (mail filter) applications
|
|
after the end of the message header. See <a href="MILTER_README.html">MILTER_README</a> for a list
|
|
of available macro names and their meanings. </p>
|
|
|
|
<p> This feature is available in Postfix 2.5 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="milter_header_checks">milter_header_checks</a>
|
|
(default: empty)</b></DT><DD>
|
|
|
|
<p> Optional lookup tables for content inspection of message headers
|
|
that are produced by Milter applications. See the <a href="header_checks.5.html">header_checks(5)</a>
|
|
manual page available actions. Currently, PREPEND is not implemented.
|
|
</p>
|
|
|
|
<p> The following example sends all mail that is marked as SPAM to
|
|
a spam handling machine. Note that matches are case-insensitive
|
|
by default. </p>
|
|
|
|
<pre>
|
|
/etc/postfix/<a href="postconf.5.html">main.cf</a>:
|
|
<a href="postconf.5.html#milter_header_checks">milter_header_checks</a> = <a href="pcre_table.5.html">pcre</a>:/etc/postfix/<a href="postconf.5.html#milter_header_checks">milter_header_checks</a>
|
|
</pre>
|
|
|
|
<pre>
|
|
/etc/postfix/<a href="postconf.5.html#milter_header_checks">milter_header_checks</a>:
|
|
/^X-SPAM-FLAG:\s+YES/ FILTER mysmtp:sanitizer.example.com:25
|
|
</pre>
|
|
|
|
<p> The <a href="postconf.5.html#milter_header_checks">milter_header_checks</a> mechanism could also be used for
|
|
allowlisting. For example it could be used to skip heavy content
|
|
inspection for DKIM-signed mail from known friendly domains. </p>
|
|
|
|
<p> This feature is available in Postfix 2.7, and as an optional
|
|
patch for Postfix 2.6. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="milter_helo_macros">milter_helo_macros</a>
|
|
(default: see "postconf -d" output)</b></DT><DD>
|
|
|
|
<p> The macros that are sent to Milter (mail filter) applications
|
|
after the SMTP HELO or EHLO command. See
|
|
<a href="MILTER_README.html">MILTER_README</a> for a list of available macro names and their meanings.
|
|
</p>
|
|
|
|
<p> This feature is available in Postfix 2.3 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="milter_macro_daemon_name">milter_macro_daemon_name</a>
|
|
(default: $<a href="postconf.5.html#myhostname">myhostname</a>)</b></DT><DD>
|
|
|
|
<p> The {daemon_name} macro value for Milter (mail filter) applications.
|
|
See <a href="MILTER_README.html">MILTER_README</a> for a list of available macro names and their
|
|
meanings. </p>
|
|
|
|
<p> This feature is available in Postfix 2.3 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="milter_macro_defaults">milter_macro_defaults</a>
|
|
(default: empty)</b></DT><DD>
|
|
|
|
<p> Optional list of <i>name=value</i> pairs that specify default
|
|
values for arbitrary macros that Postfix may send to Milter
|
|
applications. These defaults are used when there is no corresponding
|
|
information from the message delivery context. </p>
|
|
|
|
<p> Specify <i>name=value</i> or <i>{name=value}</i> pairs separated
|
|
by comma or whitespace. Enclose a pair in "{}" when a value contains
|
|
comma or whitespace (this form ignores whitespace after the enclosing
|
|
"{", around the "=", and before the enclosing "}"). </p>
|
|
|
|
<p> This feature is available in Postfix 3.1 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="milter_macro_v">milter_macro_v</a>
|
|
(default: $<a href="postconf.5.html#mail_name">mail_name</a> $<a href="postconf.5.html#mail_version">mail_version</a>)</b></DT><DD>
|
|
|
|
<p> The {v} macro value for Milter (mail filter) applications.
|
|
See <a href="MILTER_README.html">MILTER_README</a> for a list of available macro names and their
|
|
meanings. </p>
|
|
|
|
<p> This feature is available in Postfix 2.3 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="milter_mail_macros">milter_mail_macros</a>
|
|
(default: see "postconf -d" output)</b></DT><DD>
|
|
|
|
<p> The macros that are sent to Milter (mail filter) applications
|
|
after the SMTP MAIL FROM command. See <a href="MILTER_README.html">MILTER_README</a>
|
|
for a list of available macro names and their meanings. </p>
|
|
|
|
<p> This feature is available in Postfix 2.3 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="milter_protocol">milter_protocol</a>
|
|
(default: 6)</b></DT><DD>
|
|
|
|
<p> The mail filter protocol version and optional protocol extensions
|
|
for communication with a Milter application; prior to Postfix 2.6
|
|
the default protocol is 2. Postfix
|
|
sends this version number during the initial protocol handshake.
|
|
It should match the version number that is expected by the mail
|
|
filter application (or by its Milter library). </p>
|
|
|
|
<p>Protocol versions: </p>
|
|
|
|
<dl compact>
|
|
|
|
<dt>2</dt> <dd>Use Sendmail 8 mail filter protocol version 2 (default
|
|
with Sendmail version 8.11 .. 8.13 and Postfix version 2.3 ..
|
|
2.5).</dd>
|
|
|
|
<dt>3</dt> <dd>Use Sendmail 8 mail filter protocol version 3.</dd>
|
|
|
|
<dt>4</dt> <dd>Use Sendmail 8 mail filter protocol version 4.</dd>
|
|
|
|
<dt>6</dt> <dd>Use Sendmail 8 mail filter protocol version 6 (default
|
|
with Sendmail version 8.14 and Postfix version 2.6).</dd>
|
|
|
|
</dl>
|
|
|
|
<p>Protocol extensions: </p>
|
|
|
|
<dl compact>
|
|
|
|
<dt>no_header_reply</dt> <dd> Specify this when the Milter application
|
|
will not reply for each individual message header.</dd>
|
|
|
|
</dl>
|
|
|
|
<p> This feature is available in Postfix 2.3 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="milter_rcpt_macros">milter_rcpt_macros</a>
|
|
(default: see "postconf -d" output)</b></DT><DD>
|
|
|
|
<p> The macros that are sent to Milter (mail filter) applications
|
|
after the SMTP RCPT TO command. See <a href="MILTER_README.html">MILTER_README</a>
|
|
for a list of available macro names and their meanings. </p>
|
|
|
|
<p> This feature is available in Postfix 2.3 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="milter_unknown_command_macros">milter_unknown_command_macros</a>
|
|
(default: see "postconf -d" output)</b></DT><DD>
|
|
|
|
<p> The macros that are sent to version 3 or higher Milter (mail
|
|
filter) applications after an unknown SMTP command. See <a href="MILTER_README.html">MILTER_README</a>
|
|
for a list of available macro names and their meanings. </p>
|
|
|
|
<p> This feature is available in Postfix 2.3 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="mime_boundary_length_limit">mime_boundary_length_limit</a>
|
|
(default: 2048)</b></DT><DD>
|
|
|
|
<p>
|
|
The maximal length of MIME multipart boundary strings. The MIME
|
|
processor is unable to distinguish between boundary strings that
|
|
do not differ in the first $<a href="postconf.5.html#mime_boundary_length_limit">mime_boundary_length_limit</a> characters.
|
|
</p>
|
|
|
|
<p>
|
|
This feature is available in Postfix 2.0 and later.
|
|
</p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="mime_header_checks">mime_header_checks</a>
|
|
(default: $<a href="postconf.5.html#header_checks">header_checks</a>)</b></DT><DD>
|
|
|
|
<p>
|
|
Optional lookup tables for content inspection of MIME related
|
|
message headers, as described in the <a href="header_checks.5.html">header_checks(5)</a> manual page.
|
|
</p>
|
|
|
|
<p>
|
|
This feature is available in Postfix 2.0 and later.
|
|
</p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="mime_nesting_limit">mime_nesting_limit</a>
|
|
(default: 100)</b></DT><DD>
|
|
|
|
<p>
|
|
The maximal recursion level that the MIME processor will handle.
|
|
Postfix refuses mail that is nested deeper than the specified limit.
|
|
</p>
|
|
|
|
<p>
|
|
This feature is available in Postfix 2.0 and later.
|
|
</p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="minimal_backoff_time">minimal_backoff_time</a>
|
|
(default: 300s)</b></DT><DD>
|
|
|
|
<p>
|
|
The minimal time between attempts to deliver a deferred message;
|
|
prior to Postfix 2.4 the default value was 1000s.
|
|
</p>
|
|
|
|
<p>
|
|
This parameter also limits the time an unreachable destination is
|
|
kept in the short-term, in-memory, destination status cache.
|
|
</p>
|
|
|
|
<p> This parameter should be set greater than or equal to
|
|
$<a href="postconf.5.html#queue_run_delay">queue_run_delay</a>. See also $<a href="postconf.5.html#maximal_backoff_time">maximal_backoff_time</a>. </p>
|
|
|
|
<p> Specify a non-zero time value (an integral value plus an optional
|
|
one-letter suffix that specifies the time unit). Time units: s
|
|
(seconds), m (minutes), h (hours), d (days), w (weeks).
|
|
The default time unit is s (seconds). </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="multi_instance_directories">multi_instance_directories</a>
|
|
(default: empty)</b></DT><DD>
|
|
|
|
<p> An optional list of non-default Postfix configuration directories;
|
|
these directories belong to additional Postfix instances that share
|
|
the Postfix executable files and documentation with the default
|
|
Postfix instance, and that are started, stopped, etc., together
|
|
with the default Postfix instance. Specify a list of pathnames
|
|
separated by comma or whitespace. </p>
|
|
|
|
<p> When $<a href="postconf.5.html#multi_instance_directories">multi_instance_directories</a> is empty, the <a href="postfix.1.html">postfix(1)</a> command
|
|
runs in single-instance mode and operates on a single Postfix
|
|
instance only. Otherwise, the <a href="postfix.1.html">postfix(1)</a> command runs in multi-instance
|
|
mode and invokes the multi-instance manager specified with the
|
|
<a href="postconf.5.html#multi_instance_wrapper">multi_instance_wrapper</a> parameter. The multi-instance manager in
|
|
turn executes <a href="postfix.1.html">postfix(1)</a> commands for the default instance and for
|
|
all Postfix instances in $<a href="postconf.5.html#multi_instance_directories">multi_instance_directories</a>. </p>
|
|
|
|
<p> Currently, this parameter setting is ignored except for the
|
|
default <a href="postconf.5.html">main.cf</a> file. </p>
|
|
|
|
<p> This feature is available in Postfix 2.6 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="multi_instance_enable">multi_instance_enable</a>
|
|
(default: no)</b></DT><DD>
|
|
|
|
<p> Allow this Postfix instance to be started, stopped, etc., by a
|
|
multi-instance manager. By default, new instances are created in
|
|
a safe state that prevents them from being started inadvertently.
|
|
This parameter is reserved for the multi-instance manager. </p>
|
|
|
|
<p> This feature is available in Postfix 2.6 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="multi_instance_group">multi_instance_group</a>
|
|
(default: empty)</b></DT><DD>
|
|
|
|
<p> The optional instance group name of this Postfix instance. A
|
|
group identifies closely-related Postfix instances that the
|
|
multi-instance manager can start, stop, etc., as a unit. This
|
|
parameter is reserved for the multi-instance manager. </p>
|
|
|
|
<p> This feature is available in Postfix 2.6 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="multi_instance_name">multi_instance_name</a>
|
|
(default: empty)</b></DT><DD>
|
|
|
|
<p> The optional instance name of this Postfix instance. This name
|
|
becomes also the default value for the <a href="postconf.5.html#syslog_name">syslog_name</a> parameter. </p>
|
|
|
|
<p> This feature is available in Postfix 2.6 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="multi_instance_wrapper">multi_instance_wrapper</a>
|
|
(default: empty)</b></DT><DD>
|
|
|
|
<p> The pathname of a multi-instance manager command that the
|
|
<a href="postfix.1.html">postfix(1)</a> command invokes when the <a href="postconf.5.html#multi_instance_directories">multi_instance_directories</a>
|
|
parameter value is non-empty. The pathname may be followed by
|
|
initial command arguments separated by whitespace; shell
|
|
metacharacters such as quotes are not supported in this context.
|
|
</p>
|
|
|
|
<p> The <a href="postfix.1.html">postfix(1)</a> command invokes the manager command with the
|
|
<a href="postfix.1.html">postfix(1)</a> non-option command arguments on the manager command line,
|
|
and with all installation configuration parameters exported into
|
|
the manager command process environment. The manager command in
|
|
turn invokes the <a href="postfix.1.html">postfix(1)</a> command for individual Postfix instances
|
|
as "postfix -c <i><a href="postconf.5.html#config_directory">config_directory</a></i> <i>command</i>". </p>
|
|
|
|
<p> This feature is available in Postfix 2.6 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="multi_recipient_bounce_reject_code">multi_recipient_bounce_reject_code</a>
|
|
(default: 550)</b></DT><DD>
|
|
|
|
<p>
|
|
The numerical Postfix SMTP server response code when a remote SMTP
|
|
client request is blocked by the <a href="postconf.5.html#reject_multi_recipient_bounce">reject_multi_recipient_bounce</a>
|
|
restriction.
|
|
</p>
|
|
|
|
<p>
|
|
Do not change this unless you have a complete understanding of <a href="https://tools.ietf.org/html/rfc5321">RFC 5321</a>.
|
|
</p>
|
|
|
|
<p>
|
|
This feature is available in Postfix 2.1 and later.
|
|
</p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="mydestination">mydestination</a>
|
|
(default: $<a href="postconf.5.html#myhostname">myhostname</a>, localhost.$<a href="postconf.5.html#mydomain">mydomain</a>, localhost)</b></DT><DD>
|
|
|
|
<p> The list of domains that are delivered via the $<a href="postconf.5.html#local_transport">local_transport</a>
|
|
mail delivery transport. By default this is the Postfix <a href="local.8.html">local(8)</a>
|
|
delivery agent which looks up all recipients in /etc/passwd and
|
|
/etc/aliases. The SMTP server validates recipient addresses with
|
|
$<a href="postconf.5.html#local_recipient_maps">local_recipient_maps</a> and rejects non-existent recipients. See also
|
|
the <a href="ADDRESS_CLASS_README.html#local_domain_class">local domain</a> class in the <a href="ADDRESS_CLASS_README.html">ADDRESS_CLASS_README</a> file.
|
|
</p>
|
|
|
|
<p>
|
|
The default <a href="postconf.5.html#mydestination">mydestination</a> value specifies names for the local
|
|
machine only. On a mail domain gateway, you should also include
|
|
$<a href="postconf.5.html#mydomain">mydomain</a>.
|
|
</p>
|
|
|
|
<p>
|
|
The $<a href="postconf.5.html#local_transport">local_transport</a> delivery method is also selected for mail
|
|
addressed to user@[the.net.work.address] of the mail system (the
|
|
IP addresses specified with the <a href="postconf.5.html#inet_interfaces">inet_interfaces</a> and <a href="postconf.5.html#proxy_interfaces">proxy_interfaces</a>
|
|
parameters).
|
|
</p>
|
|
|
|
<p>
|
|
Warnings:
|
|
</p>
|
|
|
|
<ul>
|
|
|
|
<li><p>Do not specify the names of virtual domains - those domains
|
|
are specified elsewhere. See <a href="VIRTUAL_README.html">VIRTUAL_README</a> for more information. </p>
|
|
|
|
<li><p>Do not specify the names of domains that this machine is
|
|
backup MX host for. See <a href="STANDARD_CONFIGURATION_README.html">STANDARD_CONFIGURATION_README</a> for how to
|
|
set up backup MX hosts. </p>
|
|
|
|
<li><p>By default, the Postfix SMTP server rejects mail for recipients
|
|
not listed with the <a href="postconf.5.html#local_recipient_maps">local_recipient_maps</a> parameter. See the
|
|
<a href="postconf.5.html">postconf(5)</a> manual for a description of the <a href="postconf.5.html#local_recipient_maps">local_recipient_maps</a>
|
|
and <a href="postconf.5.html#unknown_local_recipient_reject_code">unknown_local_recipient_reject_code</a> parameters. </p>
|
|
|
|
</ul>
|
|
|
|
<p>
|
|
Specify a list of host or domain names, "/file/name" or "<a href="DATABASE_README.html">type:table</a>"
|
|
patterns, separated by commas and/or whitespace. A "/file/name"
|
|
pattern is replaced by its contents; a "<a href="DATABASE_README.html">type:table</a>" lookup table
|
|
is matched when a name matches a lookup key (the lookup result is
|
|
ignored). Continue long lines by starting the next line with
|
|
whitespace. </p>
|
|
|
|
<p>
|
|
Examples:
|
|
</p>
|
|
|
|
<pre>
|
|
<a href="postconf.5.html#mydestination">mydestination</a> = $<a href="postconf.5.html#myhostname">myhostname</a>, localhost.$<a href="postconf.5.html#mydomain">mydomain</a> $<a href="postconf.5.html#mydomain">mydomain</a>
|
|
<a href="postconf.5.html#mydestination">mydestination</a> = $<a href="postconf.5.html#myhostname">myhostname</a>, localhost.$<a href="postconf.5.html#mydomain">mydomain</a> www.$<a href="postconf.5.html#mydomain">mydomain</a>, ftp.$<a href="postconf.5.html#mydomain">mydomain</a>
|
|
</pre>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="mydomain">mydomain</a>
|
|
(default: see "postconf -d" output)</b></DT><DD>
|
|
|
|
<p>
|
|
The internet domain name of this mail system. The default is to
|
|
use $<a href="postconf.5.html#myhostname">myhostname</a> minus the first component, or "localdomain" (Postfix
|
|
2.3 and later). $<a href="postconf.5.html#mydomain">mydomain</a> is used as
|
|
a default value for many other configuration parameters.
|
|
</p>
|
|
|
|
<p>
|
|
Example:
|
|
</p>
|
|
|
|
<pre>
|
|
<a href="postconf.5.html#mydomain">mydomain</a> = domain.tld
|
|
</pre>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="myhostname">myhostname</a>
|
|
(default: see "postconf -d" output)</b></DT><DD>
|
|
|
|
<p>
|
|
The internet hostname of this mail system. The default is to use
|
|
the fully-qualified domain name (FQDN) from gethostname(), or to
|
|
use the non-FQDN result from gethostname() and append ".$<a href="postconf.5.html#mydomain">mydomain</a>".
|
|
$<a href="postconf.5.html#myhostname">myhostname</a> is used as a default value for many other configuration
|
|
parameters. </p>
|
|
|
|
<p>
|
|
Example:
|
|
</p>
|
|
|
|
<pre>
|
|
<a href="postconf.5.html#myhostname">myhostname</a> = host.example.com
|
|
</pre>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="mynetworks">mynetworks</a>
|
|
(default: see "postconf -d" output)</b></DT><DD>
|
|
|
|
<p>
|
|
The list of "trusted" remote SMTP clients that have more privileges than
|
|
"strangers".
|
|
</p>
|
|
|
|
<p>
|
|
In particular, "trusted" SMTP clients are allowed to relay mail
|
|
through Postfix. See the <a href="postconf.5.html#smtpd_relay_restrictions">smtpd_relay_restrictions</a> parameter
|
|
description in the <a href="postconf.5.html">postconf(5)</a> manual.
|
|
</p>
|
|
|
|
<p>
|
|
You can specify the list of "trusted" network addresses by hand
|
|
or you can let Postfix do it for you (which is the default).
|
|
See the description of the <a href="postconf.5.html#mynetworks_style">mynetworks_style</a> parameter for more
|
|
information.
|
|
</p>
|
|
|
|
<p>
|
|
If you specify the <a href="postconf.5.html#mynetworks">mynetworks</a> list by hand,
|
|
Postfix ignores the <a href="postconf.5.html#mynetworks_style">mynetworks_style</a> setting.
|
|
</p>
|
|
|
|
<p> Specify a list of network addresses or network/netmask patterns,
|
|
separated by commas and/or whitespace. Continue long lines by
|
|
starting the next line with whitespace. </p>
|
|
|
|
<p> The netmask specifies the number of bits in the network part
|
|
of a host address. You can also specify "/file/name" or "<a href="DATABASE_README.html">type:table</a>"
|
|
patterns. A "/file/name" pattern is replaced by its contents; a
|
|
"<a href="DATABASE_README.html">type:table</a>" lookup table is matched when a table entry matches a
|
|
lookup string (the lookup result is ignored). </p>
|
|
|
|
<p> The list is matched left to right, and the search stops on the
|
|
first match. Specify "!pattern" to exclude an address or network
|
|
block from the list. The form "!/file/name" is supported only
|
|
in Postfix version 2.4 and later. </p>
|
|
|
|
<p> Note 1: Pattern matching of domain names is controlled by the
|
|
presence or absence of "<a href="postconf.5.html#mynetworks">mynetworks</a>" in the <a href="postconf.5.html#parent_domain_matches_subdomains">parent_domain_matches_subdomains</a>
|
|
parameter value. </p>
|
|
|
|
<p> Note 2: IP version 6 address information must be specified inside
|
|
<tt>[]</tt> in the <a href="postconf.5.html#mynetworks">mynetworks</a> value, and in files specified with
|
|
"/file/name". IP version 6 addresses contain the ":" character,
|
|
and would otherwise be confused with a "<a href="DATABASE_README.html">type:table</a>" pattern. </p>
|
|
|
|
<p> Note 3: CIDR ranges cannot be specified in hash tables. Use cidr
|
|
tables if CIDR ranges are used. </p>
|
|
|
|
<p> Examples: </p>
|
|
|
|
<pre>
|
|
<a href="postconf.5.html#mynetworks">mynetworks</a> = 127.0.0.0/8 168.100.189.0/28
|
|
<a href="postconf.5.html#mynetworks">mynetworks</a> = !192.168.0.1, 192.168.0.0/28
|
|
<a href="postconf.5.html#mynetworks">mynetworks</a> = 127.0.0.0/8 168.100.189.0/28 [::1]/128 [2001:240:587::]/64
|
|
<a href="postconf.5.html#mynetworks">mynetworks</a> = $<a href="postconf.5.html#config_directory">config_directory</a>/mynetworks
|
|
<a href="postconf.5.html#mynetworks">mynetworks</a> = <a href="DATABASE_README.html#types">hash</a>:/etc/postfix/network_table
|
|
<a href="postconf.5.html#mynetworks">mynetworks</a> = <a href="cidr_table.5.html">cidr</a>:/etc/postfix/network_table.cidr
|
|
</pre>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="mynetworks_style">mynetworks_style</a>
|
|
(default: Postfix ≥ 3.0: host, Postfix < 3.0: subnet)</b></DT><DD>
|
|
|
|
<p>
|
|
The method to generate the default value for the <a href="postconf.5.html#mynetworks">mynetworks</a> parameter.
|
|
This is the list of trusted networks for relay access control etc.
|
|
</p>
|
|
|
|
<ul>
|
|
|
|
<li><p>Specify "<a href="postconf.5.html#mynetworks_style">mynetworks_style</a> = host" when Postfix should
|
|
"trust" only the local machine. </p>
|
|
|
|
<li><p>Specify "<a href="postconf.5.html#mynetworks_style">mynetworks_style</a> = subnet" when Postfix
|
|
should "trust" remote SMTP clients in the same IP subnetworks as the local
|
|
machine. On Linux, this works correctly only with interfaces
|
|
specified with the "ifconfig" or "ip" command. </p>
|
|
|
|
<li><p>Specify "<a href="postconf.5.html#mynetworks_style">mynetworks_style</a> = class" when Postfix should
|
|
"trust" remote SMTP clients in the same IP class A/B/C networks as the
|
|
local machine. Caution: this may cause
|
|
Postfix to "trust" your entire provider's network. Instead, specify
|
|
an explicit <a href="postconf.5.html#mynetworks">mynetworks</a> list by hand, as described with the <a href="postconf.5.html#mynetworks">mynetworks</a>
|
|
configuration parameter. </p>
|
|
|
|
</ul>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="myorigin">myorigin</a>
|
|
(default: $<a href="postconf.5.html#myhostname">myhostname</a>)</b></DT><DD>
|
|
|
|
<p>
|
|
The domain name that locally-posted mail appears to come
|
|
from, and that locally posted mail is delivered to. The default,
|
|
$<a href="postconf.5.html#myhostname">myhostname</a>, is adequate for small sites. If you run a domain with
|
|
multiple machines, you should (1) change this to $<a href="postconf.5.html#mydomain">mydomain</a> and (2)
|
|
set up a domain-wide alias database that aliases each user to
|
|
user@that.users.mailhost.
|
|
</p>
|
|
|
|
<p>
|
|
Example:
|
|
</p>
|
|
|
|
<pre>
|
|
<a href="postconf.5.html#myorigin">myorigin</a> = $<a href="postconf.5.html#mydomain">mydomain</a>
|
|
</pre>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="nested_header_checks">nested_header_checks</a>
|
|
(default: $<a href="postconf.5.html#header_checks">header_checks</a>)</b></DT><DD>
|
|
|
|
<p>
|
|
Optional lookup tables for content inspection of non-MIME message
|
|
headers in attached messages, as described in the <a href="header_checks.5.html">header_checks(5)</a>
|
|
manual page.
|
|
</p>
|
|
|
|
<p>
|
|
This feature is available in Postfix 2.0 and later.
|
|
</p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="newaliases_path">newaliases_path</a>
|
|
(default: see "postconf -d" output)</b></DT><DD>
|
|
|
|
<p>
|
|
Sendmail compatibility feature that specifies the location of the
|
|
<a href="newaliases.1.html">newaliases(1)</a> command. This command can be used to rebuild the
|
|
<a href="local.8.html">local(8)</a> <a href="aliases.5.html">aliases(5)</a> database.
|
|
</p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="non_fqdn_reject_code">non_fqdn_reject_code</a>
|
|
(default: 504)</b></DT><DD>
|
|
|
|
<p>
|
|
The numerical Postfix SMTP server reply code when a client request
|
|
is rejected by the <a href="postconf.5.html#reject_non_fqdn_helo_hostname">reject_non_fqdn_helo_hostname</a>, <a href="postconf.5.html#reject_non_fqdn_sender">reject_non_fqdn_sender</a>
|
|
or <a href="postconf.5.html#reject_non_fqdn_recipient">reject_non_fqdn_recipient</a> restriction.
|
|
</p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="non_smtpd_milters">non_smtpd_milters</a>
|
|
(default: empty)</b></DT><DD>
|
|
|
|
<p> A list of Milter (mail filter) applications for new mail that
|
|
does not arrive via the Postfix <a href="smtpd.8.html">smtpd(8)</a> server. This includes local
|
|
submission via the <a href="sendmail.1.html">sendmail(1)</a> command line, new mail that arrives
|
|
via the Postfix <a href="qmqpd.8.html">qmqpd(8)</a> server, and old mail that is re-injected
|
|
into the queue with "postsuper -r". Specify space or comma as a
|
|
separator. See the <a href="MILTER_README.html">MILTER_README</a> document for details. </p>
|
|
|
|
<p> This feature is available in Postfix 2.3 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="notify_classes">notify_classes</a>
|
|
(default: resource, software)</b></DT><DD>
|
|
|
|
<p>
|
|
The list of error classes that are reported to the postmaster. These
|
|
postmaster notifications do not replace user notifications. The
|
|
default is to report only the most serious problems. The paranoid
|
|
may wish to turn on the policy (UCE and mail relaying) and protocol
|
|
error (broken mail software) reports.
|
|
</p>
|
|
|
|
<p> NOTE: postmaster notifications may contain confidential information
|
|
such as SASL passwords or message content. It is the system
|
|
administrator's responsibility to treat such information with care.
|
|
</p>
|
|
|
|
<p>
|
|
The error classes are:
|
|
</p>
|
|
|
|
<dl>
|
|
|
|
<dt><b>bounce</b> (also implies <b>2bounce</b>)</dt>
|
|
|
|
<dd>Send the postmaster copies of the headers of bounced mail, and
|
|
send transcripts of SMTP sessions when Postfix rejects mail. The
|
|
notification is sent to the address specified with the
|
|
<a href="postconf.5.html#bounce_notice_recipient">bounce_notice_recipient</a> configuration parameter (default: postmaster).
|
|
</dd>
|
|
|
|
<dt><b>2bounce</b></dt>
|
|
|
|
<dd>Send undeliverable bounced mail to the postmaster. The notification
|
|
is sent to the address specified with the <a href="postconf.5.html#2bounce_notice_recipient">2bounce_notice_recipient</a>
|
|
configuration parameter (default: postmaster). </dd>
|
|
|
|
<dt><b>data</b></dt>
|
|
|
|
<dd>Send the postmaster a transcript of the SMTP session with an
|
|
error because a critical data file was unavailable. The notification
|
|
is sent to the address specified with the <a href="postconf.5.html#error_notice_recipient">error_notice_recipient</a>
|
|
configuration parameter (default: postmaster). <br> This feature
|
|
is available in Postfix 2.9 and later. </dd>
|
|
|
|
<dt><b>delay</b></dt>
|
|
|
|
<dd>Send the postmaster copies of the headers of delayed mail (see
|
|
<a href="postconf.5.html#delay_warning_time">delay_warning_time</a>). The
|
|
notification is sent to the address specified with the
|
|
<a href="postconf.5.html#delay_notice_recipient">delay_notice_recipient</a> configuration parameter (default: postmaster).
|
|
</dd>
|
|
|
|
<dt><b>policy</b></dt>
|
|
|
|
<dd>Send the postmaster a transcript of the SMTP session when a
|
|
client request was rejected because of (UCE) policy. The notification
|
|
is sent to the address specified with the <a href="postconf.5.html#error_notice_recipient">error_notice_recipient</a>
|
|
configuration parameter (default: postmaster). </dd>
|
|
|
|
<dt><b>protocol</b></dt>
|
|
|
|
<dd>Send the postmaster a transcript of the SMTP session in case
|
|
of client or server protocol errors. The notification is sent to
|
|
the address specified with the <a href="postconf.5.html#error_notice_recipient">error_notice_recipient</a> configuration
|
|
parameter (default: postmaster). </dd>
|
|
|
|
<dt><b>resource</b></dt>
|
|
|
|
<dd>Inform the postmaster of mail not delivered due to resource
|
|
problems. The notification is sent to the address specified with
|
|
the <a href="postconf.5.html#error_notice_recipient">error_notice_recipient</a> configuration parameter (default:
|
|
postmaster). </dd>
|
|
|
|
<dt><b>software</b></dt>
|
|
|
|
<dd>Inform the postmaster of mail not delivered due to software
|
|
problems. The notification is sent to the address specified with
|
|
the <a href="postconf.5.html#error_notice_recipient">error_notice_recipient</a> configuration parameter (default:
|
|
postmaster). </dd>
|
|
|
|
</dl>
|
|
|
|
<p>
|
|
Examples:
|
|
</p>
|
|
|
|
<pre>
|
|
<a href="postconf.5.html#notify_classes">notify_classes</a> = bounce, delay, policy, protocol, resource, software
|
|
<a href="postconf.5.html#notify_classes">notify_classes</a> = 2bounce, resource, software
|
|
</pre>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="openssl_path">openssl_path</a>
|
|
(default: openssl)</b></DT><DD>
|
|
|
|
<p>
|
|
The location of the OpenSSL command line program openssl(1). This
|
|
is used by the "<b><a href="postfix-tls.1.html">postfix tls</a></b>" command to create private keys,
|
|
certificate signing requests, self-signed certificates, and to
|
|
compute public key digests for DANE TLSA records. In multi-instance
|
|
environments, this parameter is always determined from the configuration
|
|
of the default Postfix instance.
|
|
</p>
|
|
|
|
<p> Example: </p>
|
|
|
|
<blockquote>
|
|
<pre>
|
|
/etc/postfix/<a href="postconf.5.html">main.cf</a>:
|
|
# NetBSD pkgsrc:
|
|
<a href="postconf.5.html#openssl_path">openssl_path</a> = /usr/pkg/bin/openssl
|
|
# Local build:
|
|
<a href="postconf.5.html#openssl_path">openssl_path</a> = /usr/local/bin/openssl
|
|
</pre>
|
|
</blockquote>
|
|
|
|
<p>
|
|
This feature is available in Postfix 3.1 and later.
|
|
</p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="owner_request_special">owner_request_special</a>
|
|
(default: yes)</b></DT><DD>
|
|
|
|
<p>
|
|
Enable special treatment for owner-<i>listname</i> entries in the
|
|
<a href="aliases.5.html">aliases(5)</a> file, and don't split owner-<i>listname</i> and
|
|
<i>listname</i>-request address localparts when the <a href="postconf.5.html#recipient_delimiter">recipient_delimiter</a>
|
|
is set to "-". This feature is useful for mailing lists.
|
|
</p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="parent_domain_matches_subdomains">parent_domain_matches_subdomains</a>
|
|
(default: see "postconf -d" output)</b></DT><DD>
|
|
|
|
<p>
|
|
A list of Postfix features where the pattern "example.com" also
|
|
matches subdomains of example.com,
|
|
instead of requiring an explicit ".example.com" pattern. This is
|
|
planned backwards compatibility: eventually, all Postfix features
|
|
are expected to require explicit ".example.com" style patterns when
|
|
you really want to match subdomains.
|
|
</p>
|
|
|
|
<p> The following Postfix feature names are supported. </p>
|
|
|
|
<dl>
|
|
|
|
<dt> Postfix version 1.0 and later</dt>
|
|
|
|
<dd>
|
|
<a href="postconf.5.html#debug_peer_list">debug_peer_list</a>,
|
|
<a href="postconf.5.html#fast_flush_domains">fast_flush_domains</a>,
|
|
<a href="postconf.5.html#mynetworks">mynetworks</a>,
|
|
<a href="postconf.5.html#permit_mx_backup_networks">permit_mx_backup_networks</a>,
|
|
<a href="postconf.5.html#relay_domains">relay_domains</a>,
|
|
<a href="postconf.5.html#transport_maps">transport_maps</a>
|
|
</dd>
|
|
|
|
<dt> Postfix version 1.1 and later</dt>
|
|
|
|
<dd>
|
|
<a href="postconf.5.html#qmqpd_authorized_clients">qmqpd_authorized_clients</a>,
|
|
<a href="SMTPD_ACCESS_README.html">smtpd_access_maps</a>,
|
|
</dd>
|
|
|
|
<dt> Postfix version 2.8 and later </dt>
|
|
|
|
<dd>
|
|
<a href="postconf.5.html#postscreen_access_list">postscreen_access_list</a>
|
|
</dd>
|
|
|
|
<dt> Postfix version 3.0 and later </dt>
|
|
|
|
<dd>
|
|
<a href="postconf.5.html#smtpd_client_event_limit_exceptions">smtpd_client_event_limit_exceptions</a>
|
|
</dd>
|
|
|
|
</dl>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="permit_mx_backup_networks">permit_mx_backup_networks</a>
|
|
(default: empty)</b></DT><DD>
|
|
|
|
<p>
|
|
Restrict the use of the <a href="postconf.5.html#permit_mx_backup">permit_mx_backup</a> SMTP access feature to
|
|
only domains whose primary MX hosts match the listed networks.
|
|
The parameter value syntax is the same as with the <a href="postconf.5.html#mynetworks">mynetworks</a>
|
|
parameter; note, however, that the default value is empty. </p>
|
|
|
|
<p> Pattern matching of domain names is controlled by the presence
|
|
or absence of "<a href="postconf.5.html#permit_mx_backup_networks">permit_mx_backup_networks</a>" in the
|
|
<a href="postconf.5.html#parent_domain_matches_subdomains">parent_domain_matches_subdomains</a> parameter value. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="pickup_service_name">pickup_service_name</a>
|
|
(default: pickup)</b></DT><DD>
|
|
|
|
<p>
|
|
The name of the <a href="pickup.8.html">pickup(8)</a> service. This service picks up local mail
|
|
submissions from the Postfix <a href="QSHAPE_README.html#maildrop_queue">maildrop queue</a>.
|
|
</p>
|
|
|
|
<p>
|
|
This feature is available in Postfix 2.0 and later.
|
|
</p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="pipe_delivery_status_filter">pipe_delivery_status_filter</a>
|
|
(default: $<a href="postconf.5.html#default_delivery_status_filter">default_delivery_status_filter</a>)</b></DT><DD>
|
|
|
|
<p> Optional filter for the <a href="pipe.8.html">pipe(8)</a> delivery agent to change the
|
|
delivery status code or explanatory text of successful or unsuccessful
|
|
deliveries. See <a href="postconf.5.html#default_delivery_status_filter">default_delivery_status_filter</a> for details. </p>
|
|
|
|
<p> This feature is available in Postfix 3.0 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="plaintext_reject_code">plaintext_reject_code</a>
|
|
(default: 450)</b></DT><DD>
|
|
|
|
<p>
|
|
The numerical Postfix SMTP server response code when a request
|
|
is rejected by the <b><a href="postconf.5.html#reject_plaintext_session">reject_plaintext_session</a></b> restriction.
|
|
</p>
|
|
|
|
<p> This feature is available in Postfix 2.3 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="postlog_service_name">postlog_service_name</a>
|
|
(default: postlog)</b></DT><DD>
|
|
|
|
<p> The name of the <a href="postlogd.8.html">postlogd(8)</a> service entry in <a href="master.5.html">master.cf</a>.
|
|
This service appends logfile records to the file specified
|
|
with the <a href="postconf.5.html#maillog_file">maillog_file</a> parameter. </p>
|
|
|
|
<p> This feature is available in Postfix 3.4 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="postlogd_watchdog_timeout">postlogd_watchdog_timeout</a>
|
|
(default: 10s)</b></DT><DD>
|
|
|
|
<p> How much time a <a href="postlogd.8.html">postlogd(8)</a> process may take to process a request
|
|
before it is terminated by a built-in watchdog timer. This is a
|
|
safety mechanism that prevents <a href="postlogd.8.html">postlogd(8)</a> from becoming non-responsive
|
|
due to a bug in Postfix itself or in system software. This limit
|
|
cannot be set under 10s. </p>
|
|
|
|
<p> Specify a non-zero time value (an integral value plus an optional
|
|
one-letter suffix that specifies the time unit). Time units: s
|
|
(seconds), m (minutes), h (hours), d (days), w (weeks).
|
|
The default time unit is s (seconds). </p>
|
|
|
|
<p> This feature is available in Postfix 3.4 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="postmulti_control_commands">postmulti_control_commands</a>
|
|
(default: reload flush)</b></DT><DD>
|
|
|
|
<p> The <a href="postfix.1.html">postfix(1)</a> commands that the <a href="postmulti.1.html">postmulti(1)</a> instance manager
|
|
treats as "control" commands, that operate on running instances. For
|
|
these commands, disabled instances are skipped. </p>
|
|
|
|
<p> This feature is available in Postfix 2.6 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="postmulti_start_commands">postmulti_start_commands</a>
|
|
(default: start)</b></DT><DD>
|
|
|
|
<p> The <a href="postfix.1.html">postfix(1)</a> commands that the <a href="postmulti.1.html">postmulti(1)</a> instance manager treats
|
|
as "start" commands. For these commands, disabled instances are "checked"
|
|
rather than "started", and failure to "start" a member instance of an
|
|
instance group will abort the start-up of later instances. </p>
|
|
|
|
<p> This feature is available in Postfix 2.6 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="postmulti_stop_commands">postmulti_stop_commands</a>
|
|
(default: see "postconf -d" output)</b></DT><DD>
|
|
|
|
<p> The <a href="postfix.1.html">postfix(1)</a> commands that the <a href="postmulti.1.html">postmulti(1)</a> instance manager treats
|
|
as "stop" commands. For these commands, disabled instances are skipped,
|
|
and enabled instances are processed in reverse order. </p>
|
|
|
|
<p> This feature is available in Postfix 2.6 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="postscreen_access_list">postscreen_access_list</a>
|
|
(default: <a href="postconf.5.html#permit_mynetworks">permit_mynetworks</a>)</b></DT><DD>
|
|
|
|
<p> Permanent allow/denylist for remote SMTP client IP addresses.
|
|
<a href="postscreen.8.html">postscreen(8)</a> searches this list immediately after a remote SMTP
|
|
client connects. Specify a comma- or whitespace-separated list of
|
|
commands (in upper or lower case) or lookup tables. The search stops
|
|
upon the first command that fires for the client IP address. </p>
|
|
|
|
<dl>
|
|
|
|
<dt> <b> <a href="postconf.5.html#permit_mynetworks">permit_mynetworks</a> </b> </dt> <dd> Allowlist the client and
|
|
terminate the search if the client IP address matches $<a href="postconf.5.html#mynetworks">mynetworks</a>.
|
|
Do not subject the client to any before/after 220 greeting tests.
|
|
Pass the connection immediately to a Postfix SMTP server process.
|
|
<br> Pattern matching of domain names is controlled by the presence
|
|
or absence of "<a href="postconf.5.html#postscreen_access_list">postscreen_access_list</a>" in the
|
|
<a href="postconf.5.html#parent_domain_matches_subdomains">parent_domain_matches_subdomains</a> parameter value. </dd>
|
|
|
|
<dt> <b> <a href="DATABASE_README.html">type:table</a> </b> </dt> <dd> Query the specified lookup
|
|
table. Each table lookup result is an access list, except that
|
|
access lists inside a table cannot specify <a href="DATABASE_README.html">type:table</a> entries. <br>
|
|
To discourage the use of hash, btree, etc. tables, there is no
|
|
support for substring matching like <a href="smtpd.8.html">smtpd(8)</a>. Use CIDR tables
|
|
instead. </dd>
|
|
|
|
<dt> <b> permit </b> </dt> <dd> Allowlist the client and terminate
|
|
the search. Do not subject the client to any before/after 220
|
|
greeting tests. Pass the connection immediately to a Postfix SMTP
|
|
server process. </dd>
|
|
|
|
<dt> <b> reject </b> </dt> <dd> Denylist the client and terminate
|
|
the search. Subject the client to the action configured with the
|
|
<a href="postconf.5.html#postscreen_denylist_action">postscreen_denylist_action</a> configuration parameter. </dd>
|
|
|
|
<dt> <b> dunno </b> </dt> <dd> All <a href="postscreen.8.html">postscreen(8)</a> access lists
|
|
implicitly have this command at the end. <br> When <b> dunno </b>
|
|
is executed inside a lookup table, return from the lookup table and
|
|
evaluate the next command. <br> When <b> dunno </b> is executed
|
|
outside a lookup table, terminate the search, and subject the client
|
|
to the configured before/after 220 greeting tests. </dd>
|
|
|
|
</dl>
|
|
|
|
<p> Example: </p>
|
|
|
|
<pre>
|
|
/etc/postfix/<a href="postconf.5.html">main.cf</a>:
|
|
<a href="postconf.5.html#postscreen_access_list">postscreen_access_list</a> = <a href="postconf.5.html#permit_mynetworks">permit_mynetworks</a>,
|
|
<a href="cidr_table.5.html">cidr</a>:/etc/postfix/postscreen_access.cidr
|
|
# Postfix < 3.6 use <a href="postconf.5.html#postscreen_blacklist_action">postscreen_blacklist_action</a>.
|
|
<a href="postconf.5.html#postscreen_denylist_action">postscreen_denylist_action</a> = enforce
|
|
</pre>
|
|
|
|
<pre>
|
|
/etc/postfix/postscreen_access.<a href="cidr_table.5.html">cidr</a>:
|
|
# Rules are evaluated in the order as specified.
|
|
# Denylist 192.168.* except 192.168.0.1.
|
|
192.168.0.1 dunno
|
|
192.168.0.0/16 reject
|
|
</pre>
|
|
|
|
<p> This feature is available in Postfix 2.8. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="postscreen_allowlist_interfaces">postscreen_allowlist_interfaces</a>
|
|
(default: <a href="DATABASE_README.html#types">static</a>:all)</b></DT><DD>
|
|
|
|
<p> A list of local <a href="postscreen.8.html">postscreen(8)</a> server IP addresses where a
|
|
non-allowlisted remote SMTP client can obtain <a href="postscreen.8.html">postscreen(8)</a>'s temporary
|
|
allowlist status. This status is required before the client can
|
|
talk to a Postfix SMTP server process. By default, a client can
|
|
obtain <a href="postscreen.8.html">postscreen(8)</a>'s allowlist status on any local <a href="postscreen.8.html">postscreen(8)</a>
|
|
server IP address. </p>
|
|
|
|
<p> When <a href="postscreen.8.html">postscreen(8)</a> listens on both primary and backup MX
|
|
addresses, the <a href="postconf.5.html#postscreen_allowlist_interfaces">postscreen_allowlist_interfaces</a> parameter can be
|
|
configured to give the temporary allowlist status only when a client
|
|
connects to a primary MX address. Once a client is allowlisted it
|
|
can talk to a Postfix SMTP server on any address. Thus, clients
|
|
that connect only to backup MX addresses will never become allowlisted,
|
|
and will never be allowed to talk to a Postfix SMTP server process.
|
|
</p>
|
|
|
|
<p> Specify a list of network addresses or network/netmask patterns,
|
|
separated by commas and/or whitespace. The netmask specifies the
|
|
number of bits in the network part of a host address. Continue long
|
|
lines by starting the next line with whitespace. </p>
|
|
|
|
<p> You can also specify "/file/name" or "<a href="DATABASE_README.html">type:table</a>" patterns. A
|
|
"/file/name" pattern is replaced by its contents; a "<a href="DATABASE_README.html">type:table</a>"
|
|
lookup table is matched when a table entry matches a lookup string
|
|
(the lookup result is ignored). </p>
|
|
|
|
<p> The list is matched left to right, and the search stops on the
|
|
first match. Specify "!pattern" to exclude an address or network
|
|
block from the list. </p>
|
|
|
|
<p> Note: IP version 6 address information must be specified inside
|
|
[] in the <a href="postconf.5.html#postscreen_allowlist_interfaces">postscreen_allowlist_interfaces</a> value, and in files
|
|
specified with "/file/name". IP version 6 addresses contain the
|
|
":" character, and would otherwise be confused with a "<a href="DATABASE_README.html">type:table</a>"
|
|
pattern. </p>
|
|
|
|
<p> Example: </p>
|
|
|
|
<pre>
|
|
/etc/postfix/<a href="postconf.5.html">main.cf</a>:
|
|
# Don't allowlist connections to the backup IP address.
|
|
# Postfix < 3.6 use <a href="postconf.5.html#postscreen_whitelist_interfaces">postscreen_whitelist_interfaces</a>.
|
|
<a href="postconf.5.html#postscreen_allowlist_interfaces">postscreen_allowlist_interfaces</a> = !168.100.189.8, <a href="DATABASE_README.html#types">static</a>:all
|
|
</pre>
|
|
|
|
<p> This feature is available in Postfix 3.6 and later. </p>
|
|
|
|
<p> Available as <a href="postconf.5.html#postscreen_whitelist_interfaces">postscreen_whitelist_interfaces</a> in Postfix 2.9 - 3.5. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="postscreen_bare_newline_action">postscreen_bare_newline_action</a>
|
|
(default: ignore)</b></DT><DD>
|
|
|
|
<p> The action that <a href="postscreen.8.html">postscreen(8)</a> takes when a remote SMTP client sends
|
|
a bare newline character, that is, a newline not preceded by carriage
|
|
return. Specify one of the following: </p>
|
|
|
|
<dl>
|
|
|
|
<dt> <b>ignore</b> </dt>
|
|
|
|
<dd> Ignore the failure of this test. Allow other tests to complete.
|
|
Do <i>not</i> repeat this test before the result from some
|
|
other test expires.
|
|
This option is useful for testing and collecting statistics
|
|
without blocking mail permanently. </dd>
|
|
|
|
<dt> <b>enforce</b> </dt>
|
|
|
|
<dd> Allow other tests to complete. Reject attempts to deliver mail
|
|
with a 550 SMTP reply, and log the helo/sender/recipient information.
|
|
Repeat this test the next time the client connects. </dd>
|
|
|
|
<dt> <b>drop</b> </dt>
|
|
|
|
<dd> Drop the connection immediately with a 521 SMTP reply. Repeat
|
|
this test the next time the client connects. </dd>
|
|
|
|
</dl>
|
|
|
|
<p> This feature is available in Postfix 2.8. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="postscreen_bare_newline_enable">postscreen_bare_newline_enable</a>
|
|
(default: no)</b></DT><DD>
|
|
|
|
<p> Enable "bare newline" SMTP protocol tests in the <a href="postscreen.8.html">postscreen(8)</a>
|
|
server. These tests are expensive: a remote SMTP client must
|
|
disconnect after
|
|
it passes the test, before it can talk to a real Postfix SMTP server.
|
|
</p>
|
|
|
|
<p> This feature is available in Postfix 2.8. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="postscreen_bare_newline_ttl">postscreen_bare_newline_ttl</a>
|
|
(default: 30d)</b></DT><DD>
|
|
|
|
<p> The amount of time that <a href="postscreen.8.html">postscreen(8)</a> remembers that a client
|
|
IP address passed a "bare newline" SMTP protocol test, before it
|
|
address is required to pass that test again. The default
|
|
is long because a remote SMTP client must disconnect after it passes
|
|
the test,
|
|
before it can talk to a real Postfix SMTP server. </p>
|
|
|
|
<p> Specify a non-zero time value (an integral value plus an optional
|
|
one-letter suffix that specifies the time unit). Time units: s
|
|
(seconds), m (minutes), h (hours), d (days), w (weeks).
|
|
The default time unit is d (days). </p>
|
|
|
|
<p> This feature is available in Postfix 2.8. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="postscreen_blacklist_action">postscreen_blacklist_action</a>
|
|
(default: ignore)</b></DT><DD>
|
|
|
|
<p> Renamed to <a href="postconf.5.html#postscreen_denylist_action">postscreen_denylist_action</a> in Postfix 3.6. </p>
|
|
|
|
<p> This feature is available in Postfix 2.8 - 3.5. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="postscreen_cache_cleanup_interval">postscreen_cache_cleanup_interval</a>
|
|
(default: 12h)</b></DT><DD>
|
|
|
|
<p> The amount of time between <a href="postscreen.8.html">postscreen(8)</a> cache cleanup runs.
|
|
Cache cleanup increases the load on the cache database and should
|
|
therefore not be run frequently. This feature requires that the
|
|
cache database supports the "delete" and "sequence" operators.
|
|
Specify a zero interval to disable cache cleanup. </p>
|
|
|
|
<p> After each cache cleanup run, the <a href="postscreen.8.html">postscreen(8)</a> daemon logs the
|
|
number of entries that were retained and dropped. A cleanup run is
|
|
logged as "partial" when the daemon terminates early after "<b>postfix
|
|
reload</b>", "<b>postfix stop</b>", or no requests for $<a href="postconf.5.html#max_idle">max_idle</a>
|
|
seconds. </p>
|
|
|
|
<p> Specify a non-negative time value (an integral value plus an optional
|
|
one-letter suffix that specifies the time unit). Time units: s
|
|
(seconds), m (minutes), h (hours), d (days), w (weeks).
|
|
The default time unit is h (hours). </p>
|
|
|
|
<p> This feature is available in Postfix 2.8. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="postscreen_cache_map">postscreen_cache_map</a>
|
|
(default: <a href="DATABASE_README.html#types">btree</a>:$<a href="postconf.5.html#data_directory">data_directory</a>/postscreen_cache)</b></DT><DD>
|
|
|
|
<p> Persistent storage for the <a href="postscreen.8.html">postscreen(8)</a> server decisions. </p>
|
|
|
|
<p> To share a <a href="postscreen.8.html">postscreen(8)</a> cache between multiple <a href="postscreen.8.html">postscreen(8)</a>
|
|
instances, use "<a href="postconf.5.html#postscreen_cache_map">postscreen_cache_map</a> = <a href="proxymap.8.html">proxy</a>:<a href="DATABASE_README.html#types">btree</a>:/path/to/file".
|
|
This requires Postfix version 2.9 or later; earlier <a href="proxymap.8.html">proxymap(8)</a>
|
|
implementations don't support cache cleanup. For an alternative
|
|
approach see the <a href="memcache_table.5.html">memcache_table(5)</a> manpage. </p>
|
|
|
|
<p> This feature is available in Postfix 2.8. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="postscreen_cache_retention_time">postscreen_cache_retention_time</a>
|
|
(default: 7d)</b></DT><DD>
|
|
|
|
<p> The amount of time that <a href="postscreen.8.html">postscreen(8)</a> will cache an expired
|
|
temporary allowlist entry before it is removed. This prevents clients
|
|
from being logged as "NEW" just because their cache entry expired
|
|
an hour ago. It also prevents the cache from filling up with clients
|
|
that passed some deep protocol test once and never came back. </p>
|
|
|
|
<p> Specify a non-zero time value (an integral value plus an optional
|
|
one-letter suffix that specifies the time unit). Time units: s
|
|
(seconds), m (minutes), h (hours), d (days), w (weeks).
|
|
The default time unit is d (days). </p>
|
|
|
|
<p> This feature is available in Postfix 2.8. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="postscreen_client_connection_count_limit">postscreen_client_connection_count_limit</a>
|
|
(default: $<a href="postconf.5.html#smtpd_client_connection_count_limit">smtpd_client_connection_count_limit</a>)</b></DT><DD>
|
|
|
|
<p> How many simultaneous connections any remote SMTP client is
|
|
allowed to have
|
|
with the <a href="postscreen.8.html">postscreen(8)</a> daemon. By default, this limit is the same
|
|
as with the Postfix SMTP server. Note that the triage process can
|
|
take several seconds, with the time spent in <a href="postconf.5.html#postscreen_greet_wait">postscreen_greet_wait</a>
|
|
delay, and with the time spent talking to the <a href="postscreen.8.html">postscreen(8)</a> built-in
|
|
dummy SMTP protocol engine. </p>
|
|
|
|
<p> This feature is available in Postfix 2.8. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="postscreen_command_count_limit">postscreen_command_count_limit</a>
|
|
(default: 20)</b></DT><DD>
|
|
|
|
<p> The limit on the total number of commands per SMTP session for
|
|
<a href="postscreen.8.html">postscreen(8)</a>'s built-in SMTP protocol engine. This SMTP engine
|
|
defers or rejects all attempts to deliver mail, therefore there is
|
|
no need to enforce separate limits on the number of junk commands
|
|
and error commands. </p>
|
|
|
|
<p> This feature is available in Postfix 2.8. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="postscreen_command_filter">postscreen_command_filter</a>
|
|
(default: $<a href="postconf.5.html#smtpd_command_filter">smtpd_command_filter</a>)</b></DT><DD>
|
|
|
|
<p> A mechanism to transform commands from remote SMTP clients.
|
|
See <a href="postconf.5.html#smtpd_command_filter">smtpd_command_filter</a> for further details. </p>
|
|
|
|
<p> This feature is available in Postfix 2.8 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="postscreen_command_time_limit">postscreen_command_time_limit</a>
|
|
(default: normal: 300s, <a href="STRESS_README.html">overload</a>: 10s)</b></DT><DD>
|
|
|
|
<p> The time limit to read an entire command line with <a href="postscreen.8.html">postscreen(8)</a>'s
|
|
built-in SMTP protocol engine. </p>
|
|
|
|
<p> This feature is available in Postfix 2.8. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="postscreen_denylist_action">postscreen_denylist_action</a>
|
|
(default: ignore)</b></DT><DD>
|
|
|
|
<p> The action that <a href="postscreen.8.html">postscreen(8)</a> takes when a remote SMTP client is
|
|
permanently denylisted with the <a href="postconf.5.html#postscreen_access_list">postscreen_access_list</a> parameter.
|
|
Specify one of the following: </p>
|
|
|
|
<dl>
|
|
|
|
<dt> <b>ignore</b> (default) </dt>
|
|
|
|
<dd> Ignore this result. Allow other tests to complete. Repeat
|
|
this test the next time the client connects.
|
|
This option is useful for testing and collecting statistics
|
|
without blocking mail. </dd>
|
|
|
|
<dt> <b>enforce</b> </dt>
|
|
|
|
<dd> Allow other tests to complete. Reject attempts to deliver mail
|
|
with a 550 SMTP reply, and log the helo/sender/recipient information.
|
|
Repeat this test the next time the client connects. </dd>
|
|
|
|
<dt> <b>drop</b> </dt>
|
|
|
|
<dd> Drop the connection immediately with a 521 SMTP reply. Repeat
|
|
this test the next time the client connects. </dd>
|
|
|
|
</dl>
|
|
|
|
<p> This feature is available in Postfix 3.6 and later. </p>
|
|
|
|
<p> Available as <a href="postconf.5.html#postscreen_blacklist_action">postscreen_blacklist_action</a> in Postfix 2.8 - 3.5. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="postscreen_disable_vrfy_command">postscreen_disable_vrfy_command</a>
|
|
(default: $<a href="postconf.5.html#disable_vrfy_command">disable_vrfy_command</a>)</b></DT><DD>
|
|
|
|
<p> Disable the SMTP VRFY command in the <a href="postscreen.8.html">postscreen(8)</a> daemon. See
|
|
<a href="postconf.5.html#disable_vrfy_command">disable_vrfy_command</a> for details. </p>
|
|
|
|
<p> This feature is available in Postfix 2.8. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="postscreen_discard_ehlo_keyword_address_maps">postscreen_discard_ehlo_keyword_address_maps</a>
|
|
(default: $<a href="postconf.5.html#smtpd_discard_ehlo_keyword_address_maps">smtpd_discard_ehlo_keyword_address_maps</a>)</b></DT><DD>
|
|
|
|
<p> Lookup tables, indexed by the remote SMTP client address, with
|
|
case insensitive lists of EHLO keywords (pipelining, starttls, auth,
|
|
etc.) that the <a href="postscreen.8.html">postscreen(8)</a> server will not send in the EHLO response
|
|
to a remote SMTP client. See <a href="postconf.5.html#smtpd_discard_ehlo_keywords">smtpd_discard_ehlo_keywords</a> for details.
|
|
The table is not searched by hostname for robustness reasons. </p>
|
|
|
|
<p> This feature is available in Postfix 2.8 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="postscreen_discard_ehlo_keywords">postscreen_discard_ehlo_keywords</a>
|
|
(default: $<a href="postconf.5.html#smtpd_discard_ehlo_keywords">smtpd_discard_ehlo_keywords</a>)</b></DT><DD>
|
|
|
|
<p> A case insensitive list of EHLO keywords (pipelining, starttls,
|
|
auth, etc.) that the <a href="postscreen.8.html">postscreen(8)</a> server will not send in the EHLO
|
|
response to a remote SMTP client. See <a href="postconf.5.html#smtpd_discard_ehlo_keywords">smtpd_discard_ehlo_keywords</a>
|
|
for details. </p>
|
|
|
|
<p> This feature is available in Postfix 2.8 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="postscreen_dnsbl_action">postscreen_dnsbl_action</a>
|
|
(default: ignore)</b></DT><DD>
|
|
|
|
<p>The action that <a href="postscreen.8.html">postscreen(8)</a> takes when a remote SMTP client's combined
|
|
DNSBL score is equal to or greater than a threshold (as defined
|
|
with the <a href="postconf.5.html#postscreen_dnsbl_sites">postscreen_dnsbl_sites</a> and <a href="postconf.5.html#postscreen_dnsbl_threshold">postscreen_dnsbl_threshold</a>
|
|
parameters). Specify one of the following: </p>
|
|
|
|
<dl>
|
|
|
|
<dt> <b>ignore</b> (default) </dt>
|
|
|
|
<dd> Ignore the failure of this test. Allow other tests to complete.
|
|
Repeat this test the next time the client connects.
|
|
This option is useful for testing and collecting statistics
|
|
without blocking mail. </dd>
|
|
|
|
<dt> <b>enforce</b> </dt>
|
|
|
|
<dd> Allow other tests to complete. Reject attempts to deliver mail
|
|
with a 550 SMTP reply, and log the helo/sender/recipient information.
|
|
Repeat this test the next time the client connects. </dd>
|
|
|
|
<dt> <b>drop</b> </dt>
|
|
|
|
<dd> Drop the connection immediately with a 521 SMTP reply. Repeat
|
|
this test the next time the client connects. </dd>
|
|
|
|
</dl>
|
|
|
|
<p> This feature is available in Postfix 2.8. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="postscreen_dnsbl_allowlist_threshold">postscreen_dnsbl_allowlist_threshold</a>
|
|
(default: 0)</b></DT><DD>
|
|
|
|
<p> Allow a remote SMTP client to skip "before" and "after 220
|
|
greeting" protocol tests, based on its combined DNSBL score as
|
|
defined with the <a href="postconf.5.html#postscreen_dnsbl_sites">postscreen_dnsbl_sites</a> parameter. </p>
|
|
|
|
<p> Specify a negative value to enable this feature. When a client
|
|
passes the <a href="postconf.5.html#postscreen_dnsbl_allowlist_threshold">postscreen_dnsbl_allowlist_threshold</a> without having
|
|
failed other tests, all pending or disabled tests are flagged as
|
|
completed with an expiration time based on the DNS reply TTL.
|
|
When a test was already completed, its expiration time is updated
|
|
if it was less than the value based on the DNS reply TTL. See
|
|
also <a href="postconf.5.html#postscreen_dnsbl_max_ttl">postscreen_dnsbl_max_ttl</a> and <a href="postconf.5.html#postscreen_dnsbl_min_ttl">postscreen_dnsbl_min_ttl</a>. </p>
|
|
|
|
<p> This feature is available in Postfix 3.6 and later. </p>
|
|
|
|
<p> Available as <a href="postconf.5.html#postscreen_dnsbl_whitelist_threshold">postscreen_dnsbl_whitelist_threshold</a> in Postfix 2.11
|
|
- 3.5. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="postscreen_dnsbl_max_ttl">postscreen_dnsbl_max_ttl</a>
|
|
(default: ${<a href="postconf.5.html#postscreen_dnsbl_ttl">postscreen_dnsbl_ttl</a>?{$<a href="postconf.5.html#postscreen_dnsbl_ttl">postscreen_dnsbl_ttl</a>}:{1}}h)</b></DT><DD>
|
|
|
|
<p> The maximum amount of time that <a href="postscreen.8.html">postscreen(8)</a> remembers that a
|
|
client IP address passed a DNS-based reputation test, before it is
|
|
required to pass that test again. If the DNS
|
|
reply specifies a shorter TTL value, that value will be used unless
|
|
it would be smaller than <a href="postconf.5.html#postscreen_dnsbl_min_ttl">postscreen_dnsbl_min_ttl</a>. </p>
|
|
|
|
<p> Specify a non-zero time value (an integral value plus an optional
|
|
one-letter suffix that specifies the time unit). Time units: s
|
|
(seconds), m (minutes), h (hours), d (days), w (weeks).
|
|
The default time unit is h (hours). </p>
|
|
|
|
<p> This feature is available in Postfix 3.1. The default setting
|
|
is backwards-compatible with older Postfix versions. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="postscreen_dnsbl_min_ttl">postscreen_dnsbl_min_ttl</a>
|
|
(default: 60s)</b></DT><DD>
|
|
|
|
<p> The minimum amount of time that <a href="postscreen.8.html">postscreen(8)</a> remembers that a
|
|
client IP address passed a DNS-based reputation test, before it
|
|
is required to pass that test again. If the DNS
|
|
reply specifies a larger TTL value, that value will be used unless
|
|
it would be larger than <a href="postconf.5.html#postscreen_dnsbl_max_ttl">postscreen_dnsbl_max_ttl</a>. </p>
|
|
|
|
<p> Specify a non-zero time value (an integral value plus an optional
|
|
one-letter suffix that specifies the time unit). Time units: s
|
|
(seconds), m (minutes), h (hours), d (days), w (weeks).
|
|
The default time unit is s (seconds). </p>
|
|
|
|
<p> This feature is available in Postfix 3.1. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="postscreen_dnsbl_reply_map">postscreen_dnsbl_reply_map</a>
|
|
(default: empty)</b></DT><DD>
|
|
|
|
<p> A mapping from an actual DNSBL domain name which includes a secret
|
|
password, to the DNSBL domain name that postscreen will reply with
|
|
when it rejects mail. When no mapping is found, the actual DNSBL
|
|
domain will be used. </p>
|
|
|
|
<p> For maximal stability it is best to use a file that is read
|
|
into memory such as <a href="pcre_table.5.html">pcre</a>:, <a href="regexp_table.5.html">regexp</a>: or <a href="DATABASE_README.html#types">texthash</a>: (<a href="DATABASE_README.html#types">texthash</a>: is similar
|
|
to <a href="DATABASE_README.html#types">hash</a>:, except a) there is no need to run <a href="postmap.1.html">postmap(1)</a> before the
|
|
file can be used, and b) <a href="DATABASE_README.html#types">texthash</a>: does not detect changes after
|
|
the file is read). </p>
|
|
|
|
<p> Example: </p>
|
|
|
|
<pre>
|
|
/etc/postfix/<a href="postconf.5.html">main.cf</a>:
|
|
<a href="postconf.5.html#postscreen_dnsbl_reply_map">postscreen_dnsbl_reply_map</a> = <a href="DATABASE_README.html#types">texthash</a>:/etc/postfix/dnsbl_reply
|
|
</pre>
|
|
|
|
<pre>
|
|
/etc/postfix/dnsbl_reply:
|
|
secret.zen.spamhaus.org zen.spamhaus.org
|
|
</pre>
|
|
|
|
<p> NOTE: This feature differs from the Postfix SMTP server's
|
|
<a href="postconf.5.html#rbl_reply_maps">rbl_reply_maps</a> feature, where 1) the table search key includes the
|
|
optional "<i>=address-filter</i>", and where 2) the lookup result
|
|
contains free text with <i>$name</i> variables. </p>
|
|
|
|
<p> This feature is available in Postfix 2.8. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="postscreen_dnsbl_sites">postscreen_dnsbl_sites</a>
|
|
(default: empty)</b></DT><DD>
|
|
|
|
<p>Optional list of patterns with DNS allow/denylist domains, filters
|
|
and weight
|
|
factors. When the list is non-empty, the <a href="dnsblog.8.html">dnsblog(8)</a> daemon will
|
|
query these domains with the reversed IP addresses of remote SMTP
|
|
clients,
|
|
and <a href="postscreen.8.html">postscreen(8)</a> will update an SMTP client's DNSBL score with
|
|
each non-error reply as described below. </p>
|
|
|
|
<p> Caution: when postscreen rejects mail, its SMTP response contains
|
|
the DNSBL
|
|
domain name. Use the <a href="postconf.5.html#postscreen_dnsbl_reply_map">postscreen_dnsbl_reply_map</a> feature to hide
|
|
"password" information in DNSBL domain names. </p>
|
|
|
|
<p> When a client's score is equal to or greater than the threshold
|
|
specified with <a href="postconf.5.html#postscreen_dnsbl_threshold">postscreen_dnsbl_threshold</a>, <a href="postscreen.8.html">postscreen(8)</a> can drop
|
|
the connection with the remote SMTP client. </p>
|
|
|
|
<p> Specify a list of domain=filter*weight patterns, separated by
|
|
comma or whitespace. </p>
|
|
|
|
<ul>
|
|
|
|
<li> <p> When a pattern specifies no "=filter", <a href="postscreen.8.html">postscreen(8)</a> will
|
|
use any non-error DNSBL query result. Otherwise, <a href="postscreen.8.html">postscreen(8)</a>
|
|
will use only DNSBL
|
|
query results that match the filter. The filter has the form d.d.d.d,
|
|
where each d is a number, or a pattern inside [] that contains one
|
|
or more ";"-separated numbers or number..number ranges. </p>
|
|
|
|
<li> <p> When a pattern specifies no "*weight", the weight of the
|
|
pattern is 1. Otherwise, the weight must be an integral number.
|
|
Specify a negative number for allowlisting. </p>
|
|
|
|
<li> <p> When a pattern matches one or more DNSBL query results,
|
|
<a href="postscreen.8.html">postscreen(8)</a> adds that pattern's weight once to the remote SMTP
|
|
client's DNSBL score. </p>
|
|
|
|
</ul>
|
|
|
|
<p> Examples: </p>
|
|
|
|
<p> To use example.com as a high-confidence blocklist, and to
|
|
block mail with example.net and example.org only when both agree:
|
|
</p>
|
|
|
|
<pre>
|
|
<a href="postconf.5.html#postscreen_dnsbl_threshold">postscreen_dnsbl_threshold</a> = 2
|
|
<a href="postconf.5.html#postscreen_dnsbl_sites">postscreen_dnsbl_sites</a> = example.com*2, example.net, example.org
|
|
</pre>
|
|
|
|
<p> To filter only DNSBL replies containing 127.0.0.4: </p>
|
|
|
|
<pre>
|
|
<a href="postconf.5.html#postscreen_dnsbl_sites">postscreen_dnsbl_sites</a> = example.com=127.0.0.4
|
|
</pre>
|
|
|
|
<p> This feature is available in Postfix 2.8. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="postscreen_dnsbl_threshold">postscreen_dnsbl_threshold</a>
|
|
(default: 1)</b></DT><DD>
|
|
|
|
<p> The inclusive lower bound for blocking a remote SMTP client, based on
|
|
its combined DNSBL score as defined with the <a href="postconf.5.html#postscreen_dnsbl_sites">postscreen_dnsbl_sites</a>
|
|
parameter. </p>
|
|
|
|
<p> This feature is available in Postfix 2.8. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="postscreen_dnsbl_timeout">postscreen_dnsbl_timeout</a>
|
|
(default: 10s)</b></DT><DD>
|
|
|
|
<p> The time limit for DNSBL or DNSWL lookups. This is separate from
|
|
the timeouts in the <a href="dnsblog.8.html">dnsblog(8)</a> daemon which are defined by system
|
|
resolver(3) routines. </p>
|
|
|
|
<p> Specify a non-zero time value (an integral value plus an optional
|
|
one-letter suffix that specifies the time unit). Time units: s
|
|
(seconds), m (minutes), h (hours), d (days), w (weeks).
|
|
The default time unit is s (seconds). </p>
|
|
|
|
<p> This feature is available in Postfix 3.0. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="postscreen_dnsbl_ttl">postscreen_dnsbl_ttl</a>
|
|
(default: 1h)</b></DT><DD>
|
|
|
|
<p> The amount of time that <a href="postscreen.8.html">postscreen(8)</a> remembers that a client
|
|
IP address passed a DNS-based reputation test, before it is required
|
|
to pass that test again. </p>
|
|
|
|
<p> Specify a non-zero time value (an integral value plus an optional
|
|
one-letter suffix that specifies the time unit). Time units: s
|
|
(seconds), m (minutes), h (hours), d (days), w (weeks).
|
|
The default time unit is h (hours). </p>
|
|
|
|
<p> This feature is available in Postfix 2.8-3.0. It was
|
|
replaced by <a href="postconf.5.html#postscreen_dnsbl_max_ttl">postscreen_dnsbl_max_ttl</a> in Postfix 3.1. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="postscreen_dnsbl_whitelist_threshold">postscreen_dnsbl_whitelist_threshold</a>
|
|
(default: 0)</b></DT><DD>
|
|
|
|
<p> Renamed to <a href="postconf.5.html#postscreen_dnsbl_allowlist_threshold">postscreen_dnsbl_allowlist_threshold</a> in Postfix 3.6. </p>
|
|
|
|
<p> This feature is available in Postfix 2.11 - 3.5. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="postscreen_enforce_tls">postscreen_enforce_tls</a>
|
|
(default: $<a href="postconf.5.html#smtpd_enforce_tls">smtpd_enforce_tls</a>)</b></DT><DD>
|
|
|
|
<p> Mandatory TLS: announce STARTTLS support to remote SMTP clients, and
|
|
require that clients use TLS encryption. See smtpd_postscreen_enforce_tls
|
|
for details. </p>
|
|
|
|
<p> This feature is available in Postfix 2.8 and later.
|
|
Preferably, use <a href="postconf.5.html#postscreen_tls_security_level">postscreen_tls_security_level</a> instead. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="postscreen_expansion_filter">postscreen_expansion_filter</a>
|
|
(default: see "postconf -d" output)</b></DT><DD>
|
|
|
|
<p> List of characters that are permitted in <a href="postconf.5.html#postscreen_reject_footer">postscreen_reject_footer</a>
|
|
attribute expansions. See <a href="postconf.5.html#smtpd_expansion_filter">smtpd_expansion_filter</a> for further
|
|
details. </p>
|
|
|
|
<p> This feature is available in Postfix 2.8 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="postscreen_forbidden_commands">postscreen_forbidden_commands</a>
|
|
(default: $<a href="postconf.5.html#smtpd_forbidden_commands">smtpd_forbidden_commands</a>)</b></DT><DD>
|
|
|
|
<p> List of commands that the <a href="postscreen.8.html">postscreen(8)</a> server considers in
|
|
violation of the SMTP protocol. See <a href="postconf.5.html#smtpd_forbidden_commands">smtpd_forbidden_commands</a> for
|
|
syntax, and <a href="postconf.5.html#postscreen_non_smtp_command_action">postscreen_non_smtp_command_action</a> for possible actions.
|
|
</p>
|
|
|
|
<p> This feature is available in Postfix 2.8. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="postscreen_greet_action">postscreen_greet_action</a>
|
|
(default: ignore)</b></DT><DD>
|
|
|
|
<p>The action that <a href="postscreen.8.html">postscreen(8)</a> takes when a remote SMTP client speaks
|
|
before its turn within the time specified with the <a href="postconf.5.html#postscreen_greet_wait">postscreen_greet_wait</a>
|
|
parameter. Specify one of the following: </p>
|
|
|
|
<dl>
|
|
|
|
<dt> <b>ignore</b> (default) </dt>
|
|
|
|
<dd> Ignore the failure of this test. Allow other tests to complete.
|
|
Repeat this test the next time the client connects.
|
|
This option is useful for testing and collecting statistics
|
|
without blocking mail. </dd>
|
|
|
|
<dt> <b>enforce</b> </dt>
|
|
|
|
<dd> Allow other tests to complete. Reject attempts to deliver mail
|
|
with a 550 SMTP reply, and log the helo/sender/recipient information.
|
|
Repeat this test the next time the client connects. </dd>
|
|
|
|
<dt> <b>drop</b> </dt>
|
|
|
|
<dd> Drop the connection immediately with a 521 SMTP reply. Repeat
|
|
this test the next time the client connects. </dd>
|
|
|
|
</dl>
|
|
|
|
<p> In either case, <a href="postscreen.8.html">postscreen(8)</a> will not allowlist the remote SMTP client
|
|
IP address. </p>
|
|
|
|
<p> This feature is available in Postfix 2.8. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="postscreen_greet_banner">postscreen_greet_banner</a>
|
|
(default: $<a href="postconf.5.html#smtpd_banner">smtpd_banner</a>)</b></DT><DD>
|
|
|
|
<p> The <i>text</i> in the optional "220-<i>text</i>..." server
|
|
response that
|
|
<a href="postscreen.8.html">postscreen(8)</a> sends ahead of the real Postfix SMTP server's "220
|
|
text..." response, in an attempt to confuse bad SMTP clients so
|
|
that they speak before their turn (pre-greet). Specify an empty
|
|
value to disable this feature. </p>
|
|
|
|
<p> This feature is available in Postfix 2.8. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="postscreen_greet_ttl">postscreen_greet_ttl</a>
|
|
(default: 1d)</b></DT><DD>
|
|
|
|
<p> The amount of time that <a href="postscreen.8.html">postscreen(8)</a> remembers that a client
|
|
IP address passed a PREGREET test, before it is required to pass
|
|
that test again. The default is relatively short, because
|
|
a good client can immediately talk to a real Postfix SMTP server. </p>
|
|
|
|
<p> Specify a non-zero time value (an integral value plus an optional
|
|
one-letter suffix that specifies the time unit). Time units: s
|
|
(seconds), m (minutes), h (hours), d (days), w (weeks).
|
|
The default time unit is d (days). </p>
|
|
|
|
<p> This feature is available in Postfix 2.8. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="postscreen_greet_wait">postscreen_greet_wait</a>
|
|
(default: normal: 6s, <a href="STRESS_README.html">overload</a>: 2s)</b></DT><DD>
|
|
|
|
<p> The amount of time that <a href="postscreen.8.html">postscreen(8)</a> will wait for an SMTP
|
|
client to send a command before its turn, and for DNS blocklist
|
|
lookup results to arrive (default: up to 2 seconds under stress,
|
|
up to 6 seconds otherwise). <p>
|
|
|
|
<p> Specify a non-zero time value (an integral value plus an optional
|
|
one-letter suffix that specifies the time unit). Time units: s
|
|
(seconds), m (minutes), h (hours), d (days), w (weeks).
|
|
The default time unit is s (seconds). </p>
|
|
|
|
<p> This feature is available in Postfix 2.8. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="postscreen_helo_required">postscreen_helo_required</a>
|
|
(default: $<a href="postconf.5.html#smtpd_helo_required">smtpd_helo_required</a>)</b></DT><DD>
|
|
|
|
<p> Require that a remote SMTP client sends HELO or EHLO before
|
|
commencing a MAIL transaction. </p>
|
|
|
|
<p> This feature is available in Postfix 2.8. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="postscreen_non_smtp_command_action">postscreen_non_smtp_command_action</a>
|
|
(default: drop)</b></DT><DD>
|
|
|
|
<p> The action that <a href="postscreen.8.html">postscreen(8)</a> takes when a remote SMTP client sends
|
|
non-SMTP commands as specified with the <a href="postconf.5.html#postscreen_forbidden_commands">postscreen_forbidden_commands</a>
|
|
parameter. Specify one of the following: </p>
|
|
|
|
<dl>
|
|
|
|
<dt> <b>ignore</b> </dt>
|
|
|
|
<dd> Ignore the failure of this test. Allow other tests to complete.
|
|
Do <i>not</i> repeat this test before the result from some
|
|
other test expires.
|
|
This option is useful for testing and collecting statistics
|
|
without blocking mail permanently. </dd>
|
|
|
|
<dt> <b>enforce</b> </dt>
|
|
|
|
<dd> Allow other tests to complete. Reject attempts to deliver mail
|
|
with a 550 SMTP reply, and log the helo/sender/recipient information.
|
|
Repeat this test the next time the client connects. </dd>
|
|
|
|
<dt> <b>drop</b> </dt>
|
|
|
|
<dd> Drop the connection immediately with a 521 SMTP reply. Repeat
|
|
this test the next time the client connects. This action is the
|
|
same as with the Postfix SMTP server's <a href="postconf.5.html#smtpd_forbidden_commands">smtpd_forbidden_commands</a>
|
|
feature. </dd>
|
|
|
|
</dl>
|
|
|
|
<p> This feature is available in Postfix 2.8. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="postscreen_non_smtp_command_enable">postscreen_non_smtp_command_enable</a>
|
|
(default: no)</b></DT><DD>
|
|
|
|
<p> Enable "non-SMTP command" tests in the <a href="postscreen.8.html">postscreen(8)</a> server. These
|
|
tests are expensive: a client must disconnect after it passes the
|
|
test, before it can talk to a real Postfix SMTP server. </p>
|
|
|
|
<p> This feature is available in Postfix 2.8. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="postscreen_non_smtp_command_ttl">postscreen_non_smtp_command_ttl</a>
|
|
(default: 30d)</b></DT><DD>
|
|
|
|
<p> The amount of time that <a href="postscreen.8.html">postscreen(8)</a> remembers that a client
|
|
IP address passed a "non_smtp_command" SMTP protocol test, before
|
|
it is required to pass that test again. The default
|
|
is long because a client must disconnect after it passes the test,
|
|
before it can talk to a real Postfix SMTP server. </p>
|
|
|
|
<p> Specify a non-zero time value (an integral value plus an optional
|
|
one-letter suffix that specifies the time unit). Time units: s
|
|
(seconds), m (minutes), h (hours), d (days), w (weeks).
|
|
The default time unit is d (days). </p>
|
|
|
|
<p> This feature is available in Postfix 2.8. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="postscreen_pipelining_action">postscreen_pipelining_action</a>
|
|
(default: enforce)</b></DT><DD>
|
|
|
|
<p> The action that <a href="postscreen.8.html">postscreen(8)</a> takes when a remote SMTP client
|
|
sends
|
|
multiple commands instead of sending one command and waiting for
|
|
the server to respond. Specify one of the following: </p>
|
|
|
|
<dl>
|
|
|
|
<dt> <b>ignore</b> </dt>
|
|
|
|
<dd> Ignore the failure of this test. Allow other tests to complete.
|
|
Do <i>not</i> repeat this test before the result from some
|
|
other test expires.
|
|
This option is useful for testing and collecting statistics
|
|
without blocking mail permanently. </dd>
|
|
|
|
<dt> <b>enforce</b> </dt>
|
|
|
|
<dd> Allow other tests to complete. Reject attempts to deliver mail
|
|
with a 550 SMTP reply, and log the helo/sender/recipient information.
|
|
Repeat this test the next time the client connects. </dd>
|
|
|
|
<dt> <b>drop</b> </dt>
|
|
|
|
<dd> Drop the connection immediately with a 521 SMTP reply. Repeat
|
|
this test the next time the client connects. </dd>
|
|
|
|
</dl>
|
|
|
|
<p> This feature is available in Postfix 2.8. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="postscreen_pipelining_enable">postscreen_pipelining_enable</a>
|
|
(default: no)</b></DT><DD>
|
|
|
|
<p> Enable "pipelining" SMTP protocol tests in the <a href="postscreen.8.html">postscreen(8)</a>
|
|
server. These tests are expensive: a good client must disconnect
|
|
after it passes the test, before it can talk to a real Postfix SMTP
|
|
server. </p>
|
|
|
|
<p> This feature is available in Postfix 2.8. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="postscreen_pipelining_ttl">postscreen_pipelining_ttl</a>
|
|
(default: 30d)</b></DT><DD>
|
|
|
|
<p> The amount of time that <a href="postscreen.8.html">postscreen(8)</a> remembers that a client
|
|
IP address passed a "pipelining" SMTP protocol test, before it is
|
|
required to pass that test again. The default is
|
|
long because a good client must disconnect after it passes the test,
|
|
before it can talk to a real Postfix SMTP server. </p>
|
|
|
|
<p> Specify a non-zero time value (an integral value plus an optional
|
|
one-letter suffix that specifies the time unit). Time units: s
|
|
(seconds), m (minutes), h (hours), d (days), w (weeks).
|
|
The default time unit is d (days). </p>
|
|
|
|
<p> This feature is available in Postfix 2.8. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="postscreen_post_queue_limit">postscreen_post_queue_limit</a>
|
|
(default: $<a href="postconf.5.html#default_process_limit">default_process_limit</a>)</b></DT><DD>
|
|
|
|
<p> The number of clients that can be waiting for service from a
|
|
real Postfix SMTP server process. When this queue is full, all
|
|
clients will
|
|
receive a 421 response. </p>
|
|
|
|
<p> This feature is available in Postfix 2.8. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="postscreen_pre_queue_limit">postscreen_pre_queue_limit</a>
|
|
(default: $<a href="postconf.5.html#default_process_limit">default_process_limit</a>)</b></DT><DD>
|
|
|
|
<p> The number of non-allowlisted clients that can be waiting for
|
|
a decision whether they will receive service from a real Postfix
|
|
SMTP server
|
|
process. When this queue is full, all non-allowlisted clients will
|
|
receive a 421 response. </p>
|
|
|
|
<p> This feature is available in Postfix 2.8. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="postscreen_reject_footer">postscreen_reject_footer</a>
|
|
(default: $<a href="postconf.5.html#smtpd_reject_footer">smtpd_reject_footer</a>)</b></DT><DD>
|
|
|
|
<p> Optional information that is appended after a 4XX or 5XX
|
|
<a href="postscreen.8.html">postscreen(8)</a> server
|
|
response. See <a href="postconf.5.html#smtpd_reject_footer">smtpd_reject_footer</a> for further details. </p>
|
|
|
|
<p> This feature is available in Postfix 2.8 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="postscreen_reject_footer_maps">postscreen_reject_footer_maps</a>
|
|
(default: $<a href="postconf.5.html#smtpd_reject_footer_maps">smtpd_reject_footer_maps</a>)</b></DT><DD>
|
|
|
|
<p> Optional lookup table for information that is appended after a 4XX
|
|
or 5XX <a href="postscreen.8.html">postscreen(8)</a> server response. See <a href="postconf.5.html#smtpd_reject_footer_maps">smtpd_reject_footer_maps</a> for
|
|
further details. </p>
|
|
|
|
<p> This feature is available in Postfix 3.4 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="postscreen_tls_security_level">postscreen_tls_security_level</a>
|
|
(default: $<a href="postconf.5.html#smtpd_tls_security_level">smtpd_tls_security_level</a>)</b></DT><DD>
|
|
|
|
<p> The SMTP TLS security level for the <a href="postscreen.8.html">postscreen(8)</a> server; when
|
|
a non-empty value is specified, this overrides the obsolete parameters
|
|
<a href="postconf.5.html#postscreen_use_tls">postscreen_use_tls</a> and <a href="postconf.5.html#postscreen_enforce_tls">postscreen_enforce_tls</a>. See <a href="postconf.5.html#smtpd_tls_security_level">smtpd_tls_security_level</a>
|
|
for details. </p>
|
|
|
|
<p> This feature is available in Postfix 2.8 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="postscreen_upstream_proxy_protocol">postscreen_upstream_proxy_protocol</a>
|
|
(default: empty)</b></DT><DD>
|
|
|
|
<p> The name of the proxy protocol used by an optional before-postscreen
|
|
proxy agent. When a proxy agent is used, this protocol conveys local
|
|
and remote address and port information. Specify
|
|
"<a href="postconf.5.html#postscreen_upstream_proxy_protocol">postscreen_upstream_proxy_protocol</a> = haproxy" to enable the haproxy
|
|
protocol; version 2 is supported with Postfix 3.5 and later. <p>
|
|
|
|
<p> This feature is available in Postfix 2.10 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="postscreen_upstream_proxy_timeout">postscreen_upstream_proxy_timeout</a>
|
|
(default: 5s)</b></DT><DD>
|
|
|
|
<p> The time limit for the proxy protocol specified with the
|
|
<a href="postconf.5.html#postscreen_upstream_proxy_protocol">postscreen_upstream_proxy_protocol</a> parameter. </p>
|
|
|
|
<p> This feature is available in Postfix 2.10 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="postscreen_use_tls">postscreen_use_tls</a>
|
|
(default: $<a href="postconf.5.html#smtpd_use_tls">smtpd_use_tls</a>)</b></DT><DD>
|
|
|
|
<p> Opportunistic TLS: announce STARTTLS support to remote SMTP clients,
|
|
but do not require that clients use TLS encryption. </p>
|
|
|
|
<p> This feature is available in Postfix 2.8 and later.
|
|
Preferably, use <a href="postconf.5.html#postscreen_tls_security_level">postscreen_tls_security_level</a> instead. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="postscreen_watchdog_timeout">postscreen_watchdog_timeout</a>
|
|
(default: 10s)</b></DT><DD>
|
|
|
|
<p> How much time a <a href="postscreen.8.html">postscreen(8)</a> process may take to respond to
|
|
a remote SMTP client command or to perform a cache operation before it
|
|
is terminated by a built-in watchdog timer. This is a safety
|
|
mechanism that prevents <a href="postscreen.8.html">postscreen(8)</a> from becoming non-responsive
|
|
due to a bug in Postfix itself or in system software. To avoid
|
|
false alarms and unnecessary cache corruption this limit cannot be
|
|
set under 10s. </p>
|
|
|
|
<p> Specify a non-zero time value (an integral value plus an optional
|
|
one-letter suffix that specifies the time unit). Time units: s
|
|
(seconds), m (minutes), h (hours), d (days), w (weeks).
|
|
The default time unit is s (seconds). </p>
|
|
|
|
<p> This feature is available in Postfix 2.8. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="postscreen_whitelist_interfaces">postscreen_whitelist_interfaces</a>
|
|
(default: <a href="DATABASE_README.html#types">static</a>:all)</b></DT><DD>
|
|
|
|
<p> Renamed to <a href="postconf.5.html#postscreen_allowlist_interfaces">postscreen_allowlist_interfaces</a> in Postfix 3.6. </p>
|
|
|
|
<p> This feature is available in Postfix 2.9 - 3.5. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="prepend_delivered_header">prepend_delivered_header</a>
|
|
(default: command, file, forward)</b></DT><DD>
|
|
|
|
<p> The message delivery contexts where the Postfix <a href="local.8.html">local(8)</a> delivery
|
|
agent prepends a Delivered-To: message header with the address
|
|
that the mail was delivered to. This information is used for mail
|
|
delivery loop detection. </p>
|
|
|
|
<p>
|
|
By default, the Postfix local delivery agent prepends a Delivered-To:
|
|
header when forwarding mail and when delivering to file (mailbox)
|
|
and command. Turning off the Delivered-To: header when forwarding
|
|
mail is not recommended.
|
|
</p>
|
|
|
|
<p>
|
|
Specify zero or more of <b>forward</b>, <b>file</b>, or <b>command</b>.
|
|
</p>
|
|
|
|
<p>
|
|
Example:
|
|
</p>
|
|
|
|
<pre>
|
|
<a href="postconf.5.html#prepend_delivered_header">prepend_delivered_header</a> = forward
|
|
</pre>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="process_id">process_id</a>
|
|
(read-only)</b></DT><DD>
|
|
|
|
<p>
|
|
The process ID of a Postfix command or daemon process.
|
|
</p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="process_id_directory">process_id_directory</a>
|
|
(default: pid)</b></DT><DD>
|
|
|
|
<p>
|
|
The location of Postfix PID files relative to $<a href="postconf.5.html#queue_directory">queue_directory</a>.
|
|
This is a read-only parameter.
|
|
</p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="process_name">process_name</a>
|
|
(read-only)</b></DT><DD>
|
|
|
|
<p>
|
|
The process name of a Postfix command or daemon process.
|
|
</p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="propagate_unmatched_extensions">propagate_unmatched_extensions</a>
|
|
(default: canonical, virtual)</b></DT><DD>
|
|
|
|
<p>
|
|
What address lookup tables copy an address extension from the lookup
|
|
key to the lookup result.
|
|
</p>
|
|
|
|
<p>
|
|
For example, with a <a href="virtual.5.html">virtual(5)</a> mapping of "<i>joe@example.com =>
|
|
joe.user@example.net</i>", the address "<i>joe+foo@example.com</i>"
|
|
would rewrite to "<i>joe.user+foo@example.net</i>".
|
|
</p>
|
|
|
|
<p>
|
|
Specify zero or more of <b>canonical</b>, <b>virtual</b>, <b>alias</b>,
|
|
<b>forward</b>, <b>include</b> or <b>generic</b>. These cause
|
|
address extension
|
|
propagation with <a href="canonical.5.html">canonical(5)</a>, <a href="virtual.5.html">virtual(5)</a>, and <a href="aliases.5.html">aliases(5)</a> maps,
|
|
with <a href="local.8.html">local(8)</a> .forward and :include: file lookups, and with <a href="smtp.8.html">smtp(8)</a>
|
|
generic maps, respectively. </p>
|
|
|
|
<p>
|
|
Note: enabling this feature for types other than <b>canonical</b>
|
|
and <b>virtual</b> is likely to cause problems when mail is forwarded
|
|
to other sites, especially with mail that is sent to a mailing list
|
|
exploder address.
|
|
</p>
|
|
|
|
<p>
|
|
Examples:
|
|
</p>
|
|
|
|
<pre>
|
|
<a href="postconf.5.html#propagate_unmatched_extensions">propagate_unmatched_extensions</a> = canonical, virtual, alias,
|
|
forward, include
|
|
<a href="postconf.5.html#propagate_unmatched_extensions">propagate_unmatched_extensions</a> = canonical, virtual
|
|
</pre>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="proxy_interfaces">proxy_interfaces</a>
|
|
(default: empty)</b></DT><DD>
|
|
|
|
<p>
|
|
The remote network interface addresses that this mail system receives mail
|
|
on by way of a proxy or network address translation unit.
|
|
</p>
|
|
|
|
<p>
|
|
This feature is available in Postfix 2.0 and later.
|
|
</p>
|
|
|
|
<p> You must specify your "outside" proxy/NAT addresses when your
|
|
system is a backup MX host for other domains, otherwise mail delivery
|
|
loops will happen when the primary MX host is down. </p>
|
|
|
|
<p>
|
|
Example:
|
|
</p>
|
|
|
|
<pre>
|
|
<a href="postconf.5.html#proxy_interfaces">proxy_interfaces</a> = 1.2.3.4
|
|
</pre>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="proxy_read_maps">proxy_read_maps</a>
|
|
(default: see "postconf -d" output)</b></DT><DD>
|
|
|
|
<p>
|
|
The lookup tables that the <a href="proxymap.8.html">proxymap(8)</a> server is allowed to
|
|
access for the read-only service.
|
|
</p>
|
|
|
|
<p>
|
|
Specify zero or more "type:name" lookup tables, separated by
|
|
whitespace or comma.
|
|
Table references that don't begin with <a href="proxymap.8.html">proxy</a>: are ignored.
|
|
</p>
|
|
|
|
<p>
|
|
This feature is available in Postfix 2.0 and later.
|
|
</p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="proxy_write_maps">proxy_write_maps</a>
|
|
(default: see "postconf -d" output)</b></DT><DD>
|
|
|
|
<p> The lookup tables that the <a href="proxymap.8.html">proxymap(8)</a> server is allowed to
|
|
access for the read-write service. Postfix-owned local database
|
|
files should be stored under the Postfix-owned <a href="postconf.5.html#data_directory">data_directory</a>.
|
|
Table references that don't begin with <a href="proxymap.8.html">proxy</a>: are ignored. </p>
|
|
|
|
<p>
|
|
This feature is available in Postfix 2.5 and later.
|
|
</p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="proxymap_service_name">proxymap_service_name</a>
|
|
(default: proxymap)</b></DT><DD>
|
|
|
|
<p> The name of the proxymap read-only table lookup service. This
|
|
service is normally implemented by the <a href="proxymap.8.html">proxymap(8)</a> daemon. </p>
|
|
|
|
<p> This feature is available in Postfix 2.6 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="proxywrite_service_name">proxywrite_service_name</a>
|
|
(default: proxywrite)</b></DT><DD>
|
|
|
|
<p> The name of the proxywrite read-write table lookup service.
|
|
This service is normally implemented by the <a href="proxymap.8.html">proxymap(8)</a> daemon.
|
|
</p>
|
|
|
|
<p> This feature is available in Postfix 2.6 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="qmgr_clog_warn_time">qmgr_clog_warn_time</a>
|
|
(default: 300s)</b></DT><DD>
|
|
|
|
<p>
|
|
The minimal delay between warnings that a specific destination is
|
|
clogging up the Postfix <a href="QSHAPE_README.html#active_queue">active queue</a>. Specify 0 to disable.
|
|
</p>
|
|
|
|
<p> Specify a non-negative time value (an integral value plus an optional
|
|
one-letter suffix that specifies the time unit). Time units: s
|
|
(seconds), m (minutes), h (hours), d (days), w (weeks).
|
|
The default time unit is s (seconds). </p>
|
|
|
|
<p>
|
|
This feature is enabled with the <a href="postconf.5.html#helpful_warnings">helpful_warnings</a> parameter.
|
|
</p>
|
|
|
|
<p>
|
|
This feature is available in Postfix 2.0 and later.
|
|
</p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="qmgr_daemon_timeout">qmgr_daemon_timeout</a>
|
|
(default: 1000s)</b></DT><DD>
|
|
|
|
<p> How much time a Postfix queue manager process may take to handle
|
|
a request before it is terminated by a built-in watchdog timer.
|
|
</p>
|
|
|
|
<p> Specify a non-zero time value (an integral value plus an optional
|
|
one-letter suffix that specifies the time unit). Time units: s
|
|
(seconds), m (minutes), h (hours), d (days), w (weeks).
|
|
The default time unit is s (seconds). </p>
|
|
|
|
<p> This feature is available in Postfix 2.8 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="qmgr_fudge_factor">qmgr_fudge_factor</a>
|
|
(default: 100)</b></DT><DD>
|
|
|
|
<p>
|
|
Obsolete feature: the percentage of delivery resources that a busy
|
|
mail system will use up for delivery of a large mailing list
|
|
message.
|
|
</p>
|
|
|
|
<p>
|
|
This feature exists only in the <a href="qmgr.8.html">oqmgr(8)</a> old queue manager. The
|
|
current queue manager solves the problem in a better way.
|
|
</p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="qmgr_ipc_timeout">qmgr_ipc_timeout</a>
|
|
(default: 60s)</b></DT><DD>
|
|
|
|
<p> The time limit for the queue manager to send or receive information
|
|
over an internal communication channel. The purpose is to break
|
|
out of deadlock situations. If the time limit is exceeded the
|
|
software either retries or aborts the operation. </p>
|
|
|
|
<p> Specify a non-zero time value (an integral value plus an optional
|
|
one-letter suffix that specifies the time unit). Time units: s
|
|
(seconds), m (minutes), h (hours), d (days), w (weeks).
|
|
The default time unit is s (seconds). </p>
|
|
|
|
<p> This feature is available in Postfix 2.8 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="qmgr_message_active_limit">qmgr_message_active_limit</a>
|
|
(default: 20000)</b></DT><DD>
|
|
|
|
<p>
|
|
The maximal number of messages in the <a href="QSHAPE_README.html#active_queue">active queue</a>.
|
|
</p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="qmgr_message_recipient_limit">qmgr_message_recipient_limit</a>
|
|
(default: 20000)</b></DT><DD>
|
|
|
|
<p> The maximal number of recipients held in memory by the Postfix
|
|
queue manager, and the maximal size of the short-term,
|
|
in-memory "dead" destination status cache. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="qmgr_message_recipient_minimum">qmgr_message_recipient_minimum</a>
|
|
(default: 10)</b></DT><DD>
|
|
|
|
<p>
|
|
The minimal number of in-memory recipients for any message. This
|
|
takes priority over any other in-memory recipient limits (i.e.,
|
|
the global <a href="postconf.5.html#qmgr_message_recipient_limit">qmgr_message_recipient_limit</a> and the per transport
|
|
_recipient_limit) if necessary. The minimum value allowed for this
|
|
parameter is 1.
|
|
</p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="qmqpd_authorized_clients">qmqpd_authorized_clients</a>
|
|
(default: empty)</b></DT><DD>
|
|
|
|
<p>
|
|
What remote QMQP clients are allowed to connect to the Postfix QMQP
|
|
server port.
|
|
</p>
|
|
|
|
<p>
|
|
By default, no client is allowed to use the service. This is
|
|
because the QMQP server will relay mail to any destination.
|
|
</p>
|
|
|
|
<p>
|
|
Specify a list of client patterns. A list pattern specifies a host
|
|
name, a domain name, an internet address, or a network/mask pattern,
|
|
where the mask specifies the number of bits in the network part.
|
|
When a pattern specifies a file name, its contents are substituted
|
|
for the file name; when a pattern is a "<a href="DATABASE_README.html">type:table</a>" table specification,
|
|
table lookup is used instead. </p>
|
|
|
|
<p>
|
|
Patterns are separated by whitespace and/or commas. In order to
|
|
reverse the result, precede a pattern with an
|
|
exclamation point (!). The form "!/file/name" is supported only
|
|
in Postfix version 2.4 and later.
|
|
</p>
|
|
|
|
<p> Pattern matching of domain names is controlled by the presence
|
|
or absence of "<a href="postconf.5.html#qmqpd_authorized_clients">qmqpd_authorized_clients</a>" in the
|
|
<a href="postconf.5.html#parent_domain_matches_subdomains">parent_domain_matches_subdomains</a> parameter value. </p>
|
|
|
|
<p>
|
|
Example:
|
|
</p>
|
|
|
|
<pre>
|
|
<a href="postconf.5.html#qmqpd_authorized_clients">qmqpd_authorized_clients</a> = !192.168.0.1, 192.168.0.0/24
|
|
</pre>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="qmqpd_client_port_logging">qmqpd_client_port_logging</a>
|
|
(default: no)</b></DT><DD>
|
|
|
|
<p> Enable logging of the remote QMQP client port in addition to
|
|
the hostname and IP address. The logging format is "host[address]:port".
|
|
</p>
|
|
|
|
<p> This feature is available in Postfix 2.5 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="qmqpd_error_delay">qmqpd_error_delay</a>
|
|
(default: 1s)</b></DT><DD>
|
|
|
|
<p>
|
|
How long the Postfix QMQP server will pause before sending a negative
|
|
reply to the remote QMQP client. The purpose is to slow down confused
|
|
or malicious clients.
|
|
</p>
|
|
|
|
<p> Specify a non-negative time value (an integral value plus an optional
|
|
one-letter suffix that specifies the time unit). Time units: s
|
|
(seconds), m (minutes), h (hours), d (days), w (weeks).
|
|
The default time unit is s (seconds). </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="qmqpd_timeout">qmqpd_timeout</a>
|
|
(default: 300s)</b></DT><DD>
|
|
|
|
<p>
|
|
The time limit for sending or receiving information over the network.
|
|
If a read or write operation blocks for more than $<a href="postconf.5.html#qmqpd_timeout">qmqpd_timeout</a>
|
|
seconds the Postfix QMQP server gives up and disconnects.
|
|
</p>
|
|
|
|
<p> Specify a non-zero time value (an integral value plus an optional
|
|
one-letter suffix that specifies the time unit). Time units: s
|
|
(seconds), m (minutes), h (hours), d (days), w (weeks).
|
|
The default time unit is s (seconds). </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="queue_directory">queue_directory</a>
|
|
(default: see "postconf -d" output)</b></DT><DD>
|
|
|
|
<p>
|
|
The location of the Postfix top-level queue directory. This is the
|
|
root directory of Postfix daemon processes that run chrooted.
|
|
</p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="queue_file_attribute_count_limit">queue_file_attribute_count_limit</a>
|
|
(default: 100)</b></DT><DD>
|
|
|
|
<p>
|
|
The maximal number of (name=value) attributes that may be stored
|
|
in a Postfix queue file. The limit is enforced by the <a href="cleanup.8.html">cleanup(8)</a>
|
|
server.
|
|
</p>
|
|
|
|
<p>
|
|
This feature is available in Postfix 2.0 and later.
|
|
</p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="queue_minfree">queue_minfree</a>
|
|
(default: 0)</b></DT><DD>
|
|
|
|
<p>
|
|
The minimal amount of free space in bytes in the queue file system
|
|
that is needed to receive mail. This is currently used by the
|
|
Postfix SMTP server to decide if it will accept any mail at all.
|
|
</p>
|
|
|
|
<p>
|
|
By default, the Postfix SMTP server rejects MAIL FROM commands when
|
|
the amount of free space is less than 1.5*$<a href="postconf.5.html#message_size_limit">message_size_limit</a>
|
|
(Postfix version 2.1 and later).
|
|
To specify a higher minimum free space limit, specify a <a href="postconf.5.html#queue_minfree">queue_minfree</a>
|
|
value that is at least 1.5*$<a href="postconf.5.html#message_size_limit">message_size_limit</a>.
|
|
</p>
|
|
|
|
<p>
|
|
With Postfix versions 2.0 and earlier, a <a href="postconf.5.html#queue_minfree">queue_minfree</a> value of
|
|
zero means there is no minimum required amount of free space.
|
|
</p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="queue_run_delay">queue_run_delay</a>
|
|
(default: 300s)</b></DT><DD>
|
|
|
|
<p>
|
|
The time between <a href="QSHAPE_README.html#deferred_queue">deferred queue</a> scans by the queue manager;
|
|
prior to Postfix 2.4 the default value was 1000s.
|
|
</p>
|
|
|
|
<p> This parameter should be set less than or equal to
|
|
$<a href="postconf.5.html#minimal_backoff_time">minimal_backoff_time</a>. See also $<a href="postconf.5.html#maximal_backoff_time">maximal_backoff_time</a>. </p>
|
|
|
|
<p> Specify a non-zero time value (an integral value plus an optional
|
|
one-letter suffix that specifies the time unit). Time units: s
|
|
(seconds), m (minutes), h (hours), d (days), w (weeks).
|
|
The default time unit is s (seconds). </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="queue_service_name">queue_service_name</a>
|
|
(default: qmgr)</b></DT><DD>
|
|
|
|
<p>
|
|
The name of the <a href="qmgr.8.html">qmgr(8)</a> service. This service manages the Postfix
|
|
queue and schedules delivery requests.
|
|
</p>
|
|
|
|
<p>
|
|
This feature is available in Postfix 2.0 and later.
|
|
</p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="rbl_reply_maps">rbl_reply_maps</a>
|
|
(default: empty)</b></DT><DD>
|
|
|
|
<p>
|
|
Optional lookup tables with RBL or RHSBL response templates. The
|
|
table search key is the reject_rbl_* or reject_rhsbl_* argument,
|
|
including any optional "<i>=address-filter</i>". With Postfix 3.10
|
|
and later, if the result is "not found" and the search key has the
|
|
form <i>domain=address-filter</i>, then <a href="postconf.5.html#rbl_reply_maps">rbl_reply_maps</a> will also
|
|
search with the <i>domain</i>. </p>
|
|
|
|
<p> By default, Postfix uses the
|
|
template as specified with the <a href="postconf.5.html#default_rbl_reply">default_rbl_reply</a> configuration
|
|
parameter. See there for a discussion of the response template
|
|
syntax.
|
|
</p>
|
|
|
|
<p> Example: </p>
|
|
|
|
<pre>
|
|
/etc/postfix/<a href="postconf.5.html">main.cf</a>:
|
|
<a href="postconf.5.html#rbl_reply_maps">rbl_reply_maps</a> = <a href="DATABASE_README.html#types">hash</a>:/etc/postfix/rbl_reply
|
|
<a href="postconf.5.html#smtpd_recipient_restrictions">smtpd_recipient_restrictions</a> =
|
|
<a href="postconf.5.html#permit_mynetworks">permit_mynetworks</a>,
|
|
<a href="postconf.5.html#reject_rbl_client">reject_rbl_client</a> <i>secret</i>.zen.dq.spamhaus.net=127.0.0.[2..11],
|
|
...
|
|
<br>
|
|
/etc/postfix/rbl_reply:
|
|
# See https://www.postfix.org/postconf.5.html#<a href="postconf.5.html#default_rbl_reply">default_rbl_reply</a>
|
|
# for the definition of the $client_address and $rbl_class etc.
|
|
# variables.
|
|
<i>secret</i>.zen.dq.spamhaus.net=127.0.0.[2..11]
|
|
554 $rbl_class $rbl_what blocked using ZEN - see <a href="https://www.spamhaus.org/query/ip/$client_address">https://www.spamhaus.org/query/ip/$client_address</a> for details
|
|
</pre>
|
|
|
|
<pre>
|
|
# Postfix ≥ 3.10: if a search key <i>domain=address-filter</i>
|
|
# is not found, then <a href="postconf.5.html#rbl_reply_maps">rbl_reply_maps</a> will also search with the
|
|
# <i>domain</i>.
|
|
<i>secret</i>.zen.dq.spamhaus.net
|
|
554 $rbl_class $rbl_what blocked using ZEN - see <a href="https://www.spamhaus.org/query/ip/$client_address">https://www.spamhaus.org/query/ip/$client_address</a> for details
|
|
</pre>
|
|
|
|
<p>
|
|
NOTE: This feature differs from <a href="postconf.5.html#postscreen_dnsbl_reply_map">postscreen_dnsbl_reply_map</a> where
|
|
the table search key is only a domain name (no "<i>=address-filter</i>",
|
|
no "<i>*weight</i>" factor) and where the lookup result
|
|
should be only a domain name (no free text, no <i>$name</i> variables).
|
|
</p>
|
|
|
|
<p>
|
|
This feature is available in Postfix 2.0 and later.
|
|
The "=address-filter" feature is available in Postfix 2.8 and later.
|
|
</p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="readme_directory">readme_directory</a>
|
|
(default: see "postconf -d" output)</b></DT><DD>
|
|
|
|
<p>
|
|
The location of Postfix README files that describe how to build,
|
|
configure or operate a specific Postfix subsystem or feature.
|
|
</p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="receive_override_options">receive_override_options</a>
|
|
(default: empty)</b></DT><DD>
|
|
|
|
<p> Enable or disable recipient validation, built-in content
|
|
filtering, or address mapping. Typically, these are specified in
|
|
<a href="master.5.html">master.cf</a> as command-line arguments for the <a href="smtpd.8.html">smtpd(8)</a>, <a href="qmqpd.8.html">qmqpd(8)</a> or
|
|
<a href="pickup.8.html">pickup(8)</a> daemons. </p>
|
|
|
|
<p> Specify zero or more of the following options. The options
|
|
override <a href="postconf.5.html">main.cf</a> settings and are either implemented by <a href="smtpd.8.html">smtpd(8)</a>,
|
|
<a href="qmqpd.8.html">qmqpd(8)</a>, or <a href="pickup.8.html">pickup(8)</a> themselves, or they are forwarded to the
|
|
cleanup server. </p>
|
|
|
|
<dl>
|
|
|
|
<dt><b><a name="no_unknown_recipient_checks">no_unknown_recipient_checks</a></b></dt>
|
|
|
|
<dd>Do not try to reject unknown recipients (SMTP server only).
|
|
This is typically specified AFTER an external content filter.
|
|
</dd>
|
|
|
|
<dt><b><a name="no_address_mappings">no_address_mappings</a></b></dt>
|
|
|
|
<dd>Disable canonical address mapping, virtual alias map expansion,
|
|
address masquerading, and automatic BCC (blind carbon-copy)
|
|
recipients. This is typically specified BEFORE an external content
|
|
filter. </dd>
|
|
|
|
<dt><b><a name="no_header_body_checks">no_header_body_checks</a></b></dt>
|
|
|
|
<dd>Disable header/body_checks. This is typically specified AFTER
|
|
an external content filter. </dd>
|
|
|
|
<dt><b><a name="no_milters">no_milters</a></b></dt>
|
|
|
|
<dd>Disable Milter (mail filter) applications. This is typically
|
|
specified AFTER an external content filter. </dd>
|
|
|
|
</dl>
|
|
|
|
<p>
|
|
Note: when the "BEFORE content filter" <a href="postconf.5.html#receive_override_options">receive_override_options</a>
|
|
setting is specified in the <a href="postconf.5.html">main.cf</a> file, specify the "AFTER content
|
|
filter" <a href="postconf.5.html#receive_override_options">receive_override_options</a> setting in <a href="master.5.html">master.cf</a> (and vice
|
|
versa).
|
|
</p>
|
|
|
|
<p>
|
|
Examples:
|
|
</p>
|
|
|
|
<pre>
|
|
<a href="postconf.5.html#receive_override_options">receive_override_options</a> =
|
|
<a href="postconf.5.html#no_unknown_recipient_checks">no_unknown_recipient_checks</a>, <a href="postconf.5.html#no_header_body_checks">no_header_body_checks</a>
|
|
<a href="postconf.5.html#receive_override_options">receive_override_options</a> = <a href="postconf.5.html#no_address_mappings">no_address_mappings</a>
|
|
</pre>
|
|
|
|
<p>
|
|
This feature is available in Postfix 2.1 and later.
|
|
</p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="recipient_bcc_maps">recipient_bcc_maps</a>
|
|
(default: empty)</b></DT><DD>
|
|
|
|
<p>
|
|
Optional BCC (blind carbon-copy) address lookup tables, indexed by
|
|
envelope recipient address. The BCC address (multiple results are not
|
|
supported) is added when mail enters from outside of Postfix.
|
|
</p>
|
|
|
|
<p>
|
|
Specify zero or more "type:name" lookup tables, separated by
|
|
whitespace or comma. Tables will be searched in the specified order
|
|
until a match is found.
|
|
</p>
|
|
|
|
<p>
|
|
The table search order is as follows:
|
|
</p>
|
|
|
|
<ul>
|
|
|
|
<li> Look up the "user+extension@domain.tld" address including the
|
|
optional address extension.
|
|
|
|
<li> Look up the "user@domain.tld" address without the optional
|
|
address extension.
|
|
|
|
<li> Look up the "user+extension" address local part when the
|
|
recipient domain equals $<a href="postconf.5.html#myorigin">myorigin</a>, $<a href="postconf.5.html#mydestination">mydestination</a>, $<a href="postconf.5.html#inet_interfaces">inet_interfaces</a>
|
|
or $<a href="postconf.5.html#proxy_interfaces">proxy_interfaces</a>.
|
|
|
|
<li> Look up the "user" address local part when the recipient domain
|
|
equals $<a href="postconf.5.html#myorigin">myorigin</a>, $<a href="postconf.5.html#mydestination">mydestination</a>, $<a href="postconf.5.html#inet_interfaces">inet_interfaces</a> or $<a href="postconf.5.html#proxy_interfaces">proxy_interfaces</a>.
|
|
|
|
<li> Look up the "@domain.tld" part.
|
|
|
|
</ul>
|
|
|
|
<p>
|
|
Note: with Postfix 2.3 and later the BCC address is added as if it
|
|
was specified with NOTIFY=NONE. The sender will not be notified
|
|
when the BCC address is undeliverable, as long as all down-stream
|
|
software implements <a href="https://tools.ietf.org/html/rfc3461">RFC 3461</a>.
|
|
</p>
|
|
|
|
<p>
|
|
Note: with Postfix 2.2 and earlier the sender will unconditionally
|
|
be notified when the BCC address is undeliverable.
|
|
</p>
|
|
|
|
<p> Note: automatic BCC recipients are produced only for new mail.
|
|
To avoid mailer loops, automatic BCC recipients are not generated
|
|
after Postfix forwards mail internally, or after Postfix generates
|
|
mail itself. </p>
|
|
|
|
<p> Note: automatic BCC recipients are subject to address
|
|
canonicalization (add missing domain), <a href="postconf.5.html#canonical_maps">canonical_maps</a>, <a href="postconf.5.html#masquerade_domains">masquerade_domains</a>,
|
|
and <a href="postconf.5.html#virtual_alias_maps">virtual_alias_maps</a>. </p>
|
|
|
|
<p>
|
|
Example:
|
|
</p>
|
|
|
|
<pre>
|
|
<a href="postconf.5.html#recipient_bcc_maps">recipient_bcc_maps</a> = <a href="DATABASE_README.html#types">hash</a>:/etc/postfix/recipient_bcc
|
|
</pre>
|
|
|
|
<p>
|
|
After a change, run "<b>postmap /etc/postfix/recipient_bcc</b>".
|
|
</p>
|
|
|
|
<p>
|
|
This feature is available in Postfix 2.1 and later.
|
|
</p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="recipient_canonical_classes">recipient_canonical_classes</a>
|
|
(default: envelope_recipient, header_recipient)</b></DT><DD>
|
|
|
|
<p> What addresses are subject to <a href="postconf.5.html#recipient_canonical_maps">recipient_canonical_maps</a> address
|
|
mapping. By default, <a href="postconf.5.html#recipient_canonical_maps">recipient_canonical_maps</a> address mapping is
|
|
applied to envelope recipient addresses, and to header recipient
|
|
addresses. </p>
|
|
|
|
<p> Specify one or more of: envelope_recipient, header_recipient
|
|
</p>
|
|
|
|
<p> This feature is available in Postfix 2.2 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="recipient_canonical_maps">recipient_canonical_maps</a>
|
|
(default: empty)</b></DT><DD>
|
|
|
|
<p>
|
|
Optional address mapping lookup tables for envelope and header
|
|
recipient addresses.
|
|
The table format and lookups are documented in <a href="canonical.5.html">canonical(5)</a>.
|
|
</p>
|
|
|
|
<p>
|
|
Note: $<a href="postconf.5.html#recipient_canonical_maps">recipient_canonical_maps</a> is processed before $<a href="postconf.5.html#canonical_maps">canonical_maps</a>.
|
|
</p>
|
|
|
|
<p>
|
|
Example:
|
|
</p>
|
|
|
|
<pre>
|
|
<a href="postconf.5.html#recipient_canonical_maps">recipient_canonical_maps</a> = <a href="DATABASE_README.html#types">hash</a>:/etc/postfix/recipient_canonical
|
|
</pre>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="recipient_delimiter">recipient_delimiter</a>
|
|
(default: empty)</b></DT><DD>
|
|
|
|
<p> The set of characters that can separate an email address
|
|
localpart, user name, or a .forward file name from its extension.
|
|
For example, with "<a href="postconf.5.html#recipient_delimiter">recipient_delimiter</a> = +", the software tries
|
|
user+foo@example.com before trying user@example.com, user+foo before
|
|
trying user, and .forward+foo before trying .forward. </p>
|
|
|
|
<p> More formally, an email address localpart or user name is
|
|
separated from its extension by the first character that matches
|
|
the <a href="postconf.5.html#recipient_delimiter">recipient_delimiter</a> set. The delimiter character and extension
|
|
may then be used to generate an extended .forward file name. This
|
|
implementation recognizes one delimiter character and one extension
|
|
per email address localpart or email address. With Postfix 2.10 and
|
|
earlier, the <a href="postconf.5.html#recipient_delimiter">recipient_delimiter</a> specifies a single character. </p>
|
|
|
|
<p> See <a href="canonical.5.html">canonical(5)</a>, <a href="local.8.html">local(8)</a>, <a href="relocated.5.html">relocated(5)</a> and <a href="virtual.5.html">virtual(5)</a> for the
|
|
effects of <a href="postconf.5.html#recipient_delimiter">recipient_delimiter</a> on lookups in aliases, canonical,
|
|
virtual, and relocated maps, and see the <a href="postconf.5.html#propagate_unmatched_extensions">propagate_unmatched_extensions</a>
|
|
parameter for propagating an extension from one email address to
|
|
another. </p>
|
|
|
|
<p> When used in <a href="postconf.5.html#command_execution_directory">command_execution_directory</a>, <a href="postconf.5.html#forward_path">forward_path</a>, or
|
|
<a href="postconf.5.html#luser_relay">luser_relay</a>, ${<a href="postconf.5.html#recipient_delimiter">recipient_delimiter</a>} is replaced with the actual
|
|
recipient delimiter that was found in the recipient email address
|
|
(Postfix 2.11 and later), or it is replaced with the <a href="postconf.5.html">main.cf</a>
|
|
<a href="postconf.5.html#recipient_delimiter">recipient_delimiter</a> parameter value (Postfix 2.10 and earlier).
|
|
</p>
|
|
|
|
<p> The <a href="postconf.5.html#recipient_delimiter">recipient_delimiter</a> is not applied to the mailer-daemon
|
|
address, the postmaster address, or the double-bounce address. With
|
|
the default "<a href="postconf.5.html#owner_request_special">owner_request_special</a> = yes" setting, the <a href="postconf.5.html#recipient_delimiter">recipient_delimiter</a>
|
|
is also not applied to addresses with the special "owner-" prefix
|
|
or the special "-request" suffix. </p>
|
|
|
|
<p>
|
|
Examples:
|
|
</p>
|
|
|
|
<pre>
|
|
# Handle Postfix-style extensions.
|
|
<a href="postconf.5.html#recipient_delimiter">recipient_delimiter</a> = +
|
|
</pre>
|
|
|
|
<pre>
|
|
# Handle both Postfix and qmail extensions (Postfix 2.11 and later).
|
|
<a href="postconf.5.html#recipient_delimiter">recipient_delimiter</a> = +-
|
|
</pre>
|
|
|
|
<pre>
|
|
# Use .forward for mail without address extension, and for mail with
|
|
# an unrecognized address extension.
|
|
<a href="postconf.5.html#forward_path">forward_path</a> = $home/.forward${<a href="postconf.5.html#recipient_delimiter">recipient_delimiter</a>}${extension},
|
|
$home/.forward
|
|
</pre>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="reject_code">reject_code</a>
|
|
(default: 554)</b></DT><DD>
|
|
|
|
<p>
|
|
The numerical Postfix SMTP server response code when a remote SMTP
|
|
client request is rejected by the "reject" restriction.
|
|
</p>
|
|
|
|
<p>
|
|
Do not change this unless you have a complete understanding of <a href="https://tools.ietf.org/html/rfc5321">RFC 5321</a>.
|
|
</p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="reject_tempfail_action">reject_tempfail_action</a>
|
|
(default: <a href="postconf.5.html#defer_if_permit">defer_if_permit</a>)</b></DT><DD>
|
|
|
|
<p> The Postfix SMTP server's action when a reject-type restriction
|
|
fails due to a temporary error condition. Specify "defer" to defer
|
|
the remote SMTP client request immediately. With the default
|
|
"<a href="postconf.5.html#defer_if_permit">defer_if_permit</a>" action, the Postfix SMTP server continues to look
|
|
for opportunities to reject mail, and defers the client request
|
|
only if it would otherwise be accepted. </p>
|
|
|
|
<p> For finer control, see: <a href="postconf.5.html#unverified_recipient_tempfail_action">unverified_recipient_tempfail_action</a>,
|
|
<a href="postconf.5.html#unverified_sender_tempfail_action">unverified_sender_tempfail_action</a>, <a href="postconf.5.html#unknown_address_tempfail_action">unknown_address_tempfail_action</a>,
|
|
and <a href="postconf.5.html#unknown_helo_hostname_tempfail_action">unknown_helo_hostname_tempfail_action</a>. </p>
|
|
|
|
<p> This feature is available in Postfix 2.6 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="relay_clientcerts">relay_clientcerts</a>
|
|
(default: empty)</b></DT><DD>
|
|
|
|
<p> List of tables with remote SMTP client-certificate fingerprints or
|
|
public key fingerprints (Postfix 2.9 and later) for which the Postfix
|
|
SMTP server will allow access with the <a href="postconf.5.html#permit_tls_clientcerts">permit_tls_clientcerts</a>
|
|
feature. The fingerprint digest algorithm is configurable via the
|
|
<a href="postconf.5.html#smtpd_tls_fingerprint_digest">smtpd_tls_fingerprint_digest</a> parameter (hard-coded as md5 prior to
|
|
Postfix version 2.5). </p>
|
|
|
|
<p> The default algorithm is <b>sha256</b> with Postfix ≥ 3.6
|
|
and the <b><a href="postconf.5.html#compatibility_level">compatibility_level</a></b> set to 3.6 or higher. With Postfix
|
|
≤ 3.5, the default algorithm is <b>md5</b>. The best-practice
|
|
algorithm is now <b>sha256</b>. Recent advances in hash function
|
|
cryptanalysis have led to md5 and sha1 being deprecated in favor of
|
|
sha256. However, as long as there are no known "second pre-image"
|
|
attacks against the older algorithms, their use in this context, though
|
|
not recommended, is still likely safe. </p>
|
|
|
|
<p> Postfix lookup tables are in the form of (key, value) pairs.
|
|
Since we only need the key, the value can be chosen freely, e.g.
|
|
the name of the user or host:
|
|
D7:04:2F:A7:0B:8C:A5:21:FA:31:77:E1:41:8A:EE:80 lutzpc.at.home </p>
|
|
|
|
<p> Example: </p>
|
|
|
|
<pre>
|
|
<a href="postconf.5.html#relay_clientcerts">relay_clientcerts</a> = <a href="DATABASE_README.html#types">hash</a>:/etc/postfix/relay_clientcerts
|
|
</pre>
|
|
|
|
<p>For more fine-grained control, use <a href="postconf.5.html#check_ccert_access">check_ccert_access</a> to select
|
|
an appropriate <a href="access.5.html">access(5)</a> policy for each client.
|
|
See <a href="RESTRICTION_CLASS_README.html">RESTRICTION_CLASS_README</a>.</p>
|
|
|
|
<p>This feature is available with Postfix version 2.2.</p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="relay_destination_concurrency_limit">relay_destination_concurrency_limit</a>
|
|
(default: $<a href="postconf.5.html#default_destination_concurrency_limit">default_destination_concurrency_limit</a>)</b></DT><DD>
|
|
|
|
<p> The maximal number of parallel deliveries to the same destination
|
|
via the relay message delivery transport. This limit is enforced
|
|
by the queue manager. The message delivery transport name is the
|
|
first field in the entry in the <a href="master.5.html">master.cf</a> file. </p>
|
|
|
|
<p> This feature is available in Postfix 2.0 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="relay_destination_recipient_limit">relay_destination_recipient_limit</a>
|
|
(default: $<a href="postconf.5.html#default_destination_recipient_limit">default_destination_recipient_limit</a>)</b></DT><DD>
|
|
|
|
<p> The maximal number of recipients per message for the relay
|
|
message delivery transport. This limit is enforced by the queue
|
|
manager. The message delivery transport name is the first field in
|
|
the entry in the <a href="master.5.html">master.cf</a> file. </p>
|
|
|
|
<p> Setting this parameter to a value of 1 changes the meaning of
|
|
<a href="postconf.5.html#relay_destination_concurrency_limit">relay_destination_concurrency_limit</a> from concurrency per domain
|
|
into concurrency per recipient. </p>
|
|
|
|
<p> This feature is available in Postfix 2.0 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="relay_domains">relay_domains</a>
|
|
(default: Postfix ≥ 3.0: empty, Postfix < 3.0: $<a href="postconf.5.html#mydestination">mydestination</a>)</b></DT><DD>
|
|
|
|
<p> What destination domains (and subdomains thereof) this system
|
|
will relay mail to. For details about how
|
|
the <a href="postconf.5.html#relay_domains">relay_domains</a> value is used, see the description of the
|
|
<a href="postconf.5.html#permit_auth_destination">permit_auth_destination</a> and <a href="postconf.5.html#reject_unauth_destination">reject_unauth_destination</a> SMTP recipient
|
|
restrictions. </p>
|
|
|
|
<p> Domains that match $<a href="postconf.5.html#relay_domains">relay_domains</a> are delivered with the
|
|
$<a href="postconf.5.html#relay_transport">relay_transport</a> mail delivery transport. The SMTP server validates
|
|
recipient addresses with $<a href="postconf.5.html#relay_recipient_maps">relay_recipient_maps</a> and rejects non-existent
|
|
recipients. See also the <a href="ADDRESS_CLASS_README.html#relay_domain_class">relay domains</a> address class in the
|
|
<a href="ADDRESS_CLASS_README.html">ADDRESS_CLASS_README</a> file. </p>
|
|
|
|
<p> Note: Postfix will not automatically forward mail for domains
|
|
that list this system as their primary or backup MX host. See the
|
|
<a href="postconf.5.html#permit_mx_backup">permit_mx_backup</a> restriction in the <a href="postconf.5.html">postconf(5)</a> manual page. </p>
|
|
|
|
<p> Specify a list of host or domain names, "/file/name" patterns
|
|
or "<a href="DATABASE_README.html">type:table</a>" lookup tables, separated by commas and/or whitespace.
|
|
Continue long lines by starting the next line with whitespace. A
|
|
"/file/name" pattern is replaced by its contents; a "<a href="DATABASE_README.html">type:table</a>"
|
|
lookup table is matched when a (parent) domain appears as lookup
|
|
key. Specify "!pattern" to exclude a domain from the list. The form
|
|
"!/file/name" is supported only in Postfix version 2.4 and later.
|
|
</p>
|
|
|
|
<p> Pattern matching of domain names is controlled by the presence
|
|
or absence of "<a href="postconf.5.html#relay_domains">relay_domains</a>" in the <a href="postconf.5.html#parent_domain_matches_subdomains">parent_domain_matches_subdomains</a>
|
|
parameter value. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="relay_domains_reject_code">relay_domains_reject_code</a>
|
|
(default: 554)</b></DT><DD>
|
|
|
|
<p>
|
|
The numerical Postfix SMTP server response code when a client
|
|
request is rejected by the <a href="postconf.5.html#reject_unauth_destination">reject_unauth_destination</a> recipient
|
|
restriction.
|
|
</p>
|
|
|
|
<p>
|
|
Do not change this unless you have a complete understanding of <a href="https://tools.ietf.org/html/rfc5321">RFC 5321</a>.
|
|
</p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="relay_recipient_maps">relay_recipient_maps</a>
|
|
(default: empty)</b></DT><DD>
|
|
|
|
<p> Optional lookup tables with all valid addresses in the domains
|
|
that match $<a href="postconf.5.html#relay_domains">relay_domains</a>. Specify @domain as a wild-card for
|
|
domains that have no valid recipient list, and become a source of
|
|
backscatter mail: Postfix accepts spam for non-existent recipients
|
|
and then floods innocent people with undeliverable mail. Technically,
|
|
tables
|
|
listed with $<a href="postconf.5.html#relay_recipient_maps">relay_recipient_maps</a> are used as lists: Postfix needs
|
|
to know only if a lookup string is found or not, but it does not
|
|
use the result from the table lookup. </p>
|
|
|
|
<p>
|
|
Specify zero or more "type:name" lookup tables, separated by
|
|
whitespace or comma. Tables will be searched in the specified order
|
|
until a match is found.
|
|
</p>
|
|
|
|
<p>
|
|
If this parameter is non-empty, then the Postfix SMTP server will reject
|
|
mail to unknown relay users. This feature is off by default.
|
|
</p>
|
|
|
|
<p>
|
|
See also the <a href="ADDRESS_CLASS_README.html#relay_domain_class">relay domains</a> address class in the <a href="ADDRESS_CLASS_README.html">ADDRESS_CLASS_README</a>
|
|
file.
|
|
</p>
|
|
|
|
<p>
|
|
Example:
|
|
</p>
|
|
|
|
<pre>
|
|
<a href="postconf.5.html#relay_recipient_maps">relay_recipient_maps</a> = <a href="DATABASE_README.html#types">hash</a>:/etc/postfix/relay_recipients
|
|
</pre>
|
|
|
|
<p>
|
|
This feature is available in Postfix 2.0 and later.
|
|
</p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="relay_transport">relay_transport</a>
|
|
(default: relay)</b></DT><DD>
|
|
|
|
<p>
|
|
The default mail delivery transport and next-hop destination for
|
|
the <a href="ADDRESS_CLASS_README.html#relay_domain_class">relay domain</a> address class: recipient domains that match
|
|
$<a href="postconf.5.html#relay_domains">relay_domains</a>. </p>
|
|
|
|
<p> For recipient domains in the <a href="ADDRESS_CLASS_README.html#relay_domain_class">relay domain</a> address class: </p>
|
|
|
|
<ul>
|
|
|
|
<li> <p> In order of decreasing precedence, the message delivery
|
|
transport is taken from 1) $<a href="postconf.5.html#transport_maps">transport_maps</a>, 2) $<a href="postconf.5.html#relay_transport">relay_transport</a>.
|
|
</p>
|
|
|
|
<li> <p> In order of decreasing precedence, the nexthop destination
|
|
is taken from 1) $<a href="postconf.5.html#transport_maps">transport_maps</a>, 2) $<a href="postconf.5.html#relay_transport">relay_transport</a>, 3)
|
|
$<a href="postconf.5.html#sender_dependent_relayhost_maps">sender_dependent_relayhost_maps</a> or $<a href="postconf.5.html#relayhost">relayhost</a> or the recipient
|
|
domain. </p>
|
|
|
|
</ul>
|
|
|
|
<p>
|
|
Specify a string of the form <i>transport:nexthop</i>, where <i>transport</i>
|
|
is the name of a mail delivery transport defined in <a href="master.5.html">master.cf</a>.
|
|
The <i>:nexthop</i> destination is optional; its syntax is documented
|
|
in the manual page of the corresponding delivery agent.
|
|
</p>
|
|
|
|
<p>
|
|
See also the <a href="ADDRESS_CLASS_README.html#relay_domain_class">relay domains</a> address class in the <a href="ADDRESS_CLASS_README.html">ADDRESS_CLASS_README</a>
|
|
file.
|
|
</p>
|
|
|
|
<p>
|
|
This feature is available in Postfix 2.0 and later.
|
|
</p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="relayhost">relayhost</a>
|
|
(default: empty)</b></DT><DD>
|
|
|
|
<p>
|
|
The next-hop destination(s) for non-local mail; takes precedence
|
|
over non-<a href="ADDRESS_CLASS_README.html#local_domain_class">local domains</a> in recipient addresses. This information
|
|
will not be used when the sender matches $<a href="postconf.5.html#sender_dependent_relayhost_maps">sender_dependent_relayhost_maps</a>.
|
|
</p>
|
|
|
|
<p> In order of decreasing precedence: </p>
|
|
|
|
<ul>
|
|
|
|
<li> <p> For recipient domains in the <a href="ADDRESS_CLASS_README.html#relay_domain_class">relay domain</a> address class
|
|
(domains matching $<a href="postconf.5.html#relay_domains">relay_domains</a>), the nexthop destination is taken
|
|
from 1) $<a href="postconf.5.html#transport_maps">transport_maps</a>, 2) $<a href="postconf.5.html#relay_transport">relay_transport</a>, 3)
|
|
$<a href="postconf.5.html#sender_dependent_relayhost_maps">sender_dependent_relayhost_maps</a> or $<a href="postconf.5.html#relayhost">relayhost</a> or the recipient
|
|
domain. <p>
|
|
|
|
<li> <p> For recipient domains in the <a href="ADDRESS_CLASS_README.html#default_domain_class">default domain</a> address class
|
|
(domains that do not match $<a href="postconf.5.html#mydestination">mydestination</a>, $<a href="postconf.5.html#inet_interfaces">inet_interfaces</a>,
|
|
$<a href="postconf.5.html#proxy_interfaces">proxy_interfaces</a>, $<a href="postconf.5.html#virtual_alias_domains">virtual_alias_domains</a>, $<a href="postconf.5.html#virtual_mailbox_domains">virtual_mailbox_domains</a>,
|
|
or $<a href="postconf.5.html#relay_domains">relay_domains</a>), the nexthop destination is taken from 1)
|
|
$<a href="postconf.5.html#transport_maps">transport_maps</a>, 2) $<a href="postconf.5.html#sender_dependent_default_transport_maps">sender_dependent_default_transport_maps</a> or
|
|
$<a href="postconf.5.html#default_transport">default_transport</a>, 3) $<a href="postconf.5.html#sender_dependent_relayhost_maps">sender_dependent_relayhost_maps</a> or $<a href="postconf.5.html#relayhost">relayhost</a>
|
|
or the recipient domain. </p>
|
|
|
|
</ul>
|
|
|
|
<p>
|
|
On an intranet, specify the organizational domain name. If your
|
|
internal DNS uses no MX records, specify the name of the intranet
|
|
gateway host instead.
|
|
</p>
|
|
|
|
<p>
|
|
In the case of SMTP delivery, specify one or more destinations in
|
|
the form of a domain name, hostname, hostname:service, [hostname]:service,
|
|
[hostaddress] or [hostaddress]:service, separated by comma or whitespace.
|
|
The form [hostname] turns off MX or SRV lookups. Multiple destinations
|
|
are supported in Postfix 3.5 and later. Each destination is tried
|
|
in the specified order.
|
|
</p>
|
|
|
|
<p> If an SMTP destination is a load balancer, and there are no
|
|
alternative destinations, specify the load balancer multiple times.
|
|
Without the duplicate info, the Postfix SMTP client would not
|
|
reconnect immediately to the same load balancer after a remote SMTP
|
|
server failure. </p>
|
|
|
|
<p>
|
|
If you're connected via UUCP, see the <a href="UUCP_README.html">UUCP_README</a> file for useful
|
|
information.
|
|
</p>
|
|
|
|
<p>
|
|
Examples:
|
|
</p>
|
|
|
|
<pre>
|
|
<a href="postconf.5.html#relayhost">relayhost</a> = $<a href="postconf.5.html#mydomain">mydomain</a>
|
|
<a href="postconf.5.html#relayhost">relayhost</a> = [gateway.example.com]
|
|
<a href="postconf.5.html#relayhost">relayhost</a> = mail1.example:587, mail2.example:587
|
|
<a href="postconf.5.html#relayhost">relayhost</a> = [an.ip.add.ress]
|
|
</pre>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="relocated_maps">relocated_maps</a>
|
|
(default: empty)</b></DT><DD>
|
|
|
|
<p>
|
|
Optional lookup tables with new contact information for users or
|
|
domains that no longer exist. The table format and lookups are
|
|
documented in <a href="relocated.5.html">relocated(5)</a>.
|
|
</p>
|
|
|
|
<p>
|
|
Specify zero or more "type:name" lookup tables, separated by
|
|
whitespace or comma. Tables will be searched in the specified order
|
|
until a match is found.
|
|
</p>
|
|
|
|
<p>
|
|
If you use this feature, run "<b>postmap /etc/postfix/relocated</b>" to
|
|
build the necessary DBM or DB file after change, then "<b>postfix
|
|
reload</b>" to make the changes visible.
|
|
</p>
|
|
|
|
<p>
|
|
Examples:
|
|
</p>
|
|
|
|
<pre>
|
|
<a href="postconf.5.html#relocated_maps">relocated_maps</a> = <a href="DATABASE_README.html#types">dbm</a>:/etc/postfix/relocated
|
|
<a href="postconf.5.html#relocated_maps">relocated_maps</a> = <a href="DATABASE_README.html#types">hash</a>:/etc/postfix/relocated
|
|
</pre>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="remote_header_rewrite_domain">remote_header_rewrite_domain</a>
|
|
(default: empty)</b></DT><DD>
|
|
|
|
<p> Rewrite or add message headers in mail from remote clients if
|
|
the <a href="postconf.5.html#remote_header_rewrite_domain">remote_header_rewrite_domain</a> parameter value is non-empty,
|
|
updating incomplete addresses with the domain specified in the
|
|
<a href="postconf.5.html#remote_header_rewrite_domain">remote_header_rewrite_domain</a> parameter, and adding missing headers.
|
|
</p>
|
|
|
|
<p> The
|
|
<a href="postconf.5.html#local_header_rewrite_clients">local_header_rewrite_clients</a> parameter controls what clients Postfix
|
|
considers local. </p>
|
|
|
|
<p> Examples: </p>
|
|
|
|
<p> The safe setting: append "domain.invalid" to incomplete header
|
|
addresses from remote SMTP clients, so that those addresses cannot
|
|
be confused with local addresses. </p>
|
|
|
|
<blockquote>
|
|
<pre>
|
|
<a href="postconf.5.html#remote_header_rewrite_domain">remote_header_rewrite_domain</a> = domain.invalid
|
|
</pre>
|
|
</blockquote>
|
|
|
|
<p> The default, purist, setting: don't rewrite headers from remote
|
|
clients at all. </p>
|
|
|
|
<blockquote>
|
|
<pre>
|
|
<a href="postconf.5.html#remote_header_rewrite_domain">remote_header_rewrite_domain</a> =
|
|
</pre>
|
|
</blockquote>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="require_home_directory">require_home_directory</a>
|
|
(default: no)</b></DT><DD>
|
|
|
|
<p>
|
|
Require that a <a href="local.8.html">local(8)</a> recipient's home directory exists
|
|
before mail delivery is attempted. By default this test is disabled.
|
|
It can be useful for environments that import home directories to
|
|
the mail server (IMPORTING HOME DIRECTORIES IS NOT RECOMMENDED).
|
|
</p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="reset_owner_alias">reset_owner_alias</a>
|
|
(default: no)</b></DT><DD>
|
|
|
|
<p> Reset the <a href="local.8.html">local(8)</a> delivery agent's idea of the owner-alias
|
|
attribute, when delivering mail to a child alias that does not have
|
|
its own owner alias. </p>
|
|
|
|
<p> This feature is available in Postfix 2.8 and later. With older
|
|
Postfix releases, the behavior is as if this parameter is set to
|
|
"yes". </p>
|
|
|
|
<p> As documented in <a href="aliases.5.html">aliases(5)</a>, when an alias <i>name</i> has a
|
|
companion alias named owner-<i>name</i>, this will replace the
|
|
envelope sender address, so that delivery errors will be
|
|
reported to the owner alias instead of the sender. This configuration
|
|
is recommended for mailing lists. <p>
|
|
|
|
<p> A less known property of the owner alias is that it also forces
|
|
the <a href="local.8.html">local(8)</a> delivery agent to write local and remote addresses
|
|
from alias expansion to a new queue file, instead of attempting to
|
|
deliver mail to local addresses as soon as they come out of alias
|
|
expansion. </p>
|
|
|
|
<p> Writing local addresses from alias expansion to a new queue
|
|
file allows for robust handling of temporary delivery errors: errors
|
|
with one local member have no effect on deliveries to other members
|
|
of the list. On the other hand, delivery to local addresses as
|
|
soon as they come out of alias expansion is fragile: a temporary
|
|
error with one local address from alias expansion will cause the
|
|
entire alias to be expanded repeatedly until the error goes away,
|
|
or until the message expires in the queue. In that case, a problem
|
|
with one list member results in multiple message deliveries to other
|
|
list members. </p>
|
|
|
|
<p> The default behavior of Postfix 2.8 and later is to keep the
|
|
owner-alias attribute of the parent alias, when delivering mail to
|
|
a child alias that does not have its own owner alias. Then, local
|
|
addresses from that child alias will be written to a new queue file,
|
|
and a temporary error with one local address will not affect delivery
|
|
to other mailing list members. </p>
|
|
|
|
<p> Unfortunately, older Postfix releases reset the owner-alias
|
|
attribute when delivering mail to a child alias that does not have
|
|
its own owner alias. To be precise, this resets only the decision
|
|
to create a new queue file, not the decision to override the envelope
|
|
sender address. The <a href="local.8.html">local(8)</a> delivery agent then attempts to
|
|
deliver local addresses as soon as they come out of child alias
|
|
expansion. If delivery to any address from child alias expansion
|
|
fails with a temporary error condition, the entire mailing list may
|
|
be expanded repeatedly until the mail expires in the queue, resulting
|
|
in multiple deliveries of the same message to mailing list members.
|
|
</p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="resolve_dequoted_address">resolve_dequoted_address</a>
|
|
(default: yes)</b></DT><DD>
|
|
|
|
<p> Resolve a recipient address safely instead of correctly, by
|
|
looking inside quotes. </p>
|
|
|
|
<p> By default, the Postfix address resolver does not quote the
|
|
address localpart as per <a href="https://tools.ietf.org/html/rfc822">RFC 822</a>, so that additional @ or % or !
|
|
operators remain visible. This behavior is safe but it is also
|
|
technically incorrect. </p>
|
|
|
|
<p> If you specify "<a href="postconf.5.html#resolve_dequoted_address">resolve_dequoted_address</a> = no", then
|
|
the Postfix
|
|
resolver will not know about additional @ etc. operators in the
|
|
address localpart. This opens opportunities for obscure mail relay
|
|
attacks with user@domain@domain addresses when Postfix provides
|
|
backup MX service for Sendmail systems. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="resolve_null_domain">resolve_null_domain</a>
|
|
(default: no)</b></DT><DD>
|
|
|
|
<p> Resolve an address that ends in the "@" null domain as if the
|
|
local hostname were specified, instead of rejecting the address as
|
|
invalid. </p>
|
|
|
|
<p> This feature is available in Postfix 2.1 and later.
|
|
Earlier versions always resolve the null domain as the local
|
|
hostname. </p>
|
|
|
|
<p> The Postfix SMTP server uses this feature to reject mail from
|
|
or to addresses that end in the "@" null domain, and from addresses
|
|
that rewrite into a form that ends in the "@" null domain. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="resolve_numeric_domain">resolve_numeric_domain</a>
|
|
(default: no)</b></DT><DD>
|
|
|
|
<p> Resolve "user@ipaddress" as "user@[ipaddress]", instead of
|
|
rejecting the address as invalid. </p>
|
|
|
|
<p> This feature is available in Postfix 2.3 and later.
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="respectful_logging">respectful_logging</a>
|
|
(default: see 'postconf -d' output)</b></DT><DD>
|
|
|
|
<p> Avoid logging that implies white is better than black. Instead
|
|
use 'allowlist', 'denylist', and variations of those words. </p>
|
|
|
|
<p> This feature is available in Postfix 3.6 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="rewrite_service_name">rewrite_service_name</a>
|
|
(default: rewrite)</b></DT><DD>
|
|
|
|
<p>
|
|
The name of the address rewriting service. This service rewrites
|
|
addresses to standard form and resolves them to a (delivery method,
|
|
next-hop host, recipient) triple.
|
|
</p>
|
|
|
|
<p>
|
|
This feature is available in Postfix 2.0 and later.
|
|
</p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="sample_directory">sample_directory</a>
|
|
(default: /etc/postfix)</b></DT><DD>
|
|
|
|
<p>
|
|
The name of the directory with example Postfix configuration files.
|
|
Starting with Postfix 2.1, these files have been replaced with the
|
|
<a href="postconf.5.html">postconf(5)</a> manual page.
|
|
</p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="send_cyrus_sasl_authzid">send_cyrus_sasl_authzid</a>
|
|
(default: no)</b></DT><DD>
|
|
|
|
<p> When authenticating to a remote SMTP or LMTP server with the
|
|
default setting "no", send no SASL authoriZation ID (authzid); send
|
|
only the SASL authentiCation ID (authcid) plus the authcid's password.
|
|
</p>
|
|
|
|
<p> The non-default setting "yes" enables the behavior of older
|
|
Postfix versions. These always send a SASL authzid that is equal
|
|
to the SASL authcid, but this causes interoperability problems
|
|
with some SMTP servers. </p>
|
|
|
|
<p> This feature is available in Postfix 2.4.4 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="sender_based_routing">sender_based_routing</a>
|
|
(default: no)</b></DT><DD>
|
|
|
|
<p>
|
|
This parameter should not be used. It was replaced by <a href="postconf.5.html#sender_dependent_relayhost_maps">sender_dependent_relayhost_maps</a>
|
|
in Postfix version 2.3.
|
|
</p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="sender_bcc_maps">sender_bcc_maps</a>
|
|
(default: empty)</b></DT><DD>
|
|
|
|
<p> Optional BCC (blind carbon-copy) address lookup tables, indexed
|
|
by envelope sender address. The BCC address (multiple results are not
|
|
supported) is added when mail enters from outside of Postfix. </p>
|
|
|
|
<p>
|
|
Specify zero or more "type:name" lookup tables, separated by
|
|
whitespace or comma. Tables will be searched in the specified order
|
|
until a match is found.
|
|
</p>
|
|
|
|
<p>
|
|
The table search order is as follows:
|
|
</p>
|
|
|
|
<ul>
|
|
|
|
<li> Look up the "user+extension@domain.tld" address including the
|
|
optional address extension.
|
|
|
|
<li> Look up the "user@domain.tld" address without the optional
|
|
address extension.
|
|
|
|
<li> Look up the "user+extension" address local part when the
|
|
sender domain equals $<a href="postconf.5.html#myorigin">myorigin</a>, $<a href="postconf.5.html#mydestination">mydestination</a>, $<a href="postconf.5.html#inet_interfaces">inet_interfaces</a>
|
|
or $<a href="postconf.5.html#proxy_interfaces">proxy_interfaces</a>.
|
|
|
|
<li> Look up the "user" address local part when the sender domain
|
|
equals $<a href="postconf.5.html#myorigin">myorigin</a>, $<a href="postconf.5.html#mydestination">mydestination</a>, $<a href="postconf.5.html#inet_interfaces">inet_interfaces</a> or $<a href="postconf.5.html#proxy_interfaces">proxy_interfaces</a>.
|
|
|
|
<li> Look up the "@domain.tld" part.
|
|
|
|
</ul>
|
|
|
|
<p>
|
|
Note: with Postfix 2.3 and later the BCC address is added as if it
|
|
was specified with NOTIFY=NONE. The sender will not be notified
|
|
when the BCC address is undeliverable, as long as all down-stream
|
|
software implements <a href="https://tools.ietf.org/html/rfc3461">RFC 3461</a>.
|
|
</p>
|
|
|
|
<p>
|
|
Note: with Postfix 2.2 and earlier the sender will be notified
|
|
when the BCC address is undeliverable.
|
|
</p>
|
|
|
|
<p> Note: automatic BCC recipients are produced only for new mail.
|
|
To avoid mailer loops, automatic BCC recipients are not generated
|
|
after Postfix forwards mail internally, or after Postfix generates
|
|
mail itself. </p>
|
|
|
|
<p> Note: automatic BCC recipients are subject to address
|
|
canonicalization (add missing domain), <a href="postconf.5.html#canonical_maps">canonical_maps</a>, <a href="postconf.5.html#masquerade_domains">masquerade_domains</a>,
|
|
and <a href="postconf.5.html#virtual_alias_maps">virtual_alias_maps</a>. </p>
|
|
|
|
<p>
|
|
Example:
|
|
</p>
|
|
|
|
<pre>
|
|
<a href="postconf.5.html#sender_bcc_maps">sender_bcc_maps</a> = <a href="DATABASE_README.html#types">hash</a>:/etc/postfix/sender_bcc
|
|
</pre>
|
|
|
|
<p>
|
|
After a change, run "<b>postmap /etc/postfix/sender_bcc</b>".
|
|
</p>
|
|
|
|
<p>
|
|
This feature is available in Postfix 2.1 and later.
|
|
</p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="sender_canonical_classes">sender_canonical_classes</a>
|
|
(default: envelope_sender, header_sender)</b></DT><DD>
|
|
|
|
<p> What addresses are subject to <a href="postconf.5.html#sender_canonical_maps">sender_canonical_maps</a> address
|
|
mapping. By default, <a href="postconf.5.html#sender_canonical_maps">sender_canonical_maps</a> address mapping is
|
|
applied to envelope sender addresses, and to header sender addresses.
|
|
</p>
|
|
|
|
<p> Specify one or more of: envelope_sender, header_sender </p>
|
|
|
|
<p> This feature is available in Postfix 2.2 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="sender_canonical_maps">sender_canonical_maps</a>
|
|
(default: empty)</b></DT><DD>
|
|
|
|
<p>
|
|
Optional address mapping lookup tables for envelope and header
|
|
sender addresses.
|
|
The table format and lookups are documented in <a href="canonical.5.html">canonical(5)</a>.
|
|
</p>
|
|
|
|
<p>
|
|
Example: you want to rewrite the SENDER address "user@ugly.example"
|
|
to "user@pretty.example", while still being able to send mail to
|
|
the RECIPIENT address "user@ugly.example".
|
|
</p>
|
|
|
|
<p>
|
|
Note: $<a href="postconf.5.html#sender_canonical_maps">sender_canonical_maps</a> is processed before $<a href="postconf.5.html#canonical_maps">canonical_maps</a>.
|
|
</p>
|
|
|
|
<p>
|
|
Example:
|
|
</p>
|
|
|
|
<pre>
|
|
<a href="postconf.5.html#sender_canonical_maps">sender_canonical_maps</a> = <a href="DATABASE_README.html#types">hash</a>:/etc/postfix/sender_canonical
|
|
</pre>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="sender_dependent_default_transport_maps">sender_dependent_default_transport_maps</a>
|
|
(default: empty)</b></DT><DD>
|
|
|
|
<p> A sender-dependent override for the global <a href="postconf.5.html#default_transport">default_transport</a>
|
|
parameter setting. The tables are searched by the envelope sender
|
|
address and @domain. A lookup result of DUNNO terminates the search
|
|
without overriding the global <a href="postconf.5.html#default_transport">default_transport</a> parameter setting.
|
|
This information is overruled with the <a href="transport.5.html">transport(5)</a> table. </p>
|
|
|
|
<p> This setting affects only the <a href="ADDRESS_CLASS_README.html#default_domain_class">default domain</a> address class
|
|
(recipient domains that do not match $<a href="postconf.5.html#mydestination">mydestination</a>, $<a href="postconf.5.html#inet_interfaces">inet_interfaces</a>,
|
|
$<a href="postconf.5.html#proxy_interfaces">proxy_interfaces</a>, $<a href="postconf.5.html#virtual_alias_domains">virtual_alias_domains</a>, $<a href="postconf.5.html#virtual_mailbox_domains">virtual_mailbox_domains</a>,
|
|
or $<a href="postconf.5.html#relay_domains">relay_domains</a>): </p>
|
|
|
|
<ul>
|
|
|
|
<li> <p> In order of decreasing precedence, the delivery transport
|
|
is taken from 1) $<a href="postconf.5.html#transport_maps">transport_maps</a>, 2)
|
|
$<a href="postconf.5.html#sender_dependent_default_transport_maps">sender_dependent_default_transport_maps</a> or $<a href="postconf.5.html#default_transport">default_transport</a>.
|
|
</p>
|
|
|
|
<li> <p> In order of decreasing precedence, the nexthop destination
|
|
is taken from 1) $<a href="postconf.5.html#transport_maps">transport_maps</a>, 2)
|
|
$<a href="postconf.5.html#sender_dependent_default_transport_maps">sender_dependent_default_transport_maps</a> or $<a href="postconf.5.html#default_transport">default_transport</a>, 3)
|
|
$<a href="postconf.5.html#sender_dependent_relayhost_maps">sender_dependent_relayhost_maps</a> or $<a href="postconf.5.html#relayhost">relayhost</a> or the recipient
|
|
domain. </p>
|
|
|
|
</ul>
|
|
|
|
<p> Note: this overrides <a href="postconf.5.html#default_transport">default_transport</a>, not <a href="postconf.5.html#transport_maps">transport_maps</a>, and
|
|
therefore the expected syntax is that of <a href="postconf.5.html#default_transport">default_transport</a>, not the
|
|
syntax of <a href="postconf.5.html#transport_maps">transport_maps</a>. Specifically, this does not support the
|
|
<a href="postconf.5.html#transport_maps">transport_maps</a> syntax for null transport, null nexthop, or null
|
|
email addresses. </p>
|
|
|
|
<p>
|
|
Specify zero or more "type:name" lookup tables, separated by
|
|
whitespace or comma. Tables will be searched in the specified order
|
|
until a match is found.
|
|
</p>
|
|
|
|
<p> For safety reasons, this feature does not allow $number
|
|
substitutions in regular expression maps. </p>
|
|
|
|
<p> This feature is available in Postfix 2.7 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="sender_dependent_relayhost_maps">sender_dependent_relayhost_maps</a>
|
|
(default: empty)</b></DT><DD>
|
|
|
|
<p> A sender-dependent override for the global <a href="postconf.5.html#relayhost">relayhost</a> parameter
|
|
setting. The tables are searched by the envelope sender address and
|
|
@domain. A lookup result of DUNNO terminates the search without
|
|
overriding the global <a href="postconf.5.html#relayhost">relayhost</a> parameter setting (Postfix 2.6 and
|
|
later). </p>
|
|
|
|
<p> In order of decreasing precedence: </p>
|
|
|
|
<ul>
|
|
|
|
<li> <p> For recipient domains in the <a href="ADDRESS_CLASS_README.html#relay_domain_class">relay domain</a> address class
|
|
(domains matching $<a href="postconf.5.html#relay_domains">relay_domains</a>), the nexthop destination is taken
|
|
from 1) $<a href="postconf.5.html#transport_maps">transport_maps</a>, 2) $<a href="postconf.5.html#relay_transport">relay_transport</a>, 3)
|
|
$<a href="postconf.5.html#sender_dependent_relayhost_maps">sender_dependent_relayhost_maps</a> or $<a href="postconf.5.html#relayhost">relayhost</a> or the recipient
|
|
domain. </p>
|
|
|
|
<li> <p> For recipient domains in the <a href="ADDRESS_CLASS_README.html#default_domain_class">default domain</a> address class
|
|
(domains that do not match <a href="postconf.5.html#mydestination">mydestination</a>, $<a href="postconf.5.html#inet_interfaces">inet_interfaces</a>,
|
|
$<a href="postconf.5.html#proxy_interfaces">proxy_interfaces</a>, $<a href="postconf.5.html#virtual_alias_domains">virtual_alias_domains</a>, $<a href="postconf.5.html#virtual_mailbox_domains">virtual_mailbox_domains</a>,
|
|
$<a href="postconf.5.html#relay_domains">relay_domains</a>), the nexthop destination is taken from 1)
|
|
$<a href="postconf.5.html#transport_maps">transport_maps</a>, 2) $<a href="postconf.5.html#sender_dependent_default_transport_maps">sender_dependent_default_transport_maps</a> or
|
|
$<a href="postconf.5.html#default_transport">default_transport</a>, 3) $<a href="postconf.5.html#sender_dependent_relayhost_maps">sender_dependent_relayhost_maps</a> or $<a href="postconf.5.html#relayhost">relayhost</a>
|
|
or the recipient domain. </p>
|
|
|
|
</ul>
|
|
|
|
<p>
|
|
Specify zero or more "type:name" lookup tables, separated by
|
|
whitespace or comma. Tables will be searched in the specified order
|
|
until a match is found.
|
|
</p>
|
|
|
|
<p> For safety reasons, this feature does not allow $number
|
|
substitutions in regular expression maps. </p>
|
|
|
|
<p>
|
|
This feature is available in Postfix 2.3 and later.
|
|
</p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="sendmail_fix_line_endings">sendmail_fix_line_endings</a>
|
|
(default: always)</b></DT><DD>
|
|
|
|
<p> Controls how the Postfix sendmail command converts email message
|
|
line endings from <CR><LF> into UNIX format (<LF>).
|
|
</p>
|
|
|
|
<dl>
|
|
|
|
<dt> <b>always</b> </dt> <dd> Always convert message lines ending
|
|
in <CR><LF>. This setting is the default with Postfix
|
|
2.9 and later. </dd>
|
|
|
|
<dt> <b>strict</b> </dt> <dd> Convert message lines ending in
|
|
<CR><LF> only if the first input line ends in
|
|
<CR><LF>. This setting is backwards-compatible with
|
|
Postfix 2.8 and earlier. </dd>
|
|
|
|
<dt> <b>never</b> </dt> <dd> Never convert message lines ending in
|
|
<CR><LF>. This setting exists for completeness only.
|
|
</dd>
|
|
|
|
</dl>
|
|
|
|
<p> This feature is available in Postfix 2.9 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="sendmail_path">sendmail_path</a>
|
|
(default: see "postconf -d" output)</b></DT><DD>
|
|
|
|
<p>
|
|
A Sendmail compatibility feature that specifies the location of
|
|
the Postfix <a href="sendmail.1.html">sendmail(1)</a> command. This command can be used to
|
|
submit mail into the Postfix queue.
|
|
</p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="service_name">service_name</a>
|
|
(read-only)</b></DT><DD>
|
|
|
|
<p> The <a href="master.5.html">master.cf</a> service name of a Postfix daemon process. This
|
|
can be used to distinguish the logging from different services that
|
|
use the same program name. </p>
|
|
|
|
<p> Example <a href="master.5.html">master.cf</a> entries: </p>
|
|
|
|
<pre>
|
|
# Distinguish inbound MTA logging from submission and submissions logging.
|
|
smtp inet n - n - - smtpd
|
|
submission inet n - n - - smtpd
|
|
-o <a href="postconf.5.html#syslog_name">syslog_name</a>=postfix/$<a href="postconf.5.html#service_name">service_name</a>
|
|
submissions inet n - n - - smtpd
|
|
-o <a href="postconf.5.html#syslog_name">syslog_name</a>=postfix/$<a href="postconf.5.html#service_name">service_name</a>
|
|
</pre>
|
|
|
|
<pre>
|
|
# Distinguish outbound MTA logging from inbound relay logging.
|
|
smtp unix - - n - - smtp
|
|
relay unix - - n - - smtp
|
|
-o <a href="postconf.5.html#syslog_name">syslog_name</a>=postfix/$<a href="postconf.5.html#service_name">service_name</a>
|
|
</pre>
|
|
|
|
<p> This feature is available in Postfix 3.3 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="service_throttle_time">service_throttle_time</a>
|
|
(default: 60s)</b></DT><DD>
|
|
|
|
<p>
|
|
How long the Postfix <a href="master.8.html">master(8)</a> waits before forking a server that
|
|
appears to be malfunctioning.
|
|
</p>
|
|
|
|
<p> Specify a non-zero time value (an integral value plus an optional
|
|
one-letter suffix that specifies the time unit). Time units: s
|
|
(seconds), m (minutes), h (hours), d (days), w (weeks).
|
|
The default time unit is s (seconds). </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="setgid_group">setgid_group</a>
|
|
(default: postdrop)</b></DT><DD>
|
|
|
|
<p>
|
|
The group ownership of set-gid Postfix commands and of group-writable
|
|
Postfix directories. When this parameter value is changed you need
|
|
to re-run "<b>postfix set-permissions</b>" (with Postfix version 2.0 and
|
|
earlier: "<b>/etc/postfix/post-install set-permissions</b>".
|
|
</p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="shlib_directory">shlib_directory</a>
|
|
(default: see 'postconf -d' output)</b></DT><DD>
|
|
|
|
<p> The location of Postfix dynamically-linked libraries
|
|
(libpostfix-*.so), and the default location of Postfix database
|
|
plugins (postfix-*.so) that have a relative pathname in the
|
|
dynamicmaps.cf file. The <a href="postconf.5.html#shlib_directory">shlib_directory</a> parameter defaults to
|
|
"no" when Postfix dynamically-linked libraries and database plugins
|
|
are disabled at compile time, otherwise it typically defaults to
|
|
/usr/lib/postfix or /usr/local/lib/postfix. </p>
|
|
|
|
<p> Notes: </p>
|
|
|
|
<ul>
|
|
|
|
<li> <p> The directory specified with <a href="postconf.5.html#shlib_directory">shlib_directory</a> should contain
|
|
only Postfix-related files. Postfix dynamically-linked libraries
|
|
and database plugins should not be installed in a "public" system
|
|
directory such as /usr/lib or /usr/local/lib. Linking Postfix
|
|
dynamically-linked library files or database plugins into non-Postfix
|
|
programs is not supported. Postfix dynamically-linked libraries
|
|
and database plugins implement a Postfix-internal API that changes
|
|
without maintaining compatibility. </p>
|
|
|
|
<li> <p> You can change the <a href="postconf.5.html#shlib_directory">shlib_directory</a> value after Postfix is
|
|
built. However, you may have to run ldconfig or equivalent to prevent
|
|
Postfix programs from failing because the libpostfix-*.so files are
|
|
not found. No ldconfig command is needed if you keep the libpostfix-*.so
|
|
files in the compiled-in default $<a href="postconf.5.html#shlib_directory">shlib_directory</a> location. </p>
|
|
|
|
</ul>
|
|
|
|
<p> This feature is available in Postfix 3.0 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="show_user_unknown_table_name">show_user_unknown_table_name</a>
|
|
(default: yes)</b></DT><DD>
|
|
|
|
<p>
|
|
Display the name of the recipient table in the "User unknown"
|
|
responses. The extra detail makes troubleshooting easier but also
|
|
reveals information that is nobody else's business.
|
|
</p>
|
|
|
|
<p>
|
|
This feature is available in Postfix 2.0 and later.
|
|
</p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="showq_service_name">showq_service_name</a>
|
|
(default: showq)</b></DT><DD>
|
|
|
|
<p>
|
|
The name of the <a href="showq.8.html">showq(8)</a> service. This service produces mail queue
|
|
status reports.
|
|
</p>
|
|
|
|
<p>
|
|
This feature is available in Postfix 2.0 and later.
|
|
</p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="smtp_address_preference">smtp_address_preference</a>
|
|
(default: any)</b></DT><DD>
|
|
|
|
<p> The address type ("ipv6", "ipv4" or "any") that the Postfix
|
|
SMTP client will try first, when a destination has IPv6 and IPv4
|
|
addresses with equal MX preference. This feature has no effect
|
|
unless the <a href="postconf.5.html#inet_protocols">inet_protocols</a> setting enables both IPv4 and IPv6. </p>
|
|
|
|
<p> Postfix SMTP client address preference has evolved. With Postfix
|
|
2.8 the default is "ipv6"; earlier implementations are hard-coded
|
|
to prefer IPv6 over IPv4. </p>
|
|
|
|
<p> Notes for mail delivery between sites that have both IPv4 and
|
|
IPv6 connectivity: </p>
|
|
|
|
<ul>
|
|
|
|
<li> <p> The setting "<a href="postconf.5.html#smtp_address_preference">smtp_address_preference</a> = ipv6" is unsafe.
|
|
All deliveries will suffer delays during an IPv6 outage, even
|
|
while the destination is still reachable over IPv4. Mail may be
|
|
stuck in the queue with Postfix versions < 3.3 that do not
|
|
implement "<a href="postconf.5.html#smtp_balance_inet_protocols">smtp_balance_inet_protocols</a>". For similar reasons, the
|
|
setting "<a href="postconf.5.html#smtp_address_preference">smtp_address_preference</a> = ipv4" is also unsafe. </p>
|
|
|
|
<li> <p> The setting "<a href="postconf.5.html#smtp_address_preference">smtp_address_preference</a> = any" is safe. With
|
|
this, and "<a href="postconf.5.html#smtp_balance_inet_protocols">smtp_balance_inet_protocols</a> = yes" (the default), only
|
|
half of deliveries will suffer delays if there is an outage
|
|
that affects IPv6 or IPv4, as long as it does not affect both. </p>
|
|
|
|
<li> <p> The setting "<a href="postconf.5.html#smtp_address_preference">smtp_address_preference</a> = ipv4" is not a
|
|
solution for remote servers that flag email received over IPv6 as
|
|
more 'spammy' (the client IPv6 address has a bad or missing PTR or
|
|
AAAA record, bad network neighbors, etc.). Instead, configure Postfix
|
|
to receive mail over both IPv4 and IPv6, and to deliver mail over
|
|
only IPv4. </p>
|
|
|
|
<blockquote>
|
|
<pre>
|
|
/etc/postfix/<a href="postconf.5.html">main.cf</a>:
|
|
<a href="postconf.5.html#inet_protocols">inet_protocols</a> = all
|
|
</pre>
|
|
</blockquote>
|
|
|
|
<blockquote>
|
|
<pre>
|
|
/etc/postfix/<a href="master.5.html">master.cf</a>
|
|
smtp ...other fields... smtp -o <a href="postconf.5.html#inet_protocols">inet_protocols</a>=ipv4
|
|
</pre>
|
|
</blockquote>
|
|
|
|
</ul>
|
|
|
|
<p> This feature is available in Postfix 2.8 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="smtp_address_verify_target">smtp_address_verify_target</a>
|
|
(default: rcpt)</b></DT><DD>
|
|
|
|
<p> In the context of email address verification, the SMTP protocol
|
|
stage that determines whether an email address is deliverable.
|
|
Specify one of "rcpt" or "data". The latter is needed with remote
|
|
SMTP servers that reject recipients after the DATA command. Use
|
|
<a href="postconf.5.html#transport_maps">transport_maps</a> to apply this feature selectively: </p>
|
|
|
|
<blockquote>
|
|
<pre>
|
|
/etc/postfix/<a href="postconf.5.html">main.cf</a>:
|
|
<a href="postconf.5.html#transport_maps">transport_maps</a> = <a href="DATABASE_README.html#types">hash</a>:/etc/postfix/transport
|
|
</pre>
|
|
</blockquote>
|
|
|
|
<blockquote>
|
|
<pre>
|
|
/etc/postfix/transport:
|
|
smtp-domain-that-verifies-after-data smtp-data-target:
|
|
lmtp-domain-that-verifies-after-data lmtp-data-target:
|
|
</pre>
|
|
</blockquote>
|
|
|
|
<blockquote>
|
|
<pre>
|
|
/etc/postfix/<a href="master.5.html">master.cf</a>:
|
|
smtp-data-target unix - - n - - smtp
|
|
-o <a href="postconf.5.html#smtp_address_verify_target">smtp_address_verify_target</a>=data
|
|
lmtp-data-target unix - - n - - lmtp
|
|
-o <a href="postconf.5.html#lmtp_address_verify_target">lmtp_address_verify_target</a>=data
|
|
</pre>
|
|
</blockquote>
|
|
|
|
<p> Unselective use of the "data" target does no harm, but will
|
|
result in unnecessary "lost connection after DATA" events at remote
|
|
SMTP/LMTP servers. </p>
|
|
|
|
<p> This feature is available in Postfix 3.0 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="smtp_always_send_ehlo">smtp_always_send_ehlo</a>
|
|
(default: yes)</b></DT><DD>
|
|
|
|
<p>
|
|
Always send EHLO at the start of an SMTP session.
|
|
</p>
|
|
|
|
<p>
|
|
With "<a href="postconf.5.html#smtp_always_send_ehlo">smtp_always_send_ehlo</a> = no", the Postfix SMTP client sends
|
|
EHLO only when
|
|
the word "ESMTP" appears in the server greeting banner (example:
|
|
220 spike.porcupine.org ESMTP Postfix).
|
|
</p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="smtp_balance_inet_protocols">smtp_balance_inet_protocols</a>
|
|
(default: yes)</b></DT><DD>
|
|
|
|
<p> When a remote destination resolves to a combination of IPv4 and
|
|
IPv6 addresses, ensure that the Postfix SMTP client can try both
|
|
address types before it runs into the <a href="postconf.5.html#smtp_mx_address_limit">smtp_mx_address_limit</a>. </p>
|
|
|
|
<p> This avoids an interoperability problem when a destination resolves
|
|
to primarily IPv6 addresses, the smtp_address_limit feature eliminates
|
|
most or all IPv4 addresses, and the destination is not reachable over
|
|
IPv6. </p>
|
|
|
|
<p> This feature is available in Postfix 3.3 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="smtp_bind_address">smtp_bind_address</a>
|
|
(default: empty)</b></DT><DD>
|
|
|
|
<p>
|
|
An optional numerical network address that the Postfix SMTP client
|
|
should bind to when making an IPv4 connection.
|
|
</p>
|
|
|
|
<p>
|
|
This can be specified in the <a href="postconf.5.html">main.cf</a> file for all SMTP clients, or
|
|
it can be specified in the <a href="master.5.html">master.cf</a> file for a specific client,
|
|
for example:
|
|
</p>
|
|
|
|
<blockquote>
|
|
<pre>
|
|
/etc/postfix/<a href="master.5.html">master.cf</a>:
|
|
smtp ... smtp -o <a href="postconf.5.html#smtp_bind_address">smtp_bind_address</a>=11.22.33.44
|
|
</pre>
|
|
</blockquote>
|
|
|
|
<p> See <a href="postconf.5.html#smtp_bind_address_enforce">smtp_bind_address_enforce</a> for how Postfix should handle
|
|
errors (Postfix 3.7 and later). </p>
|
|
|
|
<p> Note 1: when <a href="postconf.5.html#inet_interfaces">inet_interfaces</a> specifies no more than one IPv4
|
|
address, and that address is a non-loopback address, it is
|
|
automatically used as the <a href="postconf.5.html#smtp_bind_address">smtp_bind_address</a>. This supports virtual
|
|
IP hosting, but can be a problem on multi-homed firewalls. See the
|
|
<a href="postconf.5.html#inet_interfaces">inet_interfaces</a> documentation for more detail. </p>
|
|
|
|
<p> Note 2: address information may be enclosed inside <tt>[]</tt>,
|
|
but this form is not required here. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="smtp_bind_address6">smtp_bind_address6</a>
|
|
(default: empty)</b></DT><DD>
|
|
|
|
<p>
|
|
An optional numerical network address that the Postfix SMTP client
|
|
should bind to when making an IPv6 connection.
|
|
</p>
|
|
|
|
<p> This feature is available in Postfix 2.2 and later. </p>
|
|
|
|
<p>
|
|
This can be specified in the <a href="postconf.5.html">main.cf</a> file for all SMTP clients, or
|
|
it can be specified in the <a href="master.5.html">master.cf</a> file for a specific client,
|
|
for example:
|
|
</p>
|
|
|
|
<blockquote>
|
|
<pre>
|
|
/etc/postfix/<a href="master.5.html">master.cf</a>:
|
|
smtp ... smtp -o <a href="postconf.5.html#smtp_bind_address6">smtp_bind_address6</a>=1:2:3:4:5:6:7:8
|
|
</pre>
|
|
</blockquote>
|
|
|
|
<p> See <a href="postconf.5.html#smtp_bind_address_enforce">smtp_bind_address_enforce</a> for how Postfix should handle
|
|
errors (Postfix 3.7 and later). </p>
|
|
|
|
<p> Note 1: when <a href="postconf.5.html#inet_interfaces">inet_interfaces</a> specifies no more than one IPv6
|
|
address, and that address is a non-loopback address, it is
|
|
automatically used as the <a href="postconf.5.html#smtp_bind_address6">smtp_bind_address6</a>. This supports virtual
|
|
IP hosting, but can be a problem on multi-homed firewalls. See the
|
|
<a href="postconf.5.html#inet_interfaces">inet_interfaces</a> documentation for more detail. </p>
|
|
|
|
<p> Note 2: address information may be enclosed inside <tt>[]</tt>,
|
|
but this form is not recommended here. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="smtp_bind_address_enforce">smtp_bind_address_enforce</a>
|
|
(default: no)</b></DT><DD>
|
|
|
|
<p> Defer delivery when the Postfix SMTP client cannot apply the
|
|
<a href="postconf.5.html#smtp_bind_address">smtp_bind_address</a> or <a href="postconf.5.html#smtp_bind_address6">smtp_bind_address6</a> setting. By default, the
|
|
Postfix SMTP client will continue delivery after logging a warning.
|
|
</p>
|
|
|
|
<p> This feature is available in Postfix 3.7 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="smtp_body_checks">smtp_body_checks</a>
|
|
(default: empty)</b></DT><DD>
|
|
|
|
<p> Restricted <a href="header_checks.5.html">body_checks(5)</a> tables for the Postfix SMTP client.
|
|
These tables are searched while mail is being delivered. Actions
|
|
that change the delivery time or destination are not available.
|
|
</p>
|
|
|
|
<p> This feature is available in Postfix 2.5 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="smtp_cname_overrides_servername">smtp_cname_overrides_servername</a>
|
|
(default: version dependent)</b></DT><DD>
|
|
|
|
<p> When the remote SMTP servername is a DNS CNAME, replace the
|
|
servername with the result from CNAME expansion for the purpose of
|
|
logging, SASL password lookup, TLS
|
|
policy decisions, or TLS certificate verification. The value "no"
|
|
hardens Postfix <a href="postconf.5.html#smtp_tls_per_site">smtp_tls_per_site</a> hostname-based policies against
|
|
false hostname information in DNS CNAME records, and makes SASL
|
|
password file lookups more predictable. This is the default setting
|
|
as of Postfix 2.3. </p>
|
|
|
|
<p> When DNS CNAME records are validated with secure DNS lookups
|
|
(<a href="postconf.5.html#smtp_dns_support_level">smtp_dns_support_level</a> = dnssec), they are always allowed to
|
|
override the above servername (Postfix 2.11 and later). </p>
|
|
|
|
<p> This feature is available in Postfix 2.2.9 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="smtp_connect_timeout">smtp_connect_timeout</a>
|
|
(default: 30s)</b></DT><DD>
|
|
|
|
<p>
|
|
The Postfix SMTP client time limit for completing a TCP connection, or
|
|
zero (use the operating system built-in time limit).
|
|
</p>
|
|
|
|
<p>
|
|
When no connection can be made within the deadline, the Postfix
|
|
SMTP client
|
|
tries the next address on the mail exchanger list. Specify 0 to
|
|
disable the time limit (i.e. use whatever timeout is implemented by
|
|
the operating system).
|
|
</p>
|
|
|
|
<p> Specify a non-negative time value (an integral value plus an optional
|
|
one-letter suffix that specifies the time unit). Time units: s
|
|
(seconds), m (minutes), h (hours), d (days), w (weeks).
|
|
The default time unit is s (seconds). </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="smtp_connection_cache_destinations">smtp_connection_cache_destinations</a>
|
|
(default: empty)</b></DT><DD>
|
|
|
|
<p> Permanently enable SMTP connection caching for the specified
|
|
destinations. With SMTP connection caching, a connection is not
|
|
closed immediately after completion of a mail transaction. Instead,
|
|
the connection is kept open for up to $<a href="postconf.5.html#smtp_connection_cache_time_limit">smtp_connection_cache_time_limit</a>
|
|
seconds. This allows connections to be reused for other deliveries,
|
|
and can improve mail delivery performance. </p>
|
|
|
|
<p> Specify a comma or white space separated list of destinations
|
|
or pseudo-destinations: </p>
|
|
|
|
<ul>
|
|
|
|
<li> if mail is sent without a <a href="postconf.5.html#relayhost">relay host</a>: a domain name (the
|
|
right-hand side of an email address, without the [] around a numeric
|
|
IP address),
|
|
|
|
<li> if mail is sent via a <a href="postconf.5.html#relayhost">relay host</a>: a <a href="postconf.5.html#relayhost">relay host</a> name (without
|
|
[] or non-default TCP port), as specified in <a href="postconf.5.html">main.cf</a> or in the
|
|
transport map,
|
|
|
|
<li> if mail is sent via a UNIX-domain socket: a pathname (without
|
|
the unix: prefix),
|
|
|
|
<li> a /file/name with domain names and/or <a href="postconf.5.html#relayhost">relay host</a> names as
|
|
defined above,
|
|
|
|
<li> a "<a href="DATABASE_README.html">type:table</a>" with domain names and/or <a href="postconf.5.html#relayhost">relay host</a> names on
|
|
the left-hand side. The right-hand side result from "<a href="DATABASE_README.html">type:table</a>"
|
|
lookups is ignored.
|
|
|
|
</ul>
|
|
|
|
<p> This feature is available in Postfix 2.2 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="smtp_connection_cache_on_demand">smtp_connection_cache_on_demand</a>
|
|
(default: yes)</b></DT><DD>
|
|
|
|
<p> Temporarily enable SMTP connection caching while a destination
|
|
has a high volume of mail in the <a href="QSHAPE_README.html#active_queue">active queue</a>. With SMTP connection
|
|
caching, a connection is not closed immediately after completion
|
|
of a mail transaction. Instead, the connection is kept open for
|
|
up to $<a href="postconf.5.html#smtp_connection_cache_time_limit">smtp_connection_cache_time_limit</a> seconds. This allows
|
|
connections to be reused for other deliveries, and can improve mail
|
|
delivery performance. </p>
|
|
|
|
<p> This feature is available in Postfix 2.2 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="smtp_connection_cache_time_limit">smtp_connection_cache_time_limit</a>
|
|
(default: 2s)</b></DT><DD>
|
|
|
|
<p> When SMTP connection caching is enabled, the amount of time that
|
|
an unused SMTP client socket is kept open before it is closed. Do
|
|
not specify larger values without permission from the remote sites.
|
|
</p>
|
|
|
|
<p> This feature is available in Postfix 2.2 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="smtp_connection_reuse_count_limit">smtp_connection_reuse_count_limit</a>
|
|
(default: 0)</b></DT><DD>
|
|
|
|
<p> When SMTP connection caching is enabled, the number of times
|
|
that an SMTP session may be reused before it is closed, or zero (no
|
|
limit). With a reuse count limit of N, a connection is used up to
|
|
N+1 times. </p>
|
|
|
|
<p> NOTE: This feature is unsafe. When a high-volume destination
|
|
has multiple inbound MTAs, then the slowest inbound MTA will attract
|
|
the most connections to that destination. This limitation does not
|
|
exist with the <a href="postconf.5.html#smtp_connection_reuse_time_limit">smtp_connection_reuse_time_limit</a> feature. </p>
|
|
|
|
<p> This feature is available in Postfix 2.11. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="smtp_connection_reuse_time_limit">smtp_connection_reuse_time_limit</a>
|
|
(default: 300s)</b></DT><DD>
|
|
|
|
<p> The amount of time during which Postfix will use an SMTP
|
|
connection repeatedly. The timer starts when the connection is
|
|
initiated (i.e. it includes the connect, greeting and helo latency,
|
|
in addition to the latencies of subsequent mail delivery transactions).
|
|
</p>
|
|
|
|
<p> This feature addresses a performance stability problem with
|
|
remote SMTP servers. This problem is not specific to Postfix: it
|
|
can happen when any MTA sends large amounts of SMTP email to a site
|
|
that has multiple MX hosts. </p>
|
|
|
|
<p> The problem starts when one of a set of MX hosts becomes slower
|
|
than the rest. Even though SMTP clients connect to fast and slow
|
|
MX hosts with equal probability, the slow MX host ends up with more
|
|
simultaneous inbound connections than the faster MX hosts, because
|
|
the slow MX host needs more time to serve each client request. </p>
|
|
|
|
<p> The slow MX host becomes a connection attractor. If one MX
|
|
host becomes N times slower than the rest, it dominates mail delivery
|
|
latency unless there are more than N fast MX hosts to counter the
|
|
effect. And if the number of MX hosts is smaller than N, the mail
|
|
delivery latency becomes effectively that of the slowest MX host
|
|
divided by the total number of MX hosts. </p>
|
|
|
|
<p> The solution uses connection caching in a way that differs from
|
|
Postfix version 2.2. By limiting the amount of time during which a connection
|
|
can be used repeatedly (instead of limiting the number of deliveries
|
|
over that connection), Postfix not only restores fairness in the
|
|
distribution of simultaneous connections across a set of MX hosts,
|
|
it also favors deliveries over connections that perform well, which
|
|
is exactly what we want. </p>
|
|
|
|
<p> The default reuse time limit, 300s, is comparable to the various
|
|
smtp transaction timeouts which are fair estimates of maximum excess
|
|
latency for a slow delivery. Note that hosts may accept thousands
|
|
of messages over a single connection within the default connection
|
|
reuse time limit. This number is much larger than the default Postfix
|
|
version 2.2 limit of 10 messages per cached connection. It may prove necessary
|
|
to lower the limit to avoid interoperability issues with MTAs that
|
|
exhibit bugs when many messages are delivered via a single connection.
|
|
A lower reuse time limit risks losing the benefit of connection
|
|
reuse when the average connection and mail delivery latency exceeds
|
|
the reuse time limit. </p>
|
|
|
|
<p> This feature is available in Postfix 2.3 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="smtp_data_done_timeout">smtp_data_done_timeout</a>
|
|
(default: 600s)</b></DT><DD>
|
|
|
|
<p>
|
|
The Postfix SMTP client time limit for sending the SMTP ".", and
|
|
for receiving the remote SMTP server response.
|
|
</p>
|
|
|
|
<p>
|
|
When no response is received within the deadline, a warning is
|
|
logged that the mail may be delivered multiple times.
|
|
</p>
|
|
|
|
<p> Specify a non-zero time value (an integral value plus an optional
|
|
one-letter suffix that specifies the time unit). Time units: s
|
|
(seconds), m (minutes), h (hours), d (days), w (weeks).
|
|
The default time unit is s (seconds). </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="smtp_data_init_timeout">smtp_data_init_timeout</a>
|
|
(default: 120s)</b></DT><DD>
|
|
|
|
<p>
|
|
The Postfix SMTP client time limit for sending the SMTP DATA command,
|
|
and for receiving the remote SMTP server response.
|
|
</p>
|
|
|
|
<p>
|
|
Time units: s (seconds), m (minutes), h (hours), d (days), w (weeks).
|
|
The default time unit is s (seconds).
|
|
</p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="smtp_data_xfer_timeout">smtp_data_xfer_timeout</a>
|
|
(default: 180s)</b></DT><DD>
|
|
|
|
<p>
|
|
The Postfix SMTP client time limit for sending the SMTP message content.
|
|
When the connection makes no progress for more than $<a href="postconf.5.html#smtp_data_xfer_timeout">smtp_data_xfer_timeout</a>
|
|
seconds the Postfix SMTP client terminates the transfer.
|
|
</p>
|
|
|
|
<p>
|
|
Time units: s (seconds), m (minutes), h (hours), d (days), w (weeks).
|
|
The default time unit is s (seconds).
|
|
</p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="smtp_defer_if_no_mx_address_found">smtp_defer_if_no_mx_address_found</a>
|
|
(default: no)</b></DT><DD>
|
|
|
|
<p>
|
|
Defer mail delivery when no MX record resolves to an IP address.
|
|
</p>
|
|
|
|
<p>
|
|
The default (no) is to return the mail as undeliverable. With older
|
|
Postfix versions the default was to keep trying to deliver the mail
|
|
until someone fixed the MX record or until the mail was too old.
|
|
</p>
|
|
|
|
<p>
|
|
Note: the Postfix SMTP client always ignores MX records with equal
|
|
or worse preference
|
|
than the local MTA itself.
|
|
</p>
|
|
|
|
<p>
|
|
This feature is available in Postfix 2.1 and later.
|
|
</p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="smtp_delivery_status_filter">smtp_delivery_status_filter</a>
|
|
(default: $<a href="postconf.5.html#default_delivery_status_filter">default_delivery_status_filter</a>)</b></DT><DD>
|
|
|
|
<p> Optional filter for the <a href="smtp.8.html">smtp(8)</a> delivery agent to change the
|
|
delivery status code or explanatory text of successful or unsuccessful
|
|
deliveries. See <a href="postconf.5.html#default_delivery_status_filter">default_delivery_status_filter</a> for details. </p>
|
|
|
|
<p> NOTE: This feature modifies Postfix SMTP client error or non-error
|
|
messages that may or may not be derived from remote SMTP server
|
|
responses. In contrast, the <a href="postconf.5.html#smtp_reply_filter">smtp_reply_filter</a> feature modifies
|
|
remote SMTP server responses only. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="smtp_destination_concurrency_limit">smtp_destination_concurrency_limit</a>
|
|
(default: $<a href="postconf.5.html#default_destination_concurrency_limit">default_destination_concurrency_limit</a>)</b></DT><DD>
|
|
|
|
<p> The maximal number of parallel deliveries to the same destination
|
|
via the smtp message delivery transport. This limit is enforced by
|
|
the queue manager. The message delivery transport name is the first
|
|
field in the entry in the <a href="master.5.html">master.cf</a> file. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="smtp_destination_recipient_limit">smtp_destination_recipient_limit</a>
|
|
(default: $<a href="postconf.5.html#default_destination_recipient_limit">default_destination_recipient_limit</a>)</b></DT><DD>
|
|
|
|
<p> The maximal number of recipients per message for the smtp
|
|
message delivery transport. This limit is enforced by the queue
|
|
manager. The message delivery transport name is the first field in
|
|
the entry in the <a href="master.5.html">master.cf</a> file. </p>
|
|
|
|
<p> Setting this parameter to a value of 1 changes the meaning of
|
|
<a href="postconf.5.html#smtp_destination_concurrency_limit">smtp_destination_concurrency_limit</a> from concurrency per domain
|
|
into concurrency per recipient. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="smtp_discard_ehlo_keyword_address_maps">smtp_discard_ehlo_keyword_address_maps</a>
|
|
(default: empty)</b></DT><DD>
|
|
|
|
<p> Lookup tables, indexed by the remote SMTP server address, with
|
|
case insensitive lists of EHLO keywords (pipelining, starttls, auth,
|
|
etc.) that the Postfix SMTP client will ignore in the EHLO response from a
|
|
remote SMTP server. See <a href="postconf.5.html#smtp_discard_ehlo_keywords">smtp_discard_ehlo_keywords</a> for details. The
|
|
table is not indexed by hostname for consistency with
|
|
<a href="postconf.5.html#smtpd_discard_ehlo_keyword_address_maps">smtpd_discard_ehlo_keyword_address_maps</a>. </p>
|
|
|
|
<p>
|
|
Specify zero or more "type:name" lookup tables, separated by
|
|
whitespace or comma. Tables will be searched in the specified order
|
|
until a match is found.
|
|
</p>
|
|
|
|
<p> This feature is available in Postfix 2.2 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="smtp_discard_ehlo_keywords">smtp_discard_ehlo_keywords</a>
|
|
(default: empty)</b></DT><DD>
|
|
|
|
<p> A case insensitive list of EHLO keywords (pipelining, starttls,
|
|
auth, etc.) that the Postfix SMTP client will ignore in the EHLO
|
|
response from a remote SMTP server. </p>
|
|
|
|
<p> This feature is available in Postfix 2.2 and later. </p>
|
|
|
|
<p> Notes: </p>
|
|
|
|
<ul>
|
|
|
|
<li> <p> Specify the <b>silent-discard</b> pseudo keyword to prevent
|
|
this action from being logged. </p>
|
|
|
|
<li> <p> Use the <a href="postconf.5.html#smtp_discard_ehlo_keyword_address_maps">smtp_discard_ehlo_keyword_address_maps</a> feature to
|
|
discard EHLO keywords selectively. </p>
|
|
|
|
</ul>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="smtp_dns_reply_filter">smtp_dns_reply_filter</a>
|
|
(default: empty)</b></DT><DD>
|
|
|
|
<p> Optional filter for Postfix SMTP client DNS lookup results.
|
|
Specify zero or more lookup tables. The lookup tables are searched
|
|
in the given order for a match with the DNS lookup result, converted
|
|
to the following form: </p>
|
|
|
|
<pre>
|
|
<i>name ttl class type preference value</i>
|
|
</pre>
|
|
|
|
<p> The <i>class</i> field is always "IN", the <i>preference</i>
|
|
field exists only for MX records, the names of hosts, domains, etc.
|
|
end in ".", and those names are in ASCII form (xn--mumble form in
|
|
the case of UTF8 names). </p>
|
|
|
|
<p> When a match is found, the table lookup result specifies an
|
|
action. By default, the table query and the action name are
|
|
case-insensitive. Currently, only the <b>IGNORE</b> action is
|
|
implemented. </p>
|
|
|
|
<p> Notes: </p>
|
|
|
|
<ul>
|
|
|
|
<li> <p> Postfix DNS reply filters have no effect on implicit DNS
|
|
lookups through nsswitch.conf or equivalent mechanisms. </p>
|
|
|
|
<li> <p> The Postfix SMTP/LMTP client uses <a href="postconf.5.html#smtp_dns_reply_filter">smtp_dns_reply_filter</a>
|
|
and <a href="postconf.5.html#lmtp_dns_reply_filter">lmtp_dns_reply_filter</a> only to discover a remote SMTP or LMTP
|
|
service (record types MX, A, AAAA, and TLSA). These lookups are
|
|
also made to implement the features <a href="postconf.5.html#reject_unverified_sender">reject_unverified_sender</a> and
|
|
<a href="postconf.5.html#reject_unverified_recipient">reject_unverified_recipient</a>. </p>
|
|
|
|
<li> <p> The Postfix SMTP/LMTP client defers mail delivery when
|
|
a filter removes all lookup results from a successful query. </p>
|
|
|
|
<li> <p> Postfix SMTP server uses <a href="postconf.5.html#smtpd_dns_reply_filter">smtpd_dns_reply_filter</a> only to
|
|
look up MX, A, AAAA, and TXT records to implement the features
|
|
<a href="postconf.5.html#reject_unknown_helo_hostname">reject_unknown_helo_hostname</a>, <a href="postconf.5.html#reject_unknown_sender_domain">reject_unknown_sender_domain</a>,
|
|
<a href="postconf.5.html#reject_unknown_recipient_domain">reject_unknown_recipient_domain</a>, reject_rbl_*, and reject_rhsbl_*.
|
|
</p>
|
|
|
|
<li> <p> The Postfix SMTP server logs a warning or defers mail
|
|
delivery when a filter removes all lookup results from a successful
|
|
query. </p>
|
|
|
|
</ul>
|
|
|
|
<p> Example: ignore Google AAAA records in Postfix SMTP client DNS
|
|
lookups, because Google sometimes hard-rejects mail from IPv6 clients
|
|
with valid PTR etc. records. </p>
|
|
|
|
<pre>
|
|
/etc/postfix/<a href="postconf.5.html">main.cf</a>:
|
|
<a href="postconf.5.html#smtp_dns_reply_filter">smtp_dns_reply_filter</a> = <a href="pcre_table.5.html">pcre</a>:/etc/postfix/smtp_dns_reply_filter
|
|
</pre>
|
|
|
|
<pre>
|
|
/etc/postfix/smtp_dns_reply_filter:
|
|
# /domain ttl IN AAAA address/ action, all case-insensitive.
|
|
# Note: the domain name ends in ".".
|
|
/^\S+\.google\.com\.\s+\S+\s+\S+\s+AAAA\s+/ IGNORE
|
|
</pre>
|
|
|
|
<p> This feature is available in Postfix 3.0 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="smtp_dns_resolver_options">smtp_dns_resolver_options</a>
|
|
(default: empty)</b></DT><DD>
|
|
|
|
<p> DNS Resolver options for the Postfix SMTP client. Specify zero
|
|
or more of the following options, separated by comma or whitespace.
|
|
Option names are case-sensitive. Some options refer to domain names
|
|
that are specified in the file /etc/resolv.conf or equivalent. </p>
|
|
|
|
<dl>
|
|
|
|
<dt><b>res_defnames</b></dt>
|
|
|
|
<dd> Append the current domain name to single-component names (those
|
|
that do not contain a "." character). This can produce incorrect
|
|
results, and is the hard-coded behavior prior to Postfix 2.8. </dd>
|
|
|
|
<dt><b>res_dnsrch</b></dt>
|
|
|
|
<dd> Search for host names in the current domain and in parent
|
|
domains. This can produce incorrect results and is therefore not
|
|
recommended. </dd>
|
|
|
|
</dl>
|
|
|
|
<p> This feature is available in Postfix 2.8 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="smtp_dns_support_level">smtp_dns_support_level</a>
|
|
(default: empty)</b></DT><DD>
|
|
|
|
<p> Level of DNS support in the Postfix SMTP client. With
|
|
"<a href="postconf.5.html#smtp_dns_support_level">smtp_dns_support_level</a>" left at its empty default value, the legacy
|
|
"<a href="postconf.5.html#disable_dns_lookups">disable_dns_lookups</a>" parameter controls whether DNS is enabled in
|
|
the Postfix SMTP client, otherwise the legacy parameter is ignored.
|
|
</p>
|
|
|
|
<p> Specify one of the following: </p>
|
|
|
|
<dl>
|
|
|
|
<dt><b>disabled</b></dt>
|
|
|
|
<dd>Disable DNS lookups. No MX lookups are performed and hostname
|
|
to address lookups are unconditionally "native". This setting is
|
|
not appropriate for hosts that deliver mail to the public Internet.
|
|
Some obsolete how-to documents recommend disabling DNS lookups in
|
|
some configurations with content_filters. This is no longer required
|
|
and strongly discouraged. </dd>
|
|
|
|
<dt><b>enabled</b></dt>
|
|
|
|
<dd>Enable DNS lookups. Nexthop destination domains not enclosed
|
|
in "[]" will be subject to MX lookups. If "dns" and "native" are
|
|
included in the "<a href="postconf.5.html#smtp_host_lookup">smtp_host_lookup</a>" parameter value, DNS will be
|
|
queried first to resolve MX-host A records, followed by "native"
|
|
lookups if no answer is found in DNS. </dd>
|
|
|
|
<dt><b>dnssec</b></dt>
|
|
|
|
<dd>Enable <a href="https://tools.ietf.org/html/rfc4033">DNSSEC</a>
|
|
lookups. The "dnssec" setting differs from the "enabled" setting
|
|
above in the following ways: <ul> <li>Any MX lookups will set
|
|
RES_USE_DNSSEC and RES_USE_EDNS0 to request DNSSEC-validated
|
|
responses. If the MX response is DNSSEC-validated the corresponding
|
|
hostnames are considered validated. <li> The address lookups of
|
|
validated hostnames are also validated, (provided of course
|
|
"<a href="postconf.5.html#smtp_host_lookup">smtp_host_lookup</a>" includes "dns", see below). <li>Temporary
|
|
failures in DNSSEC-enabled hostname-to-address resolution block any
|
|
"native" lookups. Additional "native" lookups only happen when
|
|
DNSSEC lookups hard-fail (NODATA or NXDOMAIN). </ul> </dd>
|
|
|
|
</dl>
|
|
|
|
<p> The Postfix SMTP client considers non-MX "[nexthop]" and
|
|
"[nexthop]:port" destinations equivalent to statically-validated
|
|
MX records of the form "nexthop. IN MX 0 nexthop." Therefore,
|
|
with "dnssec" support turned on, validated hostname-to-address
|
|
lookups apply to the nexthop domain of any "[nexthop]" or
|
|
"[nexthop]:port" destination. This is also true for LMTP "inet:host"
|
|
and "inet:host:port" destinations, as LMTP hostnames are never
|
|
subject to MX lookups. </p>
|
|
|
|
<p>The "dnssec" setting is recommended only if you plan to use the
|
|
<a href="TLS_README.html#client_tls_dane">dane</a> or <a
|
|
href="TLS_README.html#client_tls_dane">dane-only</a> TLS security
|
|
level, otherwise enabling DNSSEC support in Postfix offers no
|
|
additional security. Postfix DNSSEC support relies on an upstream
|
|
recursive nameserver that validates DNSSEC signatures. Such a DNS
|
|
server will always filter out forged DNS responses, even when Postfix
|
|
itself is not configured to use DNSSEC. </p>
|
|
|
|
<p> When using Postfix DANE support the "<a href="postconf.5.html#smtp_host_lookup">smtp_host_lookup</a>" parameter
|
|
should include "dns", as <a
|
|
href="https://tools.ietf.org/html/rfc7672">DANE</a> is not applicable
|
|
to hosts resolved via "native" lookups. </p>
|
|
|
|
<p> As mentioned above, Postfix is not a validating <a
|
|
href="https://tools.ietf.org/html/rfc4035#section-4.9">stub
|
|
resolver</a>; it relies on the system's configured DNSSEC-validating
|
|
<a href="https://tools.ietf.org/html/rfc4035#section-3.2">recursive
|
|
nameserver</a> to perform all DNSSEC validation. Since this
|
|
nameserver's DNSSEC-validated responses will be fully trusted, it
|
|
is strongly recommended that the MTA host have a local DNSSEC-validating
|
|
recursive caching nameserver listening on a loopback address, and
|
|
be configured to use only this nameserver for all lookups. Otherwise,
|
|
Postfix may remain subject to man-in-the-middle attacks that forge
|
|
responses from the recursive nameserver</p>
|
|
|
|
<p>DNSSEC support requires a version of Postfix compiled against a
|
|
reasonably-modern DNS resolver(3) library that implements the
|
|
RES_USE_DNSSEC and RES_USE_EDNS0 resolver options. </p>
|
|
|
|
<p> This feature is available in Postfix 2.11 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="smtp_enforce_tls">smtp_enforce_tls</a>
|
|
(default: no)</b></DT><DD>
|
|
|
|
<p> Enforcement mode: require that remote SMTP servers use TLS
|
|
encryption, and never send mail in the clear. This also requires
|
|
that the remote SMTP server hostname matches the information in
|
|
the remote server certificate, and that the remote SMTP server
|
|
certificate was issued by a CA that is trusted by the Postfix SMTP
|
|
client. If the certificate doesn't verify or the hostname doesn't
|
|
match, delivery is deferred and mail stays in the queue. </p>
|
|
|
|
<p> The server hostname is matched against all names provided as
|
|
dNSNames in the SubjectAlternativeName. If no dNSNames are specified,
|
|
the CommonName is checked. The behavior may be changed with the
|
|
<a href="postconf.5.html#smtp_tls_enforce_peername">smtp_tls_enforce_peername</a> option. </p>
|
|
|
|
<p> This option is useful only if you are definitely sure that you
|
|
will only connect to servers that support <a href="https://tools.ietf.org/html/rfc2487">RFC 2487</a> _and_ that
|
|
provide valid server certificates. Typical use is for clients that
|
|
send all their email to a dedicated mailhub. </p>
|
|
|
|
<p> This feature is available in Postfix 2.2 and later. With
|
|
Postfix 2.3 and later use <a href="postconf.5.html#smtp_tls_security_level">smtp_tls_security_level</a> instead. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="smtp_fallback_relay">smtp_fallback_relay</a>
|
|
(default: $<a href="postconf.5.html#fallback_relay">fallback_relay</a>)</b></DT><DD>
|
|
|
|
<p> Optional list of relay destinations that will be used when an
|
|
SMTP destination is not found, or when delivery fails due to a
|
|
non-permanent error. With Postfix 2.2 and earlier this parameter
|
|
is called <a href="postconf.5.html#fallback_relay">fallback_relay</a>. </p>
|
|
|
|
<p> By default, <a href="postconf.5.html#smtp_fallback_relay">smtp_fallback_relay</a> is empty, mail is returned to
|
|
the sender when a destination is not found, and delivery is deferred
|
|
after it fails due to a non-permanent error. </p>
|
|
|
|
<p> With bulk email deliveries, it can be beneficial to run the
|
|
fallback relay MTA on the same host, so that it can reuse the sender
|
|
IP address. This speeds up deliveries that are delayed by IP-based
|
|
reputation systems (greylist, etc.). </p>
|
|
|
|
<p> The fallback relays must be SMTP destinations. Specify a domain,
|
|
host, host:port, [host]:port, [address] or [address]:port; the form
|
|
[host] turns off MX lookups. If you specify multiple SMTP
|
|
destinations, Postfix will try them in the specified order. </p>
|
|
|
|
<p> To prevent mailer loops between MX hosts and fall-back hosts,
|
|
Postfix version 2.2 and later will not use the fallback relays for
|
|
destinations that it is MX host for (assuming DNS lookup is turned on).
|
|
</p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="smtp_generic_maps">smtp_generic_maps</a>
|
|
(default: empty)</b></DT><DD>
|
|
|
|
<p> Optional lookup tables that perform address rewriting in the
|
|
Postfix SMTP client, typically to transform a locally valid address into
|
|
a globally valid address when sending mail across the Internet.
|
|
This is needed when the local machine does not have its own Internet
|
|
domain name, but uses something like <i>localdomain.local</i>
|
|
instead. </p>
|
|
|
|
<p>
|
|
Specify zero or more "type:name" lookup tables, separated by
|
|
whitespace or comma. Tables will be searched in the specified order
|
|
until a match is found.
|
|
</p>
|
|
|
|
<p> The table format and lookups are documented in <a href="generic.5.html">generic(5)</a>;
|
|
examples are shown in the <a href="ADDRESS_REWRITING_README.html">ADDRESS_REWRITING_README</a> and
|
|
<a href="STANDARD_CONFIGURATION_README.html">STANDARD_CONFIGURATION_README</a> documents. </p>
|
|
|
|
<p> This feature is available in Postfix 2.2 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="smtp_header_checks">smtp_header_checks</a>
|
|
(default: empty)</b></DT><DD>
|
|
|
|
<p> Restricted <a href="header_checks.5.html">header_checks(5)</a> tables for the Postfix SMTP client.
|
|
These tables are searched while mail is being delivered. Actions
|
|
that change the delivery time or destination are not available.
|
|
</p>
|
|
|
|
<p> This feature is available in Postfix 2.5 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="smtp_helo_name">smtp_helo_name</a>
|
|
(default: $<a href="postconf.5.html#myhostname">myhostname</a>)</b></DT><DD>
|
|
|
|
<p>
|
|
The hostname to send in the SMTP HELO or EHLO command.
|
|
</p>
|
|
|
|
<p>
|
|
The default value is the machine hostname. Specify a hostname or
|
|
[ip.add.re.ss].
|
|
</p>
|
|
|
|
<p>
|
|
This information can be specified in the <a href="postconf.5.html">main.cf</a> file for all SMTP
|
|
clients, or it can be specified in the <a href="master.5.html">master.cf</a> file for a specific
|
|
client, for example:
|
|
</p>
|
|
|
|
<blockquote>
|
|
<pre>
|
|
/etc/postfix/<a href="master.5.html">master.cf</a>:
|
|
mysmtp ... smtp -o <a href="postconf.5.html#smtp_helo_name">smtp_helo_name</a>=foo.bar.com
|
|
</pre>
|
|
</blockquote>
|
|
|
|
<p>
|
|
This feature is available in Postfix 2.0 and later.
|
|
</p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="smtp_helo_timeout">smtp_helo_timeout</a>
|
|
(default: 300s)</b></DT><DD>
|
|
|
|
<p>
|
|
The Postfix SMTP client time limit for sending the HELO or EHLO command,
|
|
and for receiving the initial remote SMTP server response.
|
|
</p>
|
|
|
|
<p> Specify a non-zero time value (an integral value plus an optional
|
|
one-letter suffix that specifies the time unit). Time units: s
|
|
(seconds), m (minutes), h (hours), d (days), w (weeks).
|
|
The default time unit is s (seconds). </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="smtp_host_lookup">smtp_host_lookup</a>
|
|
(default: dns)</b></DT><DD>
|
|
|
|
<p>
|
|
What mechanisms the Postfix SMTP client uses to look up a host's
|
|
IP address. This parameter is ignored when DNS lookups are disabled
|
|
(see: <a href="postconf.5.html#disable_dns_lookups">disable_dns_lookups</a> and <a href="postconf.5.html#smtp_dns_support_level">smtp_dns_support_level</a>). The "dns"
|
|
mechanism is always tried before "native" if both are listed.
|
|
</p>
|
|
|
|
<p>
|
|
Specify one of the following:
|
|
</p>
|
|
|
|
<dl>
|
|
|
|
<dt><b>dns</b></dt>
|
|
|
|
<dd>Hosts can be found in the DNS (preferred). </dd>
|
|
|
|
<dt><b>native</b></dt>
|
|
|
|
<dd>Use the native naming service only (nsswitch.conf, or equivalent
|
|
mechanism). </dd>
|
|
|
|
<dt><b>dns, native</b></dt>
|
|
|
|
<dd>Use the native service for hosts not found in the DNS. </dd>
|
|
|
|
</dl>
|
|
|
|
<p>
|
|
This feature is available in Postfix 2.1 and later.
|
|
</p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="smtp_line_length_limit">smtp_line_length_limit</a>
|
|
(default: 998)</b></DT><DD>
|
|
|
|
<p>
|
|
The maximal length of message header and body lines that Postfix
|
|
will send via SMTP. This limit does not include the <CR><LF>
|
|
at the end of each line. Longer lines are broken by inserting
|
|
"<CR><LF><SPACE>", to minimize the damage to MIME
|
|
formatted mail. Specify zero to disable this limit.
|
|
</p>
|
|
|
|
<p>
|
|
The Postfix limit of 998 characters not including <CR><LF>
|
|
is consistent with the SMTP limit of 1000 characters including
|
|
<CR><LF>. The Postfix limit was 990 with Postfix 2.8
|
|
and earlier.
|
|
</p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="smtp_mail_timeout">smtp_mail_timeout</a>
|
|
(default: 300s)</b></DT><DD>
|
|
|
|
<p>
|
|
The Postfix SMTP client time limit for sending the MAIL FROM command,
|
|
and for receiving the remote SMTP server response.
|
|
</p>
|
|
|
|
<p> Specify a non-zero time value (an integral value plus an optional
|
|
one-letter suffix that specifies the time unit). Time units: s
|
|
(seconds), m (minutes), h (hours), d (days), w (weeks).
|
|
The default time unit is s (seconds). </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="smtp_mime_header_checks">smtp_mime_header_checks</a>
|
|
(default: empty)</b></DT><DD>
|
|
|
|
<p> Restricted mime_<a href="header_checks.5.html">header_checks(5)</a> tables for the Postfix SMTP
|
|
client. These tables are searched while mail is being delivered.
|
|
Actions that change the delivery time or destination are not
|
|
available. </p>
|
|
|
|
<p> This feature is available in Postfix 2.5 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="smtp_min_data_rate">smtp_min_data_rate</a>
|
|
(default: 500)</b></DT><DD>
|
|
|
|
<p> The minimum plaintext data transfer rate in bytes/second for
|
|
DATA requests, when deadlines are enabled with <a href="postconf.5.html#smtp_per_request_deadline">smtp_per_request_deadline</a>.
|
|
After a write operation transfers N plaintext message bytes (possibly
|
|
after TLS encryption), and after the DATA request deadline is
|
|
decremented by the elapsed time of that write operation, the DATA
|
|
request deadline is incremented by N/smtp_min_data_rate seconds.
|
|
However, the deadline will never be incremented beyond the time
|
|
limit specified with <a href="postconf.5.html#smtp_data_xfer_timeout">smtp_data_xfer_timeout</a>. </p>
|
|
|
|
<p> This feature is available in Postfix 3.7 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="smtp_mx_address_limit">smtp_mx_address_limit</a>
|
|
(default: 5)</b></DT><DD>
|
|
|
|
<p>
|
|
The maximal number of MX (mail exchanger) IP addresses that can
|
|
result from Postfix SMTP client mail exchanger lookups, or zero (no
|
|
limit). Prior to
|
|
Postfix version 2.3, this limit was disabled by default.
|
|
</p>
|
|
|
|
<p>
|
|
This feature is available in Postfix 2.1 and later.
|
|
</p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="smtp_mx_session_limit">smtp_mx_session_limit</a>
|
|
(default: 2)</b></DT><DD>
|
|
|
|
<p> The maximal number of SMTP sessions per delivery request before
|
|
the Postfix SMTP client
|
|
gives up or delivers to a fall-back <a href="postconf.5.html#relayhost">relay host</a>, or zero (no
|
|
limit). This restriction ignores sessions that fail to complete the
|
|
SMTP initial handshake (Postfix version 2.2 and earlier) or that fail to
|
|
complete the EHLO and TLS handshake (Postfix version 2.3 and later). </p>
|
|
|
|
<p> This feature is available in Postfix 2.1 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="smtp_nested_header_checks">smtp_nested_header_checks</a>
|
|
(default: empty)</b></DT><DD>
|
|
|
|
<p> Restricted nested_<a href="header_checks.5.html">header_checks(5)</a> tables for the Postfix SMTP
|
|
client. These tables are searched while mail is being delivered.
|
|
Actions that change the delivery time or destination are not
|
|
available. </p>
|
|
|
|
<p> This feature is available in Postfix 2.5 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="smtp_never_send_ehlo">smtp_never_send_ehlo</a>
|
|
(default: no)</b></DT><DD>
|
|
|
|
<p> Never send EHLO at the start of an SMTP session. See also the
|
|
<a href="postconf.5.html#smtp_always_send_ehlo">smtp_always_send_ehlo</a> parameter. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="smtp_per_record_deadline">smtp_per_record_deadline</a>
|
|
(default: no)</b></DT><DD>
|
|
|
|
<p> Change the behavior of the smtp_*_timeout time limits, from a
|
|
time limit per read or write system call, to a time limit to send
|
|
or receive a complete record (an SMTP command line, SMTP response
|
|
line, SMTP message content line, or TLS protocol message). This
|
|
limits the impact from hostile peers that trickle data one byte at
|
|
a time. </p>
|
|
|
|
<p> Note: when per-record deadlines are enabled, a short timeout
|
|
may cause problems with TLS over very slow network connections.
|
|
The reasons are that a TLS protocol message can be up to 16 kbytes
|
|
long (with TLSv1), and that an entire TLS protocol message must be
|
|
sent or received within the per-record deadline. </p>
|
|
|
|
<p> This feature is available in Postfix 2.9-3.6. With older
|
|
Postfix releases, the behavior is as if this parameter is set to
|
|
"no". Postfix 3.7 and later use <a href="postconf.5.html#smtp_per_request_deadline">smtp_per_request_deadline</a>. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="smtp_per_request_deadline">smtp_per_request_deadline</a>
|
|
(default: no)</b></DT><DD>
|
|
|
|
<p> Change the behavior of the smtp_*_timeout time limits, from a
|
|
time limit per plaintext or TLS read or write call, to a combined
|
|
time limit for sending a complete SMTP request and for receiving a
|
|
complete SMTP response. The deadline limits only the time spent
|
|
waiting for plaintext or TLS read or write calls, not time spent
|
|
elsewhere. The per-request deadline limits the impact from hostile
|
|
peers that trickle data one byte at a time. </p>
|
|
|
|
<p> See <a href="postconf.5.html#smtp_min_data_rate">smtp_min_data_rate</a> for how the per-request deadline is
|
|
managed during the DATA phase. </p>
|
|
|
|
<p> Note: when per-request deadlines are enabled, a short time limit
|
|
may cause problems with TLS over very slow network connections. The
|
|
reason is that a TLS protocol message can be up to 16 kbytes long
|
|
(with TLSv1), and that an entire TLS protocol message must be
|
|
transferred within the per-request deadline. </p>
|
|
|
|
<p> This feature is available in Postfix 3.7 and later. A weaker
|
|
feature, called <a href="postconf.5.html#smtp_per_record_deadline">smtp_per_record_deadline</a>, is available with Postfix
|
|
2.9-3.6. </p>
|
|
|
|
<p> This feature is available in Postfix 3.7 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="smtp_pix_workaround_delay_time">smtp_pix_workaround_delay_time</a>
|
|
(default: 10s)</b></DT><DD>
|
|
|
|
<p>
|
|
How long the Postfix SMTP client pauses before sending
|
|
".<CR><LF>" in order to work around the PIX firewall
|
|
"<CR><LF>.<CR><LF>" bug.
|
|
</p>
|
|
|
|
<p>
|
|
Choosing too short a time makes this workaround ineffective when
|
|
sending large messages over slow network connections.
|
|
</p>
|
|
|
|
<p> Specify a non-zero time value (an integral value plus an optional
|
|
one-letter suffix that specifies the time unit). Time units: s
|
|
(seconds), m (minutes), h (hours), d (days), w (weeks).
|
|
The default time unit is s (seconds). </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="smtp_pix_workaround_maps">smtp_pix_workaround_maps</a>
|
|
(default: empty)</b></DT><DD>
|
|
|
|
<p> Lookup tables, indexed by the remote SMTP server address, with
|
|
per-destination workarounds for CISCO PIX firewall bugs. The table
|
|
is not indexed by hostname for consistency with
|
|
<a href="postconf.5.html#smtp_discard_ehlo_keyword_address_maps">smtp_discard_ehlo_keyword_address_maps</a>. </p>
|
|
|
|
<p>
|
|
Specify zero or more "type:name" lookup tables, separated by
|
|
whitespace or comma. Tables will be searched in the specified order
|
|
until a match is found.
|
|
</p>
|
|
|
|
<p> This feature is available in Postfix 2.4 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="smtp_pix_workaround_threshold_time">smtp_pix_workaround_threshold_time</a>
|
|
(default: 500s)</b></DT><DD>
|
|
|
|
<p> How long a message must be queued before the Postfix SMTP client
|
|
turns on the PIX firewall "<CR><LF>.<CR><LF>"
|
|
bug workaround for delivery through firewalls with "smtp fixup"
|
|
mode turned on. </p>
|
|
|
|
<p> Specify a non-negative time value (an integral value plus an optional
|
|
one-letter suffix that specifies the time unit). Time units: s
|
|
(seconds), m (minutes), h (hours), d (days), w (weeks).
|
|
The default time unit is s (seconds). </p>
|
|
|
|
<p>
|
|
By default, the workaround is turned off for mail that is queued
|
|
for less than 500 seconds. In other words, the workaround is normally
|
|
turned off for the first delivery attempt.
|
|
</p>
|
|
|
|
<p>
|
|
Specify 0 to enable the PIX firewall
|
|
"<CR><LF>.<CR><LF>" bug workaround upon the
|
|
first delivery attempt.
|
|
</p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="smtp_pix_workarounds">smtp_pix_workarounds</a>
|
|
(default: disable_esmtp, delay_dotcrlf)</b></DT><DD>
|
|
|
|
<p> A list that specifies zero or more workarounds for CISCO PIX
|
|
firewall bugs. These workarounds are implemented by the Postfix
|
|
SMTP client. Workaround names are separated by comma or space, and
|
|
are case insensitive. This parameter setting can be overruled with
|
|
per-destination <a href="postconf.5.html#smtp_pix_workaround_maps">smtp_pix_workaround_maps</a> settings. </p>
|
|
|
|
<dl>
|
|
|
|
<dt><b>delay_dotcrlf</b><dd> Insert a delay before sending
|
|
".<CR><LF>" after the end of the message content. The
|
|
delay is subject to the <a href="postconf.5.html#smtp_pix_workaround_delay_time">smtp_pix_workaround_delay_time</a> and
|
|
<a href="postconf.5.html#smtp_pix_workaround_threshold_time">smtp_pix_workaround_threshold_time</a> parameter settings. </dd>
|
|
|
|
<dt><b>disable_esmtp</b><dd> Disable all extended SMTP commands:
|
|
send HELO instead of EHLO. </dd>
|
|
|
|
</dl>
|
|
|
|
<p> This feature is available in Postfix 2.4 and later. The default
|
|
settings are backwards compatible with earlier Postfix versions.
|
|
</p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="smtp_quit_timeout">smtp_quit_timeout</a>
|
|
(default: 300s)</b></DT><DD>
|
|
|
|
<p>
|
|
The Postfix SMTP client time limit for sending the QUIT command,
|
|
and for receiving the remote SMTP server response.
|
|
</p>
|
|
|
|
<p> Specify a non-zero time value (an integral value plus an optional
|
|
one-letter suffix that specifies the time unit). Time units: s
|
|
(seconds), m (minutes), h (hours), d (days), w (weeks).
|
|
The default time unit is s (seconds). </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="smtp_quote_rfc821_envelope">smtp_quote_rfc821_envelope</a>
|
|
(default: yes)</b></DT><DD>
|
|
|
|
<p>
|
|
Quote addresses in Postfix SMTP client MAIL FROM and RCPT TO commands
|
|
as required
|
|
by <a href="https://tools.ietf.org/html/rfc5321">RFC 5321</a>. This includes putting quotes around an address localpart
|
|
that ends in ".".
|
|
</p>
|
|
|
|
<p>
|
|
The default is to comply with <a href="https://tools.ietf.org/html/rfc5321">RFC 5321</a>. If you have to send mail to
|
|
a broken SMTP server, configure a special SMTP client in <a href="master.5.html">master.cf</a>:
|
|
</p>
|
|
|
|
<blockquote>
|
|
<pre>
|
|
/etc/postfix/<a href="master.5.html">master.cf</a>:
|
|
broken-smtp . . . smtp -o <a href="postconf.5.html#smtp_quote_rfc821_envelope">smtp_quote_rfc821_envelope</a>=no
|
|
</pre>
|
|
</blockquote>
|
|
|
|
<p>
|
|
and route mail for the destination in question to the "broken-smtp"
|
|
message delivery with a <a href="transport.5.html">transport(5)</a> table.
|
|
</p>
|
|
|
|
<p>
|
|
This feature is available in Postfix 2.1 and later.
|
|
</p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="smtp_randomize_addresses">smtp_randomize_addresses</a>
|
|
(default: yes)</b></DT><DD>
|
|
|
|
<p>
|
|
Randomize the order of equal-preference MX host addresses. This
|
|
is a performance feature of the Postfix SMTP client.
|
|
</p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="smtp_rcpt_timeout">smtp_rcpt_timeout</a>
|
|
(default: 300s)</b></DT><DD>
|
|
|
|
<p>
|
|
The Postfix SMTP client time limit for sending the SMTP RCPT TO
|
|
command, and for receiving the remote SMTP server response.
|
|
</p>
|
|
|
|
<p> Specify a non-zero time value (an integral value plus an optional
|
|
one-letter suffix that specifies the time unit). Time units: s
|
|
(seconds), m (minutes), h (hours), d (days), w (weeks).
|
|
The default time unit is s (seconds). </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="smtp_reply_filter">smtp_reply_filter</a>
|
|
(default: empty)</b></DT><DD>
|
|
|
|
<p> A mechanism to transform replies from remote SMTP servers one
|
|
line at a time. This is a last-resort tool to work around server
|
|
replies that break interoperability with the Postfix SMTP client.
|
|
Other uses involve fault injection to test Postfix's handling of
|
|
invalid responses. </p>
|
|
|
|
<p> Notes: </p>
|
|
|
|
<ul>
|
|
|
|
<li> <p> In the case of a multi-line reply, the Postfix SMTP client
|
|
uses the final reply line's numerical SMTP reply code and enhanced
|
|
status code. </p>
|
|
|
|
<li> <p> The numerical SMTP reply code (XYZ) takes precedence over
|
|
the enhanced status code (X.Y.Z). When the enhanced status code
|
|
initial digit differs from the SMTP reply code initial digit, or
|
|
when no enhanced status code is present, the Postfix SMTP client
|
|
uses a generic enhanced status code (X.0.0) instead. </p>
|
|
|
|
</ul>
|
|
|
|
<p> Specify the name of a "<a href="DATABASE_README.html">type:table</a>" lookup table. The search
|
|
string is a single SMTP reply line as received from the remote SMTP
|
|
server, except that the trailing <CR><LF> are removed.
|
|
When the lookup succeeds, the result replaces the single SMTP reply
|
|
line. </p>
|
|
|
|
<p> Examples: </p>
|
|
|
|
<pre>
|
|
/etc/postfix/<a href="postconf.5.html">main.cf</a>:
|
|
<a href="postconf.5.html#smtp_reply_filter">smtp_reply_filter</a> = <a href="pcre_table.5.html">pcre</a>:/etc/postfix/reply_filter
|
|
</pre>
|
|
|
|
<pre>
|
|
/etc/postfix/reply_filter:
|
|
# Transform garbage into "250-filler..." so that it looks like
|
|
# one line from a multi-line reply. It does not matter what we
|
|
# substitute here as long it has the right syntax. The Postfix
|
|
# SMTP client will use the final line's numerical SMTP reply
|
|
# code and enhanced status code.
|
|
!/^([2-5][0-9][0-9]($|[- ]))/ 250-filler for garbage
|
|
</pre>
|
|
|
|
<p> This feature is available in Postfix 2.7. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="smtp_rset_timeout">smtp_rset_timeout</a>
|
|
(default: 20s)</b></DT><DD>
|
|
|
|
<p> The Postfix SMTP client time limit for sending the RSET command,
|
|
and for receiving the remote SMTP server response. The SMTP client
|
|
sends RSET in
|
|
order to finish a recipient address probe, or to verify that a
|
|
cached session is still usable. </p>
|
|
|
|
<p> Specify a non-zero time value (an integral value plus an optional
|
|
one-letter suffix that specifies the time unit). Time units: s
|
|
(seconds), m (minutes), h (hours), d (days), w (weeks).
|
|
The default time unit is s (seconds). </p>
|
|
|
|
<p> This feature is available in Postfix 2.1 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="smtp_sasl_auth_cache_name">smtp_sasl_auth_cache_name</a>
|
|
(default: empty)</b></DT><DD>
|
|
|
|
<p> An optional table to prevent repeated SASL authentication
|
|
failures with the same remote SMTP server hostname, username and
|
|
password. Each table (key, value) pair contains a server name, a
|
|
username and password, and the full server response. This information
|
|
is stored when a remote SMTP server rejects an authentication attempt
|
|
with a 535 reply code. As long as the <a href="postconf.5.html#smtp_sasl_password_maps">smtp_sasl_password_maps</a>
|
|
information does not change, and as long as the <a href="postconf.5.html#smtp_sasl_auth_cache_name">smtp_sasl_auth_cache_name</a>
|
|
information does not expire (see <a href="postconf.5.html#smtp_sasl_auth_cache_time">smtp_sasl_auth_cache_time</a>) the
|
|
Postfix SMTP client avoids SASL authentication attempts with the
|
|
same server, username and password, and instead bounces or defers
|
|
mail as controlled with the <a href="postconf.5.html#smtp_sasl_auth_soft_bounce">smtp_sasl_auth_soft_bounce</a> configuration
|
|
parameter. </p>
|
|
|
|
<p> Use a per-destination delivery concurrency of 1 (for example,
|
|
"<a href="postconf.5.html#smtp_destination_concurrency_limit">smtp_destination_concurrency_limit</a> = 1",
|
|
"<a href="postconf.5.html#relay_destination_concurrency_limit">relay_destination_concurrency_limit</a> = 1", etc.), otherwise multiple
|
|
delivery agents may experience a login failure at the same time.
|
|
</p>
|
|
|
|
<p> The table must be accessed via the proxywrite service, i.e. the
|
|
map name must start with "<a href="proxymap.8.html">proxy</a>:". The table should be stored under
|
|
the directory specified with the <a href="postconf.5.html#data_directory">data_directory</a> parameter. </p>
|
|
|
|
<p> This feature uses cryptographic hashing to protect plain-text
|
|
passwords, and requires that Postfix is compiled with TLS support.
|
|
</p>
|
|
|
|
<p> Example: </p>
|
|
|
|
<pre>
|
|
<a href="postconf.5.html#smtp_sasl_auth_cache_name">smtp_sasl_auth_cache_name</a> = <a href="proxymap.8.html">proxy</a>:<a href="DATABASE_README.html#types">btree</a>:/var/lib/postfix/sasl_auth_cache
|
|
</pre>
|
|
|
|
<p> This feature is available in Postfix 2.5 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="smtp_sasl_auth_cache_time">smtp_sasl_auth_cache_time</a>
|
|
(default: 90d)</b></DT><DD>
|
|
|
|
<p> The maximal age of an <a href="postconf.5.html#smtp_sasl_auth_cache_name">smtp_sasl_auth_cache_name</a> entry before it
|
|
is removed. </p>
|
|
|
|
<p> Specify a non-negative time value (an integral value plus an optional
|
|
one-letter suffix that specifies the time unit). Time units: s
|
|
(seconds), m (minutes), h (hours), d (days), w (weeks).
|
|
The default time unit is d (days). </p>
|
|
|
|
<p> This feature is available in Postfix 2.5 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="smtp_sasl_auth_enable">smtp_sasl_auth_enable</a>
|
|
(default: no)</b></DT><DD>
|
|
|
|
<p>
|
|
Enable SASL authentication in the Postfix SMTP client. By default,
|
|
the Postfix SMTP client uses no authentication.
|
|
</p>
|
|
|
|
<p>
|
|
Example:
|
|
</p>
|
|
|
|
<pre>
|
|
<a href="postconf.5.html#smtp_sasl_auth_enable">smtp_sasl_auth_enable</a> = yes
|
|
</pre>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="smtp_sasl_auth_soft_bounce">smtp_sasl_auth_soft_bounce</a>
|
|
(default: yes)</b></DT><DD>
|
|
|
|
<p> When a remote SMTP server rejects a SASL authentication request
|
|
with a 535 reply code, defer mail delivery instead of returning
|
|
mail as undeliverable. The latter behavior was hard-coded prior to
|
|
Postfix version 2.5. </p>
|
|
|
|
<p> Note: the setting "yes" overrides the global <a href="postconf.5.html#soft_bounce">soft_bounce</a>
|
|
parameter, but the setting "no" does not. </p>
|
|
|
|
<p> Example: </p>
|
|
|
|
<pre>
|
|
# Default as of Postfix 2.5
|
|
<a href="postconf.5.html#smtp_sasl_auth_soft_bounce">smtp_sasl_auth_soft_bounce</a> = yes
|
|
# The old hard-coded default
|
|
<a href="postconf.5.html#smtp_sasl_auth_soft_bounce">smtp_sasl_auth_soft_bounce</a> = no
|
|
</pre>
|
|
|
|
<p> This feature is available in Postfix 2.5 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="smtp_sasl_mechanism_filter">smtp_sasl_mechanism_filter</a>
|
|
(default: empty)</b></DT><DD>
|
|
|
|
<p>
|
|
If non-empty, a Postfix SMTP client filter for the remote SMTP
|
|
server's list of offered SASL mechanisms. Different client and
|
|
server implementations may support different mechanism lists; by
|
|
default, the Postfix SMTP client will use the intersection of the
|
|
two. <a href="postconf.5.html#smtp_sasl_mechanism_filter">smtp_sasl_mechanism_filter</a> specifies an optional third mechanism
|
|
list to intersect with. </p>
|
|
|
|
<p> Specify mechanism names, "/file/name" patterns or "<a href="DATABASE_README.html">type:table</a>"
|
|
lookup tables. The right-hand side result from "<a href="DATABASE_README.html">type:table</a>" lookups
|
|
is ignored. Specify "!pattern" to exclude a mechanism name from the
|
|
list. The form "!/file/name" is supported only in Postfix version
|
|
2.4 and later. </p>
|
|
|
|
<p> This feature is available in Postfix 2.2 and later. </p>
|
|
|
|
<p>
|
|
Examples:
|
|
</p>
|
|
|
|
<pre>
|
|
<a href="postconf.5.html#smtp_sasl_mechanism_filter">smtp_sasl_mechanism_filter</a> = plain, login
|
|
<a href="postconf.5.html#smtp_sasl_mechanism_filter">smtp_sasl_mechanism_filter</a> = /etc/postfix/smtp_mechs
|
|
<a href="postconf.5.html#smtp_sasl_mechanism_filter">smtp_sasl_mechanism_filter</a> = !gssapi, !login, <a href="DATABASE_README.html#types">static</a>:rest
|
|
</pre>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="smtp_sasl_password_maps">smtp_sasl_password_maps</a>
|
|
(default: empty)</b></DT><DD>
|
|
|
|
<p>
|
|
Optional Postfix SMTP client lookup tables with one username:password
|
|
entry per sender, remote hostname or next-hop domain. Per-sender
|
|
lookup is done only when sender-dependent authentication is enabled.
|
|
If no username:password entry is found, then the Postfix SMTP client
|
|
will not attempt to authenticate to the remote host.
|
|
</p>
|
|
|
|
<p> Use <a href="postconf.5.html#smtp_sasl_password_result_delimiter">smtp_sasl_password_result_delimiter</a> to specify an
|
|
alternative separator between username and password. </p>
|
|
|
|
<p>
|
|
The Postfix SMTP client opens the lookup table before going to
|
|
chroot jail, so you can leave the password file in /etc/postfix.
|
|
</p>
|
|
|
|
<p>
|
|
Specify zero or more "type:name" lookup tables, separated by
|
|
whitespace or comma. Tables will be searched in the specified order
|
|
until a match is found.
|
|
</p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="smtp_sasl_password_result_delimiter">smtp_sasl_password_result_delimiter</a>
|
|
(default: :)</b></DT><DD>
|
|
|
|
<p> The delimiter between username and password in sasl_passwd_maps lookup
|
|
results. Specify one non-whitespace character that does not appear in
|
|
the username. </p>
|
|
|
|
<p> This feature is available in Postfix ≥ 3.9. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="smtp_sasl_path">smtp_sasl_path</a>
|
|
(default: empty)</b></DT><DD>
|
|
|
|
<p> Implementation-specific information that the Postfix SMTP client
|
|
passes through to
|
|
the SASL plug-in implementation that is selected with
|
|
<b><a href="postconf.5.html#smtp_sasl_type">smtp_sasl_type</a></b>. Typically this specifies the name of a
|
|
configuration file or rendezvous point. </p>
|
|
|
|
<p> This feature is available in Postfix 2.3 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="smtp_sasl_security_options">smtp_sasl_security_options</a>
|
|
(default: noplaintext, noanonymous)</b></DT><DD>
|
|
|
|
<p> Postfix SMTP client SASL security options; as of Postfix 2.3
|
|
the list of available
|
|
features depends on the SASL client implementation that is selected
|
|
with <b><a href="postconf.5.html#smtp_sasl_type">smtp_sasl_type</a></b>. </p>
|
|
|
|
<p> The following security features are defined for the <b>cyrus</b>
|
|
client SASL implementation: </p>
|
|
|
|
<p>
|
|
Specify zero or more of the following:
|
|
</p>
|
|
|
|
<dl>
|
|
|
|
<dt><b>noplaintext</b></dt>
|
|
|
|
<dd>Disallow methods that use plaintext passwords. </dd>
|
|
|
|
<dt><b>noactive</b></dt>
|
|
|
|
<dd>Disallow methods subject to active (non-dictionary) attack.
|
|
</dd>
|
|
|
|
<dt><b>nodictionary</b></dt>
|
|
|
|
<dd>Disallow methods subject to passive (dictionary) attack. </dd>
|
|
|
|
<dt><b>noanonymous</b></dt>
|
|
|
|
<dd>Disallow methods that allow anonymous authentication. </dd>
|
|
|
|
<dt><b>mutual_auth</b></dt>
|
|
|
|
<dd>Only allow methods that provide mutual authentication (not
|
|
available with SASL version 1). </dd>
|
|
|
|
</dl>
|
|
|
|
<p>
|
|
Example:
|
|
</p>
|
|
|
|
<pre>
|
|
<a href="postconf.5.html#smtp_sasl_security_options">smtp_sasl_security_options</a> = noplaintext
|
|
</pre>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="smtp_sasl_tls_security_options">smtp_sasl_tls_security_options</a>
|
|
(default: $<a href="postconf.5.html#smtp_sasl_security_options">smtp_sasl_security_options</a>)</b></DT><DD>
|
|
|
|
<p> The SASL authentication security options that the Postfix SMTP
|
|
client uses for TLS encrypted SMTP sessions. </p>
|
|
|
|
<p> This feature is available in Postfix 2.2 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="smtp_sasl_tls_verified_security_options">smtp_sasl_tls_verified_security_options</a>
|
|
(default: $<a href="postconf.5.html#smtp_sasl_tls_security_options">smtp_sasl_tls_security_options</a>)</b></DT><DD>
|
|
|
|
<p> The SASL authentication security options that the Postfix SMTP
|
|
client uses for TLS encrypted SMTP sessions with a verified server
|
|
certificate. </p>
|
|
|
|
<p> When mail is sent to the public MX host for the recipient's
|
|
domain, server certificates are by default optional, and delivery
|
|
proceeds even if certificate verification fails. For delivery via
|
|
a submission service that requires SASL authentication, it may be
|
|
appropriate to send plaintext passwords only when the connection
|
|
to the server is strongly encrypted <b>and</b> the server identity
|
|
is verified. </p>
|
|
|
|
<p> The <a href="postconf.5.html#smtp_sasl_tls_verified_security_options">smtp_sasl_tls_verified_security_options</a> parameter makes it
|
|
possible to only enable plaintext mechanisms when a secure connection
|
|
to the server is available. Submission servers subject to this
|
|
policy must either have verifiable certificates or offer suitable
|
|
non-plaintext SASL mechanisms. </p>
|
|
|
|
<p> This feature is available in Postfix 2.6 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="smtp_sasl_type">smtp_sasl_type</a>
|
|
(default: cyrus)</b></DT><DD>
|
|
|
|
<p> The SASL plug-in type that the Postfix SMTP client should use
|
|
for authentication. The available types are listed with the
|
|
"<b>postconf -A</b>" command. </p>
|
|
|
|
<p> This feature is available in Postfix 2.3 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="smtp_send_dummy_mail_auth">smtp_send_dummy_mail_auth</a>
|
|
(default: no)</b></DT><DD>
|
|
|
|
<p> Whether or not to append the "AUTH=<>" option to the MAIL
|
|
FROM command in SASL-authenticated SMTP sessions. The default is
|
|
not to send this, to avoid problems with broken remote SMTP servers.
|
|
Before Postfix 2.9 the behavior is as if "<a href="postconf.5.html#smtp_send_dummy_mail_auth">smtp_send_dummy_mail_auth</a>
|
|
= yes".
|
|
|
|
<p> This feature is available in Postfix 2.9 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="smtp_send_xforward_command">smtp_send_xforward_command</a>
|
|
(default: no)</b></DT><DD>
|
|
|
|
<p>
|
|
Send the non-standard XFORWARD command when the Postfix SMTP server
|
|
EHLO response announces XFORWARD support.
|
|
</p>
|
|
|
|
<p>
|
|
This allows a Postfix SMTP delivery agent, used for injecting mail
|
|
into
|
|
a content filter, to forward the name, address, protocol and HELO
|
|
name of the original client to the content filter and downstream
|
|
queuing SMTP server. This can produce more useful logging than
|
|
localhost[127.0.0.1] etc.
|
|
</p>
|
|
|
|
<p>
|
|
This feature is available in Postfix 2.1 and later.
|
|
</p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="smtp_sender_dependent_authentication">smtp_sender_dependent_authentication</a>
|
|
(default: no)</b></DT><DD>
|
|
|
|
<p>
|
|
Enable sender-dependent authentication in the Postfix SMTP client; this is
|
|
available only with SASL authentication, and disables SMTP connection
|
|
caching to ensure that mail from different senders will use the
|
|
appropriate credentials. </p>
|
|
|
|
<p>
|
|
This feature is available in Postfix 2.3 and later.
|
|
</p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="smtp_skip_4xx_greeting">smtp_skip_4xx_greeting</a>
|
|
(default: yes)</b></DT><DD>
|
|
|
|
<p>
|
|
Skip SMTP servers that greet with a 4XX status code (go away, try
|
|
again later).
|
|
</p>
|
|
|
|
<p>
|
|
By default, the Postfix SMTP client moves on the next mail exchanger.
|
|
Specify
|
|
"<a href="postconf.5.html#smtp_skip_4xx_greeting">smtp_skip_4xx_greeting</a> = no" if Postfix should defer delivery
|
|
immediately.
|
|
</p>
|
|
|
|
<p> This feature is available in Postfix 2.0 and earlier.
|
|
Later Postfix versions always skip remote SMTP servers that greet
|
|
with a
|
|
4XX status code. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="smtp_skip_5xx_greeting">smtp_skip_5xx_greeting</a>
|
|
(default: yes)</b></DT><DD>
|
|
|
|
<p>
|
|
Skip remote SMTP servers that greet with a 5XX status code.
|
|
</p>
|
|
|
|
<p> By default, the Postfix SMTP client moves on the next mail
|
|
exchanger. Specify "<a href="postconf.5.html#smtp_skip_5xx_greeting">smtp_skip_5xx_greeting</a> = no" if Postfix should
|
|
bounce the mail immediately. Caution: the latter behavior appears
|
|
to contradict <a href="https://tools.ietf.org/html/rfc2821">RFC 2821</a>. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="smtp_skip_quit_response">smtp_skip_quit_response</a>
|
|
(default: yes)</b></DT><DD>
|
|
|
|
<p>
|
|
Do not wait for the response to the SMTP QUIT command.
|
|
</p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="smtp_starttls_timeout">smtp_starttls_timeout</a>
|
|
(default: 300s)</b></DT><DD>
|
|
|
|
<p> Time limit for Postfix SMTP client write and read operations
|
|
during TLS startup and shutdown handshake procedures. </p>
|
|
|
|
<p> Specify a non-zero time value (an integral value plus an optional
|
|
one-letter suffix that specifies the time unit). Time units: s
|
|
(seconds), m (minutes), h (hours), d (days), w (weeks).
|
|
The default time unit is s (seconds). </p>
|
|
|
|
<p> This feature is available in Postfix 2.2 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="smtp_tcp_port">smtp_tcp_port</a>
|
|
(default: smtp)</b></DT><DD>
|
|
|
|
<p>
|
|
The default TCP port that the Postfix SMTP client connects to.
|
|
Specify a symbolic name (see services(5)) or a numeric port.
|
|
</p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="smtp_tls_CAfile">smtp_tls_CAfile</a>
|
|
(default: empty)</b></DT><DD>
|
|
|
|
<p> A file containing CA certificates of root CAs trusted to sign
|
|
either remote SMTP server certificates or intermediate CA certificates.
|
|
These are loaded into memory before the <a href="smtp.8.html">smtp(8)</a> client enters the
|
|
chroot jail. If the number of trusted roots is large, consider using
|
|
<a href="postconf.5.html#smtp_tls_CApath">smtp_tls_CApath</a> instead, but note that the latter directory must be
|
|
present in the chroot jail if the <a href="smtp.8.html">smtp(8)</a> client is chrooted. This
|
|
file may also be used to augment the client certificate trust chain,
|
|
but it is best to include all the required certificates directly in
|
|
$<a href="postconf.5.html#smtp_tls_cert_file">smtp_tls_cert_file</a> (or, Postfix ≥ 3.4 $<a href="postconf.5.html#smtp_tls_chain_files">smtp_tls_chain_files</a>). </p>
|
|
|
|
<p> Specify "<a href="postconf.5.html#smtp_tls_CAfile">smtp_tls_CAfile</a> = /path/to/system_CA_file" to use
|
|
ONLY the system-supplied default Certification Authority certificates.
|
|
</p>
|
|
|
|
<p> Specify "<a href="postconf.5.html#tls_append_default_CA">tls_append_default_CA</a> = no" to prevent Postfix from
|
|
appending the system-supplied default CAs and trusting third-party
|
|
certificates. </p>
|
|
|
|
<p> Example: </p>
|
|
|
|
<pre>
|
|
<a href="postconf.5.html#smtp_tls_CAfile">smtp_tls_CAfile</a> = /etc/postfix/CAcert.pem
|
|
</pre>
|
|
|
|
<p> This feature is available in Postfix 2.2 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="smtp_tls_CApath">smtp_tls_CApath</a>
|
|
(default: empty)</b></DT><DD>
|
|
|
|
<p> Directory with PEM format Certification Authority certificates
|
|
that the Postfix SMTP client uses to verify a remote SMTP server
|
|
certificate. Don't forget to create the necessary "hash" links
|
|
with, for example, "$OPENSSL_HOME/bin/c_rehash /etc/postfix/certs".
|
|
</p>
|
|
|
|
<p> To use this option in chroot mode, this directory (or a copy)
|
|
must be inside the chroot jail. </p>
|
|
|
|
<p> Specify "<a href="postconf.5.html#smtp_tls_CApath">smtp_tls_CApath</a> = /path/to/system_CA_directory" to
|
|
use ONLY the system-supplied default Certification Authority certificates.
|
|
</p>
|
|
|
|
<p> Specify "<a href="postconf.5.html#tls_append_default_CA">tls_append_default_CA</a> = no" to prevent Postfix from
|
|
appending the system-supplied default CAs and trusting third-party
|
|
certificates. </p>
|
|
|
|
<p> Example: </p>
|
|
|
|
<pre>
|
|
<a href="postconf.5.html#smtp_tls_CApath">smtp_tls_CApath</a> = /etc/postfix/certs
|
|
</pre>
|
|
|
|
<p> This feature is available in Postfix 2.2 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="smtp_tls_block_early_mail_reply">smtp_tls_block_early_mail_reply</a>
|
|
(default: no)</b></DT><DD>
|
|
|
|
<p> Try to detect a mail hijacking attack based on a TLS protocol
|
|
vulnerability (CVE-2009-3555), where an attacker prepends malicious
|
|
HELO, MAIL, RCPT, DATA commands to a Postfix SMTP client TLS session.
|
|
The attack would succeed with non-Postfix SMTP servers that reply
|
|
to the malicious HELO, MAIL, RCPT, DATA commands after negotiating
|
|
the Postfix SMTP client TLS session. </p>
|
|
|
|
<p> This feature is available in Postfix 2.7. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="smtp_tls_cert_file">smtp_tls_cert_file</a>
|
|
(default: empty)</b></DT><DD>
|
|
|
|
<p> File with the Postfix SMTP client RSA certificate in PEM format.
|
|
This file may also contain the Postfix SMTP client private RSA key, and
|
|
these may be the same as the Postfix SMTP server RSA certificate and key
|
|
file. With Postfix ≥ 3.4 the preferred way to configure client keys
|
|
and certificates is via the "<a href="postconf.5.html#smtp_tls_chain_files">smtp_tls_chain_files</a>" parameter. </p>
|
|
|
|
<p> Do not configure client certificates unless you <b>must</b> present
|
|
client TLS certificates to one or more servers. Client certificates are
|
|
not usually needed, and can cause problems in configurations that work
|
|
well without them. The recommended setting is to let the defaults stand: </p>
|
|
|
|
<blockquote>
|
|
<pre>
|
|
<a href="postconf.5.html#smtp_tls_cert_file">smtp_tls_cert_file</a> =
|
|
<a href="postconf.5.html#smtp_tls_key_file">smtp_tls_key_file</a> =
|
|
<a href="postconf.5.html#smtp_tls_eccert_file">smtp_tls_eccert_file</a> =
|
|
<a href="postconf.5.html#smtp_tls_eckey_file">smtp_tls_eckey_file</a> =
|
|
# Obsolete DSA parameters
|
|
<a href="postconf.5.html#smtp_tls_dcert_file">smtp_tls_dcert_file</a> =
|
|
<a href="postconf.5.html#smtp_tls_dkey_file">smtp_tls_dkey_file</a> =
|
|
# Postfix ≥ 3.4 interface
|
|
<a href="postconf.5.html#smtp_tls_chain_files">smtp_tls_chain_files</a> =
|
|
</pre>
|
|
</blockquote>
|
|
|
|
<p> The best way to use the default settings is to comment out the above
|
|
parameters in <a href="postconf.5.html">main.cf</a> if present. </p>
|
|
|
|
<p> To enable remote SMTP servers to verify the Postfix SMTP client
|
|
certificate, the issuing CA certificates must be made available to the
|
|
server. You should include the required certificates in the client
|
|
certificate file, the client certificate first, then the issuing
|
|
CA(s) (bottom-up order). </p>
|
|
|
|
<p> Example: the certificate for "client.example.com" was issued by
|
|
"intermediate CA" which itself has a certificate issued by "root CA".
|
|
As the "root" super-user create the client.pem file with: </p>
|
|
|
|
<blockquote>
|
|
<pre>
|
|
# <b>umask 077</b>
|
|
# <b>cat client_key.pem client_cert.pem intermediate_CA.pem > chain.pem </b>
|
|
</pre>
|
|
</blockquote>
|
|
|
|
<p> If you also want to verify remote SMTP server certificates issued by
|
|
these CAs, you can add the CA certificates to the <a href="postconf.5.html#smtp_tls_CAfile">smtp_tls_CAfile</a>, in
|
|
which case it is not necessary to have them in the <a href="postconf.5.html#smtp_tls_cert_file">smtp_tls_cert_file</a>,
|
|
<a href="postconf.5.html#smtp_tls_dcert_file">smtp_tls_dcert_file</a> (obsolete) or <a href="postconf.5.html#smtp_tls_eccert_file">smtp_tls_eccert_file</a>. </p>
|
|
|
|
<p> A certificate supplied here must be usable as an SSL client certificate
|
|
and hence pass the "openssl verify -purpose sslclient ..." test. </p>
|
|
|
|
<p> Example: </p>
|
|
|
|
<pre>
|
|
<a href="postconf.5.html#smtp_tls_cert_file">smtp_tls_cert_file</a> = /etc/postfix/chain.pem
|
|
</pre>
|
|
|
|
<p> This feature is available in Postfix 2.2 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="smtp_tls_chain_files">smtp_tls_chain_files</a>
|
|
(default: empty)</b></DT><DD>
|
|
|
|
<p> List of one or more PEM files, each holding one or more private keys
|
|
directly followed by a corresponding certificate chain. The file names
|
|
are separated by commas and/or whitespace. This parameter obsoletes the
|
|
legacy algorithm-specific key and certificate file settings. When this
|
|
parameter is non-empty, the legacy parameters are ignored, and a warning
|
|
is logged if any are also non-empty. </p>
|
|
|
|
<p> With the proliferation of multiple private key algorithms—which,
|
|
as of OpenSSL 1.1.1, include DSA (obsolete), RSA, ECDSA, Ed25519
|
|
and Ed448—it is increasingly impractical to use separate
|
|
parameters to configure the key and certificate chain for each
|
|
algorithm. Therefore, Postfix now supports storing multiple keys and
|
|
corresponding certificate chains in a single file or in a set of files.
|
|
|
|
<p> Each key must appear <b>immediately before</b> the corresponding
|
|
certificate, optionally followed by additional issuer certificates that
|
|
complete the certificate chain for that key. When multiple files are
|
|
specified, they are equivalent to a single file that is concatenated
|
|
from those files in the given order. Thus, while a key must always
|
|
precede its certificate and issuer chain, it can be in a separate file,
|
|
so long as that file is listed immediately before the file that holds
|
|
the corresponding certificate chain. Once all the files are
|
|
concatenated, the sequence of PEM objects must be: <i>key1, cert1,
|
|
[chain1], key2, cert2, [chain2], ..., keyN, certN, [chainN].</i> </p>
|
|
|
|
<p> Storing the private key in the same file as the corresponding
|
|
certificate is more reliable. With the key and certificate in separate
|
|
files, there is a chance that during key rollover a Postfix process
|
|
might load a private key and certificate from separate files that don't
|
|
match. Various operational errors may even result in a persistent
|
|
broken configuration in which the certificate does not match the private
|
|
key. </p>
|
|
|
|
<p> The file or files must contain at most one key of each type. If,
|
|
for example, two or more RSA keys and corresponding chains are listed,
|
|
depending on the version of OpenSSL either only the last one will be
|
|
used or a configuration error may be detected. Note that while
|
|
"Ed25519" and "Ed448" are considered separate algorithms, the various
|
|
ECDSA curves (typically one of prime256v1, secp384r1 or secp521r1) are
|
|
considered as different parameters of a single "ECDSA" algorithm, so it
|
|
is not presently possible to configure keys for more than one ECDSA
|
|
curve. </p>
|
|
|
|
<p>
|
|
Example (separate files for each key and corresponding certificate chain):
|
|
</p>
|
|
<blockquote>
|
|
<pre>
|
|
/etc/postfix/<a href="postconf.5.html">main.cf</a>:
|
|
<a href="postconf.5.html#smtp_tls_chain_files">smtp_tls_chain_files</a> =
|
|
${<a href="postconf.5.html#config_directory">config_directory</a>}/ed25519.pem,
|
|
${<a href="postconf.5.html#config_directory">config_directory</a>}/ed448.pem,
|
|
${<a href="postconf.5.html#config_directory">config_directory</a>}/rsa.pem
|
|
</pre>
|
|
</blockquote>
|
|
|
|
<blockquote>
|
|
<pre>
|
|
/etc/postfix/ed25519.pem:
|
|
-----BEGIN PRIVATE KEY-----
|
|
MC4CAQAwBQYDK2VwBCIEIEJfbbO4BgBQGBg9NAbIJaDBqZb4bC4cOkjtAH+Efbz3
|
|
-----END PRIVATE KEY-----
|
|
-----BEGIN CERTIFICATE-----
|
|
MIIBKzCB3qADAgECAhQaw+rflRreYuUZBp0HuNn/e5rMZDAFBgMrZXAwFDESMBAG
|
|
...
|
|
nC0egv51YPDWxEHom4QA
|
|
-----END CERTIFICATE-----
|
|
</pre>
|
|
</blockquote>
|
|
|
|
<blockquote>
|
|
<pre>
|
|
/etc/postfix/ed448.pem:
|
|
-----BEGIN PRIVATE KEY-----
|
|
MEcCAQAwBQYDK2VxBDsEOQf+m0P+G0qi+NZ0RolyeiE5zdlPQR8h8y4jByBifpIe
|
|
LNler7nzHQJ1SLcOiXFHXlxp/84VZuh32A==
|
|
-----END PRIVATE KEY-----
|
|
-----BEGIN CERTIFICATE-----
|
|
MIIBdjCB96ADAgECAhQSv4oP972KypOZPNPF4fmsiQoRHzAFBgMrZXEwFDESMBAG
|
|
...
|
|
pQcWsx+4J29e6YWH3Cy/CdUaexKP4RPCZDrPX7bk5C2BQ+eeYOxyThMA
|
|
-----END CERTIFICATE-----
|
|
</pre>
|
|
</blockquote>
|
|
|
|
<blockquote>
|
|
<pre>
|
|
/etc/postfix/rsa.pem:
|
|
-----BEGIN PRIVATE KEY-----
|
|
MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQDc4QusgkahH9rL
|
|
...
|
|
ahQkZ3+krcaJvDSMgvu0tDc=
|
|
-----END PRIVATE KEY-----
|
|
-----BEGIN CERTIFICATE-----
|
|
MIIC+DCCAeCgAwIBAgIUIUkrbk1GAemPCT8i9wKsTGDH7HswDQYJKoZIhvcNAQEL
|
|
...
|
|
Rirz15HGVNTK8wzFd+nulPzwUo6dH2IU8KazmyRi7OGvpyrMlm15TRE2oyE=
|
|
-----END CERTIFICATE-----
|
|
</pre>
|
|
</blockquote>
|
|
|
|
<p>
|
|
Example (all keys and certificates in a single file):
|
|
</p>
|
|
<blockquote>
|
|
<pre>
|
|
/etc/postfix/<a href="postconf.5.html">main.cf</a>:
|
|
<a href="postconf.5.html#smtp_tls_chain_files">smtp_tls_chain_files</a> = ${<a href="postconf.5.html#config_directory">config_directory</a>}/chains.pem
|
|
</pre>
|
|
</blockquote>
|
|
|
|
<blockquote>
|
|
<pre>
|
|
/etc/postfix/chains.pem:
|
|
-----BEGIN PRIVATE KEY-----
|
|
MC4CAQAwBQYDK2VwBCIEIEJfbbO4BgBQGBg9NAbIJaDBqZb4bC4cOkjtAH+Efbz3
|
|
-----END PRIVATE KEY-----
|
|
-----BEGIN CERTIFICATE-----
|
|
MIIBKzCB3qADAgECAhQaw+rflRreYuUZBp0HuNn/e5rMZDAFBgMrZXAwFDESMBAG
|
|
...
|
|
nC0egv51YPDWxEHom4QA
|
|
-----END CERTIFICATE-----
|
|
-----BEGIN PRIVATE KEY-----
|
|
MEcCAQAwBQYDK2VxBDsEOQf+m0P+G0qi+NZ0RolyeiE5zdlPQR8h8y4jByBifpIe
|
|
LNler7nzHQJ1SLcOiXFHXlxp/84VZuh32A==
|
|
-----END PRIVATE KEY-----
|
|
-----BEGIN CERTIFICATE-----
|
|
MIIBdjCB96ADAgECAhQSv4oP972KypOZPNPF4fmsiQoRHzAFBgMrZXEwFDESMBAG
|
|
...
|
|
pQcWsx+4J29e6YWH3Cy/CdUaexKP4RPCZDrPX7bk5C2BQ+eeYOxyThMA
|
|
-----END CERTIFICATE-----
|
|
-----BEGIN PRIVATE KEY-----
|
|
MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQDc4QusgkahH9rL
|
|
...
|
|
ahQkZ3+krcaJvDSMgvu0tDc=
|
|
-----END PRIVATE KEY-----
|
|
-----BEGIN CERTIFICATE-----
|
|
MIIC+DCCAeCgAwIBAgIUIUkrbk1GAemPCT8i9wKsTGDH7HswDQYJKoZIhvcNAQEL
|
|
...
|
|
Rirz15HGVNTK8wzFd+nulPzwUo6dH2IU8KazmyRi7OGvpyrMlm15TRE2oyE=
|
|
-----END CERTIFICATE-----
|
|
</pre>
|
|
</blockquote>
|
|
|
|
<p> This feature is available in Postfix 3.4 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="smtp_tls_cipherlist">smtp_tls_cipherlist</a>
|
|
(default: empty)</b></DT><DD>
|
|
|
|
<p> Obsolete Postfix < 2.3 control for the Postfix SMTP client TLS
|
|
cipher list. As this feature applies to all TLS security levels, it is easy
|
|
to create interoperability problems by choosing a non-default cipher
|
|
list. Do not use a non-default TLS cipher list on hosts that deliver email
|
|
to the public Internet: you will be unable to send email to servers that
|
|
only support the ciphers you exclude. Using a restricted cipher list
|
|
may be more appropriate for an internal MTA, where one can exert some
|
|
control over the TLS software and settings of the peer servers. </p>
|
|
|
|
<p> <b>Note:</b> do not use "" quotes around the parameter value. </p>
|
|
|
|
<p> This feature is available in Postfix version 2.2. It is not used with
|
|
Postfix 2.3 and later; use <a href="postconf.5.html#smtp_tls_mandatory_ciphers">smtp_tls_mandatory_ciphers</a> instead. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="smtp_tls_ciphers">smtp_tls_ciphers</a>
|
|
(default: medium)</b></DT><DD>
|
|
|
|
<p> The minimum TLS cipher grade that the Postfix SMTP client
|
|
will use with opportunistic TLS encryption. Cipher types listed in
|
|
<a href="postconf.5.html#smtp_tls_exclude_ciphers">smtp_tls_exclude_ciphers</a> are excluded from the base definition of
|
|
the selected cipher grade. The default value is "medium" for
|
|
Postfix releases after the middle of 2015, "export" for older
|
|
releases. </p>
|
|
|
|
<p> When TLS is mandatory the cipher grade is chosen via the
|
|
<a href="postconf.5.html#smtp_tls_mandatory_ciphers">smtp_tls_mandatory_ciphers</a> configuration parameter, see there for syntax
|
|
details. See <a href="postconf.5.html#smtp_tls_policy_maps">smtp_tls_policy_maps</a> for information on how to configure
|
|
ciphers on a per-destination basis. </p>
|
|
|
|
<p> This feature is available in Postfix 2.6 and later. With earlier Postfix
|
|
releases only the <a href="postconf.5.html#smtp_tls_mandatory_ciphers">smtp_tls_mandatory_ciphers</a> parameter is implemented,
|
|
and opportunistic TLS always uses "export" or better (i.e. all) ciphers. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="smtp_tls_connection_reuse">smtp_tls_connection_reuse</a>
|
|
(default: no)</b></DT><DD>
|
|
|
|
<p> Try to make multiple deliveries per TLS-encrypted connection.
|
|
This uses the <a href="tlsproxy.8.html">tlsproxy(8)</a> service to encrypt an SMTP connection,
|
|
uses the <a href="scache.8.html">scache(8)</a> service to save that connection, and relies on
|
|
hints from the <a href="qmgr.8.html">qmgr(8)</a> daemon. </p>
|
|
|
|
<p> See "<a href="TLS_README.html#client_tls_reuse">Client-side
|
|
TLS connection reuse</a>" for background details. </p>
|
|
|
|
<p> This feature is available in Postfix 3.4 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="smtp_tls_dane_insecure_mx_policy">smtp_tls_dane_insecure_mx_policy</a>
|
|
(default: dane)</b></DT><DD>
|
|
|
|
<p> The TLS policy for MX hosts with "secure" TLSA records when the
|
|
nexthop destination security level is <b>dane</b>, but the MX
|
|
record was found via an "insecure" MX lookup. The choices are:
|
|
</p>
|
|
|
|
<dl>
|
|
<dt><b>may</b></dt>
|
|
<dd> The TLSA records will be ignored and TLS will be optional. If
|
|
the MX host does not appear to support STARTTLS, or the STARTTLS
|
|
handshake fails, mail may be sent in the clear. </dd>
|
|
<dt><b>encrypt</b></dt>
|
|
<dd> The TLSA records will signal a requirement to use TLS. While
|
|
TLS encryption will be required, authentication will not be performed.
|
|
</dd>
|
|
<dt><b>dane</b></dt>
|
|
<dd>The TLSA records will be used just as with "secure" MX records.
|
|
TLS encryption will be required, and, if at least one of the TLSA
|
|
records is "usable", authentication will be required. When
|
|
authentication succeeds, it will be logged only as "Trusted", not
|
|
"Verified", because the MX host name could have been forged. </dd>
|
|
</dl>
|
|
|
|
<p> The default setting is "dane" as of Postfix versions 3.6.17,
|
|
3.7.13, 3.8.8, 3.9.2, and 3.10.0. With earlier versions the default
|
|
was mistakenly dependent on the <a href="postconf.5.html#smtp_tls_security_level">smtp_tls_security_level</a> setting.
|
|
</p>
|
|
|
|
<p> Though with "insecure" MX records an active attacker can
|
|
compromise SMTP transport security by returning forged MX records,
|
|
such attacks are "tamper-evident" since any forged MX hostnames
|
|
will be recorded in the mail logs. Attackers who place a high value
|
|
on staying hidden may be deterred from forging MX records. </p>
|
|
|
|
<p>
|
|
This feature is available in Postfix 3.1 and later. The <b>may</b>
|
|
policy is backwards-compatible with earlier Postfix versions.
|
|
</p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="smtp_tls_dcert_file">smtp_tls_dcert_file</a>
|
|
(default: empty)</b></DT><DD>
|
|
|
|
<p> File with the Postfix SMTP client DSA certificate in PEM format.
|
|
This file may also contain the Postfix SMTP client private DSA key.
|
|
The DSA algorithm is obsolete and should not be used. </p>
|
|
|
|
<p> See the discussion under <a href="postconf.5.html#smtp_tls_cert_file">smtp_tls_cert_file</a> for more details.
|
|
</p>
|
|
|
|
<p> Example: </p>
|
|
|
|
<pre>
|
|
<a href="postconf.5.html#smtp_tls_dcert_file">smtp_tls_dcert_file</a> = /etc/postfix/client-dsa.pem
|
|
</pre>
|
|
|
|
<p> This feature is available in Postfix 2.2 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="smtp_tls_dkey_file">smtp_tls_dkey_file</a>
|
|
(default: $<a href="postconf.5.html#smtp_tls_dcert_file">smtp_tls_dcert_file</a>)</b></DT><DD>
|
|
|
|
<p> File with the Postfix SMTP client DSA private key in PEM format.
|
|
This file may be combined with the Postfix SMTP client DSA certificate
|
|
file specified with $<a href="postconf.5.html#smtp_tls_dcert_file">smtp_tls_dcert_file</a>. The DSA algorithm is obsolete
|
|
and should not be used. </p>
|
|
|
|
<p> The private key must be accessible without a pass-phrase, i.e. it
|
|
must not be encrypted. File permissions should grant read-only
|
|
access to the system superuser account ("root"), and no access
|
|
to anyone else. </p>
|
|
|
|
<p> This feature is available in Postfix 2.2 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="smtp_tls_eccert_file">smtp_tls_eccert_file</a>
|
|
(default: empty)</b></DT><DD>
|
|
|
|
<p> File with the Postfix SMTP client ECDSA certificate in PEM format.
|
|
This file may also contain the Postfix SMTP client ECDSA private key.
|
|
With Postfix ≥ 3.4 the preferred way to configure client keys and
|
|
certificates is via the "<a href="postconf.5.html#smtp_tls_chain_files">smtp_tls_chain_files</a>" parameter. </p>
|
|
|
|
<p> See the discussion under <a href="postconf.5.html#smtp_tls_cert_file">smtp_tls_cert_file</a> for more details.
|
|
</p>
|
|
|
|
<p> Example: </p>
|
|
|
|
<pre>
|
|
<a href="postconf.5.html#smtp_tls_eccert_file">smtp_tls_eccert_file</a> = /etc/postfix/ecdsa-ccert.pem
|
|
</pre>
|
|
|
|
<p> This feature is available in Postfix 2.6 and later, when Postfix is
|
|
compiled and linked with OpenSSL 1.0.0 or later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="smtp_tls_eckey_file">smtp_tls_eckey_file</a>
|
|
(default: $<a href="postconf.5.html#smtp_tls_eccert_file">smtp_tls_eccert_file</a>)</b></DT><DD>
|
|
|
|
<p> File with the Postfix SMTP client ECDSA private key in PEM format.
|
|
This file may be combined with the Postfix SMTP client ECDSA certificate
|
|
file specified with $<a href="postconf.5.html#smtp_tls_eccert_file">smtp_tls_eccert_file</a>. With Postfix ≥ 3.4 the
|
|
preferred way to configure client keys and certificates is via the
|
|
"<a href="postconf.5.html#smtp_tls_chain_files">smtp_tls_chain_files</a>" parameter. </p>
|
|
|
|
<p> The private key must be accessible without a pass-phrase, i.e. it
|
|
must not be encrypted. File permissions should grant read-only
|
|
access to the system superuser account ("root"), and no access
|
|
to anyone else. </p>
|
|
|
|
<p> This feature is available in Postfix 2.6 and later, when Postfix is
|
|
compiled and linked with OpenSSL 1.0.0 or later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="smtp_tls_enable_rpk">smtp_tls_enable_rpk</a>
|
|
(default: no)</b></DT><DD>
|
|
|
|
<p> Request that remote SMTP servers send an <a href="https://tools.ietf.org/html/rfc7250">RFC7250</a> raw public key
|
|
instead of an X.509 certificate. This feature and the enable_rpk
|
|
policy attribute are ignored when there is no raw public key support
|
|
in the local TLS implementation. </p>
|
|
|
|
<ul>
|
|
|
|
<li> <p> At the "may", "encrypt" and "fingerprint" security levels,
|
|
with parameter setting "<a href="postconf.5.html#smtp_tls_enable_rpk">smtp_tls_enable_rpk</a> = yes" or with "enable_rpk
|
|
= yes" in a policy entry, the Postfix SMTP client will indicate in
|
|
the TLS handshake that it prefers to receive a raw server public
|
|
key, but it will still accept a server public key certificate. </p>
|
|
|
|
<li> <p> At the "fingerprint" security level, with parameter setting
|
|
"<a href="postconf.5.html#smtp_tls_enable_rpk">smtp_tls_enable_rpk</a> = yes" or with "enable_rpk = yes" in a policy
|
|
entry, server authentication based on certificate fingerprints
|
|
becomes more fragile. Even if the server private key and certificate
|
|
remain unchanged, the remote SMTP server will fail fingerprint
|
|
authentication (won't match the configured list of fingerprints)
|
|
when it starts sending a raw public key instead of a certificate,
|
|
after its TLS implementation is updated with raw public key support.
|
|
Therefore, <b>DO NOT</b> enable raw public keys to remote destinations
|
|
authenticated by server <b>certificate</b> fingerprints. You should
|
|
enable raw public keys only for servers matched via their public
|
|
key fingerprint. </p>
|
|
|
|
<li> <p> At the "verify" and "secure" security levels, the Postfix
|
|
SMTP client always ignores the parameter setting <a href="postconf.5.html#smtp_tls_enable_rpk">smtp_tls_enable_rpk</a>
|
|
or the enable_rpk policy attribute. </p>
|
|
|
|
<li> <p> At the opportunistic "dane" security level, the Postfix
|
|
SMTP client ignores the parameter setting <a href="postconf.5.html#smtp_tls_enable_rpk">smtp_tls_enable_rpk</a> or
|
|
the enable_rpk policy attribute (but it will respect them when it
|
|
falls back to the "may" or "encrypt" level). When all valid TLSA
|
|
records specify only server public keys (no certificates) and the
|
|
local TLS implementation supports raw public keys, the client will
|
|
indicate in the TLS handshake that it prefers to receive a raw
|
|
public key, but it will still accept a public key certificate. </p>
|
|
|
|
<li> <p> At the mandatory "dane-only" security level, the Postfix
|
|
SMTP client always ignores the parameter setting <a href="postconf.5.html#smtp_tls_enable_rpk">smtp_tls_enable_rpk</a>
|
|
or the enable_rpk policy attribute. When all valid TLSA records
|
|
specify only server public keys (no certificates) and the local TLS
|
|
implementation supports raw public keys, the client will indicate
|
|
in the TLS handshake that it prefers to receive a raw public key,
|
|
but it will still accept a public key certificate. </p>
|
|
|
|
</ul>
|
|
|
|
<p>The Postfix SMTP client is always willing to send raw public keys
|
|
to servers that solicit them when a client certificate is configured
|
|
and the local TLS implementation supports raw public keys. </p>
|
|
|
|
<p> Sample commands to compute certificate and public key SHA256 digests: </p>
|
|
|
|
<pre>
|
|
# SHA256 digest of the first certificate in "cert.pem"
|
|
$ openssl x509 -in cert.pem -outform DER | openssl dgst -sha256 -c
|
|
</pre>
|
|
|
|
<pre>
|
|
# SHA256 digest of the SPKI of the first certificate in "cert.pem"
|
|
$ openssl x509 -in cert.pem -pubkey -noout |
|
|
openssl pkey -pubin -outform DER | openssl dgst -sha256 -c
|
|
</pre>
|
|
|
|
<pre>
|
|
# SHA256 digest of the SPKI of the first private key in "pkey.pem"
|
|
$ openssl pkey -in pkey.pem -pubout -outform DER |
|
|
openssl dgst -sha256 -c
|
|
</pre>
|
|
|
|
<p> This feature is available in Postfix 3.9 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="smtp_tls_enforce_peername">smtp_tls_enforce_peername</a>
|
|
(default: yes)</b></DT><DD>
|
|
|
|
<p> With mandatory TLS encryption, require that the remote SMTP
|
|
server hostname matches the information in the remote SMTP server
|
|
certificate. As of <a href="https://tools.ietf.org/html/rfc2487">RFC 2487</a> the requirements for hostname checking
|
|
for MTA clients are not specified. </p>
|
|
|
|
<p> This option can be set to "no" to disable strict peer name
|
|
checking. This setting has no effect on sessions that are controlled
|
|
via the <a href="postconf.5.html#smtp_tls_per_site">smtp_tls_per_site</a> table. </p>
|
|
|
|
<p> Disabling the hostname verification can make sense in a closed
|
|
environment where special CAs are created. If not used carefully,
|
|
this option opens the danger of a "man-in-the-middle" attack (the
|
|
CommonName of this attacker will be logged). </p>
|
|
|
|
<p> This feature is available in Postfix 2.2 and later. With
|
|
Postfix 2.3 and later use <a href="postconf.5.html#smtp_tls_security_level">smtp_tls_security_level</a> instead. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="smtp_tls_exclude_ciphers">smtp_tls_exclude_ciphers</a>
|
|
(default: empty)</b></DT><DD>
|
|
|
|
<p> List of ciphers or cipher types to exclude from the Postfix
|
|
SMTP client cipher
|
|
list at all TLS security levels. This is not an OpenSSL cipherlist, it is
|
|
a simple list separated by whitespace and/or commas. The elements are a
|
|
single cipher, or one or more "+" separated cipher properties, in which
|
|
case only ciphers matching <b>all</b> the properties are excluded. </p>
|
|
|
|
<p> Examples (some of these will cause problems): </p>
|
|
|
|
<blockquote>
|
|
<pre>
|
|
<a href="postconf.5.html#smtp_tls_exclude_ciphers">smtp_tls_exclude_ciphers</a> = aNULL
|
|
<a href="postconf.5.html#smtp_tls_exclude_ciphers">smtp_tls_exclude_ciphers</a> = MD5, DES
|
|
<a href="postconf.5.html#smtp_tls_exclude_ciphers">smtp_tls_exclude_ciphers</a> = DES+MD5
|
|
<a href="postconf.5.html#smtp_tls_exclude_ciphers">smtp_tls_exclude_ciphers</a> = AES256-SHA, DES-CBC3-MD5
|
|
<a href="postconf.5.html#smtp_tls_exclude_ciphers">smtp_tls_exclude_ciphers</a> = kEDH+aRSA
|
|
</pre>
|
|
</blockquote>
|
|
|
|
<p> The first setting disables anonymous ciphers. The next setting
|
|
disables ciphers that use the MD5 digest algorithm or the (single) DES
|
|
encryption algorithm. The next setting disables ciphers that use MD5 and
|
|
DES together. The next setting disables the two ciphers "AES256-SHA"
|
|
and "DES-CBC3-MD5". The last setting disables ciphers that use "EDH"
|
|
key exchange with RSA authentication. </p>
|
|
|
|
<p> This feature is available in Postfix 2.3 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="smtp_tls_fingerprint_cert_match">smtp_tls_fingerprint_cert_match</a>
|
|
(default: empty)</b></DT><DD>
|
|
|
|
<p> List of acceptable remote SMTP server certificate fingerprints for
|
|
the "fingerprint" TLS security level (<b><a href="postconf.5.html#smtp_tls_security_level">smtp_tls_security_level</a></b> =
|
|
fingerprint). At this security level, Certification Authorities are not
|
|
used, and certificate expiration times are ignored. Instead, server
|
|
certificates are verified directly via their certificate fingerprint
|
|
or public key fingerprint (Postfix 2.9 and later). The fingerprint
|
|
is a message digest of the server certificate (or public key). The
|
|
digest algorithm is selected via the <b><a href="postconf.5.html#smtp_tls_fingerprint_digest">smtp_tls_fingerprint_digest</a></b>
|
|
parameter. </p>
|
|
|
|
<p> The colons between each pair of nibbles in the fingerprint value
|
|
are optional (Postfix ≥ 3.6). These were required in earlier
|
|
Postfix releases. </p>
|
|
|
|
<p> When an <b><a href="postconf.5.html#smtp_tls_policy_maps">smtp_tls_policy_maps</a></b> table entry specifies the
|
|
"fingerprint" security level, any "match" attributes in that entry specify
|
|
the list of valid fingerprints for the corresponding destination. Multiple
|
|
fingerprints can be combined with a "|" delimiter in a single match
|
|
attribute, or multiple match attributes can be employed. </p>
|
|
|
|
<p> Example: Certificate fingerprint verification with internal mailhub.
|
|
Two matching fingerprints are listed. The <a href="postconf.5.html#relayhost">relayhost</a> may be multiple
|
|
physical hosts behind a load-balancer, each with its own private/public
|
|
key and self-signed certificate. Alternatively, a single <a href="postconf.5.html#relayhost">relayhost</a> may
|
|
be in the process of switching from one set of private/public keys to
|
|
another, and both keys are trusted just prior to the transition. </p>
|
|
|
|
<blockquote>
|
|
<pre>
|
|
<a href="postconf.5.html#relayhost">relayhost</a> = [mailhub.example.com]
|
|
<a href="postconf.5.html#smtp_tls_security_level">smtp_tls_security_level</a> = fingerprint
|
|
<a href="postconf.5.html#smtp_tls_fingerprint_digest">smtp_tls_fingerprint_digest</a> = sha256
|
|
<a href="postconf.5.html#smtp_tls_fingerprint_cert_match">smtp_tls_fingerprint_cert_match</a> =
|
|
cd:fc:d8:db:f8:c4:82:96:6c:...:28:71:e8:f5:8d:a5:0d:9b:d4:a6
|
|
dd:5c:ef:f5:c3:bc:64:25:36:...:99:36:06:ce:40:ef:de:2e:ad:a4
|
|
</pre>
|
|
</blockquote>
|
|
|
|
<p> Example: Certificate fingerprint verification with selected destinations.
|
|
As in the example above, we show two matching fingerprints: </p>
|
|
|
|
<blockquote>
|
|
<pre>
|
|
/etc/postfix/<a href="postconf.5.html">main.cf</a>:
|
|
<a href="postconf.5.html#smtp_tls_policy_maps">smtp_tls_policy_maps</a> = <a href="DATABASE_README.html#types">hash</a>:/etc/postfix/tls_policy
|
|
<a href="postconf.5.html#smtp_tls_fingerprint_digest">smtp_tls_fingerprint_digest</a> = sha256
|
|
</pre>
|
|
</blockquote>
|
|
|
|
<blockquote>
|
|
<pre>
|
|
/etc/postfix/tls_policy:
|
|
example.com fingerprint
|
|
match=51:e9:af:2e:1e:40:1f:...:64:0a:30:35:2d:09:16:31:5a:eb:82:76
|
|
match=b6:b4:72:34:e2:59:cd:...:c2:ca:63:0d:4d:cc:2c:7d:84:de:e6:2f
|
|
</pre>
|
|
</blockquote>
|
|
|
|
<p> This feature is available in Postfix 2.5 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="smtp_tls_fingerprint_digest">smtp_tls_fingerprint_digest</a>
|
|
(default: see "postconf -d" output)</b></DT><DD>
|
|
|
|
<p> The message digest algorithm used to construct remote SMTP server
|
|
certificate fingerprints. At the "fingerprint" TLS security level
|
|
(<b><a href="postconf.5.html#smtp_tls_security_level">smtp_tls_security_level</a></b> = fingerprint), the server certificate is
|
|
verified by directly matching its certificate fingerprint or its public
|
|
key fingerprint (Postfix 2.9 and later). The fingerprint is the
|
|
message digest of the server certificate (or its public key)
|
|
using the selected
|
|
algorithm. With a digest algorithm resistant to "second pre-image"
|
|
attacks, it is not feasible to create a new public key and a matching
|
|
certificate (or public/private key-pair) that has the same fingerprint. </p>
|
|
|
|
<p> The default algorithm is <b>sha256</b> with Postfix ≥ 3.6
|
|
and the <b><a href="postconf.5.html#compatibility_level">compatibility_level</a></b> set to 3.6 or higher. With Postfix
|
|
≤ 3.5, the default algorithm is <b>md5</b>. </p>
|
|
|
|
<p> The best-practice algorithm is now <b>sha256</b>. Recent advances in hash
|
|
function cryptanalysis have led to md5 and sha1 being deprecated in favor of
|
|
sha256. However, as long as there are no known "second pre-image" attacks
|
|
against the older algorithms, their use in this context, though not
|
|
recommended, is still likely safe. </p>
|
|
|
|
<p> While additional digest algorithms are often available with OpenSSL's
|
|
libcrypto, only those used by libssl in SSL cipher suites are available to
|
|
Postfix. You'll likely find support for md5, sha1, sha256 and sha512. </p>
|
|
|
|
<p> To find the fingerprint of a specific certificate file, with a
|
|
specific digest algorithm, run:
|
|
</p>
|
|
|
|
<blockquote>
|
|
<pre>
|
|
$ openssl x509 -noout -fingerprint -<i>digest</i> -in <i>certfile</i>.pem
|
|
</pre>
|
|
</blockquote>
|
|
|
|
<p> The text to the right of the "=" sign is the desired fingerprint.
|
|
For example: </p>
|
|
|
|
<blockquote>
|
|
<pre>
|
|
$ openssl x509 -noout -fingerprint -sha256 -in cert.pem
|
|
SHA256 Fingerprint=D4:6A:AB:19:24:...:BB:A6:CB:66:82:C0:8E:9B:EE:29:A8:1A
|
|
</pre>
|
|
</blockquote>
|
|
|
|
<p> To extract the public key fingerprint from an X.509 certificate,
|
|
you need to extract the public key from the certificate and compute
|
|
the appropriate digest of its DER (ASN.1) encoding. With OpenSSL
|
|
the "-pubkey" option of the "x509" command extracts the public
|
|
key always in "PEM" format. We pipe the result to another OpenSSL
|
|
command that converts the key to DER and then to the "dgst" command
|
|
to compute the fingerprint. </p>
|
|
|
|
<p> The actual command to transform the key to DER format depends on the
|
|
version of OpenSSL used. As of OpenSSL 1.0.0, the "pkey" command supports
|
|
all key types. </p>
|
|
<blockquote>
|
|
<pre>
|
|
# OpenSSL ≥ 1.0 with SHA-256 fingerprints.
|
|
$ openssl x509 -in cert.pem -noout -pubkey |
|
|
openssl pkey -pubin -outform DER |
|
|
openssl dgst -sha256 -c
|
|
(stdin)= 64:3f:1f:f6:e5:1e:d4:2a:56:...:fc:09:1a:61:98:b5:bc:7c:60:58
|
|
</pre>
|
|
</blockquote>
|
|
|
|
<p> The Postfix SMTP server and client log the peer (leaf) certificate
|
|
fingerprint and the public key fingerprint when the TLS loglevel is 2 or
|
|
higher. </p>
|
|
|
|
<p> This feature is available in Postfix 2.5 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="smtp_tls_force_insecure_host_tlsa_lookup">smtp_tls_force_insecure_host_tlsa_lookup</a>
|
|
(default: no)</b></DT><DD>
|
|
|
|
<p> Lookup the associated DANE TLSA RRset even when a hostname is
|
|
not an alias and its address records lie in an unsigned zone. This
|
|
is unlikely to ever yield DNSSEC validated results, since child
|
|
zones of unsigned zones are also unsigned in the absence of DLV or
|
|
locally configured non-root trust-anchors. We anticipate that such
|
|
mechanisms will not be used for just the "_tcp" subdomain of a host.
|
|
Suppressing the TLSA RRset lookup reduces latency and avoids potential
|
|
interoperability problems with nameservers for unsigned zones that
|
|
are not prepared to handle the new TLSA RRset. </p>
|
|
|
|
<p> This feature is available in Postfix 2.11. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="smtp_tls_key_file">smtp_tls_key_file</a>
|
|
(default: $<a href="postconf.5.html#smtp_tls_cert_file">smtp_tls_cert_file</a>)</b></DT><DD>
|
|
|
|
<p> File with the Postfix SMTP client RSA private key in PEM format.
|
|
This file may be combined with the Postfix SMTP client RSA certificate
|
|
file specified with $<a href="postconf.5.html#smtp_tls_cert_file">smtp_tls_cert_file</a>. With Postfix ≥ 3.4 the
|
|
preferred way to configure client keys and certificates is via the
|
|
"<a href="postconf.5.html#smtp_tls_chain_files">smtp_tls_chain_files</a>" parameter. </p>
|
|
|
|
<p> The private key must be accessible without a pass-phrase, i.e. it
|
|
must not be encrypted. File permissions should grant read-only
|
|
access to the system superuser account ("root"), and no access
|
|
to anyone else. </p>
|
|
|
|
<p> Example: </p>
|
|
|
|
<pre>
|
|
<a href="postconf.5.html#smtp_tls_key_file">smtp_tls_key_file</a> = $<a href="postconf.5.html#smtp_tls_cert_file">smtp_tls_cert_file</a>
|
|
</pre>
|
|
|
|
<p> This feature is available in Postfix 2.2 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="smtp_tls_loglevel">smtp_tls_loglevel</a>
|
|
(default: 0)</b></DT><DD>
|
|
|
|
<p> Enable additional Postfix SMTP client logging of TLS activity.
|
|
Each logging level also includes the information that is logged at
|
|
a lower logging level. </p>
|
|
|
|
<dl compact>
|
|
|
|
<dt> </dt> <dd> 0 Disable logging of TLS activity. </dd>
|
|
|
|
<dt> </dt> <dd> 1 Log only a summary message on TLS handshake completion
|
|
— no logging of remote SMTP server certificate trust-chain
|
|
verification errors if server certificate verification is not required.
|
|
With Postfix 2.8 and earlier, log the summary message and unconditionally
|
|
log trust-chain verification errors. </dd>
|
|
|
|
<dt> </dt> <dd> 2 Also enable verbose logging in the Postfix TLS
|
|
library, log session cache operations, and enable OpenSSL logging
|
|
of the progress of the SSL handshake. </dd>
|
|
|
|
<dt> </dt> <dd> 3 Also log the hexadecimal and ASCII dump of the
|
|
TLS negotiation process. </dd>
|
|
|
|
<dt> </dt> <dd> 4 Also log the hexadecimal and ASCII dump of complete
|
|
transmission after STARTTLS. </dd>
|
|
|
|
</dl>
|
|
|
|
<p> Do not use "<a href="postconf.5.html#smtp_tls_loglevel">smtp_tls_loglevel</a> = 2" or higher except in case of
|
|
problems. Use of loglevel 4 is strongly discouraged. </p>
|
|
|
|
<p> This feature is available in Postfix 2.2 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="smtp_tls_mandatory_ciphers">smtp_tls_mandatory_ciphers</a>
|
|
(default: medium)</b></DT><DD>
|
|
|
|
<p> The minimum TLS cipher grade that the Postfix SMTP client will
|
|
use with
|
|
mandatory TLS encryption. The default value "medium" is suitable
|
|
for most destinations with which you may want to enforce TLS, and
|
|
is beyond the reach of today's cryptanalytic methods. See
|
|
<a href="postconf.5.html#smtp_tls_policy_maps">smtp_tls_policy_maps</a> for information on how to configure ciphers
|
|
on a per-destination basis. </p>
|
|
|
|
<p> The following cipher grades are supported: </p>
|
|
|
|
<dl>
|
|
<dt><b>high</b></dt>
|
|
<dd> Enable only "HIGH" grade OpenSSL ciphers. This setting may
|
|
be appropriate when all mandatory TLS destinations (e.g. when all
|
|
mail is routed to a suitably capable <a href="postconf.5.html#relayhost">relayhost</a>) support at least one
|
|
"HIGH" grade cipher. The underlying cipherlist is specified via the
|
|
<a href="postconf.5.html#tls_high_cipherlist">tls_high_cipherlist</a> configuration parameter, which you are strongly
|
|
encouraged not to change. </dd>
|
|
|
|
<dt><b>medium</b></dt>
|
|
<dd> Enable "MEDIUM" grade or better OpenSSL ciphers.
|
|
The underlying cipherlist is specified via the <a href="postconf.5.html#tls_medium_cipherlist">tls_medium_cipherlist</a>
|
|
configuration parameter, which you are strongly encouraged not to change.
|
|
</dd>
|
|
|
|
<dt><b>null</b></dt>
|
|
<dd> Enable only the "NULL" OpenSSL ciphers, these provide authentication
|
|
without encryption. This setting is only appropriate in the rare case
|
|
that all servers are prepared to use NULL ciphers (not normally enabled
|
|
in TLS servers). A plausible use-case is an LMTP server listening on a
|
|
UNIX-domain socket that is configured to support "NULL" ciphers. The
|
|
underlying cipherlist is specified via the <a href="postconf.5.html#tls_null_cipherlist">tls_null_cipherlist</a>
|
|
configuration parameter, which you are strongly encouraged not to
|
|
change. </dd>
|
|
|
|
<dt><b>low</b></dt>
|
|
<dd> Enable "LOW" grade or stronger OpenSSL ciphers. In Postfix
|
|
≥ 3.8 this cipher grade is always identical to "medium". Recent
|
|
versions of OpenSSL do not support any "LOW" grade ciphers. In
|
|
earlier Postfix releases the underlying cipherlist was specified
|
|
via the <a href="postconf.5.html#tls_low_cipherlist">tls_low_cipherlist</a> configuration parameter, which you are
|
|
strongly encouraged not to change. This obsolete cipher grade
|
|
SHOULD NOT be used. </dd>
|
|
|
|
<dt><b>export</b></dt>
|
|
<dd> Enable "EXPORT" grade or stronger OpenSSL ciphers. In Postfix
|
|
≥ 3.8 this cipher grade is always identical to "medium". Recent
|
|
versions of OpenSSL do not support any "EXPORT" grade ciphers. In
|
|
earlier Postfix releases the underlying cipherlist was specified
|
|
via the <a href="postconf.5.html#tls_export_cipherlist">tls_export_cipherlist</a> configuration parameter, which you are
|
|
strongly encouraged not to change. This obsolete cipher grade
|
|
SHOULD NOT be used. </dd>
|
|
|
|
</dl>
|
|
|
|
<p> The underlying cipherlists for grades other than "null" include
|
|
anonymous ciphers, but these are automatically filtered out if the
|
|
Postfix SMTP client is configured to verify server certificates.
|
|
You are very unlikely to need to take any steps to exclude anonymous
|
|
ciphers, they are excluded automatically as necessary. If you must
|
|
exclude anonymous ciphers at the "may" or "encrypt" security levels,
|
|
when the Postfix SMTP client does not need or use peer certificates, set
|
|
"<a href="postconf.5.html#smtp_tls_exclude_ciphers">smtp_tls_exclude_ciphers</a> = aNULL". To exclude anonymous ciphers only when
|
|
TLS is enforced, set "<a href="postconf.5.html#smtp_tls_mandatory_exclude_ciphers">smtp_tls_mandatory_exclude_ciphers</a> = aNULL". </p>
|
|
|
|
<p> This feature is available in Postfix 2.3 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="smtp_tls_mandatory_exclude_ciphers">smtp_tls_mandatory_exclude_ciphers</a>
|
|
(default: empty)</b></DT><DD>
|
|
|
|
<p> Additional list of ciphers or cipher types to exclude from the
|
|
Postfix SMTP client cipher list at mandatory TLS security levels. This list
|
|
works in addition to the exclusions listed with <a href="postconf.5.html#smtp_tls_exclude_ciphers">smtp_tls_exclude_ciphers</a>
|
|
(see there for syntax details). </p>
|
|
|
|
<p> Starting with Postfix 2.6, the mandatory cipher exclusions can be
|
|
specified on a per-destination basis via the TLS policy "exclude"
|
|
attribute. See <a href="postconf.5.html#smtp_tls_policy_maps">smtp_tls_policy_maps</a> for notes and examples. </p>
|
|
|
|
<p> This feature is available in Postfix 2.3 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="smtp_tls_mandatory_protocols">smtp_tls_mandatory_protocols</a>
|
|
(default: see "postconf -d" output)</b></DT><DD>
|
|
|
|
<p> TLS protocols that the Postfix SMTP client will use with mandatory
|
|
TLS encryption. In <a href="postconf.5.html">main.cf</a> the values are separated by whitespace,
|
|
commas or colons. In the policy table "protocols" attribute (see
|
|
<a href="postconf.5.html#smtp_tls_policy_maps">smtp_tls_policy_maps</a>) the only valid separator is colon. An empty value
|
|
means allow all protocols. </p>
|
|
|
|
<p> The valid protocol names (see SSL_get_version(3)) are "SSLv2",
|
|
"SSLv3", "TLSv1", "TLSv1.1", "TLSv1.2" and "TLSv1.3". Starting with
|
|
Postfix 3.6, the default value is ">=TLSv1", which sets TLS 1.0 as
|
|
the lowest supported TLS protocol version (see below). Older releases
|
|
use the "!" exclusion syntax, also described below. </p>
|
|
|
|
<p> As of Postfix 3.6, the preferred way to limit the range of
|
|
acceptable protocols is to set a lowest acceptable TLS protocol version
|
|
and/or a highest acceptable TLS protocol version. To set the lower
|
|
bound include an element of the form: ">=<i>version</i>" where
|
|
<i>version</i> is a either one of the TLS protocol names listed above,
|
|
or a hexadecimal number corresponding to the desired TLS protocol
|
|
version (0301 for TLS 1.0, 0302 for TLS 1.1, etc.). For the upper
|
|
bound, use "<=<i>version</i>". There must be no whitespace between
|
|
the ">=" or "<=" symbols and the protocol name or number. </p>
|
|
|
|
<p> Hexadecimal protocol numbers make it possible to specify protocol
|
|
bounds for TLS versions that are known to OpenSSL, but might not be
|
|
known to Postfix. They cannot be used with the legacy exclusion syntax.
|
|
Leading "0" or "0x" prefixes are supported, but not required.
|
|
Therefore, "301", "0301", "0x301" and "0x0301" are all equivalent to
|
|
"TLSv1". Hexadecimal versions unknown to OpenSSL will fail to set the
|
|
upper or lower bound, and a warning will be logged. Hexadecimal
|
|
versions should only be used when Postfix is linked with some future
|
|
version of OpenSSL that supports TLS 1.4 or later, but Postfix does not
|
|
yet support a symbolic name for that protocol version. </p>
|
|
|
|
<p>Hexadecimal example (Postfix ≥ 3.6):</p>
|
|
<blockquote>
|
|
<pre>
|
|
# Allow only TLS 1.2 through (hypothetical) TLS 1.4, once supported
|
|
# in some future version of OpenSSL (presently a warning is logged).
|
|
<a href="postconf.5.html#smtp_tls_mandatory_protocols">smtp_tls_mandatory_protocols</a> = >=TLSv1.2, <=0305
|
|
# Allow only TLS 1.2 and up:
|
|
<a href="postconf.5.html#smtp_tls_mandatory_protocols">smtp_tls_mandatory_protocols</a> = >=0x0303
|
|
</pre>
|
|
</blockquote>
|
|
|
|
<p> With Postfix < 3.6 there is no support for a minimum or maximum
|
|
version, and the protocol range is configured via protocol exclusions.
|
|
To require at least TLS 1.0, set "<a href="postconf.5.html#smtp_tls_mandatory_protocols">smtp_tls_mandatory_protocols</a> = !SSLv2,
|
|
!SSLv3". Listing the protocols to include, rather than the protocols to
|
|
exclude, is supported, but not recommended. The exclusion syntax more
|
|
accurately matches the underlying OpenSSL interface. </p>
|
|
|
|
<p> When using the exclusion syntax, take care to ensure that the range
|
|
of protocols supported by the Postfix SMTP client is contiguous. When
|
|
a protocol version is enabled, disabling any higher version implicitly
|
|
disables all versions above that higher version. Thus, for example: </p>
|
|
|
|
<blockquote>
|
|
<pre>
|
|
<a href="postconf.5.html#smtp_tls_mandatory_protocols">smtp_tls_mandatory_protocols</a> = !SSLv2, !SSLv3, !TLSv1.1
|
|
</pre>
|
|
</blockquote>
|
|
|
|
<p> also disables any protocol versions higher than TLSv1.1 leaving
|
|
only "TLSv1" enabled. </p>
|
|
|
|
<p> Support for "TLSv1.3" was introduced in OpenSSL 1.1.1. Disabling
|
|
this protocol via "!TLSv1.3" is supported since Postfix 3.4 (or patch
|
|
releases ≥ 3.0.14, 3.1.10, 3.2.7 and 3.3.2). </p>
|
|
|
|
<p> While the vast majority of SMTP servers with DANE TLSA records now
|
|
support at least TLS 1.2, a few still only support TLS 1.0. If you use
|
|
"dane" or "dane-only" it is best not to disable TLSv1, except perhaps
|
|
via the policy table for destinations which you are sure will support
|
|
"TLSv1.2". </p>
|
|
|
|
<p> See the documentation of the <a href="postconf.5.html#smtp_tls_policy_maps">smtp_tls_policy_maps</a> parameter and
|
|
<a href="TLS_README.html">TLS_README</a> for more information about security levels. </p>
|
|
|
|
<p> Example: </p>
|
|
<pre>
|
|
# Preferred syntax with Postfix ≥ 3.6:
|
|
<a href="postconf.5.html#smtp_tls_mandatory_protocols">smtp_tls_mandatory_protocols</a> = >=TLSv1.2, <=TLSv1.3
|
|
# Legacy syntax:
|
|
<a href="postconf.5.html#smtp_tls_mandatory_protocols">smtp_tls_mandatory_protocols</a> = !SSLv2, !SSLv3, !TLSv1, !TLSv1.1
|
|
</pre>
|
|
|
|
<p> This feature is available in Postfix 2.3 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="smtp_tls_note_starttls_offer">smtp_tls_note_starttls_offer</a>
|
|
(default: no)</b></DT><DD>
|
|
|
|
<p> Log the hostname of a remote SMTP server that offers STARTTLS,
|
|
when TLS is not already enabled for that server. </p>
|
|
|
|
<p> The logfile record looks like: </p>
|
|
|
|
<pre>
|
|
postfix/smtp[pid]: Host offered STARTTLS: [name.of.host]
|
|
</pre>
|
|
|
|
<p> This feature is available in Postfix 2.2 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="smtp_tls_per_site">smtp_tls_per_site</a>
|
|
(default: empty)</b></DT><DD>
|
|
|
|
<p> Optional lookup tables with the Postfix SMTP client TLS usage
|
|
policy by next-hop destination and by remote SMTP server hostname.
|
|
When both lookups succeed, the more specific per-site policy (NONE,
|
|
MUST, etc.) overrides the less specific one (MAY), and the more secure
|
|
per-site policy (MUST, etc.) overrides the less secure one (NONE).
|
|
With Postfix 2.3 and later <a href="postconf.5.html#smtp_tls_per_site">smtp_tls_per_site</a> is strongly discouraged:
|
|
use <a href="postconf.5.html#smtp_tls_policy_maps">smtp_tls_policy_maps</a> instead. </p>
|
|
|
|
<p> Use of the bare hostname as the per-site table lookup key is
|
|
discouraged. Always use the full destination nexthop (enclosed in
|
|
[] with a possible ":port" suffix). A recipient domain or MX-enabled
|
|
transport next-hop with no port suffix may look like a bare hostname,
|
|
but is still a suitable <i>destination</i>. </p>
|
|
|
|
<p> Specify a next-hop destination or server hostname on the left-hand
|
|
side; no wildcards are allowed. The next-hop destination is either
|
|
the recipient domain, or the destination specified with a <a href="transport.5.html">transport(5)</a>
|
|
table, the <a href="postconf.5.html#relayhost">relayhost</a> parameter, or the <a href="postconf.5.html#relay_transport">relay_transport</a> parameter.
|
|
On the right hand side specify one of the following keywords: </p>
|
|
|
|
<dl>
|
|
|
|
<dt> NONE </dt> <dd> Don't use TLS at all. This overrides a less
|
|
specific <b>MAY</b> lookup result from the alternate host or next-hop
|
|
lookup key, and overrides the global <a href="postconf.5.html#smtp_use_tls">smtp_use_tls</a>, <a href="postconf.5.html#smtp_enforce_tls">smtp_enforce_tls</a>,
|
|
and <a href="postconf.5.html#smtp_tls_enforce_peername">smtp_tls_enforce_peername</a> settings. </dd>
|
|
|
|
<dt> MAY </dt> <dd> Try to use TLS if the server announces support,
|
|
otherwise use an unencrypted connection; after a failed TLS handshake
|
|
or TLS session, fall back to plaintext if the message has spent
|
|
<a href="postconf.5.html#minimal_backoff_time">minimal_backoff_time</a> in the mail queue. This level has less precedence
|
|
than a more specific result (including <b>NONE</b>) from the alternate
|
|
host or next-hop lookup key, and has less precedence than the more
|
|
specific global "<a href="postconf.5.html#smtp_enforce_tls">smtp_enforce_tls</a> = yes" or "<a href="postconf.5.html#smtp_tls_enforce_peername">smtp_tls_enforce_peername</a>
|
|
= yes". </dd>
|
|
|
|
<dt> MUST_NOPEERMATCH </dt> <dd> Require TLS encryption, but do not
|
|
require that the remote SMTP server hostname matches the information
|
|
in the remote SMTP server certificate, or that the server certificate
|
|
was issued by a trusted CA. This overrides a less secure <b>NONE</b>
|
|
or a less specific <b>MAY</b> lookup result from the alternate host
|
|
or next-hop lookup key, and overrides the global <a href="postconf.5.html#smtp_use_tls">smtp_use_tls</a>,
|
|
<a href="postconf.5.html#smtp_enforce_tls">smtp_enforce_tls</a> and <a href="postconf.5.html#smtp_tls_enforce_peername">smtp_tls_enforce_peername</a> settings. </dd>
|
|
|
|
<dt> MUST </dt> <dd> Require TLS encryption, require that the remote
|
|
SMTP server hostname matches the information in the remote SMTP
|
|
server certificate, and require that the remote SMTP server certificate
|
|
was issued by a trusted CA. This overrides a less secure <b>NONE</b>
|
|
or <b>MUST_NOPEERMATCH</b> or a less specific <b>MAY</b> lookup
|
|
result from the alternate host or next-hop lookup key, and overrides
|
|
the global <a href="postconf.5.html#smtp_use_tls">smtp_use_tls</a>, <a href="postconf.5.html#smtp_enforce_tls">smtp_enforce_tls</a> and <a href="postconf.5.html#smtp_tls_enforce_peername">smtp_tls_enforce_peername</a>
|
|
settings. </dd>
|
|
|
|
</dl>
|
|
|
|
<p> The above keywords correspond to the "none", "may", "encrypt" and
|
|
"verify" security levels for the new <a href="postconf.5.html#smtp_tls_security_level">smtp_tls_security_level</a> parameter
|
|
introduced in Postfix 2.3. Starting with Postfix 2.3, and independently
|
|
of how the policy is specified, the <a href="postconf.5.html#smtp_tls_mandatory_ciphers">smtp_tls_mandatory_ciphers</a> and
|
|
<a href="postconf.5.html#smtp_tls_mandatory_protocols">smtp_tls_mandatory_protocols</a> parameters apply when TLS encryption
|
|
is mandatory. Connections for which encryption is optional typically
|
|
enable all "export" grade and better ciphers (see <a href="postconf.5.html#smtp_tls_ciphers">smtp_tls_ciphers</a>
|
|
and <a href="postconf.5.html#smtp_tls_protocols">smtp_tls_protocols</a>). </p>
|
|
|
|
<p> As long as no secure DNS lookup mechanism is available, false
|
|
hostnames in MX or CNAME responses can change the server hostname
|
|
that Postfix uses for TLS policy lookup and server certificate
|
|
verification. Even with a perfect match between the server hostname and
|
|
the server certificate, there is no guarantee that Postfix is connected
|
|
to the right server. See <a href="TLS_README.html">TLS_README</a> (Closing a DNS loophole with obsolete
|
|
per-site TLS policies) for a possible work-around. </p>
|
|
|
|
<p> This feature is available in Postfix 2.2 and later. With
|
|
Postfix 2.3 and later use <a href="postconf.5.html#smtp_tls_policy_maps">smtp_tls_policy_maps</a> instead. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="smtp_tls_policy_maps">smtp_tls_policy_maps</a>
|
|
(default: empty)</b></DT><DD>
|
|
|
|
<p> Optional lookup tables with the Postfix SMTP client TLS security
|
|
policy by next-hop destination; when a non-empty value is specified,
|
|
this overrides the obsolete <a href="postconf.5.html#smtp_tls_per_site">smtp_tls_per_site</a> parameter. See
|
|
<a href="TLS_README.html">TLS_README</a> for a more detailed discussion of TLS security levels,
|
|
and see <a href="TLSRPT_README.html">TLSRPT_README</a> for additional configuration that may be
|
|
needed for MTA-STS plugins. </p>
|
|
|
|
<p>
|
|
Specify zero or more "type:name" lookup tables, separated by
|
|
whitespace or comma. Tables will be searched in the specified order
|
|
until a match is found.
|
|
</p>
|
|
|
|
<p> The TLS policy table is indexed by the full next-hop destination,
|
|
which is either the recipient domain, or the verbatim next-hop
|
|
specified in the transport table, $<a href="postconf.5.html#local_transport">local_transport</a>, $<a href="postconf.5.html#virtual_transport">virtual_transport</a>,
|
|
$<a href="postconf.5.html#relay_transport">relay_transport</a> or $<a href="postconf.5.html#default_transport">default_transport</a>. This includes any enclosing
|
|
square brackets and any non-default destination server port suffix. The
|
|
LMTP socket type prefix (inet: or unix:) is not included in the lookup
|
|
key. </p>
|
|
|
|
<p> Only the next-hop domain, or $<a href="postconf.5.html#myhostname">myhostname</a> with LMTP over UNIX-domain
|
|
sockets, is used as the nexthop name for certificate verification. The
|
|
port and any enclosing square brackets are used in the table lookup key,
|
|
but are not used for server name verification. </p>
|
|
|
|
<p> When the lookup key is a domain name without enclosing square brackets
|
|
or any <i>:port</i> suffix (typically the recipient domain), and the full
|
|
domain is not found in the table, just as with the <a href="transport.5.html">transport(5)</a> table,
|
|
the parent domain starting with a leading "." is matched recursively. This
|
|
allows one to specify a security policy for a recipient domain and all
|
|
its sub-domains. </p>
|
|
|
|
<p> The lookup result is a security level, followed by an optional list
|
|
of whitespace and/or comma separated name=value attributes that override
|
|
related <a href="postconf.5.html">main.cf</a> settings. The TLS security levels in order of increasing
|
|
security are: </p>
|
|
|
|
<dl>
|
|
|
|
<dt><b><a href="TLS_README.html#client_tls_none">none</a></b></dt>
|
|
<dd>No TLS. No additional attributes are supported at this level. </dd>
|
|
|
|
<dt><b><a href="TLS_README.html#client_tls_may">may</a></b></dt>
|
|
<dd>Opportunistic TLS. Since sending in the clear is acceptable,
|
|
demanding stronger than default TLS security merely reduces
|
|
interoperability. The optional "ciphers", "exclude", and "protocols"
|
|
attributes (available for opportunistic TLS with Postfix ≥ 2.6) and
|
|
"connection_reuse" attribute (Postfix ≥ 3.4) override the
|
|
"<a href="postconf.5.html#smtp_tls_ciphers">smtp_tls_ciphers</a>", "<a href="postconf.5.html#smtp_tls_exclude_ciphers">smtp_tls_exclude_ciphers</a>", "<a href="postconf.5.html#smtp_tls_protocols">smtp_tls_protocols</a>",
|
|
and "<a href="postconf.5.html#smtp_tls_connection_reuse">smtp_tls_connection_reuse</a>" configuration parameters. In the policy
|
|
table, multiple ciphers, protocols or excluded ciphers must be separated
|
|
by colons, as attribute values may not contain whitespace or commas. At
|
|
this level and higher, the optional "servername" attribute (available
|
|
with Postfix ≥ 3.4) overrides the global "<a href="postconf.5.html#smtp_tls_servername">smtp_tls_servername</a>"
|
|
parameter, enabling per-destination configuration of the SNI extension
|
|
sent to the remote SMTP server. The optional "enable_rpk" attribute
|
|
(Postfix ≥ 3.9) overrides the <a href="postconf.5.html">main.cf</a> <a href="postconf.5.html#smtp_tls_enable_rpk">smtp_tls_enable_rpk</a> parameter.
|
|
When opportunistic TLS handshakes fail, Postfix retries the connection
|
|
with TLS disabled. This allows mail delivery to sites with
|
|
non-interoperable TLS implementations.</dd>
|
|
|
|
<dt><b><a href="TLS_README.html#client_tls_encrypt">encrypt</a></b></dt>
|
|
<dd>Mandatory TLS encryption. Mail is delivered only if the remote SMTP
|
|
server offers STARTTLS and the TLS handshake succeeds. At this level and
|
|
higher, the optional "protocols" attribute overrides the <a href="postconf.5.html">main.cf</a>
|
|
<a href="postconf.5.html#smtp_tls_mandatory_protocols">smtp_tls_mandatory_protocols</a> parameter, the optional "ciphers" attribute
|
|
overrides the <a href="postconf.5.html">main.cf</a> <a href="postconf.5.html#smtp_tls_mandatory_ciphers">smtp_tls_mandatory_ciphers</a> parameter, the optional
|
|
"exclude" attribute (Postfix ≥ 2.6) overrides the <a href="postconf.5.html">main.cf</a>
|
|
<a href="postconf.5.html#smtp_tls_mandatory_exclude_ciphers">smtp_tls_mandatory_exclude_ciphers</a> parameter, and the optional
|
|
"connection_reuse" attribute (Postfix ≥ 3.4) overrides the <a href="postconf.5.html">main.cf</a>
|
|
<a href="postconf.5.html#smtp_tls_connection_reuse">smtp_tls_connection_reuse</a> parameter. In the policy table, multiple
|
|
ciphers, protocols or excluded ciphers must be separated by colons, as
|
|
attribute values may not contain whitespace or commas. The optional
|
|
"enable_rpk" attribute (Postfix ≥ 3.9) overrides the <a href="postconf.5.html">main.cf</a>
|
|
<a href="postconf.5.html#smtp_tls_enable_rpk">smtp_tls_enable_rpk</a> parameter. </dd>
|
|
|
|
<dt><b><a href="TLS_README.html#client_tls_dane">dane</a></b></dt>
|
|
<dd>Opportunistic DANE TLS. The TLS policy for the destination is
|
|
obtained via TLSA records in DNSSEC. If no TLSA records are found,
|
|
the effective security level used is <a
|
|
href="TLS_README.html#client_tls_may">may</a>. If TLSA records are
|
|
found, but none are usable, the effective security level is <a
|
|
href="TLS_README.html#client_tls_encrypt">encrypt</a>. When usable
|
|
TLSA records are obtained for the remote SMTP server, the
|
|
server certificate must match the TLSA records. <a href="https://tools.ietf.org/html/rfc7672">RFC 7672</a> (DANE)
|
|
TLS authentication and DNSSEC support is available with Postfix
|
|
2.11 and later. The optional "connection_reuse" attribute (Postfix
|
|
≥ 3.4) overrides the <a href="postconf.5.html">main.cf</a> <a href="postconf.5.html#smtp_tls_connection_reuse">smtp_tls_connection_reuse</a> parameter.
|
|
When the effective security level used is <a
|
|
href="TLS_README.html#client_tls_may">may</a>, the optional "ciphers",
|
|
"exclude", and "protocols" attributes (Postfix ≥ 2.6) override the
|
|
"<a href="postconf.5.html#smtp_tls_ciphers">smtp_tls_ciphers</a>", "<a href="postconf.5.html#smtp_tls_exclude_ciphers">smtp_tls_exclude_ciphers</a>", and "<a href="postconf.5.html#smtp_tls_protocols">smtp_tls_protocols</a>"
|
|
configuration parameters.
|
|
When the effective security level used is <a
|
|
href="TLS_README.html#client_tls_encrypt">encrypt</a>, the optional "ciphers",
|
|
"exclude", and "protocols" attributes (Postfix ≥ 2.6) override the
|
|
"<a href="postconf.5.html#smtp_tls_mandatory_ciphers">smtp_tls_mandatory_ciphers</a>", "<a href="postconf.5.html#smtp_tls_mandatory_exclude_ciphers">smtp_tls_mandatory_exclude_ciphers</a>", and
|
|
"<a href="postconf.5.html#smtp_tls_mandatory_protocols">smtp_tls_mandatory_protocols</a>" configuration parameters.
|
|
</dd>
|
|
|
|
<dt><b><a href="TLS_README.html#client_tls_dane">dane-only</a></b></dt>
|
|
<dd>Mandatory DANE TLS. The TLS policy for the destination is
|
|
obtained via TLSA records in DNSSEC. If no TLSA records are found,
|
|
or none are usable, no connection is made to the server. When
|
|
usable TLSA records are obtained for the remote SMTP server, the
|
|
server certificate must match the TLSA records. <a href="https://tools.ietf.org/html/rfc7672">RFC 7672</a> (DANE) TLS
|
|
authentication and DNSSEC support is available with Postfix 2.11
|
|
and later. The optional "ciphers", "exclude", and "protocols" attributes
|
|
(Postfix ≥ 2.6) override the "<a href="postconf.5.html#smtp_tls_mandatory_ciphers">smtp_tls_mandatory_ciphers</a>",
|
|
"<a href="postconf.5.html#smtp_tls_mandatory_exclude_ciphers">smtp_tls_mandatory_exclude_ciphers</a>", and "<a href="postconf.5.html#smtp_tls_mandatory_protocols">smtp_tls_mandatory_protocols</a>"
|
|
configuration parameters. The optional "connection_reuse" attribute
|
|
(Postfix ≥ 3.4) overrides the <a href="postconf.5.html">main.cf</a> <a href="postconf.5.html#smtp_tls_connection_reuse">smtp_tls_connection_reuse</a> parameter.
|
|
</dd>
|
|
|
|
<dt><b><a href="TLS_README.html#client_tls_fprint">fingerprint</a></b></dt>
|
|
<dd>Certificate fingerprint
|
|
verification. Available with Postfix 2.5 and later. At this security
|
|
level, there are no trusted Certification Authorities. The certificate
|
|
trust chain, expiration date, ... are not checked. Instead,
|
|
the optional policy table "match" attribute, or else the <a href="postconf.5.html">main.cf</a>
|
|
<b><a href="postconf.5.html#smtp_tls_fingerprint_cert_match">smtp_tls_fingerprint_cert_match</a></b> parameter, lists the certificate
|
|
fingerprints or the public key fingerprints (Postfix 2.9 and later)
|
|
of acceptable server certificates. The digest
|
|
algorithm used to calculate the fingerprint is selected by the
|
|
<b><a href="postconf.5.html#smtp_tls_fingerprint_digest">smtp_tls_fingerprint_digest</a></b> parameter. Multiple fingerprints can
|
|
be combined with a "|" delimiter in a single match attribute, or multiple
|
|
match attributes can be employed. The ":" character is not used as a
|
|
delimiter as it occurs between each pair of fingerprint (hexadecimal)
|
|
digits. The optional "ciphers", "exclude", and "protocols" attributes
|
|
(Postfix ≥ 2.6) override the "<a href="postconf.5.html#smtp_tls_mandatory_ciphers">smtp_tls_mandatory_ciphers</a>",
|
|
"<a href="postconf.5.html#smtp_tls_mandatory_exclude_ciphers">smtp_tls_mandatory_exclude_ciphers</a>", and "<a href="postconf.5.html#smtp_tls_mandatory_protocols">smtp_tls_mandatory_protocols</a>"
|
|
configuration parameters. The optional "connection_reuse" attribute
|
|
(Postfix ≥ 3.4) overrides the <a href="postconf.5.html">main.cf</a> <a href="postconf.5.html#smtp_tls_connection_reuse">smtp_tls_connection_reuse</a>
|
|
parameter. The optional "enable_rpk" attribute (Postfix ≥ 3.9)
|
|
overrides the <a href="postconf.5.html">main.cf</a> <a href="postconf.5.html#smtp_tls_enable_rpk">smtp_tls_enable_rpk</a> parameter. </dd>
|
|
|
|
<dt><b><a href="TLS_README.html#client_tls_verify">verify</a></b></dt>
|
|
<dd>Mandatory TLS verification. Mail is delivered only if the TLS
|
|
handshake succeeds, the remote SMTP server certificate chain can be
|
|
validated, and a DNS name in the certificate matches the specified match
|
|
criteria. At this security level, DNS MX lookups are presumed to be
|
|
secure enough, and the name verified in the server certificate is
|
|
potentially obtained via unauthenticated DNS MX lookups. The optional
|
|
"match" attribute overrides the <a href="postconf.5.html">main.cf</a> <a href="postconf.5.html#smtp_tls_verify_cert_match">smtp_tls_verify_cert_match</a>
|
|
parameter. In the policy table, multiple match patterns and strategies
|
|
must be separated by colons. In practice explicit control over matching
|
|
is more common with the "secure" policy, described below. The optional
|
|
"ciphers", "exclude", and "protocols" attributes (Postfix ≥ 2.6)
|
|
override the "<a href="postconf.5.html#smtp_tls_mandatory_ciphers">smtp_tls_mandatory_ciphers</a>",
|
|
"<a href="postconf.5.html#smtp_tls_mandatory_exclude_ciphers">smtp_tls_mandatory_exclude_ciphers</a>", and "<a href="postconf.5.html#smtp_tls_mandatory_protocols">smtp_tls_mandatory_protocols</a>"
|
|
configuration parameters. With Postfix ≥ 2.11 the optional "tafile"
|
|
policy table attribute modifies trust chain verification in the same
|
|
manner as the "<a href="postconf.5.html#smtp_tls_trust_anchor_file">smtp_tls_trust_anchor_file</a>" parameter. The "tafile"
|
|
attribute may be specified multiple times to load multiple trust-anchor
|
|
files. The optional "connection_reuse" attribute (Postfix ≥ 3.4)
|
|
overrides the <a href="postconf.5.html">main.cf</a> <a href="postconf.5.html#smtp_tls_connection_reuse">smtp_tls_connection_reuse</a> parameter. </dd>
|
|
|
|
<dt><b><a href="TLS_README.html#client_tls_secure">secure</a></b></dt>
|
|
<dd>Secure certificate verification. Mail is delivered only if the TLS
|
|
handshake succeeds, the remote SMTP server certificate chain can be
|
|
validated, and a DNS name in the certificate matches the specified match
|
|
criteria. At this security level, DNS MX lookups, though potentially
|
|
used to determine the candidate next-hop gateway IP addresses, are
|
|
<b>not</b> presumed to be secure enough for TLS peername verification.
|
|
Instead, the default name verified in the server certificate is obtained
|
|
directly from the next-hop, or is explicitly specified via the optional
|
|
"match" attribute which overrides the <a href="postconf.5.html">main.cf</a> <a href="postconf.5.html#smtp_tls_secure_cert_match">smtp_tls_secure_cert_match</a>
|
|
parameter. In the policy table, multiple match patterns and strategies
|
|
must be separated by colons. The match attribute is most useful when
|
|
multiple domains are supported by a common server: the policy entries
|
|
for additional domains specify matching rules for the primary domain
|
|
certificate. While transport table overrides that route the secondary
|
|
domains to the primary nexthop also allow secure verification, they risk
|
|
delivery to the wrong destination when domains change hands or are
|
|
re-assigned to new gateways. With the "match" attribute approach,
|
|
routing is not perturbed, and mail is deferred if verification of a new
|
|
MX host fails. The optional "ciphers", "exclude", and "protocols"
|
|
attributes (Postfix ≥ 2.6) override the "<a href="postconf.5.html#smtp_tls_mandatory_ciphers">smtp_tls_mandatory_ciphers</a>",
|
|
"<a href="postconf.5.html#smtp_tls_mandatory_exclude_ciphers">smtp_tls_mandatory_exclude_ciphers</a>", and "<a href="postconf.5.html#smtp_tls_mandatory_protocols">smtp_tls_mandatory_protocols</a>"
|
|
configuration parameters. With Postfix ≥ 2.11 the "tafile" attribute
|
|
optionally modifies trust chain verification in the same manner as the
|
|
"<a href="postconf.5.html#smtp_tls_trust_anchor_file">smtp_tls_trust_anchor_file</a>" parameter. The "tafile" attribute may be
|
|
specified multiple times to load multiple trust-anchor files. The
|
|
optional "connection_reuse" attribute (Postfix ≥ 3.4) overrides the
|
|
<a href="postconf.5.html">main.cf</a> <a href="postconf.5.html#smtp_tls_connection_reuse">smtp_tls_connection_reuse</a> parameter. </dd>
|
|
|
|
</dl>
|
|
|
|
<p>
|
|
Example:
|
|
</p>
|
|
|
|
<pre>
|
|
/etc/postfix/<a href="postconf.5.html">main.cf</a>:
|
|
<a href="postconf.5.html#smtp_tls_policy_maps">smtp_tls_policy_maps</a> = <a href="DATABASE_README.html#types">hash</a>:/etc/postfix/tls_policy
|
|
# Postfix 2.5 and later.
|
|
#
|
|
# The default digest is sha256 with Postfix ≥ 3.6 and
|
|
# compatibility level ≥ 3.
|
|
#
|
|
<a href="postconf.5.html#smtp_tls_fingerprint_digest">smtp_tls_fingerprint_digest</a> = sha256
|
|
</pre>
|
|
|
|
<pre>
|
|
/etc/postfix/tls_policy:
|
|
example.edu none
|
|
example.mil may
|
|
example.gov encrypt protocols=TLSv1
|
|
example.com verify ciphers=high
|
|
example.net secure
|
|
.example.net secure match=.example.net:example.net
|
|
[mail.example.org]:587 secure match=nexthop
|
|
# Postfix 2.5 and later
|
|
[thumb.example.org] fingerprint
|
|
match=b6:b4:72:34:e2:59:cd:...:c2:ca:63:0d:4d:cc:2c:7d:84:de:e6:2f
|
|
match=51:e9:af:2e:1e:40:1f:...:64:0a:30:35:2d:09:16:31:5a:eb:82:76
|
|
</pre>
|
|
|
|
<p> <b>Note:</b> The "hostname" strategy if listed in a non-default
|
|
setting of <a href="postconf.5.html#smtp_tls_secure_cert_match">smtp_tls_secure_cert_match</a> or in the "match" attribute
|
|
in the policy table can render the "secure" level vulnerable to
|
|
DNS forgery. Do not use the "hostname" strategy for secure-channel
|
|
configurations in environments where DNS security is not assured. </p>
|
|
|
|
<p> This feature is available in Postfix 2.3 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="smtp_tls_protocols">smtp_tls_protocols</a>
|
|
(default: see 'postconf -d' output)</b></DT><DD>
|
|
|
|
<p> TLS protocols that the Postfix SMTP client will use with
|
|
opportunistic TLS encryption. In <a href="postconf.5.html">main.cf</a> the values are separated by
|
|
whitespace, commas or colons. In the policy table "protocols" attribute
|
|
(see <a href="postconf.5.html#smtp_tls_policy_maps">smtp_tls_policy_maps</a>) the only valid separator is colon. An empty
|
|
value means allow all protocols. </p>
|
|
|
|
<p> The valid protocol names (see SSL_get_version(3)) are "SSLv2",
|
|
"SSLv3", "TLSv1", "TLSv1.1", "TLSv1.2" and "TLSv1.3". Starting with
|
|
Postfix 3.6, the default value is ">=TLSv1", which sets TLS 1.0 as
|
|
the lowest supported TLS protocol version (see below). Older releases
|
|
use the "!" exclusion syntax, also described below. </p>
|
|
|
|
<p> As of Postfix 3.6, the preferred way to limit the range of
|
|
acceptable protocols is to set the lowest acceptable TLS protocol
|
|
version and/or the highest acceptable TLS protocol version. To set the
|
|
lower bound include an element of the form: ">=<i>version</i>" where
|
|
<i>version</i> is either one of the TLS protocol names listed above,
|
|
or a hexadecimal number corresponding to the desired TLS protocol
|
|
version (0301 for TLS 1.0, 0302 for TLS 1.1, etc.). For the upper
|
|
bound, use "<=<i>version</i>". There must be no whitespace between
|
|
the ">=" or "<=" symbols and the protocol name or number. </p>
|
|
|
|
<p> Hexadecimal protocol numbers make it possible to specify protocol
|
|
bounds for TLS versions that are known to OpenSSL, but might not be
|
|
known to Postfix. They cannot be used with the legacy exclusion syntax.
|
|
Leading "0" or "0x" prefixes are supported, but not required.
|
|
Therefore, "301", "0301", "0x301" and "0x0301" are all equivalent to
|
|
"TLSv1". Hexadecimal versions unknown to OpenSSL will fail to set the
|
|
upper or lower bound, and a warning will be logged. Hexadecimal
|
|
versions should only be used when Postfix is linked with some future
|
|
version of OpenSSL that supports TLS 1.4 or later, but Postfix does not
|
|
yet support a symbolic name for that protocol version. </p>
|
|
|
|
<p>Hexadecimal example (Postfix ≥ 3.6):</p>
|
|
<blockquote>
|
|
<pre>
|
|
# Allow only TLS 1.0 through (hypothetical) TLS 1.4, once supported
|
|
# in some future version of OpenSSL (presently a warning is logged).
|
|
<a href="postconf.5.html#smtp_tls_protocols">smtp_tls_protocols</a> = >=TLSv1, <=0305
|
|
# Allow only TLS 1.0 and up:
|
|
<a href="postconf.5.html#smtp_tls_protocols">smtp_tls_protocols</a> = >=0x0301
|
|
</pre>
|
|
</blockquote>
|
|
|
|
<p> With Postfix < 3.6 there is no support for a minimum or maximum
|
|
version, and the protocol range is configured via protocol exclusions.
|
|
To require at least TLS 1.0, set "<a href="postconf.5.html#smtp_tls_protocols">smtp_tls_protocols</a> = !SSLv2, !SSLv3".
|
|
Listing the protocols to include, rather than protocols to exclude, is
|
|
supported, but not recommended. The exclusion form more accurately
|
|
matches the underlying OpenSSL interface. </p>
|
|
|
|
<p> When using the exclusion syntax, take care to ensure that the range of
|
|
protocols advertised by an SSL/TLS client is contiguous. When a protocol
|
|
version is enabled, disabling any higher version implicitly disables all
|
|
versions above that higher version. Thus, for example:
|
|
</p>
|
|
<blockquote>
|
|
<pre>
|
|
<a href="postconf.5.html#smtp_tls_protocols">smtp_tls_protocols</a> = !SSLv2, !SSLv3, !TLSv1.1
|
|
</pre>
|
|
</blockquote>
|
|
<p> also disables any protocols version higher than TLSv1.1 leaving
|
|
only "TLSv1" enabled. </p>
|
|
|
|
<p> Support for "TLSv1.3" was introduced in OpenSSL 1.1.1. Disabling
|
|
this protocol via "!TLSv1.3" is supported since Postfix 3.4 (or patch
|
|
releases ≥ 3.0.14, 3.1.10, 3.2.7 and 3.3.2). </p>
|
|
|
|
<p> Example: </p>
|
|
<pre>
|
|
# Preferred syntax with Postfix ≥ 3.6:
|
|
<a href="postconf.5.html#smtp_tls_protocols">smtp_tls_protocols</a> = >=TLSv1, <=TLSv1.3
|
|
# Legacy syntax:
|
|
<a href="postconf.5.html#smtp_tls_protocols">smtp_tls_protocols</a> = !SSLv2, !SSLv3
|
|
</pre>
|
|
|
|
<p> This feature is available in Postfix 2.6 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="smtp_tls_scert_verifydepth">smtp_tls_scert_verifydepth</a>
|
|
(default: 9)</b></DT><DD>
|
|
|
|
<p> The verification depth for remote SMTP server certificates. A depth
|
|
of 1 is sufficient if the issuing CA is listed in a local CA file. </p>
|
|
|
|
<p> The default verification depth is 9 (the OpenSSL default) for
|
|
compatibility with earlier Postfix behavior. Prior to Postfix 2.5,
|
|
the default value was 5, but the limit was not actually enforced. If
|
|
you have set this to a lower non-default value, certificates with longer
|
|
trust chains may now fail to verify. Certificate chains with 1 or 2
|
|
CAs are common, deeper chains are more rare and any number between 5
|
|
and 9 should suffice in practice. You can choose a lower number if,
|
|
for example, you trust certificates directly signed by an issuing CA
|
|
but not any CAs it delegates to. </p>
|
|
|
|
<p> This feature is available in Postfix 2.2 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="smtp_tls_secure_cert_match">smtp_tls_secure_cert_match</a>
|
|
(default: nexthop, dot-nexthop)</b></DT><DD>
|
|
|
|
<p> How the Postfix SMTP client verifies the server certificate
|
|
peername for the "secure" TLS security level. In a "secure" TLS policy table
|
|
($<a href="postconf.5.html#smtp_tls_policy_maps">smtp_tls_policy_maps</a>) entry the optional "match" attribute
|
|
overrides this <a href="postconf.5.html">main.cf</a> setting. </p>
|
|
|
|
<p> This parameter specifies one or more patterns or strategies separated
|
|
by commas, whitespace or colons. In the policy table the only valid
|
|
separator is the colon character. </p>
|
|
|
|
<p> For a description of the pattern and strategy syntax see the
|
|
<a href="postconf.5.html#smtp_tls_verify_cert_match">smtp_tls_verify_cert_match</a> parameter. The "hostname" strategy should
|
|
be avoided in this context, as in the absence of a secure global DNS, using
|
|
the results of MX lookups in certificate verification is not immune to active
|
|
(man-in-the-middle) attacks on DNS. </p>
|
|
|
|
<p>
|
|
Sample <a href="postconf.5.html">main.cf</a> setting:
|
|
</p>
|
|
|
|
<blockquote>
|
|
<pre>
|
|
<a href="postconf.5.html#smtp_tls_secure_cert_match">smtp_tls_secure_cert_match</a> = nexthop
|
|
</pre>
|
|
</blockquote>
|
|
|
|
<p>
|
|
Sample policy table override:
|
|
</p>
|
|
|
|
<blockquote>
|
|
<pre>
|
|
example.net secure match=example.com:.example.com
|
|
.example.net secure match=example.com:.example.com
|
|
</pre>
|
|
</blockquote>
|
|
|
|
<p> This feature is available in Postfix 2.3 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="smtp_tls_security_level">smtp_tls_security_level</a>
|
|
(default: empty)</b></DT><DD>
|
|
|
|
<p> The default SMTP TLS security level for the Postfix SMTP client.
|
|
When a non-empty value is specified, this overrides the obsolete
|
|
parameters <a href="postconf.5.html#smtp_use_tls">smtp_use_tls</a>, <a href="postconf.5.html#smtp_enforce_tls">smtp_enforce_tls</a>, and <a href="postconf.5.html#smtp_tls_enforce_peername">smtp_tls_enforce_peername</a>;
|
|
when no value is specified for <a href="postconf.5.html#smtp_tls_enforce_peername">smtp_tls_enforce_peername</a> or the obsolete
|
|
parameters, the default SMTP TLS security level is
|
|
<a href="TLS_README.html#client_tls_none">none</a>. </p>
|
|
|
|
<p> Specify one of the following security levels: </p>
|
|
|
|
<dl>
|
|
|
|
<dt><b><a href="TLS_README.html#client_tls_none">none</a></b></dt>
|
|
<dd> No TLS. TLS will not be used unless enabled for specific
|
|
destinations via <a href="postconf.5.html#smtp_tls_policy_maps">smtp_tls_policy_maps</a>. </dd>
|
|
|
|
<dt><b><a href="TLS_README.html#client_tls_may">may</a></b></dt>
|
|
<dd> Opportunistic TLS. Use TLS if this is supported by the remote
|
|
SMTP server, otherwise use plaintext; after a failed TLS handshake
|
|
or TLS session, fall back to plaintext if the message has spent
|
|
<a href="postconf.5.html#minimal_backoff_time">minimal_backoff_time</a> in the mail queue. Since
|
|
sending in the clear is acceptable, demanding stronger than default TLS
|
|
security merely reduces interoperability.
|
|
The "<a href="postconf.5.html#smtp_tls_ciphers">smtp_tls_ciphers</a>" and "<a href="postconf.5.html#smtp_tls_protocols">smtp_tls_protocols</a>" (Postfix ≥ 2.6)
|
|
configuration parameters provide control over the protocols and
|
|
cipher grade used with opportunistic TLS. With earlier releases the
|
|
opportunistic TLS cipher grade is always "export" and no protocols
|
|
are disabled.
|
|
When TLS handshakes fail, the connection is retried with TLS disabled.
|
|
This allows mail delivery to sites with non-interoperable TLS
|
|
implementations. </dd>
|
|
|
|
<dt><b><a href="TLS_README.html#client_tls_encrypt">encrypt</a></b></dt>
|
|
<dd>Mandatory TLS encryption. Since a minimum
|
|
level of security is intended, it is reasonable to be specific about
|
|
sufficiently secure protocol versions and ciphers. At this security level
|
|
and higher, the <a href="postconf.5.html">main.cf</a> parameters <a href="postconf.5.html#smtp_tls_mandatory_protocols">smtp_tls_mandatory_protocols</a> and
|
|
<a href="postconf.5.html#smtp_tls_mandatory_ciphers">smtp_tls_mandatory_ciphers</a> specify the TLS protocols and minimum
|
|
cipher grade which the administrator considers secure enough for
|
|
mandatory encrypted sessions. This security level is not an appropriate
|
|
default for systems delivering mail to the Internet. </dd>
|
|
|
|
<dt><b><a href="TLS_README.html#client_tls_dane">dane</a></b></dt>
|
|
<dd>Opportunistic DANE TLS. At this security level, the TLS policy
|
|
for the destination is obtained via DNSSEC. For TLSA policy to be
|
|
in effect, the destination domain's containing DNS zone must be
|
|
signed and the Postfix SMTP client's operating system must be
|
|
configured to send its DNS queries to a recursive DNS nameserver
|
|
that is able to validate the signed records. Each MX host's DNS
|
|
zone should also be signed, and should publish DANE TLSA (<a href="https://tools.ietf.org/html/rfc7672">RFC 7672</a>)
|
|
records that specify how that MX host's TLS certificate is to be
|
|
verified. TLSA records do not preempt the normal SMTP MX host
|
|
selection algorithm, if some MX hosts support TLSA and others do
|
|
not, TLS security will vary from delivery to delivery. It is up
|
|
to the domain owner to configure their MX hosts and their DNS
|
|
sensibly. To configure the Postfix SMTP client for DNSSEC lookups
|
|
see the documentation for the <a href="postconf.5.html#smtp_dns_support_level">smtp_dns_support_level</a> <a href="postconf.5.html">main.cf</a>
|
|
parameter. When DNSSEC-validated TLSA records are not found the
|
|
effective tls security level is "may". When TLSA records are found,
|
|
but are all unusable the effective security level is "encrypt". For
|
|
purposes of protocol and cipher selection, the "dane" security level
|
|
is treated like a "mandatory" TLS security level, and weak ciphers
|
|
and protocols are disabled. Since DANE authenticates server
|
|
certificates the "aNULL" cipher-suites are transparently excluded
|
|
at this level, no need to configure this manually. <a href="https://tools.ietf.org/html/rfc7672">RFC 7672</a> (DANE)
|
|
TLS authentication is available with Postfix 2.11 and later. </dd>
|
|
|
|
<dt><b><a href="TLS_README.html#client_tls_dane">dane-only</a></b></dt>
|
|
<dd>Mandatory DANE TLS. This is just like "dane" above, but DANE
|
|
TLSA authentication is required. There is no fallback to "may" or
|
|
"encrypt" when TLSA records are missing or unusable. <a href="https://tools.ietf.org/html/rfc7672">RFC 7672</a>
|
|
(DANE) TLS authentication is available with Postfix 2.11 and later.
|
|
</dd>
|
|
|
|
<dt><b><a href="TLS_README.html#client_tls_fprint">fingerprint</a></b></dt>
|
|
<dd>Certificate fingerprint verification.
|
|
At this security level, there are no trusted Certification Authorities.
|
|
The certificate trust chain, expiration date, etc., are
|
|
not checked. Instead, the <b><a href="postconf.5.html#smtp_tls_fingerprint_cert_match">smtp_tls_fingerprint_cert_match</a></b>
|
|
parameter lists the certificate fingerprint or public key fingerprint
|
|
(Postfix 2.9 and later) of the valid server certificate. The digest
|
|
algorithm used to calculate the fingerprint is selected by the
|
|
<b><a href="postconf.5.html#smtp_tls_fingerprint_digest">smtp_tls_fingerprint_digest</a></b> parameter. Available with Postfix
|
|
2.5 and later. </dd>
|
|
|
|
<dt><b><a href="TLS_README.html#client_tls_verify">verify</a></b></dt>
|
|
<dd>Mandatory TLS verification. At this security
|
|
level, DNS MX lookups are trusted to be secure enough, and the name
|
|
verified in the server certificate is usually obtained indirectly
|
|
via unauthenticated DNS MX lookups. The <a href="postconf.5.html#smtp_tls_verify_cert_match">smtp_tls_verify_cert_match</a>
|
|
parameter controls how the server name is verified. In practice explicit
|
|
control over matching is more common at the "secure" level, described
|
|
below. This security level is not an appropriate default for systems
|
|
delivering mail to the Internet. </dd>
|
|
|
|
<dt><b><a href="TLS_README.html#client_tls_secure">secure</a></b></dt>
|
|
<dd>Secure-channel TLS. At this security level,
|
|
DNS MX lookups, though potentially used to determine the candidate
|
|
next-hop gateway IP addresses, are <b>not</b> trusted to be secure enough
|
|
for TLS peername verification. Instead, the default name verified in
|
|
the server certificate is obtained from the next-hop domain as specified
|
|
in the <a href="postconf.5.html#smtp_tls_secure_cert_match">smtp_tls_secure_cert_match</a> configuration parameter. The default
|
|
matching rule is that a server certificate matches when its name is equal
|
|
to or is a sub-domain of the nexthop domain. This security level is not
|
|
an appropriate default for systems delivering mail to the Internet. </dd>
|
|
|
|
</dl>
|
|
|
|
<p>
|
|
Examples:
|
|
</p>
|
|
|
|
<pre>
|
|
# No TLS. Formerly: <a href="postconf.5.html#smtp_use_tls">smtp_use_tls</a>=no and <a href="postconf.5.html#smtp_enforce_tls">smtp_enforce_tls</a>=no.
|
|
<a href="postconf.5.html#smtp_tls_security_level">smtp_tls_security_level</a> = none
|
|
</pre>
|
|
|
|
<pre>
|
|
# Opportunistic TLS.
|
|
<a href="postconf.5.html#smtp_tls_security_level">smtp_tls_security_level</a> = may
|
|
# Do not tweak opportunistic ciphers or protocols unless it is essential
|
|
# to do so (if a security vulnerability is found in the SSL library that
|
|
# can be mitigated by disabling a particular protocol or raising the
|
|
# cipher grade).
|
|
<a href="postconf.5.html#smtp_tls_ciphers">smtp_tls_ciphers</a> = medium
|
|
<a href="postconf.5.html#smtp_tls_protocols">smtp_tls_protocols</a> = >=TLSv1
|
|
# Legacy (Postfix < 3.6) syntax:
|
|
<a href="postconf.5.html#smtp_tls_protocols">smtp_tls_protocols</a> = !SSLv2, !SSLv3
|
|
</pre>
|
|
|
|
<pre>
|
|
# Mandatory (high-grade) TLS encryption.
|
|
<a href="postconf.5.html#smtp_tls_security_level">smtp_tls_security_level</a> = encrypt
|
|
<a href="postconf.5.html#smtp_tls_mandatory_ciphers">smtp_tls_mandatory_ciphers</a> = high
|
|
</pre>
|
|
|
|
<pre>
|
|
# Authenticated TLS 1.2 or better matching the nexthop domain or a
|
|
# subdomain.
|
|
<a href="postconf.5.html#smtp_tls_security_level">smtp_tls_security_level</a> = secure
|
|
<a href="postconf.5.html#smtp_tls_mandatory_ciphers">smtp_tls_mandatory_ciphers</a> = high
|
|
<a href="postconf.5.html#smtp_tls_mandatory_protocols">smtp_tls_mandatory_protocols</a> = >=TLSv1.2
|
|
<a href="postconf.5.html#smtp_tls_secure_cert_match">smtp_tls_secure_cert_match</a> = nexthop, dot-nexthop
|
|
</pre>
|
|
|
|
<pre>
|
|
# Certificate fingerprint verification (Postfix ≥ 2.5).
|
|
# The CA-less "fingerprint" security level only scales to a limited
|
|
# number of destinations. As a global default rather than a per-site
|
|
# setting, this is practical only when mail for all recipients is sent
|
|
# to a central mail hub.
|
|
<a href="postconf.5.html#relayhost">relayhost</a> = [mailhub.example.com]
|
|
<a href="postconf.5.html#smtp_tls_security_level">smtp_tls_security_level</a> = fingerprint
|
|
<a href="postconf.5.html#smtp_tls_mandatory_protocols">smtp_tls_mandatory_protocols</a> = >=TLSv1.2
|
|
<a href="postconf.5.html#smtp_tls_mandatory_ciphers">smtp_tls_mandatory_ciphers</a> = high
|
|
<a href="postconf.5.html#smtp_tls_fingerprint_cert_match">smtp_tls_fingerprint_cert_match</a> =
|
|
3D:95:34:51:...:40:99:C0:C1
|
|
EC:3B:2D:B0:...:A3:9D:72:F6
|
|
</pre>
|
|
|
|
<p> This feature is available in Postfix 2.3 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="smtp_tls_servername">smtp_tls_servername</a>
|
|
(default: empty)</b></DT><DD>
|
|
|
|
<p> Optional name to send to the remote SMTP server in the TLS Server
|
|
Name Indication (SNI) extension. The SNI extension is always on when
|
|
DANE is used to authenticate the server, and in that case the SNI name
|
|
sent is the one required by <a href="https://tools.ietf.org/html/rfc7672">RFC7672</a> and this parameter is ignored. </p>
|
|
|
|
<p> Some SMTP servers use the received SNI name to select an appropriate
|
|
certificate chain to present to the client. While this may improve
|
|
interoperability with such servers, it may reduce interoperability with
|
|
other servers that choose to abort the connection when they don't have a
|
|
certificate chain configured for the requested name. Such servers
|
|
should select a default certificate chain and continue the handshake,
|
|
but some may not. Therefore, absent DANE, no SNI name is sent by
|
|
default. </p>
|
|
|
|
<p> The SNI name must be either a valid DNS hostname, or else one of the
|
|
special values <b>hostname</b> or <b>nexthop</b>, which select either the
|
|
remote hostname or the nexthop domain respectively. DNS names for SNI must be
|
|
in A-label (punycode) form. Invalid DNS names log a configuration error
|
|
warning and mail delivery is deferred. </p>
|
|
|
|
<p> Except when using a <a href="postconf.5.html#relayhost">relayhost</a> to forward all email, the only
|
|
sensible non-empty <a href="postconf.5.html">main.cf</a> setting for this parameter is
|
|
<b>hostname</b>. Other non-empty values are only practical on a
|
|
per-destination basis via the <b>servername</b> attribute of the Postfix
|
|
TLS <a href="TLS_README.html#client_tls_policy">policy table</a>. When
|
|
in doubt, leave this parameter empty, and configure per-destination SNI
|
|
as needed. </p>
|
|
|
|
<p> This feature is available in Postfix 3.4 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="smtp_tls_session_cache_database">smtp_tls_session_cache_database</a>
|
|
(default: empty)</b></DT><DD>
|
|
|
|
<p> Name of the file containing the optional Postfix SMTP client
|
|
TLS session cache. Specify a database type that supports enumeration,
|
|
such as <b>btree</b> or <b>sdbm</b>; there is no need to support
|
|
concurrent access. The file is created if it does not exist. The <a href="smtp.8.html">smtp(8)</a>
|
|
daemon does not use this parameter directly, rather the cache is
|
|
implemented indirectly in the <a href="tlsmgr.8.html">tlsmgr(8)</a> daemon. This means that
|
|
per-smtp-instance <a href="master.5.html">master.cf</a> overrides of this parameter are not effective.
|
|
Note that each of the cache databases supported by <a href="tlsmgr.8.html">tlsmgr(8)</a> daemon:
|
|
$<a href="postconf.5.html#smtpd_tls_session_cache_database">smtpd_tls_session_cache_database</a>, $<a href="postconf.5.html#smtp_tls_session_cache_database">smtp_tls_session_cache_database</a>
|
|
(and with Postfix 2.3 and later $<a href="postconf.5.html#lmtp_tls_session_cache_database">lmtp_tls_session_cache_database</a>), needs to
|
|
be stored separately. It is not at this time possible to store multiple
|
|
caches in a single database. </p>
|
|
|
|
<p> Note: <b>dbm</b> databases are not suitable. TLS
|
|
session objects are too large. </p>
|
|
|
|
<p> As of version 2.5, Postfix no longer uses root privileges when
|
|
opening this file. The file should now be stored under the Postfix-owned
|
|
<a href="postconf.5.html#data_directory">data_directory</a>. As a migration aid, an attempt to open the file
|
|
under a non-Postfix directory is redirected to the Postfix-owned
|
|
<a href="postconf.5.html#data_directory">data_directory</a>, and a warning is logged. </p>
|
|
|
|
<p> Example: </p>
|
|
|
|
<pre>
|
|
<a href="postconf.5.html#smtp_tls_session_cache_database">smtp_tls_session_cache_database</a> = <a href="DATABASE_README.html#types">btree</a>:/var/lib/postfix/smtp_scache
|
|
</pre>
|
|
|
|
<p> This feature is available in Postfix 2.2 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="smtp_tls_session_cache_timeout">smtp_tls_session_cache_timeout</a>
|
|
(default: 3600s)</b></DT><DD>
|
|
|
|
<p> The expiration time of Postfix SMTP client TLS session cache
|
|
information. A cache cleanup is performed periodically
|
|
every $<a href="postconf.5.html#smtp_tls_session_cache_timeout">smtp_tls_session_cache_timeout</a> seconds. As with
|
|
$<a href="postconf.5.html#smtp_tls_session_cache_database">smtp_tls_session_cache_database</a>, this parameter is implemented in the
|
|
<a href="tlsmgr.8.html">tlsmgr(8)</a> daemon and therefore per-smtp-instance <a href="master.5.html">master.cf</a> overrides
|
|
are not possible. </p>
|
|
|
|
<p> As of Postfix 2.11 this setting cannot exceed 100 days. If set
|
|
≤ 0, session caching is disabled. If set to a positive value
|
|
less than 2 minutes, the minimum value of 2 minutes is used instead. </p>
|
|
|
|
<p> Specify a non-zero time value (an integral value plus an optional
|
|
one-letter suffix that specifies the time unit). Time units: s
|
|
(seconds), m (minutes), h (hours), d (days), w (weeks).
|
|
The default time unit is s (seconds). </p>
|
|
|
|
<p> This feature is available in Postfix 2.2 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="smtp_tls_trust_anchor_file">smtp_tls_trust_anchor_file</a>
|
|
(default: empty)</b></DT><DD>
|
|
|
|
<p> Zero or more PEM-format files with trust-anchor certificates
|
|
and/or public keys. If the parameter is not empty the root CAs in
|
|
CAfile and CApath are no longer trusted. Rather, the Postfix SMTP
|
|
client will only trust certificate-chains signed by one of the
|
|
trust-anchors contained in the chosen files. The specified
|
|
trust-anchor certificates and public keys are not subject to
|
|
expiration, and need not be (self-signed) root CAs. They may, if
|
|
desired, be intermediate certificates. Therefore, these certificates
|
|
also may be found "in the middle" of the trust chain presented by
|
|
the remote SMTP server, and any untrusted issuing parent certificates
|
|
will be ignored. Specify a list of pathnames separated by comma
|
|
or whitespace. </p>
|
|
|
|
<p> Whether specified in <a href="postconf.5.html">main.cf</a>, or on a per-destination basis,
|
|
the trust-anchor PEM file must be accessible to the Postfix SMTP
|
|
client in the chroot jail if applicable. The trust-anchor file
|
|
should contain only certificates and public keys, no private key
|
|
material, and must be readable by the non-privileged $<a href="postconf.5.html#mail_owner">mail_owner</a>
|
|
user. This allows destinations to be bound to a set of specific
|
|
CAs or public keys without trusting the same CAs for all destinations.
|
|
</p>
|
|
|
|
<p> The <a href="postconf.5.html">main.cf</a> parameter supports single-purpose Postfix installations
|
|
that send mail to a fixed set of SMTP peers. At most sites, if
|
|
trust-anchor files are used at all, they will be specified on a
|
|
per-destination basis via the "tafile" attribute of the "verify"
|
|
and "secure" levels in <a href="postconf.5.html#smtp_tls_policy_maps">smtp_tls_policy_maps</a>. </p>
|
|
|
|
<p> The underlying mechanism is in support of <a href="https://tools.ietf.org/html/rfc7672">RFC 7672</a> (DANE TLSA),
|
|
which defines mechanisms for an SMTP client MTA to securely determine
|
|
server TLS certificates via DNS. </p>
|
|
|
|
<p> If you want your trust anchors to be public keys, with OpenSSL
|
|
you can extract a single PEM public key from a PEM X.509 file
|
|
containing a single certificate, as follows: </p>
|
|
|
|
<blockquote>
|
|
<pre>
|
|
$ openssl x509 -in cert.pem -out ta-key.pem -noout -pubkey
|
|
</pre>
|
|
</blockquote>
|
|
|
|
<p> This feature is available in Postfix 2.11 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="smtp_tls_verify_cert_match">smtp_tls_verify_cert_match</a>
|
|
(default: hostname)</b></DT><DD>
|
|
|
|
<p> How the Postfix SMTP client verifies the server certificate
|
|
peername for the
|
|
"verify" TLS security level. In a "verify" TLS policy table
|
|
($<a href="postconf.5.html#smtp_tls_policy_maps">smtp_tls_policy_maps</a>) entry the optional "match" attribute
|
|
overrides this <a href="postconf.5.html">main.cf</a> setting. </p>
|
|
|
|
<p> This parameter specifies one or more patterns or strategies separated
|
|
by commas, whitespace or colons. In the policy table the only valid
|
|
separator is the colon character. </p>
|
|
|
|
<p> Patterns specify domain names, or domain name suffixes: </p>
|
|
|
|
<dl>
|
|
|
|
<dt><i>example.com</i></dt> <dd> Match the <i>example.com</i> domain,
|
|
i.e. one of the names in the server certificate must be <i>example.com</i>.
|
|
Upper and lower case distinctions are ignored. </dd>
|
|
|
|
<dt><i>.example.com</i></dt>
|
|
<dd> Match subdomains of the <i>example.com</i> domain, i.e. match
|
|
a name in the server certificate that consists of a non-zero number of
|
|
labels followed by a <i>.example.com</i> suffix. Case distinctions are
|
|
ignored.</dd>
|
|
|
|
</dl>
|
|
|
|
<p> Strategies specify a transformation from the next-hop domain
|
|
to the expected name in the server certificate: </p>
|
|
|
|
<dl>
|
|
|
|
<dt>nexthop</dt>
|
|
<dd> Match against the next-hop domain, which is either the recipient
|
|
domain, or the transport next-hop configured for the domain stripped of
|
|
any optional socket type prefix, enclosing square brackets and trailing
|
|
port. When MX lookups are not suppressed, this is the original nexthop
|
|
domain prior to the MX lookup, not the result of the MX lookup. For
|
|
LMTP delivery via UNIX-domain sockets, the verified next-hop name is
|
|
$<a href="postconf.5.html#myhostname">myhostname</a>. This strategy is suitable for use with the "secure"
|
|
policy. Case is ignored.</dd>
|
|
|
|
<dt>dot-nexthop</dt>
|
|
<dd> As above, but match server certificate names that are subdomains
|
|
of the next-hop domain. Case is ignored.</dd>
|
|
|
|
<dt>hostname</dt> <dd> Match against the hostname of the server, often
|
|
obtained via an unauthenticated DNS MX lookup. For LMTP delivery via
|
|
UNIX-domain sockets, the verified name is $<a href="postconf.5.html#myhostname">myhostname</a>. This matches
|
|
the verification strategy of the "MUST" keyword in the obsolete
|
|
<a href="postconf.5.html#smtp_tls_per_site">smtp_tls_per_site</a> table, and is suitable for use with the "verify"
|
|
security level. When the next-hop name is enclosed in square brackets
|
|
to suppress MX lookups, the "hostname" strategy is the same as the
|
|
"nexthop" strategy. Case is ignored.</dd>
|
|
|
|
</dl>
|
|
|
|
<p>
|
|
Sample <a href="postconf.5.html">main.cf</a> setting:
|
|
</p>
|
|
|
|
<pre>
|
|
<a href="postconf.5.html#smtp_tls_verify_cert_match">smtp_tls_verify_cert_match</a> = hostname, nexthop, dot-nexthop
|
|
</pre>
|
|
|
|
<p>
|
|
Sample policy table override:
|
|
</p>
|
|
|
|
<pre>
|
|
example.com verify match=hostname:nexthop
|
|
.example.com verify match=example.com:.example.com:hostname
|
|
</pre>
|
|
|
|
<p> This feature is available in Postfix 2.3 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="smtp_tls_wrappermode">smtp_tls_wrappermode</a>
|
|
(default: no)</b></DT><DD>
|
|
|
|
<p> Request that the Postfix SMTP client connects using the
|
|
SUBMISSIONS (formerly called SMTPS) protocol instead of using the
|
|
STARTTLS command. </p>
|
|
|
|
<p> This mode requires "<a href="postconf.5.html#smtp_tls_security_level">smtp_tls_security_level</a> = encrypt" or
|
|
stronger. </p>
|
|
|
|
<p> Example: deliver all remote mail via a provider's submissions
|
|
service at "mail.example.com". </p>
|
|
|
|
<pre>
|
|
/etc/postfix/<a href="postconf.5.html">main.cf</a>:
|
|
# Client-side SUBMISSIONS requires "encrypt" or stronger.
|
|
<a href="postconf.5.html#smtp_tls_security_level">smtp_tls_security_level</a> = encrypt
|
|
<a href="postconf.5.html#smtp_tls_wrappermode">smtp_tls_wrappermode</a> = yes
|
|
# The [] suppress MX lookups.
|
|
<a href="postconf.5.html#relayhost">relayhost</a> = [mail.example.com]:submissions
|
|
</pre>
|
|
|
|
<p> More examples are in <a href="TLS_README.html">TLS_README</a>, including examples for older
|
|
Postfix versions. </p>
|
|
|
|
<p> This feature is available in Postfix 3.0 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="smtp_tlsrpt_enable">smtp_tlsrpt_enable</a>
|
|
(default: no)</b></DT><DD>
|
|
|
|
<p> Enable support for <a href="https://tools.ietf.org/html/rfc8460">RFC 8460</a> TLSRPT notifications. A mail receiving
|
|
domain can publish a TLSRPT policy in DNS, to request periodic
|
|
summaries of successful and failed SMTP over TLS connections to
|
|
their MX servers. This feature requires that Postfix is built
|
|
with a TLSRPT supporting library. </p>
|
|
|
|
<p> See <a href="TLSRPT_README.html">TLSRPT_README</a> for configuration examples and additional
|
|
requirements for MTA-STS <a href="postconf.5.html#smtp_tls_policy_maps">smtp_tls_policy_maps</a> plugins. </p>
|
|
|
|
<p> This feature is available in Postfix ≥ 3.10. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="smtp_tlsrpt_skip_reused_handshakes">smtp_tlsrpt_skip_reused_handshakes</a>
|
|
(default: yes)</b></DT><DD>
|
|
|
|
<p> Do not report the TLSRPT status for TLS protocol handshakes
|
|
that reuse a previously-negotiated TLS session (there is no new
|
|
information to report). Report the TLSRPT status only for "new" TLS
|
|
sessions. Set this to "no" to log the TLSRPT status of all TLS
|
|
handshakes, for example to troubleshoot Postfix TLSRPT support.
|
|
</p>
|
|
|
|
<p> Note: if an SMTP over TLS connection is reused, there is no
|
|
second etc. TLS handshake to report. </p>
|
|
|
|
<p> This feature is available in Postfix ≥ 3.10. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="smtp_tlsrpt_socket_name">smtp_tlsrpt_socket_name</a>
|
|
(default: empty)</b></DT><DD>
|
|
|
|
<p> The pathname of a UNIX-domain datagram socket that is managed
|
|
by a local TLSRPT reporting service. This parameter must specify a
|
|
pathname (absolute, or relative to $<a href="postconf.5.html#queue_directory">queue_directory</a>) when
|
|
"<a href="postconf.5.html#smtp_tlsrpt_enable">smtp_tlsrpt_enable</a> = yes". </p>
|
|
|
|
<p> See <a href="TLSRPT_README.html">TLSRPT_README</a> for configuration examples and additional
|
|
requirements for MTA-STS <a href="postconf.5.html#smtp_tls_policy_maps">smtp_tls_policy_maps</a> plugins. </p>
|
|
|
|
<p> This feature is available in Postfix ≥ 3.10. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="smtp_use_tls">smtp_use_tls</a>
|
|
(default: no)</b></DT><DD>
|
|
|
|
<p> Opportunistic mode: use TLS when a remote SMTP server announces
|
|
STARTTLS support, otherwise send the mail in the clear. Beware:
|
|
some SMTP servers offer STARTTLS even if it is not configured. With
|
|
Postfix < 2.3, if the TLS handshake fails, and no other server is
|
|
available, delivery is deferred and mail stays in the queue. If this
|
|
is a concern for you, use the <a href="postconf.5.html#smtp_tls_per_site">smtp_tls_per_site</a> feature instead. </p>
|
|
|
|
<p> This feature is available in Postfix 2.2 and later. With
|
|
Postfix 2.3 and later use <a href="postconf.5.html#smtp_tls_security_level">smtp_tls_security_level</a> instead. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="smtp_xforward_timeout">smtp_xforward_timeout</a>
|
|
(default: 300s)</b></DT><DD>
|
|
|
|
<p>
|
|
The Postfix SMTP client time limit for sending the XFORWARD command,
|
|
and for receiving the remote SMTP server response.
|
|
</p>
|
|
|
|
<p> Specify a non-zero time value (an integral value plus an optional
|
|
one-letter suffix that specifies the time unit). Time units: s
|
|
(seconds), m (minutes), h (hours), d (days), w (weeks).
|
|
The default time unit is s (seconds). </p>
|
|
|
|
<p>
|
|
This feature is available in Postfix 2.1 and later.
|
|
</p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="smtpd_authorized_verp_clients">smtpd_authorized_verp_clients</a>
|
|
(default: $<a href="postconf.5.html#authorized_verp_clients">authorized_verp_clients</a>)</b></DT><DD>
|
|
|
|
<p> What remote SMTP clients are allowed to specify the XVERP command.
|
|
This command requests that mail be delivered one recipient at a
|
|
time with a per recipient return address. </p>
|
|
|
|
<p> By default, no clients are allowed to specify XVERP. </p>
|
|
|
|
<p> This parameter was renamed with Postfix version 2.1. The default value
|
|
is backwards compatible with Postfix version 2.0. </p>
|
|
|
|
<p> Specify a list of network/netmask patterns, separated by commas
|
|
and/or whitespace. The mask specifies the number of bits in the
|
|
network part of a host address. You can also specify hostnames or
|
|
.domain names (the initial dot causes the domain to match any name
|
|
below it), "/file/name" or "<a href="DATABASE_README.html">type:table</a>" patterns. A "/file/name"
|
|
pattern is replaced by its contents; a "<a href="DATABASE_README.html">type:table</a>" lookup table
|
|
is matched when a table entry matches a lookup string (the lookup
|
|
result is ignored). Continue long lines by starting the next line
|
|
with whitespace. Specify "!pattern" to exclude an address or network
|
|
block from the list. The form "!/file/name" is supported only in
|
|
Postfix version 2.4 and later. </p>
|
|
|
|
<p> Note: IP version 6 address information must be specified inside
|
|
<tt>[]</tt> in the <a href="postconf.5.html#smtpd_authorized_verp_clients">smtpd_authorized_verp_clients</a> value, and in
|
|
files specified with "/file/name". IP version 6 addresses contain
|
|
the ":" character, and would otherwise be confused with a "<a href="DATABASE_README.html">type:table</a>"
|
|
pattern. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="smtpd_authorized_xclient_hosts">smtpd_authorized_xclient_hosts</a>
|
|
(default: empty)</b></DT><DD>
|
|
|
|
<p>
|
|
What remote SMTP clients are allowed to use the XCLIENT feature. This
|
|
command overrides remote SMTP client information that is used for access
|
|
control. Typical use is for SMTP-based content filters, fetchmail-like
|
|
programs, or SMTP server access rule testing. See the <a href="XCLIENT_README.html">XCLIENT_README</a>
|
|
document for details.
|
|
</p>
|
|
|
|
<p>
|
|
This feature is available in Postfix 2.1 and later.
|
|
</p>
|
|
|
|
<p>
|
|
By default, no clients are allowed to specify XCLIENT.
|
|
</p>
|
|
|
|
<p>
|
|
Specify a list of network/netmask patterns, separated by commas
|
|
and/or whitespace. The mask specifies the number of bits in the
|
|
network part of a host address. You can also specify hostnames or
|
|
.domain names (the initial dot causes the domain to match any name
|
|
below it), "/file/name" or "<a href="DATABASE_README.html">type:table</a>" patterns. A "/file/name"
|
|
pattern is replaced by its contents; a "<a href="DATABASE_README.html">type:table</a>" lookup table
|
|
is matched when a table entry matches a lookup string (the lookup
|
|
result is ignored). Continue long lines by starting the next line
|
|
with whitespace. Specify "!pattern" to exclude an address or network
|
|
block from the list. The form "!/file/name" is supported only in
|
|
Postfix version 2.4 and later. </p>
|
|
|
|
<p> Note: IP version 6 address information must be specified inside
|
|
<tt>[]</tt> in the <a href="postconf.5.html#smtpd_authorized_xclient_hosts">smtpd_authorized_xclient_hosts</a> value, and in
|
|
files specified with "/file/name". IP version 6 addresses contain
|
|
the ":" character, and would otherwise be confused with a "<a href="DATABASE_README.html">type:table</a>"
|
|
pattern. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="smtpd_authorized_xforward_hosts">smtpd_authorized_xforward_hosts</a>
|
|
(default: empty)</b></DT><DD>
|
|
|
|
<p>
|
|
What remote SMTP clients are allowed to use the XFORWARD feature. This
|
|
command forwards information that is used to improve logging after
|
|
SMTP-based content filters. See the <a href="XFORWARD_README.html">XFORWARD_README</a> document for
|
|
details.
|
|
</p>
|
|
|
|
<p>
|
|
This feature is available in Postfix 2.1 and later.
|
|
</p>
|
|
|
|
<p>
|
|
By default, no clients are allowed to specify XFORWARD.
|
|
</p>
|
|
|
|
<p>
|
|
Specify a list of network/netmask patterns, separated by commas
|
|
and/or whitespace. The mask specifies the number of bits in the
|
|
network part of a host address. You can also specify hostnames or
|
|
.domain names (the initial dot causes the domain to match any name
|
|
below it), "/file/name" or "<a href="DATABASE_README.html">type:table</a>" patterns. A "/file/name"
|
|
pattern is replaced by its contents; a "<a href="DATABASE_README.html">type:table</a>" lookup table
|
|
is matched when a table entry matches a lookup string (the lookup
|
|
result is ignored). Continue long lines by starting the next line
|
|
with whitespace. Specify "!pattern" to exclude an address or network
|
|
block from the list. The form "!/file/name" is supported only in
|
|
Postfix version 2.4 and later. </p>
|
|
|
|
<p> Note: IP version 6 address information must be specified inside
|
|
<tt>[]</tt> in the <a href="postconf.5.html#smtpd_authorized_xforward_hosts">smtpd_authorized_xforward_hosts</a> value, and in
|
|
files specified with "/file/name". IP version 6 addresses contain
|
|
the ":" character, and would otherwise be confused with a "<a href="DATABASE_README.html">type:table</a>"
|
|
pattern. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="smtpd_banner">smtpd_banner</a>
|
|
(default: $<a href="postconf.5.html#myhostname">myhostname</a> ESMTP $<a href="postconf.5.html#mail_name">mail_name</a>)</b></DT><DD>
|
|
|
|
<p>
|
|
The text that follows the 220 status code in the SMTP greeting
|
|
banner. Some people like to see the mail version advertised. By
|
|
default, Postfix shows no version.
|
|
</p>
|
|
|
|
<p>
|
|
You MUST specify $<a href="postconf.5.html#myhostname">myhostname</a> at the start of the text. This is
|
|
required by the SMTP protocol.
|
|
</p>
|
|
|
|
<p>
|
|
Example:
|
|
</p>
|
|
|
|
<pre>
|
|
<a href="postconf.5.html#smtpd_banner">smtpd_banner</a> = $<a href="postconf.5.html#myhostname">myhostname</a> ESMTP $<a href="postconf.5.html#mail_name">mail_name</a> ($<a href="postconf.5.html#mail_version">mail_version</a>)
|
|
</pre>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="smtpd_client_auth_rate_limit">smtpd_client_auth_rate_limit</a>
|
|
(default: 0)</b></DT><DD>
|
|
|
|
<p>
|
|
The maximal number of AUTH commands that any client is allowed to
|
|
send to this service per time unit, regardless of whether or not
|
|
Postfix actually accepts those commands. The time unit is specified
|
|
with the <a href="postconf.5.html#anvil_rate_time_unit">anvil_rate_time_unit</a> configuration parameter.
|
|
</p>
|
|
|
|
<p>
|
|
By default, there is no limit on the number of AUTH commands that a
|
|
client may send.
|
|
</p>
|
|
|
|
<p>
|
|
To disable this feature, specify a limit of 0.
|
|
</p>
|
|
|
|
<p>
|
|
WARNING: The purpose of this feature is to limit abuse. It must
|
|
not be used to regulate legitimate mail traffic.
|
|
</p>
|
|
|
|
<p>
|
|
This feature is available in Postfix 3.1 and later.
|
|
</p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="smtpd_client_connection_count_limit">smtpd_client_connection_count_limit</a>
|
|
(default: 50)</b></DT><DD>
|
|
|
|
<p>
|
|
How many simultaneous connections any client is allowed to
|
|
make to this service. By default, the limit is set to half
|
|
the default process limit value.
|
|
</p>
|
|
|
|
<p>
|
|
To disable this feature, specify a limit of 0.
|
|
</p>
|
|
|
|
<p>
|
|
WARNING: The purpose of this feature is to limit abuse. It must
|
|
not be used to regulate legitimate mail traffic.
|
|
</p>
|
|
|
|
<p>
|
|
This feature is available in Postfix 2.2 and later.
|
|
</p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="smtpd_client_connection_rate_limit">smtpd_client_connection_rate_limit</a>
|
|
(default: 0)</b></DT><DD>
|
|
|
|
<p>
|
|
The maximal number of connection attempts any client is allowed to
|
|
make to this service per time unit. The time unit is specified
|
|
with the <a href="postconf.5.html#anvil_rate_time_unit">anvil_rate_time_unit</a> configuration parameter.
|
|
</p>
|
|
|
|
<p>
|
|
By default, a client can make as many connections per time unit as
|
|
Postfix can accept.
|
|
</p>
|
|
|
|
<p>
|
|
To disable this feature, specify a limit of 0.
|
|
</p>
|
|
|
|
<p>
|
|
WARNING: The purpose of this feature is to limit abuse. It must
|
|
not be used to regulate legitimate mail traffic.
|
|
</p>
|
|
|
|
<p>
|
|
This feature is available in Postfix 2.2 and later.
|
|
</p>
|
|
|
|
<p>
|
|
Example:
|
|
</p>
|
|
|
|
<pre>
|
|
<a href="postconf.5.html#smtpd_client_connection_rate_limit">smtpd_client_connection_rate_limit</a> = 1000
|
|
</pre>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="smtpd_client_event_limit_exceptions">smtpd_client_event_limit_exceptions</a>
|
|
(default: $<a href="postconf.5.html#mynetworks">mynetworks</a>)</b></DT><DD>
|
|
|
|
<p>
|
|
Clients that are excluded from smtpd_client_*_count/rate_limit
|
|
restrictions. See the <a href="postconf.5.html#mynetworks">mynetworks</a> parameter
|
|
description for the parameter value syntax.
|
|
</p>
|
|
|
|
<p>
|
|
By default, clients in trusted networks are excluded. Specify a
|
|
list of network blocks, hostnames or .domain names (the initial
|
|
dot causes the domain to match any name below it).
|
|
</p>
|
|
|
|
<p> Note: IP version 6 address information must be specified inside
|
|
<tt>[]</tt> in the <a href="postconf.5.html#smtpd_client_event_limit_exceptions">smtpd_client_event_limit_exceptions</a> value, and
|
|
in files specified with "/file/name". IP version 6 addresses
|
|
contain the ":" character, and would otherwise be confused with a
|
|
"<a href="DATABASE_README.html">type:table</a>" pattern. </p>
|
|
|
|
<p> Pattern matching of domain names is controlled by the presence
|
|
or absence of "<a href="postconf.5.html#smtpd_client_event_limit_exceptions">smtpd_client_event_limit_exceptions</a>" in the
|
|
<a href="postconf.5.html#parent_domain_matches_subdomains">parent_domain_matches_subdomains</a> parameter value (Postfix 3.0 and
|
|
later). </p>
|
|
|
|
<p>
|
|
This feature is available in Postfix 2.2 and later.
|
|
</p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="smtpd_client_ipv4_prefix_length">smtpd_client_ipv4_prefix_length</a>
|
|
(default: 32)</b></DT><DD>
|
|
|
|
<p> Aggregate smtpd_client_*_count and smtpd_client_*_rate statistics
|
|
by IPv4 network blocks with the specified network prefix. Aggregation
|
|
uses fewer <a href="anvil.8.html">anvil(8)</a> resources to maintain counters. By default,
|
|
aggregation is disabled for IPv4. </p>
|
|
|
|
<p> This feature is available in Postfix 3.8 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="smtpd_client_ipv6_prefix_length">smtpd_client_ipv6_prefix_length</a>
|
|
(default: 84)</b></DT><DD>
|
|
|
|
<p> Aggregate smtpd_client_*_count and smtpd_client_*_rate statistics
|
|
by IPv6 network blocks with the specified network prefix. Aggregation
|
|
uses fewer the <a href="anvil.8.html">anvil(8)</a> resources to maintain counters. By default,
|
|
aggregation is enabled for IPv6. </p>
|
|
|
|
<p> This feature is available in Postfix 3.8 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="smtpd_client_message_rate_limit">smtpd_client_message_rate_limit</a>
|
|
(default: 0)</b></DT><DD>
|
|
|
|
<p>
|
|
The maximal number of message delivery requests that any client is
|
|
allowed to make to this service per time unit, regardless of whether
|
|
or not Postfix actually accepts those messages. The time unit is
|
|
specified with the <a href="postconf.5.html#anvil_rate_time_unit">anvil_rate_time_unit</a> configuration parameter.
|
|
</p>
|
|
|
|
<p>
|
|
By default, a client can send as many message delivery requests
|
|
per time unit as Postfix can accept.
|
|
</p>
|
|
|
|
<p>
|
|
To disable this feature, specify a limit of 0.
|
|
</p>
|
|
|
|
<p>
|
|
WARNING: The purpose of this feature is to limit abuse. It must
|
|
not be used to regulate legitimate mail traffic.
|
|
</p>
|
|
|
|
<p>
|
|
This feature is available in Postfix 2.2 and later.
|
|
</p>
|
|
|
|
<p>
|
|
Example:
|
|
</p>
|
|
|
|
<pre>
|
|
<a href="postconf.5.html#smtpd_client_message_rate_limit">smtpd_client_message_rate_limit</a> = 1000
|
|
</pre>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="smtpd_client_new_tls_session_rate_limit">smtpd_client_new_tls_session_rate_limit</a>
|
|
(default: 0)</b></DT><DD>
|
|
|
|
<p>
|
|
The maximal number of new (i.e., uncached) TLS sessions that a
|
|
remote SMTP client is allowed to negotiate with this service per
|
|
time unit. The time unit is specified with the <a href="postconf.5.html#anvil_rate_time_unit">anvil_rate_time_unit</a>
|
|
configuration parameter.
|
|
</p>
|
|
|
|
<p>
|
|
By default, a remote SMTP client can negotiate as many new TLS
|
|
sessions per time unit as Postfix can accept.
|
|
</p>
|
|
|
|
<p>
|
|
To disable this feature, specify a limit of 0. Otherwise, specify
|
|
a limit that is at least the per-client concurrent session limit,
|
|
or else legitimate client sessions may be rejected.
|
|
</p>
|
|
|
|
<p>
|
|
WARNING: The purpose of this feature is to limit abuse. It must
|
|
not be used to regulate legitimate mail traffic.
|
|
</p>
|
|
|
|
<p>
|
|
This feature is available in Postfix 2.3 and later.
|
|
</p>
|
|
|
|
<p>
|
|
Example:
|
|
</p>
|
|
|
|
<pre>
|
|
<a href="postconf.5.html#smtpd_client_new_tls_session_rate_limit">smtpd_client_new_tls_session_rate_limit</a> = 100
|
|
</pre>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="smtpd_client_port_logging">smtpd_client_port_logging</a>
|
|
(default: no)</b></DT><DD>
|
|
|
|
<p> Enable logging of the remote SMTP client port in addition to
|
|
the hostname and IP address. The logging format is "host[address]:port".
|
|
</p>
|
|
|
|
<p> This feature is available in Postfix 2.5 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="smtpd_client_recipient_rate_limit">smtpd_client_recipient_rate_limit</a>
|
|
(default: 0)</b></DT><DD>
|
|
|
|
<p>
|
|
The maximal number of recipient addresses that any client is allowed
|
|
to send to this service per time unit, regardless of whether or not
|
|
Postfix actually accepts those recipients. The time unit is specified
|
|
with the <a href="postconf.5.html#anvil_rate_time_unit">anvil_rate_time_unit</a> configuration parameter.
|
|
</p>
|
|
|
|
<p>
|
|
By default, a client can send as many recipient addresses per time
|
|
unit as Postfix can accept.
|
|
</p>
|
|
|
|
<p>
|
|
To disable this feature, specify a limit of 0.
|
|
</p>
|
|
|
|
<p>
|
|
WARNING: The purpose of this feature is to limit abuse. It must
|
|
not be used to regulate legitimate mail traffic.
|
|
</p>
|
|
|
|
<p>
|
|
This feature is available in Postfix 2.2 and later.
|
|
</p>
|
|
|
|
<p>
|
|
Example:
|
|
</p>
|
|
|
|
<pre>
|
|
<a href="postconf.5.html#smtpd_client_recipient_rate_limit">smtpd_client_recipient_rate_limit</a> = 1000
|
|
</pre>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="smtpd_client_restrictions">smtpd_client_restrictions</a>
|
|
(default: empty)</b></DT><DD>
|
|
|
|
<p>
|
|
Optional restrictions that the Postfix SMTP server applies in the
|
|
context of a client connection request.
|
|
See <a href="SMTPD_ACCESS_README.html">SMTPD_ACCESS_README</a>, section "Delayed evaluation of SMTP access
|
|
restriction lists" for a discussion of evaluation context and time.
|
|
</p>
|
|
|
|
<p>
|
|
The default is to allow all connection requests.
|
|
</p>
|
|
|
|
<p>
|
|
Specify a list of restrictions, separated by commas and/or whitespace.
|
|
Continue long lines by starting the next line with whitespace.
|
|
Restrictions are applied in the order as specified; the first
|
|
restriction that matches wins.
|
|
</p>
|
|
|
|
<p>
|
|
The following restrictions are specific to client hostname or
|
|
client network address information.
|
|
</p>
|
|
|
|
<dl>
|
|
|
|
<dt><b><a name="check_ccert_access">check_ccert_access</a> <i><a href="DATABASE_README.html">type:table</a></i></b></dt>
|
|
|
|
<dd> By default use the remote SMTP client certificate fingerprint
|
|
or the public key
|
|
fingerprint (Postfix 2.9 and later) as the lookup key for the specified
|
|
<a href="access.5.html">access(5)</a> database; with Postfix version 2.2, also require that the
|
|
remote SMTP client certificate is verified successfully.
|
|
The fingerprint digest algorithm is configurable via the
|
|
<a href="postconf.5.html#smtpd_tls_fingerprint_digest">smtpd_tls_fingerprint_digest</a> parameter (hard-coded as md5 prior to
|
|
Postfix version 2.5). This feature requires "<a href="postconf.5.html#smtpd_tls_ask_ccert">smtpd_tls_ask_ccert</a>
|
|
= yes" and is available with Postfix version
|
|
2.2 and later. </dd>
|
|
|
|
<dd> The default algorithm is <b>sha256</b> with Postfix ≥ 3.6
|
|
and the <b><a href="postconf.5.html#compatibility_level">compatibility_level</a></b> set to 3.6 or higher. With Postfix
|
|
≤ 3.5, the default algorithm is <b>md5</b>. The best-practice
|
|
algorithm is now <b>sha256</b>. Recent advances in hash function
|
|
cryptanalysis have led to md5 and sha1 being deprecated in favor of
|
|
sha256. However, as long as there are no known "second pre-image"
|
|
attacks against the older algorithms, their use in this context, though
|
|
not recommended, is still likely safe. </dd>
|
|
|
|
<dd> Alternatively, <a href="postconf.5.html#check_ccert_access">check_ccert_access</a> accepts an explicit search
|
|
order (Postfix 3.5 and later). The default search order as described
|
|
above corresponds with: </dd>
|
|
|
|
<dd> <a href="postconf.5.html#check_ccert_access">check_ccert_access</a> { <a href="DATABASE_README.html">type:table</a>, { search_order = cert_fingerprint,
|
|
pubkey_fingerprint } } </dd>
|
|
|
|
<dd> The commas are optional. </dd>
|
|
|
|
<dt><b><a name="check_client_access">check_client_access</a> <i><a href="DATABASE_README.html">type:table</a></i></b></dt>
|
|
|
|
<dd>Search the specified access database for the client hostname
|
|
or IP address. See the <a href="access.5.html">access(5)</a> manual page for details. </dd>
|
|
|
|
<dt><b><a name="check_client_a_access">check_client_a_access</a> <i><a href="DATABASE_README.html">type:table</a></i></b></dt>
|
|
|
|
<dd>Search the specified <a href="access.5.html">access(5)</a> database for the IP addresses for the
|
|
client hostname, and execute the corresponding action. Note: a result
|
|
of "OK" is not allowed for safety reasons. Instead, use DUNNO in order
|
|
to exclude specific hosts from denylists. This feature is available
|
|
in Postfix 3.0 and later. </dd>
|
|
|
|
<dt><b><a name="check_client_mx_access">check_client_mx_access</a> <i><a href="DATABASE_README.html">type:table</a></i></b></dt>
|
|
|
|
<dd>Search the specified <a href="access.5.html">access(5)</a> database for the MX hosts for the
|
|
client hostname, and execute the corresponding action. If no MX
|
|
record is found, look up A or AAAA records, just like the Postfix
|
|
SMTP client would. Note: a result
|
|
of "OK" is not allowed for safety reasons. Instead, use DUNNO in order
|
|
to exclude specific hosts from denylists. This feature is available
|
|
in Postfix 2.7 and later. </dd>
|
|
|
|
<dt><b><a name="check_client_ns_access">check_client_ns_access</a> <i><a href="DATABASE_README.html">type:table</a></i></b></dt>
|
|
|
|
<dd>Search the specified <a href="access.5.html">access(5)</a> database for the DNS servers for
|
|
the client hostname, and execute the corresponding action. Note: a
|
|
result of "OK" is not allowed for safety reasons. Instead, use DUNNO
|
|
in order to exclude specific hosts from denylists. This feature is
|
|
available in Postfix 2.7 and later. </dd>
|
|
|
|
<dt><b><a name="check_reverse_client_hostname_access">check_reverse_client_hostname_access</a> <i><a href="DATABASE_README.html">type:table</a></i></b></dt>
|
|
|
|
<dd>Search the specified access database for the unverified reverse
|
|
client hostname or IP address. See the <a href="access.5.html">access(5)</a>
|
|
manual page for details. Note: a result of "OK" is not allowed for
|
|
safety reasons. Instead, use DUNNO in order to exclude specific
|
|
hosts from denylists. This feature is available in Postfix 2.6
|
|
and later.</dd>
|
|
|
|
<dt><b><a name="check_reverse_client_hostname_a_access">check_reverse_client_hostname_a_access</a> <i><a href="DATABASE_README.html">type:table</a></i></b></dt>
|
|
|
|
<dd>Search the specified <a href="access.5.html">access(5)</a> database for the IP addresses for the
|
|
unverified reverse client hostname, and execute the corresponding
|
|
action. Note: a result of "OK" is not allowed for safety reasons.
|
|
Instead, use DUNNO in order to exclude specific hosts from denylists.
|
|
This feature is available in Postfix 3.0 and later. </dd>
|
|
|
|
<dt><b><a name="check_reverse_client_hostname_mx_access">check_reverse_client_hostname_mx_access</a> <i><a href="DATABASE_README.html">type:table</a></i></b></dt>
|
|
|
|
<dd>Search the specified <a href="access.5.html">access(5)</a> database for the MX hosts for the
|
|
unverified reverse client hostname, and execute the corresponding
|
|
action. If no MX record is found, look up A or AAAA records, just
|
|
like the Postfix SMTP client would.
|
|
Note: a result of "OK" is not allowed for safety reasons.
|
|
Instead, use DUNNO in order to exclude specific hosts from denylists.
|
|
This feature is available in Postfix 2.7 and later. </dd>
|
|
|
|
<dt><b><a name="check_reverse_client_hostname_ns_access">check_reverse_client_hostname_ns_access</a> <i><a href="DATABASE_README.html">type:table</a></i></b></dt>
|
|
|
|
<dd>Search the specified <a href="access.5.html">access(5)</a> database for the DNS servers for
|
|
the unverified reverse client hostname, and execute the corresponding
|
|
action. Note: a result of "OK" is not allowed for safety reasons.
|
|
Instead, use DUNNO in order to exclude specific hosts from denylists.
|
|
This feature is available in Postfix 2.7 and later. </dd>
|
|
|
|
<dt><b><a name="check_sasl_access">check_sasl_access</a> <i><a href="DATABASE_README.html">type:table</a></i></b></dt>
|
|
|
|
<dd> Use the remote SMTP client SASL user name as the lookup key for
|
|
the specified <a href="access.5.html">access(5)</a> database. The lookup key has the form
|
|
"username@domainname" when the <a href="postconf.5.html#smtpd_sasl_local_domain">smtpd_sasl_local_domain</a> parameter
|
|
value is non-empty. Unlike the <a href="postconf.5.html#check_client_access">check_client_access</a> feature,
|
|
<a href="postconf.5.html#check_sasl_access">check_sasl_access</a> does not perform matches of parent domains or IP
|
|
subnet ranges. This feature is available with Postfix version 2.11
|
|
and later. </dd>
|
|
|
|
<dt><b><a name="permit_inet_interfaces">permit_inet_interfaces</a></b></dt>
|
|
|
|
<dd>Permit the request when the client IP address matches
|
|
$<a href="postconf.5.html#inet_interfaces">inet_interfaces</a>. </dd>
|
|
|
|
<dt><b><a name="permit_mynetworks">permit_mynetworks</a></b></dt>
|
|
|
|
<dd>Permit the request when the client IP address matches any
|
|
network or network address listed in $<a href="postconf.5.html#mynetworks">mynetworks</a>. </dd>
|
|
|
|
<dt><b><a name="permit_sasl_authenticated">permit_sasl_authenticated</a></b></dt>
|
|
|
|
<dd> Permit the request when the client is successfully
|
|
authenticated via the <a href="https://tools.ietf.org/html/rfc4954">RFC 4954</a> (AUTH) protocol. </dd>
|
|
|
|
<dt><b><a name="permit_tls_all_clientcerts">permit_tls_all_clientcerts</a></b></dt>
|
|
|
|
<dd> Permit the request when the remote SMTP client certificate is
|
|
verified successfully. This option must be used only if a special
|
|
CA issues the certificates and only this CA is listed as a trusted
|
|
CA. Otherwise, clients with a third-party certificate would also
|
|
be allowed to relay. Specify "<a href="postconf.5.html#tls_append_default_CA">tls_append_default_CA</a> = no" when the
|
|
trusted CA is specified with <a href="postconf.5.html#smtpd_tls_CAfile">smtpd_tls_CAfile</a> or <a href="postconf.5.html#smtpd_tls_CApath">smtpd_tls_CApath</a>,
|
|
to prevent Postfix from appending the system-supplied default CAs.
|
|
This feature requires "<a href="postconf.5.html#smtpd_tls_ask_ccert">smtpd_tls_ask_ccert</a> = yes" and is available
|
|
with Postfix version 2.2 and later.</dd>
|
|
|
|
<dt><b><a name="permit_tls_clientcerts">permit_tls_clientcerts</a></b></dt>
|
|
|
|
<dd>Permit the request when the remote SMTP client certificate
|
|
fingerprint or public key fingerprint (Postfix 2.9 and later) is
|
|
listed in $<a href="postconf.5.html#relay_clientcerts">relay_clientcerts</a>.
|
|
The fingerprint digest algorithm is configurable via the
|
|
<a href="postconf.5.html#smtpd_tls_fingerprint_digest">smtpd_tls_fingerprint_digest</a> parameter (hard-coded as md5 prior to
|
|
Postfix version 2.5). This feature requires "<a href="postconf.5.html#smtpd_tls_ask_ccert">smtpd_tls_ask_ccert</a>
|
|
= yes" and is available with Postfix version 2.2 and later.</dd>
|
|
|
|
<dd> The default algorithm is <b>sha256</b> with Postfix ≥ 3.6
|
|
and the <b><a href="postconf.5.html#compatibility_level">compatibility_level</a></b> set to 3.6 or higher. With Postfix
|
|
≤ 3.5, the default algorithm is <b>md5</b>. The best-practice
|
|
algorithm is now <b>sha256</b>. Recent advances in hash function
|
|
cryptanalysis have led to md5 and sha1 being deprecated in favor of
|
|
sha256. However, as long as there are no known "second pre-image"
|
|
attacks against the older algorithms, their use in this context, though
|
|
not recommended, is still likely safe. </dd>
|
|
|
|
<dt><b><a name="reject_rbl_client">reject_rbl_client <i>rbl_domain=d.d.d.d</i></a></b></dt>
|
|
|
|
<dd>Reject the request when the reversed client network address is
|
|
listed with the A record "<i>d.d.d.d</i>" under <i>rbl_domain</i>
|
|
(Postfix version 2.1 and later only). Each "<i>d</i>" is a number,
|
|
or a pattern inside "[]" that contains one or more ";"-separated
|
|
numbers or number..number ranges (Postfix version 2.8 and later).
|
|
If no "<i>=d.d.d.d</i>" is specified, reject the request when the
|
|
reversed client network address is listed with any A record under
|
|
<i>rbl_domain</i>. <br>
|
|
The <a href="postconf.5.html#maps_rbl_reject_code">maps_rbl_reject_code</a> parameter specifies the response code for
|
|
rejected requests (default: 554), the <a href="postconf.5.html#default_rbl_reply">default_rbl_reply</a> parameter
|
|
specifies the default server reply, and the <a href="postconf.5.html#rbl_reply_maps">rbl_reply_maps</a> parameter
|
|
specifies tables with server replies indexed by <i>rbl_domain</i>.
|
|
This feature is available in Postfix 2.0 and later. </dd>
|
|
|
|
<dt><b><a name="permit_dnswl_client">permit_dnswl_client <i>dnswl_domain=d.d.d.d</i></a></b></dt>
|
|
|
|
<dd>Accept the request when the reversed client network address is
|
|
listed with the A record "<i>d.d.d.d</i>" under <i>dnswl_domain</i>.
|
|
Each "<i>d</i>" is a number, or a pattern inside "[]" that contains
|
|
one or more ";"-separated numbers or number..number ranges.
|
|
If no "<i>=d.d.d.d</i>" is specified, accept the request when the
|
|
reversed client network address is listed with any A record under
|
|
<i>dnswl_domain</i>. <br> For safety, <a href="postconf.5.html#permit_dnswl_client">permit_dnswl_client</a> is silently
|
|
ignored when it would override <a href="postconf.5.html#reject_unauth_destination">reject_unauth_destination</a>. The
|
|
result is DEFER_IF_REJECT when allowlist lookup fails. This feature
|
|
is available in Postfix 2.8 and later. </dd>
|
|
|
|
<dt><b><a name="reject_rhsbl_client">reject_rhsbl_client <i>rbl_domain=d.d.d.d</i></a></b></dt>
|
|
|
|
<dd>Reject the request when the client hostname is listed with the
|
|
A record "<i>d.d.d.d</i>" under <i>rbl_domain</i> (Postfix version
|
|
2.1 and later only). Each "<i>d</i>" is a number, or a pattern
|
|
inside "[]" that contains one or more ";"-separated numbers or
|
|
number..number ranges (Postfix version 2.8 and later). If no
|
|
"<i>=d.d.d.d</i>" is specified, reject the request when the client
|
|
hostname is listed with
|
|
any A record under <i>rbl_domain</i>. See the <a href="postconf.5.html#reject_rbl_client">reject_rbl_client</a>
|
|
description above for additional RBL related configuration parameters.
|
|
This feature is available in Postfix 2.0 and later; with Postfix
|
|
version 2.8 and later, <a href="postconf.5.html#reject_rhsbl_reverse_client">reject_rhsbl_reverse_client</a> will usually
|
|
produce better results. </dd>
|
|
|
|
<dt><b><a name="permit_rhswl_client">permit_rhswl_client <i>rhswl_domain=d.d.d.d</i></a></b></dt>
|
|
|
|
<dd>Accept the request when the client hostname is listed with the
|
|
A record "<i>d.d.d.d</i>" under <i>rhswl_domain</i>. Each "<i>d</i>"
|
|
is a number, or a pattern inside "[]" that contains one or more
|
|
";"-separated numbers or number..number ranges. If no
|
|
"<i>=d.d.d.d</i>" is specified, accept the request when the client
|
|
hostname is listed with any A record under <i>rhswl_domain</i>.
|
|
<br> Caution: client name allowlisting is fragile, since the client
|
|
name lookup can fail due to temporary outages. Client name
|
|
allowlisting should be used only to reduce false positives in e.g.
|
|
DNS-based blocklists, and not for making access rule exceptions.
|
|
<br> For safety, <a href="postconf.5.html#permit_rhswl_client">permit_rhswl_client</a> is silently ignored when it
|
|
would override <a href="postconf.5.html#reject_unauth_destination">reject_unauth_destination</a>. The result is DEFER_IF_REJECT
|
|
when allowlist lookup fails. This feature is available in Postfix
|
|
2.8 and later. </dd>
|
|
|
|
<dt><b><a name="reject_rhsbl_reverse_client">reject_rhsbl_reverse_client <i>rbl_domain=d.d.d.d</i></a></b></dt>
|
|
|
|
<dd>Reject the request when the unverified reverse client hostname
|
|
is listed with the A record "<i>d.d.d.d</i>" under <i>rbl_domain</i>.
|
|
Each "<i>d</i>" is a number, or a pattern inside "[]" that contains
|
|
one or more ";"-separated numbers or number..number ranges.
|
|
If no "<i>=d.d.d.d</i>" is specified, reject the request when the
|
|
unverified reverse client hostname is listed with any A record under
|
|
<i>rbl_domain</i>. See the <a href="postconf.5.html#reject_rbl_client">reject_rbl_client</a> description above for
|
|
additional RBL related configuration parameters. This feature is
|
|
available in Postfix 2.8 and later. </dd>
|
|
|
|
<dt><b><a name="reject_unknown_client_hostname">reject_unknown_client_hostname</a></b> (with Postfix < 2.3: reject_unknown_client)</dt>
|
|
|
|
<dd>Reject the request when 1) the client IP address->name mapping
|
|
fails, or 2) the name->address mapping fails, or 3) the name->address
|
|
mapping does not match the client IP address. <br> This is a
|
|
stronger restriction than the <a href="postconf.5.html#reject_unknown_reverse_client_hostname">reject_unknown_reverse_client_hostname</a>
|
|
feature, which triggers only under condition 1) above. <br> The
|
|
<a href="postconf.5.html#unknown_client_reject_code">unknown_client_reject_code</a> parameter specifies the response code
|
|
for rejected requests (default: 450). The reply is always 450 in
|
|
case the address->name or name->address lookup failed due to
|
|
a temporary problem. </dd>
|
|
|
|
<dt><b><a name="reject_unknown_reverse_client_hostname">reject_unknown_reverse_client_hostname</a></b></dt>
|
|
|
|
<dd>Reject the request when the client IP address has no address->name
|
|
mapping. <br> This is a weaker restriction than the
|
|
<a href="postconf.5.html#reject_unknown_client_hostname">reject_unknown_client_hostname</a> feature, which requires not only
|
|
that the address->name and name->address mappings exist, but
|
|
also that the two mappings reproduce the client IP address. <br>
|
|
The <a href="postconf.5.html#unknown_client_reject_code">unknown_client_reject_code</a> parameter specifies the response
|
|
code for rejected requests (default: 450). The reply is always 450
|
|
in case the address->name lookup failed due to a temporary
|
|
problem. <br> This feature is available in Postfix 2.3 and
|
|
later. </dd>
|
|
|
|
</dl>
|
|
|
|
<p>
|
|
In addition, you can use any of the following <a name="generic">
|
|
generic</a> restrictions. These restrictions are applicable in
|
|
any SMTP command context.
|
|
</p>
|
|
|
|
<dl>
|
|
|
|
<dt><b><a name="check_policy_service">check_policy_service <i>servername</i></a></b></dt>
|
|
|
|
<dd>Query the specified policy server. See the <a href="SMTPD_POLICY_README.html">SMTPD_POLICY_README</a>
|
|
document for details. This feature is available in Postfix 2.1
|
|
and later. </dd>
|
|
|
|
<dt><b><a name="defer">defer</a></b></dt>
|
|
|
|
<dd>Defer the request. The client is told to try again later. This
|
|
restriction is useful at the end of a restriction list, to make
|
|
the default policy explicit. <br> The <a href="postconf.5.html#defer_code">defer_code</a> parameter specifies
|
|
the SMTP server reply code (default: 450).</dd>
|
|
|
|
<dt><b><a name="defer_if_permit">defer_if_permit</a></b></dt>
|
|
|
|
<dd>Defer the request if some later restriction would result in an
|
|
explicit or implicit PERMIT action. This is useful when a denylisting
|
|
feature fails due to a temporary problem. This feature is available
|
|
in Postfix version 2.1 and later. </dd>
|
|
|
|
<dt><b><a name="defer_if_reject">defer_if_reject</a></b></dt>
|
|
|
|
<dd>Defer the request if some later restriction would result in a
|
|
REJECT action. This is useful when an allowlisting feature fails
|
|
due to a temporary problem. This feature is available in Postfix
|
|
version 2.1 and later. </dd>
|
|
|
|
<dt><b><a name="permit">permit</a></b></dt>
|
|
|
|
<dd>Permit the request. This restriction is useful at the end of
|
|
a restriction list, to make the default policy explicit.</dd>
|
|
|
|
<dt><b><a name="reject_multi_recipient_bounce">reject_multi_recipient_bounce</a></b></dt>
|
|
|
|
<dd>Reject the request when the envelope sender is the null address,
|
|
and the message has multiple envelope recipients. This usage has
|
|
rare but legitimate applications: under certain conditions,
|
|
multi-recipient mail that was posted with the DSN option NOTIFY=NEVER
|
|
may be forwarded with the null sender address.
|
|
<br> Note: this restriction can only work reliably
|
|
when used in <a href="postconf.5.html#smtpd_data_restrictions">smtpd_data_restrictions</a> or
|
|
<a href="postconf.5.html#smtpd_end_of_data_restrictions">smtpd_end_of_data_restrictions</a>, because the total number of
|
|
recipients is not known at an earlier stage of the SMTP conversation.
|
|
Use at the RCPT stage will only reject the second etc. recipient.
|
|
<br>
|
|
The <a href="postconf.5.html#multi_recipient_bounce_reject_code">multi_recipient_bounce_reject_code</a> parameter specifies the
|
|
response code for rejected requests (default: 550). This feature
|
|
is available in Postfix 2.1 and later. </dd>
|
|
|
|
<dt><b><a name="reject_plaintext_session">reject_plaintext_session</a></b></dt>
|
|
|
|
<dd>Reject the request when the connection is not encrypted. This
|
|
restriction should not be used before the client has had a chance
|
|
to negotiate encryption with the AUTH or STARTTLS commands.
|
|
<br>
|
|
The <a href="postconf.5.html#plaintext_reject_code">plaintext_reject_code</a> parameter specifies the response
|
|
code for rejected requests (default: 450). This feature is available
|
|
in Postfix 2.3 and later. </dd>
|
|
|
|
<dt><b><a name="reject_unauth_pipelining">reject_unauth_pipelining</a></b></dt>
|
|
|
|
<dd>Reject the request when the client sends SMTP commands ahead
|
|
of time where it is not allowed, or when the client sends SMTP
|
|
commands ahead of time without knowing that Postfix actually supports
|
|
ESMTP command pipelining. This stops mail from bulk mail software
|
|
that improperly uses ESMTP command pipelining in order to speed up
|
|
deliveries.
|
|
<br> With Postfix 2.6 and later, the SMTP server sets a per-session
|
|
flag whenever it detects illegal pipelining, including pipelined
|
|
HELO or EHLO commands. The <a href="postconf.5.html#reject_unauth_pipelining">reject_unauth_pipelining</a> feature simply
|
|
tests whether the flag was set at any point in time during the
|
|
session.
|
|
<br> With older Postfix versions, <a href="postconf.5.html#reject_unauth_pipelining">reject_unauth_pipelining</a> checks
|
|
the current status of the input read queue, and its usage is not
|
|
recommended in contexts other than <a href="postconf.5.html#smtpd_data_restrictions">smtpd_data_restrictions</a>. </dd>
|
|
|
|
<dt><b><a name="reject">reject</a></b></dt>
|
|
|
|
<dd>Reject the request. This restriction is useful at the end of
|
|
a restriction list, to make the default policy explicit. The
|
|
<a href="postconf.5.html#reject_code">reject_code</a> configuration parameter specifies the response code for
|
|
rejected requests (default: 554).</dd>
|
|
|
|
<dt><b><a name="sleep">sleep <i>seconds</i></a></b></dt>
|
|
|
|
<dd>Pause for the specified number of seconds and proceed with
|
|
the next restriction in the list, if any. This may stop zombie
|
|
mail when used as:
|
|
<pre>
|
|
/etc/postfix/<a href="postconf.5.html">main.cf</a>:
|
|
<a href="postconf.5.html#smtpd_client_restrictions">smtpd_client_restrictions</a> =
|
|
sleep 1, <a href="postconf.5.html#reject_unauth_pipelining">reject_unauth_pipelining</a>
|
|
<a href="postconf.5.html#smtpd_delay_reject">smtpd_delay_reject</a> = no
|
|
</pre>
|
|
This feature is available in Postfix 2.3. </dd>
|
|
|
|
<dt><b><a name="warn_if_reject">warn_if_reject</a></b></dt>
|
|
|
|
<dd> A safety net for testing. When "<a href="postconf.5.html#warn_if_reject">warn_if_reject</a>" is placed
|
|
before a reject-type restriction, access table query, or
|
|
<a href="postconf.5.html#check_policy_service">check_policy_service</a> query, this logs a "reject_warning" message
|
|
instead of rejecting a request (when a reject-type restriction fails
|
|
due to a temporary error, this logs a "reject_warning" message for
|
|
any implicit "<a href="postconf.5.html#defer_if_permit">defer_if_permit</a>" actions that would normally prevent
|
|
mail from being accepted by some later access restriction). This
|
|
feature has no effect on <a href="postconf.5.html#defer_if_reject">defer_if_reject</a> restrictions. </dd>
|
|
|
|
</dl>
|
|
|
|
<p>
|
|
Other restrictions that are valid in this context:
|
|
</p>
|
|
|
|
<ul>
|
|
|
|
<li> SMTP command specific restrictions that are described under
|
|
the <a href="postconf.5.html#smtpd_helo_restrictions">smtpd_helo_restrictions</a>, <a href="postconf.5.html#smtpd_sender_restrictions">smtpd_sender_restrictions</a> or
|
|
<a href="postconf.5.html#smtpd_recipient_restrictions">smtpd_recipient_restrictions</a> parameters. When helo, sender or
|
|
recipient restrictions are listed under <a href="postconf.5.html#smtpd_client_restrictions">smtpd_client_restrictions</a>,
|
|
they have effect only with "<a href="postconf.5.html#smtpd_delay_reject">smtpd_delay_reject</a> = yes", so that
|
|
$<a href="postconf.5.html#smtpd_client_restrictions">smtpd_client_restrictions</a> is evaluated at the time of the RCPT TO
|
|
command.
|
|
|
|
</ul>
|
|
|
|
<p>
|
|
Example:
|
|
</p>
|
|
|
|
<pre>
|
|
<a href="postconf.5.html#smtpd_client_restrictions">smtpd_client_restrictions</a> = <a href="postconf.5.html#permit_mynetworks">permit_mynetworks</a>, <a href="postconf.5.html#reject_unknown_client_hostname">reject_unknown_client_hostname</a>
|
|
</pre>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="smtpd_command_filter">smtpd_command_filter</a>
|
|
(default: empty)</b></DT><DD>
|
|
|
|
<p> A mechanism to transform commands from remote SMTP clients.
|
|
This is a last-resort tool to work around client commands that break
|
|
interoperability with the Postfix SMTP server. Other uses involve
|
|
fault injection to test Postfix's handling of invalid commands.
|
|
</p>
|
|
|
|
<p> Specify the name of a "<a href="DATABASE_README.html">type:table</a>" lookup table. The search
|
|
string is the SMTP command as received from the remote SMTP client,
|
|
except that initial whitespace and the trailing <CR><LF>
|
|
are removed. The result value is executed by the Postfix SMTP
|
|
server. </p>
|
|
|
|
<p> There is no need to use <a href="postconf.5.html#smtpd_command_filter">smtpd_command_filter</a> for the following
|
|
cases: </p>
|
|
|
|
<ul>
|
|
|
|
<li> <p> Use "<a href="postconf.5.html#resolve_numeric_domain">resolve_numeric_domain</a> = yes" to accept
|
|
"<i>user@ipaddress</i>". </p>
|
|
|
|
<li> <p> Postfix already accepts the correct form
|
|
"<i>user@[ipaddress]</i>". Use <a href="postconf.5.html#virtual_alias_maps">virtual_alias_maps</a> or <a href="postconf.5.html#canonical_maps">canonical_maps</a>
|
|
to translate these into domain names if necessary. </p>
|
|
|
|
<li> <p> Use "<a href="postconf.5.html#strict_rfc821_envelopes">strict_rfc821_envelopes</a> = no" to accept "RCPT TO:<<i>User
|
|
Name <user@example.com>></i>". Postfix will ignore the "<i>User
|
|
Name</i>" part and deliver to the <i><user@example.com></i> address.
|
|
</p>
|
|
|
|
</ul>
|
|
|
|
<p> Examples of problems that can be solved with the <a href="postconf.5.html#smtpd_command_filter">smtpd_command_filter</a>
|
|
feature: </p>
|
|
|
|
<pre>
|
|
/etc/postfix/<a href="postconf.5.html">main.cf</a>:
|
|
<a href="postconf.5.html#smtpd_command_filter">smtpd_command_filter</a> = <a href="pcre_table.5.html">pcre</a>:/etc/postfix/command_filter
|
|
</pre>
|
|
|
|
<pre>
|
|
/etc/postfix/command_filter:
|
|
# Work around clients that send malformed HELO commands.
|
|
/^HELO\s*$/ HELO domain.invalid
|
|
</pre>
|
|
|
|
<pre>
|
|
# Work around clients that send empty lines.
|
|
/^\s*$/ NOOP
|
|
</pre>
|
|
|
|
<pre>
|
|
# Work around clients that send RCPT TO:<'user@domain'>.
|
|
# WARNING: do not lose the parameters that follow the address.
|
|
/^(RCPT\s+TO:\s*<)'([^[:space:]]+)'(>.*)/ $1$2$3
|
|
</pre>
|
|
|
|
<pre>
|
|
# Append XVERP to MAIL FROM commands to request VERP-style delivery.
|
|
# See <a href="VERP_README.html">VERP_README</a> for more information on how to use Postfix VERP.
|
|
/^(MAIL\s+FROM:\s*<listname@example\.com>.*)/ $1 XVERP
|
|
</pre>
|
|
|
|
<pre>
|
|
# Bounce-never mail sink. Use <a href="postconf.5.html#notify_classes">notify_classes</a>=bounce,resource,software
|
|
# to send bounced mail to the postmaster (with message body removed).
|
|
/^(RCPT\s+TO:\s*<.*>.*)\s+NOTIFY=\S+(.*)/ $1 NOTIFY=NEVER$2
|
|
/^(RCPT\s+TO:.*)/ $1 NOTIFY=NEVER
|
|
</pre>
|
|
|
|
<p> This feature is available in Postfix 2.7. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="smtpd_data_restrictions">smtpd_data_restrictions</a>
|
|
(default: empty)</b></DT><DD>
|
|
|
|
<p>
|
|
Optional access restrictions that the Postfix SMTP server applies
|
|
in the context of the SMTP DATA command.
|
|
See <a href="SMTPD_ACCESS_README.html">SMTPD_ACCESS_README</a>, section "Delayed evaluation of SMTP access
|
|
restriction lists" for a discussion of evaluation context and time.
|
|
</p>
|
|
|
|
<p>
|
|
This feature is available in Postfix 2.0 and later.
|
|
</p>
|
|
|
|
<p>
|
|
Specify a list of restrictions, separated by commas and/or whitespace.
|
|
Continue long lines by starting the next line with whitespace.
|
|
Restrictions are applied in the order as specified; the first
|
|
restriction that matches wins.
|
|
</p>
|
|
|
|
<p>
|
|
The following restrictions are valid in this context:
|
|
</p>
|
|
|
|
<ul>
|
|
|
|
<li><a href="#generic">Generic</a> restrictions that can be used
|
|
in any SMTP command context, described under <a href="postconf.5.html#smtpd_client_restrictions">smtpd_client_restrictions</a>.
|
|
|
|
<li>SMTP command specific restrictions described under
|
|
<a href="postconf.5.html#smtpd_client_restrictions">smtpd_client_restrictions</a>, <a href="postconf.5.html#smtpd_helo_restrictions">smtpd_helo_restrictions</a>,
|
|
<a href="postconf.5.html#smtpd_sender_restrictions">smtpd_sender_restrictions</a> or <a href="postconf.5.html#smtpd_recipient_restrictions">smtpd_recipient_restrictions</a>.
|
|
|
|
<li>However, no recipient information is available in the case of
|
|
multi-recipient mail. Acting on only one recipient would be misleading,
|
|
because any decision will affect all recipients equally. Acting on
|
|
all recipients would require a possibly very large amount of memory,
|
|
and would also be misleading for the reasons mentioned before.
|
|
|
|
</ul>
|
|
|
|
<p>
|
|
Examples:
|
|
</p>
|
|
|
|
<pre>
|
|
<a href="postconf.5.html#smtpd_data_restrictions">smtpd_data_restrictions</a> = <a href="postconf.5.html#reject_unauth_pipelining">reject_unauth_pipelining</a>
|
|
<a href="postconf.5.html#smtpd_data_restrictions">smtpd_data_restrictions</a> = <a href="postconf.5.html#reject_multi_recipient_bounce">reject_multi_recipient_bounce</a>
|
|
</pre>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="smtpd_delay_open_until_valid_rcpt">smtpd_delay_open_until_valid_rcpt</a>
|
|
(default: yes)</b></DT><DD>
|
|
|
|
<p> Postpone the start of an SMTP mail transaction until a valid
|
|
RCPT TO command is received. Specify "no" to create a mail transaction
|
|
as soon as the Postfix SMTP server receives a valid MAIL FROM
|
|
command. </p>
|
|
|
|
<p> With sites that reject lots of mail, the default setting reduces
|
|
the use of
|
|
disk, CPU and memory resources. The downside is that rejected
|
|
recipients are logged with NOQUEUE instead of a mail transaction
|
|
ID (also known as a queue ID).
|
|
</p>
|
|
|
|
<p> This feature is available in Postfix 2.3 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="smtpd_delay_reject">smtpd_delay_reject</a>
|
|
(default: yes)</b></DT><DD>
|
|
|
|
<p>
|
|
Wait until the RCPT TO command before evaluating
|
|
$<a href="postconf.5.html#smtpd_client_restrictions">smtpd_client_restrictions</a>, $<a href="postconf.5.html#smtpd_helo_restrictions">smtpd_helo_restrictions</a> and
|
|
$<a href="postconf.5.html#smtpd_sender_restrictions">smtpd_sender_restrictions</a>, or wait until the ETRN command before
|
|
evaluating $<a href="postconf.5.html#smtpd_client_restrictions">smtpd_client_restrictions</a> and $<a href="postconf.5.html#smtpd_helo_restrictions">smtpd_helo_restrictions</a>.
|
|
</p>
|
|
|
|
<p>
|
|
This feature is turned on by default because some clients apparently
|
|
mis-behave when the Postfix SMTP server rejects commands before
|
|
RCPT TO.
|
|
</p>
|
|
|
|
<p>
|
|
The default setting has one major benefit: it allows Postfix to log
|
|
recipient address information when rejecting a client name/address
|
|
or sender address, so that it is possible to find out whose mail
|
|
is being rejected.
|
|
</p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="smtpd_discard_ehlo_keyword_address_maps">smtpd_discard_ehlo_keyword_address_maps</a>
|
|
(default: empty)</b></DT><DD>
|
|
|
|
<p> Lookup tables, indexed by the remote SMTP client address, with
|
|
case insensitive lists of EHLO keywords (pipelining, starttls, auth,
|
|
etc.) that the Postfix SMTP server will not send in the EHLO response
|
|
to a
|
|
remote SMTP client. See <a href="postconf.5.html#smtpd_discard_ehlo_keywords">smtpd_discard_ehlo_keywords</a> for details.
|
|
The tables are not searched by hostname for robustness reasons. </p>
|
|
|
|
<p>
|
|
Specify zero or more "type:name" lookup tables, separated by
|
|
whitespace or comma. Tables will be searched in the specified order
|
|
until a match is found.
|
|
</p>
|
|
|
|
<p> This feature is available in Postfix 2.2 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="smtpd_discard_ehlo_keywords">smtpd_discard_ehlo_keywords</a>
|
|
(default: empty)</b></DT><DD>
|
|
|
|
<p> A case insensitive list of EHLO keywords (pipelining, starttls,
|
|
auth, etc.) that the Postfix SMTP server will not send in the EHLO
|
|
response
|
|
to a remote SMTP client. </p>
|
|
|
|
<p> This feature is available in Postfix 2.2 and later. </p>
|
|
|
|
<p> Notes: </p>
|
|
|
|
<ul>
|
|
|
|
<li> <p> Specify the <b>silent-discard</b> pseudo keyword to prevent
|
|
this action from being logged. </p>
|
|
|
|
<li> <p> Use the <a href="postconf.5.html#smtpd_discard_ehlo_keyword_address_maps">smtpd_discard_ehlo_keyword_address_maps</a> feature
|
|
to discard EHLO keywords selectively. </p>
|
|
|
|
</ul>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="smtpd_dns_reply_filter">smtpd_dns_reply_filter</a>
|
|
(default: empty)</b></DT><DD>
|
|
|
|
<p> Optional filter for Postfix SMTP server DNS lookup results.
|
|
See <a href="postconf.5.html#smtp_dns_reply_filter">smtp_dns_reply_filter</a> for details including an example.
|
|
</p>
|
|
|
|
<p> This feature is available in Postfix 3.0 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="smtpd_end_of_data_restrictions">smtpd_end_of_data_restrictions</a>
|
|
(default: empty)</b></DT><DD>
|
|
|
|
<p> Optional access restrictions that the Postfix SMTP server
|
|
applies in the context of the SMTP END-OF-DATA command.
|
|
See <a href="SMTPD_ACCESS_README.html">SMTPD_ACCESS_README</a>, section "Delayed evaluation of SMTP access
|
|
restriction lists" for a discussion of evaluation context and time.
|
|
</p>
|
|
|
|
<p> This feature is available in Postfix 2.2 and later. </p>
|
|
|
|
<p> See <a href="postconf.5.html#smtpd_data_restrictions">smtpd_data_restrictions</a> for details and limitations. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="smtpd_enforce_tls">smtpd_enforce_tls</a>
|
|
(default: no)</b></DT><DD>
|
|
|
|
<p> Mandatory TLS: announce STARTTLS support to remote SMTP clients,
|
|
and reject all plaintext commands except HELO, EHLO, XCLIENT,
|
|
STARTTLS, NOOP, QUIT, and (Postfix ≥ 3.9) HELP.
|
|
According to <a href="https://tools.ietf.org/html/rfc2487">RFC 2487</a>
|
|
this MUST NOT be applied in case of a publicly-referenced SMTP
|
|
server. Instead, this should be used on dedicated servers, for
|
|
example submission (port 587). This option is therefore off by
|
|
default. </p>
|
|
|
|
<p> Note 1: "<a href="postconf.5.html#smtpd_enforce_tls">smtpd_enforce_tls</a> = yes" implies "<a href="postconf.5.html#smtpd_tls_auth_only">smtpd_tls_auth_only</a> = yes". </p>
|
|
|
|
<p> Note 2: when invoked via "<b>sendmail -bs</b>", Postfix will never offer
|
|
STARTTLS due to insufficient privileges to access the server private
|
|
key. This is intended behavior. </p>
|
|
|
|
<p> This feature is deprecated as of Postfix 3.9. Specify
|
|
<a href="postconf.5.html#smtpd_tls_security_level">smtpd_tls_security_level</a> instead. </p>
|
|
|
|
<p> This feature is available in Postfix 2.2 and later. With
|
|
Postfix 2.3 and later use <a href="postconf.5.html#smtpd_tls_security_level">smtpd_tls_security_level</a> instead. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="smtpd_error_sleep_time">smtpd_error_sleep_time</a>
|
|
(default: 1s)</b></DT><DD>
|
|
|
|
<p>With Postfix version 2.1 and later: the SMTP server response delay after
|
|
a client has made more than $<a href="postconf.5.html#smtpd_soft_error_limit">smtpd_soft_error_limit</a> errors, and
|
|
fewer than $<a href="postconf.5.html#smtpd_hard_error_limit">smtpd_hard_error_limit</a> errors, without delivering mail.
|
|
</p>
|
|
|
|
<p>With Postfix version 2.0 and earlier: the SMTP server delay
|
|
before sending a reject (4xx or 5xx) response, when the client has
|
|
made fewer than $<a href="postconf.5.html#smtpd_soft_error_limit">smtpd_soft_error_limit</a> errors without delivering
|
|
mail. When the client has made $<a href="postconf.5.html#smtpd_soft_error_limit">smtpd_soft_error_limit</a> or more errors,
|
|
delay all responses with the larger of (number of errors) seconds
|
|
or $<a href="postconf.5.html#smtpd_error_sleep_time">smtpd_error_sleep_time</a>. </p>
|
|
|
|
<p> Specify a non-negative time value (an integral value plus an optional
|
|
one-letter suffix that specifies the time unit). Time units: s
|
|
(seconds), m (minutes), h (hours), d (days), w (weeks).
|
|
The default time unit is s (seconds). </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="smtpd_etrn_restrictions">smtpd_etrn_restrictions</a>
|
|
(default: empty)</b></DT><DD>
|
|
|
|
<p>
|
|
Optional restrictions that the Postfix SMTP server applies in the
|
|
context of a client ETRN command.
|
|
See <a href="SMTPD_ACCESS_README.html">SMTPD_ACCESS_README</a>, section "Delayed evaluation of SMTP access
|
|
restriction lists" for a discussion of evaluation context and time.
|
|
</p>
|
|
|
|
<p>
|
|
The Postfix ETRN implementation accepts only destinations that are
|
|
eligible for the Postfix "fast flush" service. See the <a href="ETRN_README.html">ETRN_README</a>
|
|
file for details.
|
|
</p>
|
|
|
|
<p>
|
|
Specify a list of restrictions, separated by commas and/or whitespace.
|
|
Continue long lines by starting the next line with whitespace.
|
|
Restrictions are applied in the order as specified; the first
|
|
restriction that matches wins.
|
|
</p>
|
|
|
|
<p>
|
|
The following restrictions are specific to the domain name information
|
|
received with the ETRN command.
|
|
</p>
|
|
|
|
<dl>
|
|
|
|
<dt><b><a name="check_etrn_access">check_etrn_access</a> <i><a href="DATABASE_README.html">type:table</a></i></b></dt>
|
|
|
|
<dd>Search the specified access database for the ETRN domain name.
|
|
See the <a href="access.5.html">access(5)</a> manual page for details.
|
|
</dd>
|
|
|
|
</dl>
|
|
|
|
<p>
|
|
Other restrictions that are valid in this context:
|
|
</p>
|
|
|
|
<ul>
|
|
|
|
<li><a href="#generic">Generic</a> restrictions that can be used
|
|
in any SMTP command context, described under <a href="postconf.5.html#smtpd_client_restrictions">smtpd_client_restrictions</a>.
|
|
|
|
<li>SMTP command specific restrictions described under
|
|
<a href="postconf.5.html#smtpd_client_restrictions">smtpd_client_restrictions</a> and <a href="postconf.5.html#smtpd_helo_restrictions">smtpd_helo_restrictions</a>.
|
|
|
|
</ul>
|
|
|
|
<p>
|
|
Example:
|
|
</p>
|
|
|
|
<pre>
|
|
<a href="postconf.5.html#smtpd_etrn_restrictions">smtpd_etrn_restrictions</a> = <a href="postconf.5.html#permit_mynetworks">permit_mynetworks</a>, reject
|
|
</pre>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="smtpd_expansion_filter">smtpd_expansion_filter</a>
|
|
(default: see "postconf -d" output)</b></DT><DD>
|
|
|
|
<p>
|
|
What characters are allowed in $name expansions of RBL reply
|
|
templates. Characters not in the allowed set are replaced by "_".
|
|
Use C like escapes to specify special characters such as whitespace.
|
|
</p>
|
|
|
|
<p>
|
|
The <a href="postconf.5.html#smtpd_expansion_filter">smtpd_expansion_filter</a> value is not subject to Postfix configuration
|
|
parameter $name expansion.
|
|
</p>
|
|
|
|
<p>
|
|
This feature is available in Postfix 2.0 and later.
|
|
</p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="smtpd_forbid_bare_newline">smtpd_forbid_bare_newline</a>
|
|
(default: Postfix ≥ 3.9: normalize)</b></DT><DD>
|
|
|
|
<p> Reject or restrict input lines from an SMTP client that end in
|
|
<LF> instead of the standard <CR><LF>. Such line
|
|
endings are commonly allowed with UNIX-based SMTP servers, but they
|
|
violate <a href="https://tools.ietf.org/html/rfc5321">RFC 5321</a>, and allowing such line endings can make a server
|
|
vulnerable to <a href="https://www.postfix.org/smtp-smuggling.html">
|
|
SMTP smuggling</a>. </p>
|
|
|
|
<p> Specify one of the following values (case does not matter): </p>
|
|
|
|
<dl compact>
|
|
|
|
<dt> <b>normalize</b> (default for Postfix ≥ 3.9) </dt>
|
|
<dd> Require the standard
|
|
End-of-DATA sequence <CR><LF>.<CR><LF>.
|
|
Otherwise, allow command or message content lines ending in the
|
|
non-standard <LF>, and process them as if the client sent the
|
|
standard <CR><LF>. <br> <br> This maintains compatibility
|
|
with many legitimate SMTP client applications that send a mix of
|
|
standard and non-standard line endings, but will fail to receive
|
|
email from client implementations that do not terminate DATA content
|
|
with the standard End-of-DATA sequence
|
|
<CR><LF>.<CR><LF>. <br> <br> Such clients
|
|
can be excluded with <a href="postconf.5.html#smtpd_forbid_bare_newline_exclusions">smtpd_forbid_bare_newline_exclusions</a>. </dd>
|
|
|
|
<dt> <b>note</b> </dt> <dd> Same as "normalize", but also notes in
|
|
the log whether the Postfix SMTP server received any lines with
|
|
"bare <LF>". The information is formatted as "<tt>disconnect
|
|
from name[address] ... notes=bare_lf</tt>". The notes value is
|
|
expected to become a list of comma-separated names. <br> <br> This
|
|
feature is available in Postfix 3.9 and later. </dd>
|
|
|
|
<dt> <b>yes</b> </dt> <dd> Compatibility alias for <b>normalize</b>. </dd>
|
|
|
|
<dt> <b>reject</b> </dt> <dd> Require the standard End-of-DATA
|
|
sequence <CR><LF>.<CR><LF>. Reject a command
|
|
or message content when a line contains bare <LF>, log a "bare
|
|
<LF> received" error, and reply with the SMTP status code in
|
|
$<a href="postconf.5.html#smtpd_forbid_bare_newline_reject_code">smtpd_forbid_bare_newline_reject_code</a>. <br> <br> This will reject
|
|
email from SMTP clients that send any non-standard line endings
|
|
such as web applications, netcat, or load balancer health checks.
|
|
<br> <br> This will also reject email from services that use BDAT
|
|
to send MIME text containing a bare newline (<a href="https://tools.ietf.org/html/rfc3030">RFC 3030</a> Section 3
|
|
requires canonical MIME format for text message types, defined in
|
|
<a href="https://tools.ietf.org/html/rfc2045">RFC 2045</a> Sections 2.7 and 2.8). <br> <br> Such clients can be
|
|
excluded with <a href="postconf.5.html#smtpd_forbid_bare_newline_exclusions">smtpd_forbid_bare_newline_exclusions</a> (or, in the case
|
|
of BDAT violations, BDAT can be selectively disabled with
|
|
<a href="postconf.5.html#smtpd_discard_ehlo_keyword_address_maps">smtpd_discard_ehlo_keyword_address_maps</a>, or globally disabled with
|
|
<a href="postconf.5.html#smtpd_discard_ehlo_keywords">smtpd_discard_ehlo_keywords</a>). </dd>
|
|
|
|
<dt> <b>no</b> (default for Postfix < 3.9) </dt>
|
|
<dd> Do not require the standard End-of-DATA
|
|
sequence <CR><LF>.<CR><LF>. Always process
|
|
a bare <LF> as if the client sent <CR><LF>. This
|
|
option is fully backwards compatible, but is not recommended for
|
|
an Internet-facing SMTP server, because it is vulnerable to <a
|
|
href="https://www.postfix.org/smtp-smuggling.html"> SMTP smuggling</a>.
|
|
</dd>
|
|
|
|
</dl>
|
|
|
|
<p> Recommended settings: </p>
|
|
|
|
<blockquote>
|
|
<pre>
|
|
# Require the standard End-of-DATA sequence <CR><LF>.<CR><LF>.
|
|
# Otherwise, allow bare <LF> and process it as if the client sent
|
|
# <CR><LF>.
|
|
#
|
|
# This maintains compatibility with many legitimate SMTP client
|
|
# applications that send a mix of standard and non-standard line
|
|
# endings, but will fail to receive email from client implementations
|
|
# that do not terminate DATA content with the standard End-of-DATA
|
|
# sequence <CR><LF>.<CR><LF>.
|
|
#
|
|
# Such clients can be allowlisted with <a href="postconf.5.html#smtpd_forbid_bare_newline_exclusions">smtpd_forbid_bare_newline_exclusions</a>.
|
|
# The example below allowlists SMTP clients in trusted networks.
|
|
#
|
|
<a href="postconf.5.html#smtpd_forbid_bare_newline">smtpd_forbid_bare_newline</a> = normalize
|
|
<a href="postconf.5.html#smtpd_forbid_bare_newline_exclusions">smtpd_forbid_bare_newline_exclusions</a> = $<a href="postconf.5.html#mynetworks">mynetworks</a>
|
|
</pre>
|
|
</blockquote>
|
|
|
|
<p> Alternative: </p>
|
|
|
|
<blockquote>
|
|
<pre>
|
|
# Reject input lines that contain <LF> and log a "bare <LF> received"
|
|
# error. Require that input lines end in <CR><LF>, and require the
|
|
# standard End-of-DATA sequence <CR><LF>.<CR><LF>.
|
|
#
|
|
# This will reject email from SMTP clients that send any non-standard
|
|
# line endings such as web applications, netcat, or load balancer
|
|
# health checks.
|
|
#
|
|
# This will also reject email from services that use BDAT to send
|
|
# MIME text containing a bare newline (<a href="https://tools.ietf.org/html/rfc3030">RFC 3030</a> Section 3 requires
|
|
# canonical MIME format for text message types, defined in <a href="https://tools.ietf.org/html/rfc2045">RFC 2045</a>
|
|
# Sections 2.7 and 2.8).
|
|
#
|
|
# Such clients can be allowlisted with <a href="postconf.5.html#smtpd_forbid_bare_newline_exclusions">smtpd_forbid_bare_newline_exclusions</a>.
|
|
# The example below allowlists SMTP clients in trusted networks.
|
|
#
|
|
<a href="postconf.5.html#smtpd_forbid_bare_newline">smtpd_forbid_bare_newline</a> = reject
|
|
<a href="postconf.5.html#smtpd_forbid_bare_newline_exclusions">smtpd_forbid_bare_newline_exclusions</a> = $<a href="postconf.5.html#mynetworks">mynetworks</a>
|
|
#
|
|
# Alternatively, in the case of BDAT violations, BDAT can be selectively
|
|
# disabled with <a href="postconf.5.html#smtpd_discard_ehlo_keyword_address_maps">smtpd_discard_ehlo_keyword_address_maps</a>, or globally
|
|
# disabled with <a href="postconf.5.html#smtpd_discard_ehlo_keywords">smtpd_discard_ehlo_keywords</a>.
|
|
#
|
|
# <a href="postconf.5.html#smtpd_discard_ehlo_keyword_address_maps">smtpd_discard_ehlo_keyword_address_maps</a> = <a href="cidr_table.5.html">cidr</a>:/path/to/file
|
|
# /path/to/file:
|
|
# 10.0.0.0/24 chunking, silent-discard
|
|
# <a href="postconf.5.html#smtpd_discard_ehlo_keywords">smtpd_discard_ehlo_keywords</a> = chunking, silent-discard
|
|
</pre>
|
|
</blockquote>
|
|
|
|
<p> This feature with settings <b>yes</b> and <b>no</b> is available
|
|
in Postfix 3.8.4, 3.7.9, 3.6.13, and 3.5.23. Additionally, the
|
|
settings <b>reject</b>, and <b>normalize</b> are available with
|
|
Postfix ≥ 3.9, 3.8.5, 3.7.10, 3.6.14, and 3.5.24. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="smtpd_forbid_bare_newline_exclusions">smtpd_forbid_bare_newline_exclusions</a>
|
|
(default: $<a href="postconf.5.html#mynetworks">mynetworks</a>)</b></DT><DD>
|
|
|
|
<p> Exclude the specified clients from <a href="postconf.5.html#smtpd_forbid_bare_newline">smtpd_forbid_bare_newline</a>
|
|
enforcement. This setting uses the same syntax and parent-domain
|
|
matching behavior as <a href="postconf.5.html#mynetworks">mynetworks</a>. </p>
|
|
|
|
<p> This feature is available in Postfix ≥ 3.9, 3.8.4, 3.7.9,
|
|
3.6.13, and 3.5.23. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="smtpd_forbid_bare_newline_reject_code">smtpd_forbid_bare_newline_reject_code</a>
|
|
(default: 550)</b></DT><DD>
|
|
|
|
<p>
|
|
The numerical Postfix SMTP server response code when rejecting a
|
|
request with "<a href="postconf.5.html#smtpd_forbid_bare_newline">smtpd_forbid_bare_newline</a> = reject".
|
|
Specify a 5XX status code (521 to disconnect).
|
|
</p>
|
|
|
|
<p> This feature is available in Postfix ≥ 3.9, 3.8.5, 3.7.10,
|
|
3.6.14, and 3.5.24. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="smtpd_forbid_unauth_pipelining">smtpd_forbid_unauth_pipelining</a>
|
|
(default: Postfix ≥ 3.9: yes)</b></DT><DD>
|
|
|
|
<p> Disconnect remote SMTP clients that violate <a href="https://tools.ietf.org/html/rfc2920">RFC 2920</a> (or 5321)
|
|
command pipelining constraints. The server replies with "554 5.5.0
|
|
Error: SMTP protocol synchronization" and logs the unexpected remote
|
|
SMTP client input. This feature is enabled by default with Postfix
|
|
≥ 3.9. Specify "<a href="postconf.5.html#smtpd_forbid_unauth_pipelining">smtpd_forbid_unauth_pipelining</a> = no" to disable.
|
|
</p>
|
|
|
|
<p> This feature is available in Postfix ≥ 3.9, 3.8.1, 3.7.6,
|
|
3.6.10, and 3.5.20. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="smtpd_forbidden_commands">smtpd_forbidden_commands</a>
|
|
(default: CONNECT GET POST <a href="regexp_table.5.html">regexp</a>:{{/^[^A-Z]/ Bogus}})</b></DT><DD>
|
|
|
|
<p>
|
|
List of commands that cause the Postfix SMTP server to immediately
|
|
terminate the session with a 221 code. This can be used to disconnect
|
|
clients that obviously attempt to abuse the system. In addition to the
|
|
commands listed in this parameter, commands that follow the "Label:"
|
|
format of message headers will also cause a disconnect. With Postfix
|
|
versions 3.6 and earlier, the default value is "CONNECT GET POST".
|
|
</p>
|
|
|
|
<p>
|
|
This feature is available in Postfix 2.2 and later.
|
|
</p>
|
|
|
|
<p>
|
|
Support for inline regular expressions was added in Postfix version
|
|
3.7. See <a href="regexp_table.5.html">regexp_table(5)</a> for a description of the syntax and features.
|
|
</p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="smtpd_hard_error_limit">smtpd_hard_error_limit</a>
|
|
(default: normal: 20, <a href="STRESS_README.html">overload</a>: 1)</b></DT><DD>
|
|
|
|
<p>
|
|
The maximal number of errors a remote SMTP client is allowed to
|
|
make without delivering mail. The Postfix SMTP server disconnects
|
|
when the limit is reached. Normally the default limit is 20, but
|
|
it changes under overload to just 1. With Postfix 2.5 and earlier,
|
|
the SMTP server always allows up to 20 errors by default.
|
|
Valid values are greater than zero.
|
|
|
|
</p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="smtpd_helo_required">smtpd_helo_required</a>
|
|
(default: no)</b></DT><DD>
|
|
|
|
<p>
|
|
Require that a remote SMTP client introduces itself with the HELO
|
|
or EHLO command before sending the MAIL command or other commands
|
|
that require EHLO negotiation.
|
|
</p>
|
|
|
|
<p>
|
|
Example:
|
|
</p>
|
|
|
|
<pre>
|
|
<a href="postconf.5.html#smtpd_helo_required">smtpd_helo_required</a> = yes
|
|
</pre>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="smtpd_helo_restrictions">smtpd_helo_restrictions</a>
|
|
(default: empty)</b></DT><DD>
|
|
|
|
<p>
|
|
Optional restrictions that the Postfix SMTP server applies in the
|
|
context of a client HELO command.
|
|
See <a href="SMTPD_ACCESS_README.html">SMTPD_ACCESS_README</a>, section "Delayed evaluation of SMTP access
|
|
restriction lists" for a discussion of evaluation context and time.
|
|
</p>
|
|
|
|
<p>
|
|
The default is to permit everything.
|
|
</p>
|
|
|
|
<p> Note: specify "<a href="postconf.5.html#smtpd_helo_required">smtpd_helo_required</a> = yes" to fully enforce this
|
|
restriction (without "<a href="postconf.5.html#smtpd_helo_required">smtpd_helo_required</a> = yes", a client can
|
|
simply skip <a href="postconf.5.html#smtpd_helo_restrictions">smtpd_helo_restrictions</a> by not sending HELO or EHLO).
|
|
</p>
|
|
|
|
<p>
|
|
Specify a list of restrictions, separated by commas and/or whitespace.
|
|
Continue long lines by starting the next line with whitespace.
|
|
Restrictions are applied in the order as specified; the first
|
|
restriction that matches wins.
|
|
</p>
|
|
|
|
<p>
|
|
The following restrictions are specific to the hostname information
|
|
received with the HELO or EHLO command.
|
|
</p>
|
|
|
|
<dl>
|
|
|
|
<dt><b><a name="check_helo_access">check_helo_access</a> <i><a href="DATABASE_README.html">type:table</a></i></b></dt>
|
|
|
|
<dd>Search the specified <a href="access.5.html">access(5)</a> database for the HELO or EHLO
|
|
hostname, and execute the corresponding action.
|
|
Note: specify "<a href="postconf.5.html#smtpd_helo_required">smtpd_helo_required</a> = yes" to fully enforce this
|
|
restriction (without "<a href="postconf.5.html#smtpd_helo_required">smtpd_helo_required</a> = yes", a client can
|
|
simply skip <a href="postconf.5.html#check_helo_access">check_helo_access</a> by not sending HELO or EHLO). </dd>
|
|
|
|
<dt><b><a name="check_helo_a_access">check_helo_a_access</a> <i><a href="DATABASE_README.html">type:table</a></i></b></dt>
|
|
|
|
<dd>Search the specified <a href="access.5.html">access(5)</a> database for the IP addresses for
|
|
the HELO or EHLO hostname, and execute the corresponding action.
|
|
Note 1: a result of "OK" is not allowed for safety reasons. Instead,
|
|
use DUNNO in order to exclude specific hosts from denylists. Note
|
|
2: specify "<a href="postconf.5.html#smtpd_helo_required">smtpd_helo_required</a> = yes" to fully enforce this
|
|
restriction (without "<a href="postconf.5.html#smtpd_helo_required">smtpd_helo_required</a> = yes", a client can
|
|
simply skip check_helo_a_access by not sending HELO or EHLO). This
|
|
feature is available in Postfix 3.0 and later.
|
|
</dd>
|
|
|
|
<dt><b><a name="check_helo_mx_access">check_helo_mx_access</a> <i><a href="DATABASE_README.html">type:table</a></i></b></dt>
|
|
|
|
<dd>Search the specified <a href="access.5.html">access(5)</a> database for the MX hosts for
|
|
the HELO or EHLO hostname, and execute the corresponding action.
|
|
If no MX record is found, look up A or AAAA records, just like the
|
|
Postfix SMTP client would.
|
|
Note 1: a result of "OK" is not allowed for safety reasons. Instead,
|
|
use DUNNO in order to exclude specific hosts from denylists. Note
|
|
2: specify "<a href="postconf.5.html#smtpd_helo_required">smtpd_helo_required</a> = yes" to fully enforce this
|
|
restriction (without "<a href="postconf.5.html#smtpd_helo_required">smtpd_helo_required</a> = yes", a client can
|
|
simply skip <a href="postconf.5.html#check_helo_mx_access">check_helo_mx_access</a> by not sending HELO or EHLO). This
|
|
feature is available in Postfix 2.1 and later.
|
|
</dd>
|
|
|
|
<dt><b><a name="check_helo_ns_access">check_helo_ns_access</a> <i><a href="DATABASE_README.html">type:table</a></i></b></dt>
|
|
|
|
<dd>Search the specified <a href="access.5.html">access(5)</a> database for the DNS servers
|
|
for the HELO or EHLO hostname, and execute the corresponding action.
|
|
Note 1: a result of "OK" is not allowed for safety reasons. Instead,
|
|
use DUNNO in order to exclude specific hosts from denylists. Note
|
|
2: specify "<a href="postconf.5.html#smtpd_helo_required">smtpd_helo_required</a> = yes" to fully enforce this
|
|
restriction (without "<a href="postconf.5.html#smtpd_helo_required">smtpd_helo_required</a> = yes", a client can
|
|
simply skip <a href="postconf.5.html#check_helo_ns_access">check_helo_ns_access</a> by not sending HELO or EHLO). This
|
|
feature is available in Postfix 2.1 and later.
|
|
</dd>
|
|
|
|
<dt><b><a name="reject_invalid_helo_hostname">reject_invalid_helo_hostname</a></b> (with Postfix < 2.3: reject_invalid_hostname)</dt>
|
|
|
|
<dd>Reject the request when the HELO or EHLO hostname is malformed.
|
|
Note: specify "<a href="postconf.5.html#smtpd_helo_required">smtpd_helo_required</a> = yes" to fully enforce
|
|
this restriction (without "<a href="postconf.5.html#smtpd_helo_required">smtpd_helo_required</a> = yes", a client can simply
|
|
skip <a href="postconf.5.html#reject_invalid_helo_hostname">reject_invalid_helo_hostname</a> by not sending HELO or EHLO).
|
|
<br> The <a href="postconf.5.html#invalid_hostname_reject_code">invalid_hostname_reject_code</a> specifies the response code
|
|
for rejected requests (default: 501).</dd>
|
|
|
|
<dt><b><a name="reject_non_fqdn_helo_hostname">reject_non_fqdn_helo_hostname</a></b> (with Postfix < 2.3: reject_non_fqdn_hostname)</dt>
|
|
|
|
<dd>Reject the request when the HELO or EHLO hostname is not in
|
|
fully-qualified domain or address literal form, as required by the
|
|
RFC. Note: specify
|
|
"<a href="postconf.5.html#smtpd_helo_required">smtpd_helo_required</a> = yes" to fully enforce this restriction
|
|
(without "<a href="postconf.5.html#smtpd_helo_required">smtpd_helo_required</a> = yes", a client can simply skip
|
|
<a href="postconf.5.html#reject_non_fqdn_helo_hostname">reject_non_fqdn_helo_hostname</a> by not sending HELO or EHLO). <br>
|
|
The <a href="postconf.5.html#non_fqdn_reject_code">non_fqdn_reject_code</a> parameter specifies the response code for
|
|
rejected requests (default: 504).</dd>
|
|
|
|
<dt><b><a name="reject_rhsbl_helo">reject_rhsbl_helo <i>rbl_domain=d.d.d.d</i></a></b></dt>
|
|
|
|
<dd>Reject the request when the HELO or EHLO hostname is
|
|
listed with the A record "<i>d.d.d.d</i>" under <i>rbl_domain</i>
|
|
(Postfix version 2.1 and later only). Each "<i>d</i>" is a number,
|
|
or a pattern inside "[]" that contains one or more ";"-separated
|
|
numbers or number..number ranges (Postfix version 2.8 and later).
|
|
If no "<i>=d.d.d.d</i>" is
|
|
specified, reject the request when the HELO or EHLO hostname is
|
|
listed with any A record under <i>rbl_domain</i>. See the
|
|
<a href="postconf.5.html#reject_rbl_client">reject_rbl_client</a> description for additional RBL related configuration
|
|
parameters. Note: specify "<a href="postconf.5.html#smtpd_helo_required">smtpd_helo_required</a> = yes" to fully
|
|
enforce this restriction (without "<a href="postconf.5.html#smtpd_helo_required">smtpd_helo_required</a> = yes", a
|
|
client can simply skip <a href="postconf.5.html#reject_rhsbl_helo">reject_rhsbl_helo</a> by not sending HELO or
|
|
EHLO). This feature is available in Postfix 2.0
|
|
and later. </dd>
|
|
|
|
<dt><b><a name="reject_unknown_helo_hostname">reject_unknown_helo_hostname</a></b> (with Postfix < 2.3: reject_unknown_hostname)</dt>
|
|
|
|
<dd>Reject the request when the HELO or EHLO hostname has no DNS A
|
|
or MX record. <br> The reply is specified with the
|
|
<a href="postconf.5.html#unknown_hostname_reject_code">unknown_hostname_reject_code</a> parameter (default: 450) or
|
|
<a href="postconf.5.html#unknown_helo_hostname_tempfail_action">unknown_helo_hostname_tempfail_action</a> (default: <a href="postconf.5.html#defer_if_permit">defer_if_permit</a>).
|
|
See the respective parameter descriptions for details. <br>
|
|
Note: specify "<a href="postconf.5.html#smtpd_helo_required">smtpd_helo_required</a> = yes" to fully
|
|
enforce this restriction (without "<a href="postconf.5.html#smtpd_helo_required">smtpd_helo_required</a> = yes", a
|
|
client can simply skip <a href="postconf.5.html#reject_unknown_helo_hostname">reject_unknown_helo_hostname</a> by not sending
|
|
HELO or EHLO). </dd>
|
|
|
|
</dl>
|
|
|
|
<p>
|
|
Other restrictions that are valid in this context:
|
|
</p>
|
|
|
|
<ul>
|
|
|
|
<li> <a href="#generic">Generic</a> restrictions that can be used
|
|
in any SMTP command context, described under <a href="postconf.5.html#smtpd_client_restrictions">smtpd_client_restrictions</a>.
|
|
|
|
<li> Client hostname or network address specific restrictions
|
|
described under <a href="postconf.5.html#smtpd_client_restrictions">smtpd_client_restrictions</a>.
|
|
|
|
<li> SMTP command specific restrictions described under
|
|
<a href="postconf.5.html#smtpd_sender_restrictions">smtpd_sender_restrictions</a> or <a href="postconf.5.html#smtpd_recipient_restrictions">smtpd_recipient_restrictions</a>. When
|
|
sender or recipient restrictions are listed under <a href="postconf.5.html#smtpd_helo_restrictions">smtpd_helo_restrictions</a>,
|
|
they have effect only with "<a href="postconf.5.html#smtpd_delay_reject">smtpd_delay_reject</a> = yes", so that
|
|
$<a href="postconf.5.html#smtpd_helo_restrictions">smtpd_helo_restrictions</a> is evaluated at the time of the RCPT TO
|
|
command.
|
|
|
|
</ul>
|
|
|
|
<p>
|
|
Examples:
|
|
</p>
|
|
|
|
<pre>
|
|
<a href="postconf.5.html#smtpd_helo_restrictions">smtpd_helo_restrictions</a> = <a href="postconf.5.html#permit_mynetworks">permit_mynetworks</a>, <a href="postconf.5.html#reject_invalid_helo_hostname">reject_invalid_helo_hostname</a>
|
|
<a href="postconf.5.html#smtpd_helo_restrictions">smtpd_helo_restrictions</a> = <a href="postconf.5.html#permit_mynetworks">permit_mynetworks</a>, <a href="postconf.5.html#reject_unknown_helo_hostname">reject_unknown_helo_hostname</a>
|
|
</pre>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="smtpd_hide_client_session">smtpd_hide_client_session</a>
|
|
(default: no)</b></DT><DD>
|
|
|
|
<p> Do not include SMTP client session information in the Postfix
|
|
SMTP server's Received: message header. </p>
|
|
|
|
<ul>
|
|
|
|
<li> <p> The default setting, "<a href="postconf.5.html#smtpd_hide_client_session">smtpd_hide_client_session</a> = no",
|
|
must be used for the port 25 MTA service. It provides information
|
|
that is required by <a href="https://tools.ietf.org/html/rfc5321">RFC 5321</a>. </p>
|
|
|
|
<li> <p> The setting "<a href="postconf.5.html#smtpd_hide_client_session">smtpd_hide_client_session</a> = yes" may be used
|
|
for the port 587 and 465 MUA services. This hides the SMTP client
|
|
hostname and IP address, TLS session details, SASL login details,
|
|
and SMTP protocol details. </p>
|
|
|
|
</ul>
|
|
|
|
<p> Depending on the number of recipients, a redacted Received:
|
|
header has one of the following forms: </p>
|
|
|
|
<blockquote>
|
|
<pre>
|
|
Received: by mail.example.com (Postfix) id postfix-queue-id
|
|
for <user@example.com>; Day, dd Mon yyyy hh:mm:ss tz-offset (zone)
|
|
<br>
|
|
Received: by mail.example.com (Postfix) id postfix-queue-id
|
|
Day, dd Mon yyyy hh:mm:ss tz-offset (zone)
|
|
</pre>
|
|
</blockquote>
|
|
|
|
<p> The redacted form hides that a message was received with SMTP,
|
|
and therefore it does not need to provide the information required by
|
|
<a href="https://tools.ietf.org/html/rfc5321">RFC 5321</a>. The form does still meet <a href="https://tools.ietf.org/html/rfc5322">RFC 5322</a> requirements. </p>
|
|
|
|
<p> This feature is available in Postfix ≥ 3.10. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="smtpd_history_flush_threshold">smtpd_history_flush_threshold</a>
|
|
(default: 100)</b></DT><DD>
|
|
|
|
<p>
|
|
The maximal number of lines in the Postfix SMTP server command history
|
|
before it is flushed upon receipt of EHLO, RSET, or end of DATA.
|
|
</p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="smtpd_junk_command_limit">smtpd_junk_command_limit</a>
|
|
(default: normal: 100, <a href="STRESS_README.html">overload</a>: 1)</b></DT><DD>
|
|
|
|
<p>
|
|
The number of junk commands (NOOP, VRFY, ETRN or RSET) that a remote
|
|
SMTP client can send before the Postfix SMTP server starts to
|
|
increment the error counter with each junk command. The junk
|
|
command count is reset after mail is delivered. See also the
|
|
<a href="postconf.5.html#smtpd_error_sleep_time">smtpd_error_sleep_time</a> and <a href="postconf.5.html#smtpd_soft_error_limit">smtpd_soft_error_limit</a> configuration
|
|
parameters. Normally the default limit is 100, but it changes under
|
|
overload to just 1. With Postfix 2.5 and earlier, the SMTP server
|
|
always allows up to 100 junk commands by default. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="smtpd_log_access_permit_actions">smtpd_log_access_permit_actions</a>
|
|
(default: empty)</b></DT><DD>
|
|
|
|
<p> Enable logging of the named "permit" actions in SMTP server
|
|
access lists (by default, the SMTP server logs "reject" actions but
|
|
not "permit" actions). This feature does not affect conditional
|
|
actions such as "<a href="postconf.5.html#defer_if_permit">defer_if_permit</a>". </p>
|
|
|
|
<p> Specify a list of "permit" action names, "/file/name" or
|
|
"<a href="DATABASE_README.html">type:table</a>" patterns, separated by commas and/or whitespace. The
|
|
list is matched left to right, and the search stops on the first
|
|
match. A "/file/name" pattern is replaced by its contents; a
|
|
"<a href="DATABASE_README.html">type:table</a>" lookup table is matched when a name matches a lookup
|
|
key (the lookup result is ignored). Continue long lines by starting
|
|
the next line with whitespace. Specify "!pattern" to exclude a name
|
|
from the list. </p>
|
|
|
|
<p> Examples: </p>
|
|
|
|
<pre>
|
|
/etc/postfix/<a href="postconf.5.html">main.cf</a>:
|
|
# Log all "permit" actions.
|
|
<a href="postconf.5.html#smtpd_log_access_permit_actions">smtpd_log_access_permit_actions</a> = <a href="DATABASE_README.html#types">static</a>:all
|
|
</pre>
|
|
|
|
<pre>
|
|
/etc/postfix/<a href="postconf.5.html">main.cf</a>:
|
|
# Log "<a href="postconf.5.html#permit_dnswl_client">permit_dnswl_client</a>" only.
|
|
<a href="postconf.5.html#smtpd_log_access_permit_actions">smtpd_log_access_permit_actions</a> = <a href="postconf.5.html#permit_dnswl_client">permit_dnswl_client</a>
|
|
</pre>
|
|
|
|
<p> This feature is available in Postfix 2.10 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="smtpd_milter_maps">smtpd_milter_maps</a>
|
|
(default: empty)</b></DT><DD>
|
|
|
|
<p> Lookup tables with Milter settings per remote SMTP client IP
|
|
address. The lookup result overrides the <a href="postconf.5.html#smtpd_milters">smtpd_milters</a> setting,
|
|
and has the same syntax. </p>
|
|
|
|
<p> Note: lookup tables cannot return empty responses. Specify a
|
|
lookup result of DISABLE (case does not matter) to indicate that
|
|
Milter support should be disabled. </p>
|
|
|
|
<p> Example to disable Milters for local clients: </p>
|
|
|
|
<pre>
|
|
/etc/postfix/<a href="postconf.5.html">main.cf</a>:
|
|
<a href="postconf.5.html#smtpd_milter_maps">smtpd_milter_maps</a> = <a href="cidr_table.5.html">cidr</a>:/etc/postfix/smtpd_milter_map
|
|
<a href="postconf.5.html#smtpd_milters">smtpd_milters</a> = inet:host:port, { inet:host:port, ... }, ...
|
|
</pre>
|
|
|
|
<pre>
|
|
/etc/postfix/smtpd_milter_map:
|
|
# Disable Milters for local clients.
|
|
127.0.0.0/8 DISABLE
|
|
192.168.0.0/16 DISABLE
|
|
::/64 DISABLE
|
|
2001:db8::/32 DISABLE
|
|
</pre>
|
|
|
|
<p> This feature is available in Postfix 3.2 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="smtpd_milters">smtpd_milters</a>
|
|
(default: empty)</b></DT><DD>
|
|
|
|
<p> A list of Milter (mail filter) applications for new mail that
|
|
arrives via the Postfix <a href="smtpd.8.html">smtpd(8)</a> server. Specify space or comma as
|
|
separator. See the <a href="MILTER_README.html">MILTER_README</a> document for details. </p>
|
|
|
|
<p> This feature is available in Postfix 2.3 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="smtpd_min_data_rate">smtpd_min_data_rate</a>
|
|
(default: 500)</b></DT><DD>
|
|
|
|
<p> The minimum plaintext data transfer rate in bytes/second for
|
|
DATA and BDAT requests, when deadlines are enabled with
|
|
<a href="postconf.5.html#smtpd_per_request_deadline">smtpd_per_request_deadline</a>. After a read operation transfers N
|
|
plaintext message bytes (possibly after TLS decryption), and after
|
|
the DATA or BDAT request deadline is decremented by the elapsed
|
|
time of that read operation, the DATA or BDAT request deadline is
|
|
incremented by N/smtpd_min_data_rate seconds. However, the deadline
|
|
will never be incremented beyond the time limit specified with
|
|
<a href="postconf.5.html#smtpd_timeout">smtpd_timeout</a>. </p>
|
|
|
|
<p> This feature is available in Postfix 3.7 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="smtpd_noop_commands">smtpd_noop_commands</a>
|
|
(default: empty)</b></DT><DD>
|
|
|
|
<p>
|
|
List of commands that the Postfix SMTP server replies to with "250
|
|
Ok", without doing any syntax checks and without changing state.
|
|
This list overrides any commands built into the Postfix SMTP server.
|
|
</p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="smtpd_null_access_lookup_key">smtpd_null_access_lookup_key</a>
|
|
(default: <>)</b></DT><DD>
|
|
|
|
<p>
|
|
The lookup key to be used in SMTP <a href="access.5.html">access(5)</a> tables instead of the
|
|
null sender address.
|
|
</p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="smtpd_peername_lookup">smtpd_peername_lookup</a>
|
|
(default: yes)</b></DT><DD>
|
|
|
|
<p> Attempt to look up the remote SMTP client hostname, and verify that
|
|
the name matches the client IP address. A client name is set to
|
|
"unknown" when it cannot be looked up or verified, or when name
|
|
lookup is disabled. Turning off name lookup reduces delays due to
|
|
DNS lookup and increases the maximal inbound delivery rate. </p>
|
|
|
|
<p> This feature is available in Postfix 2.3 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="smtpd_per_record_deadline">smtpd_per_record_deadline</a>
|
|
(default: normal: no, <a href="STRESS_README.html">overload</a>: yes)</b></DT><DD>
|
|
|
|
<p> Change the behavior of the <a href="postconf.5.html#smtpd_timeout">smtpd_timeout</a> and <a href="postconf.5.html#smtpd_starttls_timeout">smtpd_starttls_timeout</a>
|
|
time limits, from a
|
|
time limit per read or write system call, to a time limit to send
|
|
or receive a complete record (an SMTP command line, SMTP response
|
|
line, SMTP message content line, or TLS protocol message). This
|
|
limits the impact from hostile peers that trickle data one byte at
|
|
a time. </p>
|
|
|
|
<p> Note: when per-record deadlines are enabled, a short timeout
|
|
may cause problems with TLS over very slow network connections.
|
|
The reasons are that a TLS protocol message can be up to 16 kbytes
|
|
long (with TLSv1), and that an entire TLS protocol message must be
|
|
sent or received within the per-record deadline. </p>
|
|
|
|
<p> This feature is available in Postfix 2.9-3.6. With older
|
|
Postfix releases, the behavior is as if this parameter is set to
|
|
"no". Postfix 3.7 and later use <a href="postconf.5.html#smtpd_per_request_deadline">smtpd_per_request_deadline</a>. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="smtpd_per_request_deadline">smtpd_per_request_deadline</a>
|
|
(default: normal: no, <a href="STRESS_README.html">overload</a>: yes)</b></DT><DD>
|
|
|
|
<p> Change the behavior of the <a href="postconf.5.html#smtpd_timeout">smtpd_timeout</a> and <a href="postconf.5.html#smtpd_starttls_timeout">smtpd_starttls_timeout</a>
|
|
time limits, from a time limit per plaintext or TLS read or write
|
|
call, to a combined time limit for receiving a complete SMTP request
|
|
and for sending a complete SMTP response. The deadline limits only
|
|
the time spent waiting for plaintext or TLS read or write calls,
|
|
not time spent elsewhere. The per-request deadline limits the impact
|
|
from hostile peers that trickle data one byte at a time. </p>
|
|
|
|
<p> See <a href="postconf.5.html#smtpd_min_data_rate">smtpd_min_data_rate</a> for how the per-request deadline is
|
|
managed during the DATA and BDAT phase. </p>
|
|
|
|
<p> Note: when per-request deadlines are enabled, a short time limit
|
|
may cause problems with TLS over very slow network connections. The
|
|
reason is that a TLS protocol message can be up to 16 kbytes long
|
|
(with TLSv1), and that an entire TLS protocol message must be
|
|
transferred within the per-request deadline. </p>
|
|
|
|
<p> This feature is available in Postfix 3.7 and later. A weaker
|
|
feature, called <a href="postconf.5.html#smtpd_per_record_deadline">smtpd_per_record_deadline</a>, is available with Postfix
|
|
2.9-3.6. With older Postfix releases, the behavior is as if this
|
|
parameter is set to "no". </p>
|
|
|
|
<p> This feature is available in Postfix 3.7 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="smtpd_policy_service_default_action">smtpd_policy_service_default_action</a>
|
|
(default: 451 4.3.5 Server configuration problem)</b></DT><DD>
|
|
|
|
<p> The default action when an SMTPD policy service request fails.
|
|
Specify "DUNNO" to behave as if the failed SMTPD policy service
|
|
request was not sent, and to continue processing other access
|
|
restrictions, if any. </p>
|
|
|
|
<p> Limitations: </p>
|
|
|
|
<ul>
|
|
|
|
<li> <p> This parameter may specify any value that would be a valid
|
|
SMTPD policy server response (or <a href="access.5.html">access(5)</a> map lookup result). An
|
|
<a href="access.5.html">access(5)</a> map or policy server in this parameter value may need to
|
|
be declared in advance with a restriction_class setting. </p>
|
|
|
|
<li> <p> If the specified action invokes another <a href="postconf.5.html#check_policy_service">check_policy_service</a>
|
|
request, that request will have the built-in default action. </p>
|
|
|
|
</ul>
|
|
|
|
<p> This feature is available in Postfix 3.0 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="smtpd_policy_service_max_idle">smtpd_policy_service_max_idle</a>
|
|
(default: 300s)</b></DT><DD>
|
|
|
|
<p>
|
|
The time after which an idle SMTPD policy service connection is
|
|
closed.
|
|
</p>
|
|
|
|
<p> Specify a non-zero time value (an integral value plus an optional
|
|
one-letter suffix that specifies the time unit). Time units: s
|
|
(seconds), m (minutes), h (hours), d (days), w (weeks).
|
|
The default time unit is s (seconds). </p>
|
|
|
|
<p>
|
|
This feature is available in Postfix 2.1 and later.
|
|
</p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="smtpd_policy_service_max_ttl">smtpd_policy_service_max_ttl</a>
|
|
(default: 1000s)</b></DT><DD>
|
|
|
|
<p>
|
|
The time after which an active SMTPD policy service connection is
|
|
closed.
|
|
</p>
|
|
|
|
<p> Specify a non-zero time value (an integral value plus an optional
|
|
one-letter suffix that specifies the time unit). Time units: s
|
|
(seconds), m (minutes), h (hours), d (days), w (weeks).
|
|
The default time unit is s (seconds). </p>
|
|
|
|
<p>
|
|
This feature is available in Postfix 2.1 and later.
|
|
</p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="smtpd_policy_service_policy_context">smtpd_policy_service_policy_context</a>
|
|
(default: empty)</b></DT><DD>
|
|
|
|
<p> Optional information that the Postfix SMTP server specifies in
|
|
the "policy_context" attribute of a policy service request (originally,
|
|
to share the same service endpoint among multiple <a href="postconf.5.html#check_policy_service">check_policy_service</a>
|
|
clients). </p>
|
|
|
|
<p>
|
|
This feature is available in Postfix 3.1 and later.
|
|
</p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="smtpd_policy_service_request_limit">smtpd_policy_service_request_limit</a>
|
|
(default: 0)</b></DT><DD>
|
|
|
|
<p>
|
|
The maximal number of requests per SMTPD policy service connection,
|
|
or zero (no limit). Once a connection reaches this limit, the
|
|
connection is closed and the next request will be sent over a new
|
|
connection. This is a workaround to avoid error-recovery delays
|
|
with policy servers that cannot maintain a persistent connection.
|
|
</p>
|
|
|
|
<p>
|
|
This feature is available in Postfix 3.0 and later.
|
|
</p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="smtpd_policy_service_retry_delay">smtpd_policy_service_retry_delay</a>
|
|
(default: 1s)</b></DT><DD>
|
|
|
|
<p> The delay between attempts to resend a failed SMTPD policy
|
|
service request. Specify a value greater than zero. </p>
|
|
|
|
<p> Specify a non-zero time value (an integral value plus an optional
|
|
one-letter suffix that specifies the time unit). Time units: s
|
|
(seconds), m (minutes), h (hours), d (days), w (weeks).
|
|
The default time unit is s (seconds). </p>
|
|
|
|
<p> This feature is available in Postfix 3.0 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="smtpd_policy_service_timeout">smtpd_policy_service_timeout</a>
|
|
(default: 100s)</b></DT><DD>
|
|
|
|
<p>
|
|
The time limit for connecting to, writing to, or receiving from a
|
|
delegated SMTPD policy server.
|
|
</p>
|
|
|
|
<p> Specify a non-zero time value (an integral value plus an optional
|
|
one-letter suffix that specifies the time unit). Time units: s
|
|
(seconds), m (minutes), h (hours), d (days), w (weeks).
|
|
The default time unit is s (seconds). </p>
|
|
|
|
<p>
|
|
This feature is available in Postfix 2.1 and later.
|
|
</p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="smtpd_policy_service_try_limit">smtpd_policy_service_try_limit</a>
|
|
(default: 2)</b></DT><DD>
|
|
|
|
<p> The maximal number of attempts to send an SMTPD policy service
|
|
request before giving up. Specify a value greater than zero. </p>
|
|
|
|
<p> This feature is available in Postfix 3.0 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="smtpd_proxy_ehlo">smtpd_proxy_ehlo</a>
|
|
(default: $<a href="postconf.5.html#myhostname">myhostname</a>)</b></DT><DD>
|
|
|
|
<p>
|
|
How the Postfix SMTP server announces itself to the proxy filter.
|
|
By default, the Postfix hostname is used.
|
|
</p>
|
|
|
|
<p>
|
|
This feature is available in Postfix 2.1 and later.
|
|
</p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="smtpd_proxy_filter">smtpd_proxy_filter</a>
|
|
(default: empty)</b></DT><DD>
|
|
|
|
<p> The hostname and TCP port of the mail filtering proxy server.
|
|
The proxy receives all mail from the Postfix SMTP server, and is
|
|
supposed to give the result to another Postfix SMTP server process.
|
|
</p>
|
|
|
|
<p> Specify "host:port" or "inet:host:port" for a TCP endpoint, or
|
|
"unix:pathname" for a UNIX-domain endpoint. The host can be specified
|
|
as an IP address or as a symbolic name; no MX lookups are done.
|
|
When no "host" or "host:" is specified, the local machine is
|
|
assumed. Pathname interpretation is relative to the Postfix queue
|
|
directory. </p>
|
|
|
|
<p> This feature is available in Postfix 2.1 and later. </p>
|
|
|
|
<p> The "inet:" and "unix:" prefixes are available in Postfix 2.3
|
|
and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="smtpd_proxy_options">smtpd_proxy_options</a>
|
|
(default: empty)</b></DT><DD>
|
|
|
|
<p>
|
|
List of options that control how the Postfix SMTP server
|
|
communicates with a before-queue content filter. Specify zero or
|
|
more of the following, separated by comma or whitespace. </p>
|
|
|
|
<dl>
|
|
|
|
<dt><b>speed_adjust</b></dt>
|
|
|
|
<dd> <p> Do not connect to a before-queue content filter until an entire
|
|
message has been received. This reduces the number of simultaneous
|
|
before-queue content filter processes. </p>
|
|
|
|
<p> NOTE 1: A filter must not <i>selectively</i> reject recipients
|
|
of a multi-recipient message. Rejecting all recipients is OK, as
|
|
is accepting all recipients. </p>
|
|
|
|
<p> NOTE 2: This feature increases the minimum amount of free queue
|
|
space by $<a href="postconf.5.html#message_size_limit">message_size_limit</a>. The extra space is needed to save the
|
|
message to a temporary file. </p> </dd>
|
|
|
|
</dl>
|
|
|
|
<p>
|
|
This feature is available in Postfix 2.7 and later.
|
|
</p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="smtpd_proxy_timeout">smtpd_proxy_timeout</a>
|
|
(default: 100s)</b></DT><DD>
|
|
|
|
<p>
|
|
The time limit for connecting to a proxy filter and for sending or
|
|
receiving information. When a connection fails the client gets a
|
|
generic error message while more detailed information is logged to
|
|
the maillog file.
|
|
</p>
|
|
|
|
<p> Specify a non-zero time value (an integral value plus an optional
|
|
one-letter suffix that specifies the time unit). Time units: s
|
|
(seconds), m (minutes), h (hours), d (days), w (weeks).
|
|
The default time unit is s (seconds). </p>
|
|
|
|
<p>
|
|
This feature is available in Postfix 2.1 and later.
|
|
</p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="smtpd_recipient_limit">smtpd_recipient_limit</a>
|
|
(default: 1000)</b></DT><DD>
|
|
|
|
<p>
|
|
The maximal number of recipients that the Postfix SMTP server
|
|
accepts per message delivery request.
|
|
</p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="smtpd_recipient_overshoot_limit">smtpd_recipient_overshoot_limit</a>
|
|
(default: 1000)</b></DT><DD>
|
|
|
|
<p> The number of recipients that a remote SMTP client can send in
|
|
excess of the limit specified with $<a href="postconf.5.html#smtpd_recipient_limit">smtpd_recipient_limit</a>, before
|
|
the Postfix SMTP server increments the per-session error count
|
|
for each excess recipient. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="smtpd_recipient_restrictions">smtpd_recipient_restrictions</a>
|
|
(default: see "postconf -d" output)</b></DT><DD>
|
|
|
|
<p>
|
|
Optional restrictions that the Postfix SMTP server applies in the
|
|
context of a client RCPT TO command, after <a href="postconf.5.html#smtpd_relay_restrictions">smtpd_relay_restrictions</a>.
|
|
See <a href="SMTPD_ACCESS_README.html">SMTPD_ACCESS_README</a>, section "Delayed evaluation of SMTP access
|
|
restriction lists" for a discussion of evaluation context and time.
|
|
</p>
|
|
|
|
<p> With Postfix versions before 2.10, the rules for relay permission
|
|
and spam blocking were combined under <a href="postconf.5.html#smtpd_recipient_restrictions">smtpd_recipient_restrictions</a>,
|
|
resulting in error-prone configuration. As of Postfix 2.10, relay
|
|
permission rules are preferably implemented with <a href="postconf.5.html#smtpd_relay_restrictions">smtpd_relay_restrictions</a>,
|
|
so that a permissive spam blocking policy under
|
|
<a href="postconf.5.html#smtpd_recipient_restrictions">smtpd_recipient_restrictions</a> will no longer result in a permissive
|
|
mail relay policy. </p>
|
|
|
|
<p> For backwards compatibility, sites that migrate from Postfix
|
|
versions before 2.10 can set <a href="postconf.5.html#smtpd_relay_restrictions">smtpd_relay_restrictions</a> to the empty
|
|
value, and use <a href="postconf.5.html#smtpd_recipient_restrictions">smtpd_recipient_restrictions</a> exactly as before. </p>
|
|
|
|
<p>
|
|
IMPORTANT: Either the <a href="postconf.5.html#smtpd_relay_restrictions">smtpd_relay_restrictions</a> or the
|
|
<a href="postconf.5.html#smtpd_recipient_restrictions">smtpd_recipient_restrictions</a> parameter must specify
|
|
at least one of the following restrictions. Otherwise Postfix will
|
|
refuse to receive mail:
|
|
</p>
|
|
|
|
<blockquote>
|
|
<pre>
|
|
reject, <a href="postconf.5.html#reject_unauth_destination">reject_unauth_destination</a>
|
|
</pre>
|
|
</blockquote>
|
|
|
|
<blockquote>
|
|
<pre>
|
|
defer, <a href="postconf.5.html#defer_if_permit">defer_if_permit</a>, <a href="postconf.5.html#defer_unauth_destination">defer_unauth_destination</a>
|
|
</pre>
|
|
</blockquote>
|
|
|
|
<p>
|
|
Specify a list of restrictions, separated by commas and/or whitespace.
|
|
Continue long lines by starting the next line with whitespace.
|
|
Restrictions are applied in the order as specified; the first
|
|
restriction that matches wins.
|
|
</p>
|
|
|
|
<p>
|
|
The following restrictions are specific to the recipient address
|
|
that is received with the RCPT TO command.
|
|
</p>
|
|
|
|
<dl>
|
|
|
|
<dt><b><a name="check_recipient_access">check_recipient_access</a> <i><a href="DATABASE_README.html">type:table</a></i></b></dt>
|
|
|
|
<dd>Search the specified <a href="access.5.html">access(5)</a> database for the resolved RCPT
|
|
TO address, and execute the corresponding action. </dd>
|
|
|
|
<dt><b><a name="check_recipient_a_access">check_recipient_a_access</a> <i><a href="DATABASE_README.html">type:table</a></i></b></dt>
|
|
|
|
<dd>Search the specified <a href="access.5.html">access(5)</a> database for the IP addresses for
|
|
the RCPT TO domain, and execute the corresponding action. Note:
|
|
a result of "OK" is not allowed for safety reasons. Instead, use
|
|
DUNNO in order to exclude specific hosts from denylists. This
|
|
feature is available in Postfix 3.0 and later. </dd>
|
|
|
|
<dt><b><a name="check_recipient_mx_access">check_recipient_mx_access</a> <i><a href="DATABASE_README.html">type:table</a></i></b></dt>
|
|
|
|
<dd>Search the specified <a href="access.5.html">access(5)</a> database for the MX hosts for
|
|
the RCPT TO domain, and execute the corresponding action. If no
|
|
MX record is found, look up A or AAAA records, just like the Postfix
|
|
SMTP client would. Note:
|
|
a result of "OK" is not allowed for safety reasons. Instead, use
|
|
DUNNO in order to exclude specific hosts from denylists. This
|
|
feature is available in Postfix 2.1 and later. </dd>
|
|
|
|
<dt><b><a name="check_recipient_ns_access">check_recipient_ns_access</a> <i><a href="DATABASE_README.html">type:table</a></i></b></dt>
|
|
|
|
<dd>Search the specified <a href="access.5.html">access(5)</a> database for the DNS servers
|
|
for the RCPT TO domain, and execute the corresponding action.
|
|
Note: a result of "OK" is not allowed for safety reasons. Instead,
|
|
use DUNNO in order to exclude specific hosts from denylists. This
|
|
feature is available in Postfix 2.1 and later. </dd>
|
|
|
|
<dt><b><a name="permit_auth_destination">permit_auth_destination</a></b></dt>
|
|
|
|
<dd>Permit the request when one of the following is true:
|
|
|
|
<ul>
|
|
|
|
<li> Postfix is a mail forwarder: the resolved RCPT TO domain matches
|
|
$<a href="postconf.5.html#relay_domains">relay_domains</a> or a subdomain thereof, and the address contains no
|
|
sender-specified routing (user@elsewhere@domain),
|
|
|
|
<li> Postfix is the final destination: the resolved RCPT TO domain
|
|
matches $<a href="postconf.5.html#mydestination">mydestination</a>, $<a href="postconf.5.html#inet_interfaces">inet_interfaces</a>, $<a href="postconf.5.html#proxy_interfaces">proxy_interfaces</a>,
|
|
$<a href="postconf.5.html#virtual_alias_domains">virtual_alias_domains</a>, or $<a href="postconf.5.html#virtual_mailbox_domains">virtual_mailbox_domains</a>, and the address
|
|
contains no sender-specified routing (user@elsewhere@domain).
|
|
|
|
</ul></dd>
|
|
|
|
<dt><b><a name="permit_mx_backup">permit_mx_backup</a></b></dt>
|
|
|
|
<dd>Permit the request when the local mail system is a backup MX for
|
|
the RCPT TO domain, or when the domain is an authorized destination
|
|
(see <a href="postconf.5.html#permit_auth_destination">permit_auth_destination</a> for definition).
|
|
|
|
<ul>
|
|
|
|
<li> Safety: <a href="postconf.5.html#permit_mx_backup">permit_mx_backup</a> does not accept addresses that have
|
|
sender-specified routing information (example: user@elsewhere@domain).
|
|
|
|
<li> Safety: <a href="postconf.5.html#permit_mx_backup">permit_mx_backup</a> can be vulnerable to mis-use when
|
|
access is not restricted with <a href="postconf.5.html#permit_mx_backup_networks">permit_mx_backup_networks</a>.
|
|
|
|
<li> Safety: as of Postfix version 2.3, <a href="postconf.5.html#permit_mx_backup">permit_mx_backup</a> no longer
|
|
accepts the address when the local mail system is a primary MX for
|
|
the recipient domain. Exception: <a href="postconf.5.html#permit_mx_backup">permit_mx_backup</a> accepts the address
|
|
when it specifies an authorized destination (see <a href="postconf.5.html#permit_auth_destination">permit_auth_destination</a>
|
|
for definition).
|
|
|
|
<li> Limitation: mail may be rejected in case of a temporary DNS
|
|
lookup problem with Postfix prior to version 2.0.
|
|
|
|
</ul></dd>
|
|
|
|
<dt><b><a name="reject_non_fqdn_recipient">reject_non_fqdn_recipient</a></b></dt>
|
|
|
|
<dd>Reject the request when the RCPT TO address specifies a
|
|
domain that is not in
|
|
fully-qualified domain form, as required by the RFC. <br> The
|
|
<a href="postconf.5.html#non_fqdn_reject_code">non_fqdn_reject_code</a> parameter specifies the response code for
|
|
rejected requests (default: 504). </dd>
|
|
|
|
<dt><b><a name="reject_rhsbl_recipient">reject_rhsbl_recipient <i>rbl_domain=d.d.d.d</i></a></b></dt>
|
|
|
|
<dd>Reject the request when the RCPT TO domain is listed with the
|
|
A record "<i>d.d.d.d</i>" under <i>rbl_domain</i> (Postfix version
|
|
2.1 and later only). Each "<i>d</i>" is a number, or a pattern
|
|
inside "[]" that contains one or more ";"-separated numbers or
|
|
number..number ranges (Postfix version 2.8 and later). If no
|
|
"<i>=d.d.d.d</i>" is specified, reject
|
|
the request when the RCPT TO domain is listed with
|
|
any A record under <i>rbl_domain</i>. <br> The <a href="postconf.5.html#maps_rbl_reject_code">maps_rbl_reject_code</a>
|
|
parameter specifies the response code for rejected requests (default:
|
|
554); the <a href="postconf.5.html#default_rbl_reply">default_rbl_reply</a> parameter specifies the default server
|
|
reply; and the <a href="postconf.5.html#rbl_reply_maps">rbl_reply_maps</a> parameter specifies tables with server
|
|
replies indexed by <i>rbl_domain</i>. This feature is available
|
|
in Postfix version 2.0 and later.</dd>
|
|
|
|
<dt><b><a name="reject_unauth_destination">reject_unauth_destination</a></b></dt>
|
|
|
|
<dd>Reject the request unless one of the following is true:
|
|
|
|
<ul>
|
|
|
|
<li> Postfix is a mail forwarder: the resolved RCPT TO domain matches
|
|
$<a href="postconf.5.html#relay_domains">relay_domains</a> or a subdomain thereof, and contains no sender-specified
|
|
routing (user@elsewhere@domain),
|
|
|
|
<li> Postfix is the final destination: the resolved RCPT TO domain
|
|
matches $<a href="postconf.5.html#mydestination">mydestination</a>, $<a href="postconf.5.html#inet_interfaces">inet_interfaces</a>, $<a href="postconf.5.html#proxy_interfaces">proxy_interfaces</a>,
|
|
$<a href="postconf.5.html#virtual_alias_domains">virtual_alias_domains</a>, or $<a href="postconf.5.html#virtual_mailbox_domains">virtual_mailbox_domains</a>, and contains
|
|
no sender-specified routing (user@elsewhere@domain).
|
|
|
|
</ul>The <a href="postconf.5.html#relay_domains_reject_code">relay_domains_reject_code</a> parameter specifies the response
|
|
code for rejected requests (default: 554). </dd>
|
|
|
|
<dt><b><a name="defer_unauth_destination">defer_unauth_destination</a></b></dt>
|
|
|
|
<dd> Reject the same requests as <a href="postconf.5.html#reject_unauth_destination">reject_unauth_destination</a>, with a
|
|
non-permanent error code. This feature is available in Postfix
|
|
2.10 and later.</dd>
|
|
|
|
<dt><b><a name="reject_unknown_recipient_domain">reject_unknown_recipient_domain</a></b></dt>
|
|
|
|
<dd>Reject the request when Postfix is not final destination for
|
|
the recipient domain, and the RCPT TO domain has 1) no DNS MX and
|
|
no DNS A
|
|
record or 2) a malformed MX record such as a record with
|
|
a zero-length MX hostname (Postfix version 2.3 and later). <br> The
|
|
reply is specified with the <a href="postconf.5.html#unknown_address_reject_code">unknown_address_reject_code</a> parameter
|
|
(default: 450), <a href="postconf.5.html#unknown_address_tempfail_action">unknown_address_tempfail_action</a> (default:
|
|
<a href="postconf.5.html#defer_if_permit">defer_if_permit</a>), or 556 (nullmx, Postfix 3.0 and
|
|
later). See the respective parameter descriptions for details.
|
|
</dd>
|
|
|
|
<dt><b><a name="reject_unlisted_recipient">reject_unlisted_recipient</a></b> (with Postfix version 2.0: check_recipient_maps)</dt>
|
|
|
|
<dd> Reject the request when the RCPT TO address is not listed in
|
|
the list of valid recipients for its domain class. See the
|
|
<a href="postconf.5.html#smtpd_reject_unlisted_recipient">smtpd_reject_unlisted_recipient</a> parameter description for details.
|
|
This feature is available in Postfix 2.1 and later.</dd>
|
|
|
|
<dt><b><a name="reject_unverified_recipient">reject_unverified_recipient</a></b></dt>
|
|
|
|
<dd>Reject the request when mail to the RCPT TO address is known
|
|
to bounce, or when the recipient address destination is not reachable.
|
|
Address verification information is managed by the <a href="verify.8.html">verify(8)</a> server;
|
|
see the <a href="ADDRESS_VERIFICATION_README.html">ADDRESS_VERIFICATION_README</a> file for details. <br> The
|
|
<a href="postconf.5.html#unverified_recipient_reject_code">unverified_recipient_reject_code</a> parameter specifies the numerical
|
|
response code when an address is known to bounce (default: 450,
|
|
change it to 550 when you are confident that it is safe to do so).
|
|
<br>The <a href="postconf.5.html#unverified_recipient_defer_code">unverified_recipient_defer_code</a> parameter specifies the
|
|
numerical response code when an address probe failed due to a
|
|
temporary problem (default: 450). <br> The
|
|
<a href="postconf.5.html#unverified_recipient_tempfail_action">unverified_recipient_tempfail_action</a> parameter specifies the action
|
|
after address probe failure due to a temporary problem (default:
|
|
<a href="postconf.5.html#defer_if_permit">defer_if_permit</a>). <br> This feature breaks for aliased addresses
|
|
with "<a href="postconf.5.html#enable_original_recipient">enable_original_recipient</a> = no" (Postfix ≤ 3.2). <br>
|
|
This feature is available in Postfix 2.1 and later. </dd>
|
|
|
|
</dl>
|
|
|
|
<p>
|
|
Other restrictions that are valid in this context:
|
|
</p>
|
|
|
|
<ul>
|
|
|
|
<li><a href="#generic">Generic</a> restrictions that can be used
|
|
in any SMTP command context, described under <a href="postconf.5.html#smtpd_client_restrictions">smtpd_client_restrictions</a>.
|
|
|
|
<li>SMTP command specific restrictions described under
|
|
<a href="postconf.5.html#smtpd_client_restrictions">smtpd_client_restrictions</a>, <a href="postconf.5.html#smtpd_helo_restrictions">smtpd_helo_restrictions</a> and
|
|
<a href="postconf.5.html#smtpd_sender_restrictions">smtpd_sender_restrictions</a>.
|
|
|
|
</ul>
|
|
|
|
<p>
|
|
Example:
|
|
</p>
|
|
|
|
<pre>
|
|
# The Postfix before 2.10 default mail relay policy. Later Postfix
|
|
# versions implement this preferably with <a href="postconf.5.html#smtpd_relay_restrictions">smtpd_relay_restrictions</a>.
|
|
<a href="postconf.5.html#smtpd_recipient_restrictions">smtpd_recipient_restrictions</a> = <a href="postconf.5.html#permit_mynetworks">permit_mynetworks</a>, <a href="postconf.5.html#reject_unauth_destination">reject_unauth_destination</a>
|
|
</pre>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="smtpd_reject_footer">smtpd_reject_footer</a>
|
|
(default: empty)</b></DT><DD>
|
|
|
|
<p> Optional information that is appended after each Postfix SMTP
|
|
server
|
|
4XX or 5XX response. </p>
|
|
|
|
<p> The following example uses "\c" at the start of the template
|
|
(supported in Postfix 2.10 and later) to suppress the line break
|
|
between the reply text and the footer text. With earlier Postfix
|
|
versions, the footer text always begins on a new line, and the "\c"
|
|
is output literally. </p>
|
|
|
|
<pre>
|
|
/etc/postfix/<a href="postconf.5.html">main.cf</a>:
|
|
<a href="postconf.5.html#smtpd_reject_footer">smtpd_reject_footer</a> = \c. For assistance, call 800-555-0101.
|
|
Please provide the following information in your problem report:
|
|
time ($localtime), client ($client_address) and server
|
|
($server_name).
|
|
</pre>
|
|
|
|
<p> Server response: </p>
|
|
|
|
<pre>
|
|
550-5.5.1 <user@example> Recipient address rejected: User
|
|
unknown. For assistance, call 800-555-0101. Please provide the
|
|
following information in your problem report: time (Jan 4 15:42:00),
|
|
client (192.168.1.248) and server (mail1.example.com).
|
|
</pre>
|
|
|
|
<p> Note: the above text is meant to make it easier to find the
|
|
Postfix logfile records for a failed SMTP session. The text itself
|
|
is not logged to the Postfix SMTP server's maillog file. </p>
|
|
|
|
<p> Be sure to keep the text as short as possible. Long text may
|
|
be truncated before it is logged to the remote SMTP client's maillog
|
|
file, or before it is returned to the sender in a delivery status
|
|
notification. </p>
|
|
|
|
<p> The template text is not subject to Postfix configuration
|
|
parameter $name expansion. Instead, this feature supports a limited
|
|
number of $name attributes in the footer text. These attributes are
|
|
replaced with their current value for the SMTP session. </p>
|
|
|
|
<p> Note: specify $$name in footer text that is looked up from
|
|
<a href="regexp_table.5.html">regexp</a>: or <a href="pcre_table.5.html">pcre</a>:-based <a href="postconf.5.html#smtpd_reject_footer_maps">smtpd_reject_footer_maps</a>, otherwise the
|
|
Postfix server will not use the footer text and will log a warning
|
|
instead. </p>
|
|
|
|
<dl>
|
|
|
|
<dt> <b>client_address</b> </dt> <dd> The Client IP address that
|
|
is logged in the maillog file. </dd>
|
|
|
|
<dt> <b>client_port</b> </dt> <dd> The client TCP port that is
|
|
logged in the maillog file. </dd>
|
|
|
|
<dt> <b>localtime</b> </dt> <dd> The server local time (Mmm dd
|
|
hh:mm:ss) that is logged in the maillog file. </dd>
|
|
|
|
<dt> <b>server_name</b> </dt> <dd> The server's <a href="postconf.5.html#myhostname">myhostname</a> value.
|
|
This attribute is made available for sites with multiple MTAs
|
|
(perhaps behind a load-balancer), where the server name can help
|
|
the server support team to quickly find the right log files. </dd>
|
|
|
|
</dl>
|
|
|
|
<p> Notes: </p>
|
|
|
|
<ul>
|
|
|
|
<li> <p> NOT SUPPORTED are other attributes such as sender, recipient,
|
|
or <a href="postconf.5.html">main.cf</a> parameters. </p>
|
|
|
|
<li> <p> For safety reasons, text that does not match
|
|
$<a href="postconf.5.html#smtpd_expansion_filter">smtpd_expansion_filter</a> is censored. </p>
|
|
|
|
</ul>
|
|
|
|
<p> This feature supports the two-character sequence \n as a request
|
|
for a line break in the footer text. Postfix automatically inserts
|
|
after each line break the three-digit SMTP reply code (and optional
|
|
enhanced status code) from the original Postfix reject message.
|
|
</p>
|
|
|
|
<p> To work around mail software that mis-handles multi-line replies,
|
|
specify the two-character sequence \c at the start of the template.
|
|
This suppresses the line break between the reply text and the footer
|
|
text (Postfix 2.10 and later). </p>
|
|
|
|
<p> This feature is available in Postfix 2.8 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="smtpd_reject_footer_maps">smtpd_reject_footer_maps</a>
|
|
(default: empty)</b></DT><DD>
|
|
|
|
<p> Lookup tables, indexed by the complete Postfix SMTP server 4xx or
|
|
5xx response, with reject footer templates. See <a href="postconf.5.html#smtpd_reject_footer">smtpd_reject_footer</a>
|
|
for details. </p>
|
|
|
|
<p>
|
|
Specify zero or more "type:name" lookup tables, separated by
|
|
whitespace or comma. Tables will be searched in the specified order
|
|
until a match is found.
|
|
</p>
|
|
|
|
<p> This feature is available in Postfix 3.4 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="smtpd_reject_unlisted_recipient">smtpd_reject_unlisted_recipient</a>
|
|
(default: yes)</b></DT><DD>
|
|
|
|
<p>
|
|
Request that the Postfix SMTP server rejects mail for unknown
|
|
recipient addresses, even when no explicit <a href="postconf.5.html#reject_unlisted_recipient">reject_unlisted_recipient</a>
|
|
access restriction is specified. This prevents the Postfix queue
|
|
from filling up with undeliverable MAILER-DAEMON messages.
|
|
</p>
|
|
|
|
<p> An address is considered "unknown" when 1) it does not match a
|
|
<a href="virtual.5.html">virtual(5)</a> alias or <a href="canonical.5.html">canonical(5)</a> mapping, and 2) the address is not
|
|
valid for its address class. For a definition of class-based address
|
|
validation, see <a href="ADDRESS_CLASS_README.html#classes">
|
|
ADDRESS_CLASS_README</a>. </p>
|
|
|
|
<p>
|
|
This feature is available in Postfix 2.1 and later.
|
|
</p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="smtpd_reject_unlisted_sender">smtpd_reject_unlisted_sender</a>
|
|
(default: no)</b></DT><DD>
|
|
|
|
<p> Request that the Postfix SMTP server rejects mail from unknown
|
|
sender addresses, even when no explicit <a href="postconf.5.html#reject_unlisted_sender">reject_unlisted_sender</a>
|
|
access restriction is specified. This can slow down an explosion
|
|
of forged mail from worms or viruses. </p>
|
|
|
|
<p> An address is considered "unknown" when 1) it does not match a
|
|
<a href="virtual.5.html">virtual(5)</a> alias or <a href="canonical.5.html">canonical(5)</a> mapping, and 2) the address is not
|
|
valid for its address class. For a definition of class-based address
|
|
validation, see <a href="ADDRESS_CLASS_README.html#classes">
|
|
ADDRESS_CLASS_README</a>. </p>
|
|
|
|
<p>
|
|
This feature is available in Postfix 2.1 and later.
|
|
</p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="smtpd_relay_before_recipient_restrictions">smtpd_relay_before_recipient_restrictions</a>
|
|
(default: see "postconf -d" output)</b></DT><DD>
|
|
|
|
<p> Evaluate <a href="postconf.5.html#smtpd_relay_restrictions">smtpd_relay_restrictions</a> before <a href="postconf.5.html#smtpd_recipient_restrictions">smtpd_recipient_restrictions</a>.
|
|
Historically, <a href="postconf.5.html#smtpd_relay_restrictions">smtpd_relay_restrictions</a> was evaluated after
|
|
<a href="postconf.5.html#smtpd_recipient_restrictions">smtpd_recipient_restrictions</a>, contradicting documented behavior. </p>
|
|
|
|
<p> Background: the <a href="postconf.5.html#smtpd_relay_restrictions">smtpd_relay_restrictions</a> feature is primarily
|
|
designed to enforce a mail relaying policy, while
|
|
<a href="postconf.5.html#smtpd_recipient_restrictions">smtpd_recipient_restrictions</a> is primarily designed to enforce spam
|
|
blocking policy. Both are evaluated while replying to the RCPT TO
|
|
command, and both support the same features. </p>
|
|
|
|
<p> This feature is available in Postfix 3.6 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="smtpd_relay_restrictions">smtpd_relay_restrictions</a>
|
|
(default: <a href="postconf.5.html#permit_mynetworks">permit_mynetworks</a>, <a href="postconf.5.html#permit_sasl_authenticated">permit_sasl_authenticated</a>, <a href="postconf.5.html#defer_unauth_destination">defer_unauth_destination</a>)</b></DT><DD>
|
|
|
|
<p> Access restrictions for mail relay control that the Postfix
|
|
SMTP server applies in the context of the RCPT TO command, before
|
|
<a href="postconf.5.html#smtpd_recipient_restrictions">smtpd_recipient_restrictions</a>.
|
|
See <a href="SMTPD_ACCESS_README.html">SMTPD_ACCESS_README</a>, section "Delayed evaluation of SMTP access
|
|
restriction lists" for a discussion of evaluation context and time.
|
|
</p>
|
|
|
|
<p> With Postfix versions before 2.10, the rules for relay permission
|
|
and spam blocking were combined under <a href="postconf.5.html#smtpd_recipient_restrictions">smtpd_recipient_restrictions</a>,
|
|
resulting in error-prone configuration. As of Postfix 2.10, relay
|
|
permission rules are preferably implemented with <a href="postconf.5.html#smtpd_relay_restrictions">smtpd_relay_restrictions</a>,
|
|
so that a permissive spam blocking policy under
|
|
<a href="postconf.5.html#smtpd_recipient_restrictions">smtpd_recipient_restrictions</a> will no longer result in a permissive
|
|
mail relay policy. </p>
|
|
|
|
<p> For backwards compatibility, sites that migrate from Postfix
|
|
versions before 2.10 can set <a href="postconf.5.html#smtpd_relay_restrictions">smtpd_relay_restrictions</a> to the empty
|
|
value, and use <a href="postconf.5.html#smtpd_recipient_restrictions">smtpd_recipient_restrictions</a> exactly as before. </p>
|
|
|
|
<p>
|
|
By default, the Postfix SMTP server accepts:
|
|
</p>
|
|
|
|
<ul>
|
|
|
|
<li> Mail from clients whose IP address matches $<a href="postconf.5.html#mynetworks">mynetworks</a>, or:
|
|
|
|
<li> Mail from clients who are SASL authenticated, or:
|
|
|
|
<li> Mail to remote destinations that match $<a href="postconf.5.html#relay_domains">relay_domains</a>, except
|
|
for addresses that contain sender-specified routing
|
|
(user@elsewhere@domain), or:
|
|
|
|
<li> Mail to local destinations that match $<a href="postconf.5.html#inet_interfaces">inet_interfaces</a>
|
|
or $<a href="postconf.5.html#proxy_interfaces">proxy_interfaces</a>, $<a href="postconf.5.html#mydestination">mydestination</a>, $<a href="postconf.5.html#virtual_alias_domains">virtual_alias_domains</a>, or
|
|
$<a href="postconf.5.html#virtual_mailbox_domains">virtual_mailbox_domains</a>.
|
|
|
|
</ul>
|
|
|
|
<p>
|
|
IMPORTANT: Either the <a href="postconf.5.html#smtpd_relay_restrictions">smtpd_relay_restrictions</a> or the
|
|
<a href="postconf.5.html#smtpd_recipient_restrictions">smtpd_recipient_restrictions</a> parameter must specify
|
|
at least one of the following restrictions. Otherwise Postfix will
|
|
refuse to receive mail:
|
|
</p>
|
|
|
|
<blockquote>
|
|
<pre>
|
|
reject, <a href="postconf.5.html#reject_unauth_destination">reject_unauth_destination</a>
|
|
</pre>
|
|
</blockquote>
|
|
|
|
<blockquote>
|
|
<pre>
|
|
defer, <a href="postconf.5.html#defer_if_permit">defer_if_permit</a>, <a href="postconf.5.html#defer_unauth_destination">defer_unauth_destination</a>
|
|
</pre>
|
|
</blockquote>
|
|
|
|
<p>
|
|
Specify a list of restrictions, separated by commas and/or whitespace.
|
|
Continue long lines by starting the next line with whitespace.
|
|
The same restrictions are available as documented under
|
|
<a href="postconf.5.html#smtpd_recipient_restrictions">smtpd_recipient_restrictions</a>.
|
|
</p>
|
|
|
|
<p> This feature is available in Postfix 2.10 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="smtpd_restriction_classes">smtpd_restriction_classes</a>
|
|
(default: empty)</b></DT><DD>
|
|
|
|
<p>
|
|
User-defined aliases for groups of access restrictions. The aliases
|
|
can be specified in <a href="postconf.5.html#smtpd_recipient_restrictions">smtpd_recipient_restrictions</a> etc., and on the
|
|
right-hand side of a Postfix <a href="access.5.html">access(5)</a> table.
|
|
</p>
|
|
|
|
<p>
|
|
One major application is for implementing per-recipient UCE control.
|
|
See the <a href="RESTRICTION_CLASS_README.html">RESTRICTION_CLASS_README</a> document for other examples.
|
|
</p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="smtpd_sasl_application_name">smtpd_sasl_application_name</a>
|
|
(default: smtpd)</b></DT><DD>
|
|
|
|
<p>
|
|
The application name that the Postfix SMTP server uses for SASL
|
|
server initialization. This
|
|
controls the name of the SASL configuration file. The default value
|
|
is <b>smtpd</b>, corresponding to a SASL configuration file named
|
|
<b>smtpd.conf</b>.
|
|
</p>
|
|
|
|
<p>
|
|
This feature is available in Postfix 2.1 and 2.2. With Postfix 2.3
|
|
it was renamed to <a href="postconf.5.html#smtpd_sasl_path">smtpd_sasl_path</a>.
|
|
</p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="smtpd_sasl_auth_enable">smtpd_sasl_auth_enable</a>
|
|
(default: no)</b></DT><DD>
|
|
|
|
<p>
|
|
Enable SASL authentication in the Postfix SMTP server. By default,
|
|
the Postfix SMTP server does not use authentication.
|
|
</p>
|
|
|
|
<p>
|
|
If a remote SMTP client is authenticated, the <a href="postconf.5.html#permit_sasl_authenticated">permit_sasl_authenticated</a>
|
|
access restriction can be used to permit relay access, like this:
|
|
</p>
|
|
|
|
<blockquote>
|
|
<pre>
|
|
# With Postfix 2.10 and later, the mail relay policy is
|
|
# preferably specified under <a href="postconf.5.html#smtpd_relay_restrictions">smtpd_relay_restrictions</a>.
|
|
<a href="postconf.5.html#smtpd_relay_restrictions">smtpd_relay_restrictions</a> =
|
|
<a href="postconf.5.html#permit_mynetworks">permit_mynetworks</a>, <a href="postconf.5.html#permit_sasl_authenticated">permit_sasl_authenticated</a>, ...
|
|
</pre>
|
|
|
|
<pre>
|
|
# With Postfix before 2.10, the relay policy can be
|
|
# specified only under <a href="postconf.5.html#smtpd_recipient_restrictions">smtpd_recipient_restrictions</a>.
|
|
<a href="postconf.5.html#smtpd_recipient_restrictions">smtpd_recipient_restrictions</a> =
|
|
<a href="postconf.5.html#permit_mynetworks">permit_mynetworks</a>, <a href="postconf.5.html#permit_sasl_authenticated">permit_sasl_authenticated</a>, ...
|
|
</pre>
|
|
</blockquote>
|
|
|
|
<p> To reject all SMTP connections from unauthenticated clients,
|
|
specify "<a href="postconf.5.html#smtpd_delay_reject">smtpd_delay_reject</a> = yes" (which is the default) and use:
|
|
</p>
|
|
|
|
<blockquote>
|
|
<pre>
|
|
<a href="postconf.5.html#smtpd_client_restrictions">smtpd_client_restrictions</a> = <a href="postconf.5.html#permit_sasl_authenticated">permit_sasl_authenticated</a>, reject
|
|
</pre>
|
|
</blockquote>
|
|
|
|
<p>
|
|
See the <a href="SASL_README.html">SASL_README</a> file for SASL configuration and operation details.
|
|
</p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="smtpd_sasl_authenticated_header">smtpd_sasl_authenticated_header</a>
|
|
(default: no)</b></DT><DD>
|
|
|
|
<p> Report the SASL authenticated user name in the <a href="smtpd.8.html">smtpd(8)</a> Received
|
|
message header. </p>
|
|
|
|
<p> This feature is available in Postfix 2.3 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="smtpd_sasl_exceptions_networks">smtpd_sasl_exceptions_networks</a>
|
|
(default: empty)</b></DT><DD>
|
|
|
|
<p>
|
|
What remote SMTP clients the Postfix SMTP server will not offer
|
|
AUTH support to.
|
|
</p>
|
|
|
|
<p>
|
|
Some clients (Netscape 4 at least) have a bug that causes them to
|
|
require a login and password whenever AUTH is offered, whether it's
|
|
necessary or not. To work around this, specify, for example,
|
|
$<a href="postconf.5.html#mynetworks">mynetworks</a> to prevent Postfix from offering AUTH to local clients.
|
|
</p>
|
|
|
|
<p>
|
|
Specify a list of network/netmask patterns, separated by commas
|
|
and/or whitespace. The mask specifies the number of bits in the
|
|
network part of a host address. You can also specify "/file/name" or
|
|
"<a href="DATABASE_README.html">type:table</a>" patterns. A "/file/name" pattern is replaced by its
|
|
contents; a "<a href="DATABASE_README.html">type:table</a>" lookup table is matched when a table entry
|
|
matches a lookup string (the lookup result is ignored). Continue
|
|
long lines by starting the next line with whitespace. Specify
|
|
"!pattern" to exclude an address or network block from the list.
|
|
The form "!/file/name" is supported only in Postfix version 2.4 and
|
|
later. </p>
|
|
|
|
<p> Note: IP version 6 address information must be specified inside
|
|
<tt>[]</tt> in the <a href="postconf.5.html#smtpd_sasl_exceptions_networks">smtpd_sasl_exceptions_networks</a> value, and in
|
|
files specified with "/file/name". IP version 6 addresses contain
|
|
the ":" character, and would otherwise be confused with a "<a href="DATABASE_README.html">type:table</a>"
|
|
pattern. </p>
|
|
|
|
<p>
|
|
Example:
|
|
</p>
|
|
|
|
<pre>
|
|
<a href="postconf.5.html#smtpd_sasl_exceptions_networks">smtpd_sasl_exceptions_networks</a> = $<a href="postconf.5.html#mynetworks">mynetworks</a>
|
|
</pre>
|
|
|
|
<p>
|
|
This feature is available in Postfix 2.1 and later.
|
|
</p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="smtpd_sasl_local_domain">smtpd_sasl_local_domain</a>
|
|
(default: empty)</b></DT><DD>
|
|
|
|
<p>
|
|
The name of the Postfix SMTP server's local SASL authentication
|
|
realm.
|
|
</p>
|
|
|
|
<p>
|
|
By default, the local authentication realm name is the null string.
|
|
</p>
|
|
|
|
<p>
|
|
Examples:
|
|
</p>
|
|
|
|
<pre>
|
|
<a href="postconf.5.html#smtpd_sasl_local_domain">smtpd_sasl_local_domain</a> = $<a href="postconf.5.html#mydomain">mydomain</a>
|
|
<a href="postconf.5.html#smtpd_sasl_local_domain">smtpd_sasl_local_domain</a> = $<a href="postconf.5.html#myhostname">myhostname</a>
|
|
</pre>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="smtpd_sasl_mechanism_filter">smtpd_sasl_mechanism_filter</a>
|
|
(default: !external, <a href="DATABASE_README.html#types">static</a>:rest)</b></DT><DD>
|
|
|
|
<p> If non-empty, a filter for the SASL mechanism names that the
|
|
Postfix SMTP server will announce in the EHLO response. By default,
|
|
the Postfix SMTP server will not announce the EXTERNAL mechanism,
|
|
because Postfix support for that is not implemented. </p>
|
|
|
|
<p> Specify mechanism names, "/file/name" patterns, or "<a href="DATABASE_README.html">type:table</a>"
|
|
lookup tables, separated by comma or whitespace. The right-hand
|
|
side result from "<a href="DATABASE_README.html">type:table</a>" lookups is ignored. Specify "!pattern"
|
|
to exclude a mechanism name from the list. </p>
|
|
|
|
<p>
|
|
Examples:
|
|
</p>
|
|
|
|
<pre>
|
|
<a href="postconf.5.html#smtpd_sasl_mechanism_filter">smtpd_sasl_mechanism_filter</a> = !external, !gssapi, <a href="DATABASE_README.html#types">static</a>:rest
|
|
<a href="postconf.5.html#smtpd_sasl_mechanism_filter">smtpd_sasl_mechanism_filter</a> = login, plain
|
|
<a href="postconf.5.html#smtpd_sasl_mechanism_filter">smtpd_sasl_mechanism_filter</a> = /etc/postfix/smtpd_mechs
|
|
</pre>
|
|
|
|
<p> This feature is available in Postfix 3.6 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="smtpd_sasl_path">smtpd_sasl_path</a>
|
|
(default: smtpd)</b></DT><DD>
|
|
|
|
<p> Implementation-specific information that the Postfix SMTP server
|
|
passes through to
|
|
the SASL plug-in implementation that is selected with
|
|
<b><a href="postconf.5.html#smtpd_sasl_type">smtpd_sasl_type</a></b>. Typically this specifies the name of a
|
|
configuration file or rendezvous point. </p>
|
|
|
|
<p> This feature is available in Postfix 2.3 and later. In earlier
|
|
releases it was called <b><a href="postconf.5.html#smtpd_sasl_application_name">smtpd_sasl_application_name</a></b>. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="smtpd_sasl_response_limit">smtpd_sasl_response_limit</a>
|
|
(default: 12288)</b></DT><DD>
|
|
|
|
<p> The maximum length of a SASL client's response to a server challenge.
|
|
When the client's "initial response" is longer than the normal limit for
|
|
SMTP commands, the client must omit its initial response, and wait for an
|
|
empty server challenge; it can then send what would have been its "initial
|
|
response" as a response to the empty server challenge. <a href="https://tools.ietf.org/html/rfc4954">RFC4954</a> requires the
|
|
server to accept client responses up to at least 12288 octets of
|
|
base64-encoded text. The default value is therefore also the minimum value
|
|
accepted for this parameter.</p>
|
|
|
|
<p> This feature is available in Postfix 3.4 and later. Prior versions use
|
|
"<a href="postconf.5.html#line_length_limit">line_length_limit</a>", which may need to be raised to accommodate larger client
|
|
responses, as may be needed with GSSAPI authentication of Windows AD users
|
|
who are members of many groups. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="smtpd_sasl_security_options">smtpd_sasl_security_options</a>
|
|
(default: noanonymous)</b></DT><DD>
|
|
|
|
<p> Postfix SMTP server SASL security options; as of Postfix 2.3
|
|
the list of available
|
|
features depends on the SASL server implementation that is selected
|
|
with <b><a href="postconf.5.html#smtpd_sasl_type">smtpd_sasl_type</a></b>. </p>
|
|
|
|
<p> The following security features are defined for the <b>cyrus</b>
|
|
server SASL implementation: </p>
|
|
|
|
<p>
|
|
Restrict what authentication mechanisms the Postfix SMTP server
|
|
will offer to the client. The list of available authentication
|
|
mechanisms is system dependent.
|
|
</p>
|
|
|
|
<p>
|
|
Specify zero or more of the following:
|
|
</p>
|
|
|
|
<dl>
|
|
|
|
<dt><b>noplaintext</b></dt>
|
|
|
|
<dd>Disallow methods that use plaintext passwords. </dd>
|
|
|
|
<dt><b>noactive</b></dt>
|
|
|
|
<dd>Disallow methods subject to active (non-dictionary) attack. </dd>
|
|
|
|
<dt><b>nodictionary</b></dt>
|
|
|
|
<dd>Disallow methods subject to passive (dictionary) attack. </dd>
|
|
|
|
<dt><b>noanonymous</b></dt>
|
|
|
|
<dd>Disallow methods that allow anonymous authentication. </dd>
|
|
|
|
<dt><b>forward_secrecy</b></dt>
|
|
|
|
<dd>Only allow methods that support forward secrecy (Dovecot only).
|
|
</dd>
|
|
|
|
<dt><b>mutual_auth</b></dt>
|
|
|
|
<dd>Only allow methods that provide mutual authentication (not available
|
|
with Cyrus SASL version 1). </dd>
|
|
|
|
</dl>
|
|
|
|
<p>
|
|
By default, the Postfix SMTP server accepts plaintext passwords but
|
|
not anonymous logins.
|
|
</p>
|
|
|
|
<p>
|
|
Warning: it appears that clients try authentication methods in the
|
|
order as advertised by the server (e.g., PLAIN ANONYMOUS CRAM-MD5)
|
|
which means that if you disable plaintext passwords, clients will
|
|
log in anonymously, even when they should be able to use CRAM-MD5.
|
|
So, if you disable plaintext logins, disable anonymous logins too.
|
|
Postfix treats anonymous login as no authentication.
|
|
</p>
|
|
|
|
<p>
|
|
Example:
|
|
</p>
|
|
|
|
<pre>
|
|
<a href="postconf.5.html#smtpd_sasl_security_options">smtpd_sasl_security_options</a> = noanonymous, noplaintext
|
|
</pre>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="smtpd_sasl_service">smtpd_sasl_service</a>
|
|
(default: smtp)</b></DT><DD>
|
|
|
|
<p> The service name that is passed to the SASL plug-in that is
|
|
selected with <b><a href="postconf.5.html#smtpd_sasl_type">smtpd_sasl_type</a></b> and <b><a href="postconf.5.html#smtpd_sasl_path">smtpd_sasl_path</a></b>.
|
|
</p>
|
|
|
|
<p> This feature is available in Postfix 2.11 and later. Prior
|
|
versions behave as if "<b>smtp</b>" is specified. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="smtpd_sasl_tls_security_options">smtpd_sasl_tls_security_options</a>
|
|
(default: $<a href="postconf.5.html#smtpd_sasl_security_options">smtpd_sasl_security_options</a>)</b></DT><DD>
|
|
|
|
<p> The SASL authentication security options that the Postfix SMTP
|
|
server uses for TLS encrypted SMTP sessions. </p>
|
|
|
|
<p> This feature is available in Postfix 2.2 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="smtpd_sasl_type">smtpd_sasl_type</a>
|
|
(default: cyrus)</b></DT><DD>
|
|
|
|
<p> The SASL plug-in type that the Postfix SMTP server should use
|
|
for authentication. The available types are listed with the
|
|
"<b>postconf -a</b>" command. </p>
|
|
|
|
<p> This feature is available in Postfix 2.3 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="smtpd_sender_login_maps">smtpd_sender_login_maps</a>
|
|
(default: empty)</b></DT><DD>
|
|
|
|
<p>
|
|
Optional lookup table with the SASL login names that own the
|
|
envelope sender
|
|
(MAIL FROM) addresses.
|
|
</p>
|
|
|
|
<blockquote> <p> Note: to enforce that the From: header address
|
|
matches the envelope sender (MAIL FROM) address, use an external
|
|
filter such as a Milter, for the submission or submissions (formerly
|
|
called smtps )
|
|
services. For example: <a href="https://github.com/magcks/milterfrom">https://github.com/magcks/milterfrom</a>. </p>
|
|
</blockquote>
|
|
|
|
<p>
|
|
Specify zero or more "type:name" lookup tables, separated by
|
|
whitespace or comma. Tables will be searched in the specified order
|
|
until a match is found. With lookups from
|
|
indexed files such as DB or DBM, or from networked tables such as
|
|
NIS, LDAP or SQL, the following search operations are done with a
|
|
sender address of <i>user@domain</i>: </p>
|
|
|
|
<dl>
|
|
|
|
<dt> 1) <i>user@domain</i> </dt>
|
|
|
|
<dd>This table lookup is always done and has the highest precedence. </dd>
|
|
|
|
<dt> 2) <i>user</i> </dt>
|
|
|
|
<dd>This table lookup is done only when the <i>domain</i> part of the
|
|
sender address matches $<a href="postconf.5.html#myorigin">myorigin</a>, $<a href="postconf.5.html#mydestination">mydestination</a>, $<a href="postconf.5.html#inet_interfaces">inet_interfaces</a>
|
|
or $<a href="postconf.5.html#proxy_interfaces">proxy_interfaces</a>. </dd>
|
|
|
|
<dt> 3) <i>@domain</i> </dt>
|
|
|
|
<dd>This table lookup is done last and has the lowest precedence. </dd>
|
|
|
|
</dl>
|
|
|
|
<p>
|
|
In all cases the result of table lookup must be either "not found"
|
|
or a list of SASL login names separated by comma and/or whitespace.
|
|
</p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="smtpd_sender_restrictions">smtpd_sender_restrictions</a>
|
|
(default: empty)</b></DT><DD>
|
|
|
|
<p>
|
|
Optional restrictions that the Postfix SMTP server applies in the
|
|
context of a client MAIL FROM command.
|
|
See <a href="SMTPD_ACCESS_README.html">SMTPD_ACCESS_README</a>, section "Delayed evaluation of SMTP access
|
|
restriction lists" for a discussion of evaluation context and time.
|
|
</p>
|
|
|
|
<p>
|
|
The default is to permit everything.
|
|
</p>
|
|
|
|
<p>
|
|
Specify a list of restrictions, separated by commas and/or whitespace.
|
|
Continue long lines by starting the next line with whitespace.
|
|
Restrictions are applied in the order as specified; the first
|
|
restriction that matches wins.
|
|
</p>
|
|
|
|
<p>
|
|
The following restrictions are specific to the sender address
|
|
received with the MAIL FROM command.
|
|
</p>
|
|
|
|
<dl>
|
|
|
|
<dt><b><a name="check_sender_access">check_sender_access</a> <i><a href="DATABASE_README.html">type:table</a></i></b></dt>
|
|
|
|
<dd>Search the specified <a href="access.5.html">access(5)</a> database for the MAIL FROM
|
|
address, and execute the corresponding action. </dd>
|
|
|
|
<dt><b><a name="check_sender_a_access">check_sender_a_access</a> <i><a href="DATABASE_README.html">type:table</a></i></b></dt>
|
|
|
|
<dd>Search the specified <a href="access.5.html">access(5)</a> database for the IP addresses for
|
|
the MAIL FROM domain, and execute the corresponding action. Note:
|
|
a result of "OK" is not allowed for safety reasons. Instead, use
|
|
DUNNO in order to exclude specific hosts from denylists. This
|
|
feature is available in Postfix 3.0 and later. </dd>
|
|
|
|
<dt><b><a name="check_sender_mx_access">check_sender_mx_access</a> <i><a href="DATABASE_README.html">type:table</a></i></b></dt>
|
|
|
|
<dd>Search the specified <a href="access.5.html">access(5)</a> database for the MX hosts for
|
|
the MAIL FROM domain, and execute the corresponding action. If no
|
|
MX record is found, look up A or AAAA records, just like the Postfix
|
|
SMTP client would. Note:
|
|
a result of "OK" is not allowed for safety reasons. Instead, use
|
|
DUNNO in order to exclude specific hosts from denylists. This
|
|
feature is available in Postfix 2.1 and later. </dd>
|
|
|
|
<dt><b><a name="check_sender_ns_access">check_sender_ns_access</a> <i><a href="DATABASE_README.html">type:table</a></i></b></dt>
|
|
|
|
<dd>Search the specified <a href="access.5.html">access(5)</a> database for the DNS servers
|
|
for the MAIL FROM domain, and execute the corresponding action.
|
|
Note: a result of "OK" is not allowed for safety reasons. Instead,
|
|
use DUNNO in order to exclude specific hosts from denylists. This
|
|
feature is available in Postfix 2.1 and later. </dd>
|
|
|
|
<dt><b><a name="reject_authenticated_sender_login_mismatch">reject_authenticated_sender_login_mismatch</a></b></dt>
|
|
|
|
<dd> Reject the request when the client is authenticated with SASL,
|
|
but either the MAIL FROM address is not listed in $<a href="postconf.5.html#smtpd_sender_login_maps">smtpd_sender_login_maps</a>,
|
|
or the SASL login name is not an owner for that address.
|
|
<br>
|
|
This prevents an authenticated client from using a MAIL FROM address
|
|
that they do not explicitly own.
|
|
<br>
|
|
Note: to enforce that the From: header address matches the envelope
|
|
sender (MAIL FROM) address, use an external filter such as a Milter,
|
|
for the submission or submissions (formerly called smtps) services.
|
|
For example: <a href="https://github.com/magcks/milterfrom">https://github.com/magcks/milterfrom</a>.
|
|
<br>
|
|
This feature is available in Postfix version 2.1 and later. </dd>
|
|
|
|
<dt><b><a name="reject_known_sender_login_mismatch">reject_known_sender_login_mismatch</a></b></dt>
|
|
|
|
<dd> When the client is authenticated with SASL, reject the request
|
|
when the MAIL FROM address is listed in $<a href="postconf.5.html#smtpd_sender_login_maps">smtpd_sender_login_maps</a>,
|
|
but the SASL login name is not an owner for that address.
|
|
<br>
|
|
When the client is not authenticated with SASL, reject the request
|
|
when SASL is enabled, and the MAIL FROM address is listed in
|
|
$<a href="postconf.5.html#smtpd_sender_login_maps">smtpd_sender_login_maps</a>.
|
|
<br>
|
|
This protects any MAIL FROM address that is listed in
|
|
$<a href="postconf.5.html#smtpd_sender_login_maps">smtpd_sender_login_maps</a>, while still allowing a client to use any
|
|
unlisted MAIL FROM address.
|
|
<br>
|
|
Note: to enforce that the From: header address matches the envelope
|
|
sender (MAIL FROM) address, use an external filter such as a Milter,
|
|
for the submission or submissions (formerly called smtps) services.
|
|
For example: <a href="https://github.com/magcks/milterfrom">https://github.com/magcks/milterfrom</a>.
|
|
<br>
|
|
This feature is available in Postfix version 2.11 and later.</dd>
|
|
|
|
<dt><b><a name="reject_non_fqdn_sender">reject_non_fqdn_sender</a></b></dt>
|
|
|
|
<dd>Reject the request when the MAIL FROM address specifies a
|
|
domain that is not in
|
|
fully-qualified domain form as required by the RFC. <br> The
|
|
<a href="postconf.5.html#non_fqdn_reject_code">non_fqdn_reject_code</a> parameter specifies the response code for
|
|
rejected requests (default: 504). </dd>
|
|
|
|
<dt><b><a name="reject_rhsbl_sender">reject_rhsbl_sender <i>rbl_domain=d.d.d.d</i></a></b></dt>
|
|
|
|
<dd>Reject the request when the MAIL FROM domain is listed with
|
|
the A record "<i>d.d.d.d</i>" under <i>rbl_domain</i> (Postfix
|
|
version 2.1 and later only). Each "<i>d</i>" is a number, or a
|
|
pattern inside "[]" that contains one or more ";"-separated numbers
|
|
or number..number ranges (Postfix version 2.8 and later). If no
|
|
"<i>=d.d.d.d</i>" is specified,
|
|
reject the request when the MAIL FROM domain is
|
|
listed with any A record under <i>rbl_domain</i>. <br> The
|
|
<a href="postconf.5.html#maps_rbl_reject_code">maps_rbl_reject_code</a> parameter specifies the response code for
|
|
rejected requests (default: 554); the <a href="postconf.5.html#default_rbl_reply">default_rbl_reply</a> parameter
|
|
specifies the default server reply; and the <a href="postconf.5.html#rbl_reply_maps">rbl_reply_maps</a> parameter
|
|
specifies tables with server replies indexed by <i>rbl_domain</i>.
|
|
This feature is available in Postfix 2.0 and later.</dd>
|
|
|
|
<dt><b><a name="reject_sender_login_mismatch">reject_sender_login_mismatch</a></b></dt>
|
|
|
|
<dd> As of Postfix 2.1, this is an alias for
|
|
"<a href="postconf.5.html#reject_authenticated_sender_login_mismatch">reject_authenticated_sender_login_mismatch</a>,
|
|
<a href="postconf.5.html#reject_unauthenticated_sender_login_mismatch">reject_unauthenticated_sender_login_mismatch</a>".</dd>
|
|
|
|
<dt><b><a name="reject_unauthenticated_sender_login_mismatch">reject_unauthenticated_sender_login_mismatch</a></b></dt>
|
|
|
|
<dd> Reject the request when SASL is enabled, the MAIL FROM address
|
|
is listed in $<a href="postconf.5.html#smtpd_sender_login_maps">smtpd_sender_login_maps</a>, but the client is not
|
|
authenticated with SASL.
|
|
<br>
|
|
With SASL enabled, this prevents an unauthenticated client from
|
|
using any MAIL FROM address that is listed in $<a href="postconf.5.html#smtpd_sender_login_maps">smtpd_sender_login_maps</a>.
|
|
<br>
|
|
Note: to enforce that the From: header address matches the envelope
|
|
sender (MAIL FROM) address, use an external filter such as a Milter,
|
|
for the submission or submissions (formerly called smtps) services.
|
|
For example: <a href="https://github.com/magcks/milterfrom">https://github.com/magcks/milterfrom</a>.
|
|
<br>
|
|
This feature is available in Postfix version 2.1 and later.</dd>
|
|
|
|
<dt><b><a name="reject_unknown_sender_domain">reject_unknown_sender_domain</a></b></dt>
|
|
|
|
<dd>Reject the request when Postfix is not the final destination for
|
|
the sender address, and the MAIL FROM domain has 1) no DNS MX and
|
|
no DNS A
|
|
record, or 2) a malformed MX record such as a record with
|
|
a zero-length MX hostname (Postfix version 2.3 and later). <br> The
|
|
reply is specified with the <a href="postconf.5.html#unknown_address_reject_code">unknown_address_reject_code</a> parameter
|
|
(default: 450), <a href="postconf.5.html#unknown_address_tempfail_action">unknown_address_tempfail_action</a> (default:
|
|
<a href="postconf.5.html#defer_if_permit">defer_if_permit</a>), or 550 (nullmx, Postfix 3.0 and
|
|
later). See the respective parameter descriptions for details.
|
|
</dd>
|
|
|
|
<dt><b><a name="reject_unlisted_sender">reject_unlisted_sender</a></b></dt>
|
|
|
|
<dd>Reject the request when the MAIL FROM address is not listed in
|
|
the list of valid recipients for its domain class. See the
|
|
<a href="postconf.5.html#smtpd_reject_unlisted_sender">smtpd_reject_unlisted_sender</a> parameter description for details.
|
|
This feature is available in Postfix 2.1 and later.</dd>
|
|
|
|
<dt><b><a name="reject_unverified_sender">reject_unverified_sender</a></b></dt>
|
|
|
|
<dd>Reject the request when mail to the MAIL FROM address is known to
|
|
bounce, or when the sender address destination is not reachable.
|
|
Address verification information is managed by the <a href="verify.8.html">verify(8)</a> server;
|
|
see the <a href="ADDRESS_VERIFICATION_README.html">ADDRESS_VERIFICATION_README</a> file for details. <br> The
|
|
<a href="postconf.5.html#unverified_sender_reject_code">unverified_sender_reject_code</a> parameter specifies the numerical
|
|
response code when an address is known to bounce (default: 450,
|
|
change into 550 when you are confident that it is safe to do so).
|
|
<br>The <a href="postconf.5.html#unverified_sender_defer_code">unverified_sender_defer_code</a> specifies the numerical response
|
|
code when an address probe failed due to a temporary problem
|
|
(default: 450). <br> The <a href="postconf.5.html#unverified_sender_tempfail_action">unverified_sender_tempfail_action</a> parameter
|
|
specifies the action after address probe failure due to a temporary
|
|
problem (default: <a href="postconf.5.html#defer_if_permit">defer_if_permit</a>). <br> This feature breaks for
|
|
aliased addresses with "<a href="postconf.5.html#enable_original_recipient">enable_original_recipient</a> = no" (Postfix
|
|
≤ 3.2). <br> This feature is available in Postfix 2.1 and later.
|
|
</dd>
|
|
|
|
</dl>
|
|
|
|
<p>
|
|
Other restrictions that are valid in this context:
|
|
</p>
|
|
|
|
<ul>
|
|
|
|
<li> <a href="#generic">Generic</a> restrictions that can be used
|
|
in any SMTP command context, described under <a href="postconf.5.html#smtpd_client_restrictions">smtpd_client_restrictions</a>.
|
|
|
|
<li> SMTP command specific restrictions described under
|
|
<a href="postconf.5.html#smtpd_client_restrictions">smtpd_client_restrictions</a> and <a href="postconf.5.html#smtpd_helo_restrictions">smtpd_helo_restrictions</a>.
|
|
|
|
<li> SMTP command specific restrictions described under
|
|
<a href="postconf.5.html#smtpd_recipient_restrictions">smtpd_recipient_restrictions</a>. When recipient restrictions are listed
|
|
under <a href="postconf.5.html#smtpd_sender_restrictions">smtpd_sender_restrictions</a>, they have effect only with
|
|
"<a href="postconf.5.html#smtpd_delay_reject">smtpd_delay_reject</a> = yes", so that $<a href="postconf.5.html#smtpd_sender_restrictions">smtpd_sender_restrictions</a> is
|
|
evaluated at the time of the RCPT TO command.
|
|
|
|
</ul>
|
|
|
|
<p>
|
|
Examples:
|
|
</p>
|
|
|
|
<pre>
|
|
<a href="postconf.5.html#smtpd_sender_restrictions">smtpd_sender_restrictions</a> = <a href="postconf.5.html#reject_unknown_sender_domain">reject_unknown_sender_domain</a>
|
|
<a href="postconf.5.html#smtpd_sender_restrictions">smtpd_sender_restrictions</a> = <a href="postconf.5.html#reject_unknown_sender_domain">reject_unknown_sender_domain</a>,
|
|
<a href="postconf.5.html#check_sender_access">check_sender_access</a> <a href="DATABASE_README.html#types">hash</a>:/etc/postfix/access
|
|
</pre>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="smtpd_service_name">smtpd_service_name</a>
|
|
(default: smtpd)</b></DT><DD>
|
|
|
|
<p> The internal service that <a href="postscreen.8.html">postscreen(8)</a> hands off allowed
|
|
connections to. In a future version there may be different
|
|
classes of SMTP service. </p>
|
|
|
|
<p> This feature is available in Postfix 2.8. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="smtpd_soft_error_limit">smtpd_soft_error_limit</a>
|
|
(default: 10)</b></DT><DD>
|
|
|
|
<p>
|
|
The number of errors a remote SMTP client is allowed to make without
|
|
delivering mail before the Postfix SMTP server slows down all its
|
|
responses.
|
|
</p>
|
|
|
|
<ul>
|
|
|
|
<li><p>With Postfix version 2.1 and later, when the error count
|
|
is > $<a href="postconf.5.html#smtpd_soft_error_limit">smtpd_soft_error_limit</a>, the Postfix SMTP server
|
|
delays all responses by $<a href="postconf.5.html#smtpd_error_sleep_time">smtpd_error_sleep_time</a>. </p>
|
|
|
|
<li><p>With Postfix versions 2.0 and earlier, when the error count
|
|
is > $<a href="postconf.5.html#smtpd_soft_error_limit">smtpd_soft_error_limit</a>, the Postfix SMTP server delays all
|
|
responses by the larger of (number of errors) seconds or
|
|
$<a href="postconf.5.html#smtpd_error_sleep_time">smtpd_error_sleep_time</a>. </p>
|
|
|
|
<li><p>With Postfix versions 2.0 and earlier, when the error count
|
|
is ≤ $<a href="postconf.5.html#smtpd_soft_error_limit">smtpd_soft_error_limit</a>, the Postfix SMTP server delays 4XX
|
|
and 5XX responses by $<a href="postconf.5.html#smtpd_error_sleep_time">smtpd_error_sleep_time</a>. </p>
|
|
|
|
</ul>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="smtpd_starttls_timeout">smtpd_starttls_timeout</a>
|
|
(default: see "postconf -d" output)</b></DT><DD>
|
|
|
|
<p> The time limit for Postfix SMTP server write and read operations
|
|
during TLS startup and shutdown handshake procedures. The current
|
|
default value is stress-dependent. Before Postfix version 2.8, it
|
|
was fixed at 300s. </p>
|
|
|
|
<p> Specify a non-zero time value (an integral value plus an optional
|
|
one-letter suffix that specifies the time unit). Time units: s
|
|
(seconds), m (minutes), h (hours), d (days), w (weeks).
|
|
The default time unit is s (seconds). </p>
|
|
|
|
<p> This feature is available in Postfix 2.2 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="smtpd_timeout">smtpd_timeout</a>
|
|
(default: normal: 300s, <a href="STRESS_README.html">overload</a>: 10s)</b></DT><DD>
|
|
|
|
<p> When the Postfix SMTP server wants to send an SMTP server
|
|
response, how long the Postfix SMTP server will wait for an underlying
|
|
network write operation to complete; and when the Postfix SMTP
|
|
server Postfix wants to receive an SMTP client request, how long
|
|
the Postfix SMTP server will wait for an underlying network read
|
|
operation to complete. See the <a href="postconf.5.html#smtpd_per_request_deadline">smtpd_per_request_deadline</a> for how
|
|
this time limit may be enforced (with Postfix 2.9-3.6 see
|
|
<a href="postconf.5.html#smtpd_per_record_deadline">smtpd_per_record_deadline</a>). </p>
|
|
|
|
<p> Normally the default limit
|
|
is 300s, but it changes under overload to just 10s. With Postfix
|
|
2.5 and earlier, the SMTP server always uses a time limit of 300s
|
|
by default.
|
|
</p>
|
|
|
|
<p>
|
|
Note: if you set SMTP time limits to very large values you may have
|
|
to update the global <a href="postconf.5.html#ipc_timeout">ipc_timeout</a> parameter.
|
|
</p>
|
|
|
|
<p> Specify a non-zero time value (an integral value plus an optional
|
|
one-letter suffix that specifies the time unit). Time units: s
|
|
(seconds), m (minutes), h (hours), d (days), w (weeks).
|
|
The default time unit is s (seconds). </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="smtpd_tls_CAfile">smtpd_tls_CAfile</a>
|
|
(default: empty)</b></DT><DD>
|
|
|
|
<p> A file containing (PEM format) CA certificates of root CAs trusted
|
|
to sign either remote SMTP client certificates or intermediate CA
|
|
certificates. These are loaded into memory before the <a href="smtpd.8.html">smtpd(8)</a> server
|
|
enters the chroot jail. If the number of trusted roots is large, consider
|
|
using <a href="postconf.5.html#smtpd_tls_CApath">smtpd_tls_CApath</a> instead, but note that the latter directory must
|
|
be present in the chroot jail if the <a href="smtpd.8.html">smtpd(8)</a> server is chrooted. This
|
|
file may also be used to augment the server certificate trust chain,
|
|
but it is best to include all the required certificates directly in the
|
|
server certificate file. </p>
|
|
|
|
<p> Specify "<a href="postconf.5.html#smtpd_tls_CAfile">smtpd_tls_CAfile</a> = /path/to/system_CA_file" to use ONLY
|
|
the system-supplied default Certification Authority certificates.
|
|
</p>
|
|
|
|
<p> Specify "<a href="postconf.5.html#tls_append_default_CA">tls_append_default_CA</a> = no" to prevent Postfix from
|
|
appending the system-supplied default CAs and trusting third-party
|
|
certificates. </p>
|
|
|
|
<p> By default (see <a href="postconf.5.html#smtpd_tls_ask_ccert">smtpd_tls_ask_ccert</a>), client certificates are not
|
|
requested, and <a href="postconf.5.html#smtpd_tls_CAfile">smtpd_tls_CAfile</a> should remain empty. If you do make use
|
|
of client certificates, the distinguished names (DNs) of the Certification
|
|
Authorities listed in <a href="postconf.5.html#smtpd_tls_CAfile">smtpd_tls_CAfile</a> are sent to the remote SMTP client
|
|
in the client certificate request message. MUAs with multiple client
|
|
certificates may use the list of preferred Certification Authorities
|
|
to select the correct client certificate. You may want to put your
|
|
"preferred" CA or CAs in this file, and install other trusted CAs in
|
|
$<a href="postconf.5.html#smtpd_tls_CApath">smtpd_tls_CApath</a>. </p>
|
|
|
|
<p> Example: </p>
|
|
|
|
<pre>
|
|
<a href="postconf.5.html#smtpd_tls_CAfile">smtpd_tls_CAfile</a> = /etc/postfix/CAcert.pem
|
|
</pre>
|
|
|
|
<p> This feature is available in Postfix 2.2 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="smtpd_tls_CApath">smtpd_tls_CApath</a>
|
|
(default: empty)</b></DT><DD>
|
|
|
|
<p> A directory containing (PEM format) CA certificates of root CAs
|
|
trusted to sign either remote SMTP client certificates or intermediate CA
|
|
certificates. Do not forget to create the necessary "hash" links with,
|
|
for example, "$OPENSSL_HOME/bin/c_rehash /etc/postfix/certs". To use
|
|
<a href="postconf.5.html#smtpd_tls_CApath">smtpd_tls_CApath</a> in chroot mode, this directory (or a copy) must be
|
|
inside the chroot jail. </p>
|
|
|
|
<p> Specify "<a href="postconf.5.html#smtpd_tls_CApath">smtpd_tls_CApath</a> = /path/to/system_CA_directory" to
|
|
use ONLY the system-supplied default Certification Authority certificates.
|
|
</p>
|
|
|
|
<p> Specify "<a href="postconf.5.html#tls_append_default_CA">tls_append_default_CA</a> = no" to prevent Postfix from
|
|
appending the system-supplied default CAs and trusting third-party
|
|
certificates. </p>
|
|
|
|
<p> By default (see <a href="postconf.5.html#smtpd_tls_ask_ccert">smtpd_tls_ask_ccert</a>), client certificates are
|
|
not requested, and <a href="postconf.5.html#smtpd_tls_CApath">smtpd_tls_CApath</a> should remain empty. In contrast
|
|
to <a href="postconf.5.html#smtpd_tls_CAfile">smtpd_tls_CAfile</a>, DNs of Certification Authorities installed
|
|
in $<a href="postconf.5.html#smtpd_tls_CApath">smtpd_tls_CApath</a> are not included in the client certificate
|
|
request message. MUAs with multiple client certificates may use the
|
|
list of preferred Certification Authorities to select the correct
|
|
client certificate. You may want to put your "preferred" CA or
|
|
CAs in $<a href="postconf.5.html#smtpd_tls_CAfile">smtpd_tls_CAfile</a>, and install the remaining trusted CAs in
|
|
$<a href="postconf.5.html#smtpd_tls_CApath">smtpd_tls_CApath</a>. </p>
|
|
|
|
<p> Example: </p>
|
|
|
|
<pre>
|
|
<a href="postconf.5.html#smtpd_tls_CApath">smtpd_tls_CApath</a> = /etc/postfix/certs
|
|
</pre>
|
|
|
|
<p> This feature is available in Postfix 2.2 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="smtpd_tls_always_issue_session_ids">smtpd_tls_always_issue_session_ids</a>
|
|
(default: yes)</b></DT><DD>
|
|
|
|
<p> Force the Postfix SMTP server to issue a TLS session id, even
|
|
when TLS session caching is turned off (<a href="postconf.5.html#smtpd_tls_session_cache_database">smtpd_tls_session_cache_database</a>
|
|
is empty). This behavior is compatible with Postfix < 2.3. </p>
|
|
|
|
<p> With Postfix 2.3 and later the Postfix SMTP server can disable
|
|
session id generation when TLS session caching is turned off. This
|
|
keeps remote SMTP clients from caching sessions that almost certainly cannot
|
|
be re-used. </p>
|
|
|
|
<p> By default, the Postfix SMTP server always generates TLS session
|
|
ids. This works around a known defect in mail client applications
|
|
such as MS Outlook, and may also prevent interoperability issues
|
|
with other MTAs. </p>
|
|
|
|
<p> Example: </p>
|
|
|
|
<pre>
|
|
<a href="postconf.5.html#smtpd_tls_always_issue_session_ids">smtpd_tls_always_issue_session_ids</a> = no
|
|
</pre>
|
|
|
|
<p> This feature is available in Postfix 2.3 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="smtpd_tls_ask_ccert">smtpd_tls_ask_ccert</a>
|
|
(default: no)</b></DT><DD>
|
|
|
|
<p> Ask a remote SMTP client for a client certificate. This
|
|
information is needed for certificate based mail relaying with,
|
|
for example, the <a href="postconf.5.html#permit_tls_clientcerts">permit_tls_clientcerts</a> feature. </p>
|
|
|
|
<p> Some clients such as Netscape will either complain if no
|
|
certificate is available (for the list of CAs in $<a href="postconf.5.html#smtpd_tls_CAfile">smtpd_tls_CAfile</a>)
|
|
or will offer multiple client certificates to choose from. This
|
|
may be annoying, so this option is "off" by default. </p>
|
|
|
|
<p> This feature is available in Postfix 2.2 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="smtpd_tls_auth_only">smtpd_tls_auth_only</a>
|
|
(default: no)</b></DT><DD>
|
|
|
|
<p> When TLS encryption is optional in the Postfix SMTP server, do
|
|
not announce or accept SASL authentication over unencrypted
|
|
connections. </p>
|
|
|
|
<p> This feature is available in Postfix 2.2 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="smtpd_tls_ccert_verifydepth">smtpd_tls_ccert_verifydepth</a>
|
|
(default: 9)</b></DT><DD>
|
|
|
|
<p> The verification depth for remote SMTP client certificates. A
|
|
depth of 1 is sufficient if the issuing CA is listed in a local CA
|
|
file. </p>
|
|
|
|
<p> The default verification depth is 9 (the OpenSSL default) for
|
|
compatibility with earlier Postfix behavior. Prior to Postfix 2.5,
|
|
the default value was 5, but the limit was not actually enforced. If
|
|
you have set this to a lower non-default value, certificates with longer
|
|
trust chains may now fail to verify. Certificate chains with 1 or 2
|
|
CAs are common, deeper chains are more rare and any number between 5
|
|
and 9 should suffice in practice. You can choose a lower number if,
|
|
for example, you trust certificates directly signed by an issuing CA
|
|
but not any CAs it delegates to. </p>
|
|
|
|
<p> This feature is available in Postfix 2.2 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="smtpd_tls_cert_file">smtpd_tls_cert_file</a>
|
|
(default: empty)</b></DT><DD>
|
|
|
|
<p> File with the Postfix SMTP server RSA certificate in PEM format.
|
|
This file may also contain the Postfix SMTP server private RSA key.
|
|
With Postfix ≥ 3.4 the preferred way to configure server keys and
|
|
certificates is via the "<a href="postconf.5.html#smtpd_tls_chain_files">smtpd_tls_chain_files</a>" parameter. </p>
|
|
|
|
<p> Public Internet MX hosts without certificates signed by a "reputable"
|
|
CA must generate, and be prepared to present to most clients, a
|
|
self-signed or private-CA signed certificate. The client will not be
|
|
able to authenticate the server, but unless it is running Postfix 2.3 or
|
|
similar software, it will still insist on a server certificate. </p>
|
|
|
|
<p> For servers that are <b>not</b> public Internet MX hosts, Postfix
|
|
supports configurations with no certificates. This entails the use of
|
|
just the anonymous TLS ciphers, which are not supported by typical SMTP
|
|
clients. Since some clients may not fall back to plain text after a TLS
|
|
handshake failure, a certificate-less Postfix SMTP server will be unable
|
|
to receive email from some TLS-enabled clients. To avoid accidental
|
|
configurations with no certificates, Postfix enables certificate-less
|
|
operation only when the administrator explicitly sets
|
|
"<a href="postconf.5.html#smtpd_tls_cert_file">smtpd_tls_cert_file</a> = none". This ensures that new Postfix SMTP server
|
|
configurations will not accidentally enable TLS without certificates. </p>
|
|
|
|
<p> Note that server certificates are not optional in TLS 1.3. To run
|
|
without certificates you'd have to disable the TLS 1.3 protocol by
|
|
including '!TLSv1.3' in "<a href="postconf.5.html#smtpd_tls_protocols">smtpd_tls_protocols</a>" and perhaps also
|
|
"<a href="postconf.5.html#smtpd_tls_mandatory_protocols">smtpd_tls_mandatory_protocols</a>". It is simpler instead to just
|
|
configure a certificate chain. Certificate-less operation is not
|
|
recommended. <p>
|
|
|
|
<p> Both RSA and DSA certificates are supported. When both types
|
|
are present, the cipher used determines which certificate will be
|
|
presented to the client. For Netscape and OpenSSL clients without
|
|
special cipher choices the RSA certificate is preferred. </p>
|
|
|
|
<p> To enable a remote SMTP client to verify the Postfix SMTP server
|
|
certificate, the issuing CA certificates must be made available to the
|
|
client. You should include the required certificates in the server
|
|
certificate file, the server certificate first, then the issuing
|
|
CA(s) (bottom-up order). </p>
|
|
|
|
<p> Example: the certificate for "server.example.com" was issued by
|
|
"intermediate CA" which itself has a certificate of "root CA".
|
|
Create the server.pem file with "cat server_cert.pem intermediate_CA.pem
|
|
root_CA.pem > server.pem". </p>
|
|
|
|
<p> If you also want to verify client certificates issued by these
|
|
CAs, you can add the CA certificates to the <a href="postconf.5.html#smtpd_tls_CAfile">smtpd_tls_CAfile</a>, in which
|
|
case it is not necessary to have them in the <a href="postconf.5.html#smtpd_tls_cert_file">smtpd_tls_cert_file</a>,
|
|
<a href="postconf.5.html#smtpd_tls_dcert_file">smtpd_tls_dcert_file</a> (obsolete) or <a href="postconf.5.html#smtpd_tls_eccert_file">smtpd_tls_eccert_file</a>. </p>
|
|
|
|
<p> A certificate supplied here must be usable as an SSL server certificate
|
|
and hence pass the "openssl verify -purpose sslserver ..." test. </p>
|
|
|
|
<p> Example: </p>
|
|
|
|
<pre>
|
|
<a href="postconf.5.html#smtpd_tls_cert_file">smtpd_tls_cert_file</a> = /etc/postfix/server.pem
|
|
</pre>
|
|
|
|
<p> This feature is available in Postfix 2.2 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="smtpd_tls_chain_files">smtpd_tls_chain_files</a>
|
|
(default: empty)</b></DT><DD>
|
|
|
|
<p> List of one or more PEM files, each holding one or more private keys
|
|
directly followed by a corresponding certificate chain. The file names
|
|
are separated by commas and/or whitespace. This parameter obsoletes the
|
|
legacy algorithm-specific key and certificate file settings. When this
|
|
parameter is non-empty, the legacy parameters are ignored, and a warning
|
|
is logged if any are also non-empty. </p>
|
|
|
|
<p> With the proliferation of multiple private key algorithms—which,
|
|
as of OpenSSL 1.1.1, include DSA (obsolete), RSA, ECDSA, Ed25519
|
|
and Ed448—it is increasingly impractical to use separate
|
|
parameters to configure the key and certificate chain for each
|
|
algorithm. Therefore, Postfix now supports storing multiple keys and
|
|
corresponding certificate chains in a single file or in a set of files.
|
|
|
|
<p> Each key must appear <b>immediately before</b> the corresponding
|
|
certificate, optionally followed by additional issuer certificates that
|
|
complete the certificate chain for that key. When multiple files are
|
|
specified, they are equivalent to a single file that is concatenated
|
|
from those files in the given order. Thus, while a key must always
|
|
precede its certificate and issuer chain, it can be in a separate file,
|
|
so long as that file is listed immediately before the file that holds
|
|
the corresponding certificate chain. Once all the files are
|
|
concatenated, the sequence of PEM objects must be: <i>key1, cert1,
|
|
[chain1], key2, cert2, [chain2], ..., keyN, certN, [chainN].</i> </p>
|
|
|
|
<p> Storing the private key in the same file as the corresponding
|
|
certificate is more reliable. With the key and certificate in separate
|
|
files, there is a chance that during key rollover a Postfix process
|
|
might load a private key and certificate from separate files that don't
|
|
match. Various operational errors may even result in a persistent
|
|
broken configuration in which the certificate does not match the private
|
|
key. </p>
|
|
|
|
<p> The file or files must contain at most one key of each type. If,
|
|
for example, two or more RSA keys and corresponding chains are listed,
|
|
depending on the version of OpenSSL either only the last one will be
|
|
used or a configuration error may be detected. Note that while
|
|
"Ed25519" and "Ed448" are considered separate algorithms, the various
|
|
ECDSA curves (typically one of prime256v1, secp384r1 or secp521r1) are
|
|
considered as different parameters of a single "ECDSA" algorithm, so it
|
|
is not presently possible to configure keys for more than one ECDSA
|
|
curve. </p>
|
|
|
|
<p> RSA is still the most widely supported algorithm. Presently (late
|
|
2018), ECDSA support is common, but not yet universal, and Ed25519 and
|
|
Ed448 support is mostly absent. Therefore, an RSA key should generally
|
|
be configured, along with any additional keys for the other algorithms
|
|
when desired. </p>
|
|
|
|
<p>
|
|
Example (separate files for each key and corresponding certificate chain):
|
|
</p>
|
|
<blockquote>
|
|
<pre>
|
|
/etc/postfix/<a href="postconf.5.html">main.cf</a>:
|
|
<a href="postconf.5.html#smtpd_tls_chain_files">smtpd_tls_chain_files</a> =
|
|
${<a href="postconf.5.html#config_directory">config_directory</a>}/ed25519.pem,
|
|
${<a href="postconf.5.html#config_directory">config_directory</a>}/ed448.pem,
|
|
${<a href="postconf.5.html#config_directory">config_directory</a>}/rsa.pem
|
|
</pre>
|
|
</blockquote>
|
|
|
|
<blockquote>
|
|
<pre>
|
|
/etc/postfix/ed25519.pem:
|
|
-----BEGIN PRIVATE KEY-----
|
|
MC4CAQAwBQYDK2VwBCIEIEJfbbO4BgBQGBg9NAbIJaDBqZb4bC4cOkjtAH+Efbz3
|
|
-----END PRIVATE KEY-----
|
|
-----BEGIN CERTIFICATE-----
|
|
MIIBKzCB3qADAgECAhQaw+rflRreYuUZBp0HuNn/e5rMZDAFBgMrZXAwFDESMBAG
|
|
...
|
|
nC0egv51YPDWxEHom4QA
|
|
-----END CERTIFICATE-----
|
|
</pre>
|
|
</blockquote>
|
|
|
|
<blockquote>
|
|
<pre>
|
|
/etc/postfix/ed448.pem:
|
|
-----BEGIN PRIVATE KEY-----
|
|
MEcCAQAwBQYDK2VxBDsEOQf+m0P+G0qi+NZ0RolyeiE5zdlPQR8h8y4jByBifpIe
|
|
LNler7nzHQJ1SLcOiXFHXlxp/84VZuh32A==
|
|
-----END PRIVATE KEY-----
|
|
-----BEGIN CERTIFICATE-----
|
|
MIIBdjCB96ADAgECAhQSv4oP972KypOZPNPF4fmsiQoRHzAFBgMrZXEwFDESMBAG
|
|
...
|
|
pQcWsx+4J29e6YWH3Cy/CdUaexKP4RPCZDrPX7bk5C2BQ+eeYOxyThMA
|
|
-----END CERTIFICATE-----
|
|
</pre>
|
|
</blockquote>
|
|
|
|
<blockquote>
|
|
<pre>
|
|
/etc/postfix/rsa.pem:
|
|
-----BEGIN PRIVATE KEY-----
|
|
MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQDc4QusgkahH9rL
|
|
...
|
|
ahQkZ3+krcaJvDSMgvu0tDc=
|
|
-----END PRIVATE KEY-----
|
|
-----BEGIN CERTIFICATE-----
|
|
MIIC+DCCAeCgAwIBAgIUIUkrbk1GAemPCT8i9wKsTGDH7HswDQYJKoZIhvcNAQEL
|
|
...
|
|
Rirz15HGVNTK8wzFd+nulPzwUo6dH2IU8KazmyRi7OGvpyrMlm15TRE2oyE=
|
|
-----END CERTIFICATE-----
|
|
</pre>
|
|
</blockquote>
|
|
|
|
<p>
|
|
Example (all keys and certificates in a single file):
|
|
</p>
|
|
<blockquote>
|
|
<pre>
|
|
/etc/postfix/<a href="postconf.5.html">main.cf</a>:
|
|
<a href="postconf.5.html#smtpd_tls_chain_files">smtpd_tls_chain_files</a> = ${<a href="postconf.5.html#config_directory">config_directory</a>}/chains.pem
|
|
</pre>
|
|
</blockquote>
|
|
|
|
<blockquote>
|
|
<pre>
|
|
/etc/postfix/chains.pem:
|
|
-----BEGIN PRIVATE KEY-----
|
|
MC4CAQAwBQYDK2VwBCIEIEJfbbO4BgBQGBg9NAbIJaDBqZb4bC4cOkjtAH+Efbz3
|
|
-----END PRIVATE KEY-----
|
|
-----BEGIN CERTIFICATE-----
|
|
MIIBKzCB3qADAgECAhQaw+rflRreYuUZBp0HuNn/e5rMZDAFBgMrZXAwFDESMBAG
|
|
...
|
|
nC0egv51YPDWxEHom4QA
|
|
-----END CERTIFICATE-----
|
|
-----BEGIN PRIVATE KEY-----
|
|
MEcCAQAwBQYDK2VxBDsEOQf+m0P+G0qi+NZ0RolyeiE5zdlPQR8h8y4jByBifpIe
|
|
LNler7nzHQJ1SLcOiXFHXlxp/84VZuh32A==
|
|
-----END PRIVATE KEY-----
|
|
-----BEGIN CERTIFICATE-----
|
|
MIIBdjCB96ADAgECAhQSv4oP972KypOZPNPF4fmsiQoRHzAFBgMrZXEwFDESMBAG
|
|
...
|
|
pQcWsx+4J29e6YWH3Cy/CdUaexKP4RPCZDrPX7bk5C2BQ+eeYOxyThMA
|
|
-----END CERTIFICATE-----
|
|
-----BEGIN PRIVATE KEY-----
|
|
MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQDc4QusgkahH9rL
|
|
...
|
|
ahQkZ3+krcaJvDSMgvu0tDc=
|
|
-----END PRIVATE KEY-----
|
|
-----BEGIN CERTIFICATE-----
|
|
MIIC+DCCAeCgAwIBAgIUIUkrbk1GAemPCT8i9wKsTGDH7HswDQYJKoZIhvcNAQEL
|
|
...
|
|
Rirz15HGVNTK8wzFd+nulPzwUo6dH2IU8KazmyRi7OGvpyrMlm15TRE2oyE=
|
|
-----END CERTIFICATE-----
|
|
</pre>
|
|
</blockquote>
|
|
|
|
<p> This feature is available in Postfix 3.4 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="smtpd_tls_cipherlist">smtpd_tls_cipherlist</a>
|
|
(default: empty)</b></DT><DD>
|
|
|
|
<p> Obsolete Postfix < 2.3 control for the Postfix SMTP server TLS
|
|
cipher list. It is easy to create interoperability problems by choosing
|
|
a non-default cipher list. Do not use a non-default TLS cipherlist for
|
|
MX hosts on the public Internet. Clients that begin the TLS handshake,
|
|
but are unable to agree on a common cipher, may not be able to send any
|
|
email to the SMTP server. Using a restricted cipher list may be more
|
|
appropriate for a dedicated MSA or an internal mailhub, where one can
|
|
exert some control over the TLS software and settings of the connecting
|
|
clients. </p>
|
|
|
|
<p> <b>Note:</b> do not use "" quotes around the parameter value. </p>
|
|
|
|
<p>This feature is available with Postfix version 2.2. It is not used with
|
|
Postfix 2.3 and later; use <a href="postconf.5.html#smtpd_tls_mandatory_ciphers">smtpd_tls_mandatory_ciphers</a> instead. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="smtpd_tls_ciphers">smtpd_tls_ciphers</a>
|
|
(default: medium)</b></DT><DD>
|
|
|
|
<p> The minimum TLS cipher grade that the Postfix SMTP server
|
|
will use with opportunistic TLS encryption. Cipher types listed in
|
|
<a href="postconf.5.html#smtpd_tls_exclude_ciphers">smtpd_tls_exclude_ciphers</a> are excluded from the base definition of
|
|
the selected cipher grade. The default value is "medium" for Postfix
|
|
releases after the middle of 2015, "export" for older releases.
|
|
</p>
|
|
|
|
<p> When TLS is mandatory the cipher grade is chosen via the
|
|
<a href="postconf.5.html#smtpd_tls_mandatory_ciphers">smtpd_tls_mandatory_ciphers</a> configuration parameter, see there for syntax
|
|
details. </p>
|
|
|
|
<p> This feature is available in Postfix 2.6 and later. With earlier Postfix
|
|
releases only the <a href="postconf.5.html#smtpd_tls_mandatory_ciphers">smtpd_tls_mandatory_ciphers</a> parameter is implemented,
|
|
and opportunistic TLS always uses "export" or better (i.e. all) ciphers. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="smtpd_tls_dcert_file">smtpd_tls_dcert_file</a>
|
|
(default: empty)</b></DT><DD>
|
|
|
|
<p> File with the Postfix SMTP server DSA certificate in PEM format.
|
|
This file may also contain the Postfix SMTP server private DSA key.
|
|
The DSA algorithm is obsolete and should not be used. </p>
|
|
|
|
<p> See the discussion under <a href="postconf.5.html#smtpd_tls_cert_file">smtpd_tls_cert_file</a> for more details.
|
|
</p>
|
|
|
|
<p> Example: </p>
|
|
|
|
<pre>
|
|
<a href="postconf.5.html#smtpd_tls_dcert_file">smtpd_tls_dcert_file</a> = /etc/postfix/server-dsa.pem
|
|
</pre>
|
|
|
|
<p> This feature is available in Postfix 2.2 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="smtpd_tls_dh1024_param_file">smtpd_tls_dh1024_param_file</a>
|
|
(default: empty)</b></DT><DD>
|
|
|
|
<p> File with DH parameters that the Postfix SMTP server should
|
|
use with non-export EDH ciphers. </p>
|
|
|
|
<p> With Postfix ≥ 3.7, built with OpenSSL version is 3.0.0 or later, if the
|
|
parameter value is either empty or "<b>auto</b>", then the DH parameter
|
|
selection is delegated to the OpenSSL library, which selects appropriate
|
|
parameters based on the TLS handshake. This choice is likely to be the most
|
|
interoperable with SMTP clients using various TLS libraries, and custom local
|
|
parameters are no longer recommended when using Postfix ≥ 3.7 built against
|
|
OpenSSL 3.0.0. </p>
|
|
|
|
<p> The best-practice choice of parameters uses a 2048-bit prime. This is fine,
|
|
despite the historical "1024" in the parameter name. Do not be tempted to use
|
|
much larger values, performance degrades quickly, and you may also cease to
|
|
interoperate with some mainstream SMTP clients. As of Postfix 3.1, the
|
|
compiled-in default prime is 2048-bits, and it is not strictly necessary,
|
|
though perhaps somewhat beneficial to generate custom DH parameters. </p>
|
|
|
|
<p> Instead of using the exact same parameter sets as distributed
|
|
with other TLS packages, it is more secure to generate your own
|
|
set of parameters with something like the following commands: </p>
|
|
|
|
<blockquote>
|
|
<pre>
|
|
openssl dhparam -out /etc/postfix/dh2048.pem 2048
|
|
openssl dhparam -out /etc/postfix/dh1024.pem 1024
|
|
# As of Postfix 3.6, export-grade 512-bit DH parameters are no longer
|
|
# supported or needed.
|
|
openssl dhparam -out /etc/postfix/dh512.pem 512
|
|
</pre>
|
|
</blockquote>
|
|
|
|
<p> It is safe to share the same DH parameters between multiple
|
|
Postfix instances. If you prefer, you can generate separate
|
|
parameters for each instance. </p>
|
|
|
|
<p> If you want to take maximal advantage of ciphers that offer <a
|
|
href="FORWARD_SECRECY_README.html#dfn_fs">forward secrecy</a> see
|
|
the <a href="FORWARD_SECRECY_README.html#quick-start">Getting
|
|
started</a> section of <a
|
|
href="FORWARD_SECRECY_README.html">FORWARD_SECRECY_README</a>. The
|
|
full document conveniently presents all information about Postfix
|
|
"perfect" forward secrecy support in one place: what forward secrecy
|
|
is, how to tweak settings, and what you can expect to see when
|
|
Postfix uses ciphers with forward secrecy. </p>
|
|
|
|
<p> Example: </p>
|
|
|
|
<pre>
|
|
<a href="postconf.5.html#smtpd_tls_dh1024_param_file">smtpd_tls_dh1024_param_file</a> = /etc/postfix/dh2048.pem
|
|
</pre>
|
|
|
|
<p>This feature is available in Postfix 2.2 and later.</p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="smtpd_tls_dh512_param_file">smtpd_tls_dh512_param_file</a>
|
|
(default: empty)</b></DT><DD>
|
|
|
|
<p> File with DH parameters that the Postfix SMTP server should
|
|
use with export-grade EDH ciphers. The default SMTP server cipher
|
|
grade is "medium" with Postfix releases after the middle of 2015,
|
|
and as a result export-grade cipher suites are by default not used.
|
|
</p>
|
|
|
|
<p> With Postfix ≥ 3.6 export-grade Diffie-Hellman key exchange
|
|
is no longer supported, and this parameter is silently ignored. </p>
|
|
|
|
<p> See also the discussion under the <a href="postconf.5.html#smtpd_tls_dh1024_param_file">smtpd_tls_dh1024_param_file</a>
|
|
configuration parameter. </p>
|
|
|
|
<p> Example: </p>
|
|
|
|
<pre>
|
|
<a href="postconf.5.html#smtpd_tls_dh512_param_file">smtpd_tls_dh512_param_file</a> = /etc/postfix/dh_512.pem
|
|
</pre>
|
|
|
|
<p>This feature is available in Postfix 2.2 and later,
|
|
but is ignored in Postfix 3.6 and later.</p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="smtpd_tls_dkey_file">smtpd_tls_dkey_file</a>
|
|
(default: $<a href="postconf.5.html#smtpd_tls_dcert_file">smtpd_tls_dcert_file</a>)</b></DT><DD>
|
|
|
|
<p> File with the Postfix SMTP server DSA private key in PEM format.
|
|
This file may be combined with the Postfix SMTP server DSA certificate
|
|
file specified with $<a href="postconf.5.html#smtpd_tls_dcert_file">smtpd_tls_dcert_file</a>. The DSA algorithm is obsolete
|
|
and should not be used. </p>
|
|
|
|
<p> The private key must be accessible without a pass-phrase, i.e. it
|
|
must not be encrypted. File permissions should grant read-only
|
|
access to the system superuser account ("root"), and no access
|
|
to anyone else. </p>
|
|
|
|
<p> This feature is available in Postfix 2.2 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="smtpd_tls_eccert_file">smtpd_tls_eccert_file</a>
|
|
(default: empty)</b></DT><DD>
|
|
|
|
<p> File with the Postfix SMTP server ECDSA certificate in PEM format.
|
|
This file may also contain the Postfix SMTP server private ECDSA key.
|
|
With Postfix ≥ 3.4 the preferred way to configure server keys and
|
|
certificates is via the "<a href="postconf.5.html#smtpd_tls_chain_files">smtpd_tls_chain_files</a>" parameter. </p>
|
|
|
|
<p> See the discussion under <a href="postconf.5.html#smtpd_tls_cert_file">smtpd_tls_cert_file</a> for more details. </p>
|
|
|
|
<p> Example: </p>
|
|
|
|
<pre>
|
|
<a href="postconf.5.html#smtpd_tls_eccert_file">smtpd_tls_eccert_file</a> = /etc/postfix/ecdsa-scert.pem
|
|
</pre>
|
|
|
|
<p> This feature is available in Postfix 2.6 and later, when Postfix is
|
|
compiled and linked with OpenSSL 1.0.0 or later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="smtpd_tls_eckey_file">smtpd_tls_eckey_file</a>
|
|
(default: $<a href="postconf.5.html#smtpd_tls_eccert_file">smtpd_tls_eccert_file</a>)</b></DT><DD>
|
|
|
|
<p> File with the Postfix SMTP server ECDSA private key in PEM format.
|
|
This file may be combined with the Postfix SMTP server ECDSA certificate
|
|
file specified with $<a href="postconf.5.html#smtpd_tls_eccert_file">smtpd_tls_eccert_file</a>. With Postfix ≥ 3.4 the
|
|
preferred way to configure server keys and certificates is via the
|
|
"<a href="postconf.5.html#smtpd_tls_chain_files">smtpd_tls_chain_files</a>" parameter. </p>
|
|
|
|
<p> The private key must be accessible without a pass-phrase, i.e. it
|
|
must not be encrypted. File permissions should grant read-only
|
|
access to the system superuser account ("root"), and no access
|
|
to anyone else. </p>
|
|
|
|
<p> This feature is available in Postfix 2.6 and later, when Postfix is
|
|
compiled and linked with OpenSSL 1.0.0 or later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="smtpd_tls_eecdh_grade">smtpd_tls_eecdh_grade</a>
|
|
(default: see "postconf -d" output)</b></DT><DD>
|
|
|
|
<p> The Postfix SMTP server security grade for ephemeral elliptic-curve
|
|
Diffie-Hellman (EECDH) key exchange. As of Postfix 3.6, the value of
|
|
this parameter is always ignored, and Postfix behaves as though the
|
|
<b>auto</b> value (described below) was chosen.
|
|
</p>
|
|
|
|
<p> This feature is not used as of Postfix 3.6. Do not specify. </p>
|
|
|
|
<p> The available choices are: </p>
|
|
|
|
<dl>
|
|
|
|
<dt><b>auto</b></dt> <dd> Use the most preferred curve that is
|
|
supported by both the client and the server. This setting requires
|
|
Postfix ≥ 3.2 compiled and linked with OpenSSL ≥ 1.0.2. This
|
|
is the default setting under the above conditions (and the only
|
|
setting used with Postfix ≥ 3.6). </dd>
|
|
|
|
<dt><b>none</b></dt> <dd> Don't use EECDH. Ciphers based on EECDH key
|
|
exchange will be disabled. This is the default in Postfix versions
|
|
2.6 and 2.7. </dd>
|
|
|
|
<dt><b>strong</b></dt> <dd> Use EECDH with approximately 128 bits of
|
|
security at a reasonable computational cost. This is the default in
|
|
Postfix versions 2.8–3.5. </dd>
|
|
|
|
<dt><b>ultra</b></dt> <dd> Use EECDH with approximately 192 bits of
|
|
security at computational cost that is approximately twice as high
|
|
as 128 bit strength ECC. </dd>
|
|
|
|
</dl>
|
|
|
|
<p> If you want to take maximal advantage of ciphers that offer <a
|
|
href="FORWARD_SECRECY_README.html#dfn_fs">forward secrecy</a> see
|
|
the <a href="FORWARD_SECRECY_README.html#quick-start">Getting
|
|
started</a> section of <a
|
|
href="FORWARD_SECRECY_README.html">FORWARD_SECRECY_README</a>. The
|
|
full document conveniently presents all information about Postfix
|
|
"perfect" forward secrecy support in one place: what forward secrecy
|
|
is, how to tweak settings, and what you can expect to see when
|
|
Postfix uses ciphers with forward secrecy. </p>
|
|
|
|
<p> This feature is available in Postfix 2.6 and later, when it is
|
|
compiled and linked with OpenSSL 1.0.0 or later on platforms
|
|
where EC algorithms have not been disabled by the vendor. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="smtpd_tls_enable_rpk">smtpd_tls_enable_rpk</a>
|
|
(default: no)</b></DT><DD>
|
|
|
|
<p> Request that remote SMTP clients send an <a href="https://tools.ietf.org/html/rfc7250">RFC7250</a> raw public key
|
|
instead of an X.509 certificate, when asking for or requiring client
|
|
authentication. This feature is ignored when there is no raw public
|
|
key support in the local TLS implementation. </p>
|
|
|
|
<p> The Postfix SMTP server will log a warning when "<a href="postconf.5.html#smtpd_tls_enable_rpk">smtpd_tls_enable_rpk</a>
|
|
= yes", but the remote SMTP client sends a certificate, the
|
|
certificate's public key fingerprint does not match a <a href="postconf.5.html#check_ccert_access">check_ccert_access</a>
|
|
table, while the certificate fingerprint does match a <a href="postconf.5.html#check_ccert_access">check_ccert_access</a>
|
|
table. The remote SMTP client would lose access when it starts
|
|
sending a raw public key instead of a certificate, after its TLS
|
|
implementation is updated with raw public key support. </p>
|
|
|
|
<p> The Postfix SMTP server always sends a raw public key instead
|
|
of a certificate, if solicited by the remote SMTP client and the
|
|
local TLS implementation supports raw public keys. If the client
|
|
sends a server name indication with an SNI TLS extension, and
|
|
<a href="postconf.5.html#tls_server_sni_maps">tls_server_sni_maps</a> is configured, the server will extract a raw
|
|
public key from the indicated certificate. </p>
|
|
|
|
<p> Sample commands to compute certificate and public key SHA256 digests: </p>
|
|
|
|
<pre>
|
|
# SHA256 digest of the first certificate in "cert.pem"
|
|
$ openssl x509 -in cert.pem -outform DER | openssl dgst -sha256 -c
|
|
</pre>
|
|
|
|
<pre>
|
|
# SHA256 digest of the SPKI of the first certificate in "cert.pem"
|
|
$ openssl x509 -in cert.pem -pubkey -noout |
|
|
openssl pkey -pubin -outform DER | openssl dgst -sha256 -c
|
|
</pre>
|
|
|
|
<pre>
|
|
# SHA256 digest of the SPKI of the first private key in "pkey.pem"
|
|
$ openssl pkey -in pkey.pem -pubout -outform DER |
|
|
openssl dgst -sha256 -c
|
|
</pre>
|
|
|
|
<p> This feature is available in Postfix 3.9 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="smtpd_tls_exclude_ciphers">smtpd_tls_exclude_ciphers</a>
|
|
(default: empty)</b></DT><DD>
|
|
|
|
<p> List of ciphers or cipher types to exclude from the SMTP server
|
|
cipher list at all TLS security levels. Excluding valid ciphers
|
|
can create interoperability problems. DO NOT exclude ciphers unless it
|
|
is essential to do so. This is not an OpenSSL cipherlist; it is a simple
|
|
list separated by whitespace and/or commas. The elements are a single
|
|
cipher, or one or more "+" separated cipher properties, in which case
|
|
only ciphers matching <b>all</b> the properties are excluded. </p>
|
|
|
|
<p> Examples (some of these will cause problems): </p>
|
|
|
|
<blockquote>
|
|
<pre>
|
|
<a href="postconf.5.html#smtpd_tls_exclude_ciphers">smtpd_tls_exclude_ciphers</a> = aNULL
|
|
<a href="postconf.5.html#smtpd_tls_exclude_ciphers">smtpd_tls_exclude_ciphers</a> = MD5, DES
|
|
<a href="postconf.5.html#smtpd_tls_exclude_ciphers">smtpd_tls_exclude_ciphers</a> = DES+MD5
|
|
<a href="postconf.5.html#smtpd_tls_exclude_ciphers">smtpd_tls_exclude_ciphers</a> = AES256-SHA, DES-CBC3-MD5
|
|
<a href="postconf.5.html#smtpd_tls_exclude_ciphers">smtpd_tls_exclude_ciphers</a> = kEDH+aRSA
|
|
</pre>
|
|
</blockquote>
|
|
|
|
<p> The first setting disables anonymous ciphers. The next setting
|
|
disables ciphers that use the MD5 digest algorithm or the (single) DES
|
|
encryption algorithm. The next setting disables ciphers that use MD5 and
|
|
DES together. The next setting disables the two ciphers "AES256-SHA"
|
|
and "DES-CBC3-MD5". The last setting disables ciphers that use "EDH"
|
|
key exchange with RSA authentication. </p>
|
|
|
|
<p> This feature is available in Postfix 2.3 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="smtpd_tls_fingerprint_digest">smtpd_tls_fingerprint_digest</a>
|
|
(default: see "postconf -d" output)</b></DT><DD>
|
|
|
|
<p> The message digest algorithm to construct remote SMTP client-certificate
|
|
fingerprints or public key fingerprints (Postfix 2.9 and later) for
|
|
<b><a href="postconf.5.html#check_ccert_access">check_ccert_access</a></b> and <b><a href="postconf.5.html#permit_tls_clientcerts">permit_tls_clientcerts</a></b>. </p>
|
|
|
|
<p> The default algorithm is <b>sha256</b> with Postfix ≥ 3.6
|
|
and the <b><a href="postconf.5.html#compatibility_level">compatibility_level</a></b> set to 3.6 or higher. With Postfix
|
|
≤ 3.5, the default algorithm is <b>md5</b>. </p>
|
|
|
|
<p> The best-practice algorithm is now <b>sha256</b>. Recent advances in hash
|
|
function cryptanalysis have led to md5 and sha1 being deprecated in favor of
|
|
sha256. However, as long as there are no known "second pre-image" attacks
|
|
against the older algorithms, their use in this context, though not
|
|
recommended, is still likely safe. </p>
|
|
|
|
<p> While additional digest algorithms are often available with OpenSSL's
|
|
libcrypto, only those used by libssl in SSL cipher suites are available to
|
|
Postfix. You'll likely find support for md5, sha1, sha256 and sha512. </p>
|
|
|
|
<p> To find the fingerprint of a specific certificate file, with a
|
|
specific digest algorithm, run: </p>
|
|
|
|
<blockquote>
|
|
<pre>
|
|
$ openssl x509 -noout -fingerprint -<i>digest</i> -in <i>certfile</i>.pem
|
|
</pre>
|
|
</blockquote>
|
|
|
|
<p> The text to the right of "=" sign is the desired fingerprint.
|
|
For example: </p>
|
|
|
|
<blockquote>
|
|
<pre>
|
|
$ openssl x509 -noout -fingerprint -sha256 -in cert.pem
|
|
SHA256 Fingerprint=D4:6A:AB:19:24:...:A6:CB:66:82:C0:8E:9B:EE:29:A8:1A
|
|
</pre>
|
|
</blockquote>
|
|
|
|
<p> To extract the public key fingerprint from an X.509 certificate,
|
|
you need to extract the public key from the certificate and compute
|
|
the appropriate digest of its DER (ASN.1) encoding. With OpenSSL
|
|
the "-pubkey" option of the "x509" command extracts the public
|
|
key always in "PEM" format. We pipe the result to another OpenSSL
|
|
command that converts the key to DER and then to the "dgst" command
|
|
to compute the fingerprint. </p>
|
|
|
|
<p> Example: </p>
|
|
<blockquote>
|
|
<pre>
|
|
$ openssl x509 -in cert.pem -noout -pubkey |
|
|
openssl pkey -pubin -outform DER |
|
|
openssl dgst -sha256 -c
|
|
(stdin)= 64:3f:1f:f6:e5:1e:d4:2a:56:8b:fc:09:1a:61:98:b5:bc:7c:60:58
|
|
</pre>
|
|
</blockquote>
|
|
|
|
<p> The Postfix SMTP server and client log the peer (leaf) certificate
|
|
fingerprint and public key fingerprint when the TLS loglevel is 2 or
|
|
higher. </p>
|
|
|
|
<p> Example: client-certificate access table, with sha256 fingerprints: </p>
|
|
|
|
<blockquote>
|
|
<pre>
|
|
/etc/postfix/<a href="postconf.5.html">main.cf</a>:
|
|
<a href="postconf.5.html#smtpd_tls_fingerprint_digest">smtpd_tls_fingerprint_digest</a> = sha256
|
|
<a href="postconf.5.html#smtpd_client_restrictions">smtpd_client_restrictions</a> =
|
|
<a href="postconf.5.html#check_ccert_access">check_ccert_access</a> <a href="DATABASE_README.html#types">hash</a>:/etc/postfix/access,
|
|
reject
|
|
</pre>
|
|
<pre>
|
|
/etc/postfix/access:
|
|
# Action folded to next line...
|
|
AF:88:7C:AD:51:95:6F:36:96:...:01:FB:2E:48:CD:AB:49:25:A2:3B
|
|
OK
|
|
85:16:78:FD:73:6E:CE:70:E0:...:5F:0D:3C:C8:6D:C4:2C:24:59:E1
|
|
<a href="postconf.5.html#permit_auth_destination">permit_auth_destination</a>
|
|
</pre>
|
|
</blockquote>
|
|
|
|
<p> This feature is available in Postfix 2.5 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="smtpd_tls_key_file">smtpd_tls_key_file</a>
|
|
(default: $<a href="postconf.5.html#smtpd_tls_cert_file">smtpd_tls_cert_file</a>)</b></DT><DD>
|
|
|
|
<p> File with the Postfix SMTP server RSA private key in PEM format.
|
|
This file may be combined with the Postfix SMTP server RSA certificate
|
|
file specified with $<a href="postconf.5.html#smtpd_tls_cert_file">smtpd_tls_cert_file</a>. With Postfix ≥ 3.4 the
|
|
preferred way to configure server keys and certificates is via the
|
|
"<a href="postconf.5.html#smtpd_tls_chain_files">smtpd_tls_chain_files</a>" parameter. </p>
|
|
|
|
<p> The private key must be accessible without a pass-phrase, i.e. it
|
|
must not be encrypted. File permissions should grant read-only
|
|
access to the system superuser account ("root"), and no access
|
|
to anyone else. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="smtpd_tls_loglevel">smtpd_tls_loglevel</a>
|
|
(default: 0)</b></DT><DD>
|
|
|
|
<p> Enable additional Postfix SMTP server logging of TLS activity.
|
|
Each logging level also includes the information that is logged at
|
|
a lower logging level. </p>
|
|
|
|
<dl compact>
|
|
|
|
<dt> </dt> <dd> 0 Disable logging of TLS activity. </dd>
|
|
|
|
<dt> </dt> <dd> 1 Log only a summary message on TLS handshake completion
|
|
— no logging of client certificate trust-chain verification errors
|
|
if client certificate verification is not required. With Postfix 2.8 and
|
|
earlier, log the summary message, peer certificate summary information
|
|
and unconditionally log trust-chain verification errors. </dd>
|
|
|
|
<dt> </dt> <dd> 2 Also enable verbose logging in the Postfix TLS
|
|
library, log session cache operations, and enable OpenSSL logging
|
|
of the progress of the SSL handshake. </dd>
|
|
|
|
<dt> </dt> <dd> 3 Also log hexadecimal and ASCII dump of TLS negotiation
|
|
process. </dd>
|
|
|
|
<dt> </dt> <dd> 4 Also log hexadecimal and ASCII dump of complete
|
|
transmission after STARTTLS. </dd>
|
|
|
|
</dl>
|
|
|
|
<p> Do not use "<a href="postconf.5.html#smtpd_tls_loglevel">smtpd_tls_loglevel</a> = 2" or higher except in case
|
|
of problems. Use of loglevel 4 is strongly discouraged. </p>
|
|
|
|
<p> This feature is available in Postfix 2.2 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="smtpd_tls_mandatory_ciphers">smtpd_tls_mandatory_ciphers</a>
|
|
(default: medium)</b></DT><DD>
|
|
|
|
<p> The minimum TLS cipher grade that the Postfix SMTP server will
|
|
use with mandatory TLS encryption. The default grade ("medium") is
|
|
sufficiently strong that any benefit from globally restricting TLS
|
|
sessions to a more stringent grade is likely negligible, especially
|
|
given the fact that many implementations still do not offer any stronger
|
|
("high" grade) ciphers, while those that do, will always use "high"
|
|
grade ciphers. So insisting on "high" grade ciphers is generally
|
|
counter-productive. Allowing "export" or "low" ciphers is typically
|
|
not a good idea, as systems limited to just these are limited to
|
|
obsolete browsers. No known SMTP clients fail to support at least
|
|
one "medium" or "high" grade cipher. </p>
|
|
|
|
<p> The following cipher grades are supported: </p>
|
|
|
|
<dl>
|
|
<dt><b>high</b></dt>
|
|
<dd> Enable only "HIGH" grade OpenSSL ciphers. The
|
|
underlying cipherlist is specified via the <a href="postconf.5.html#tls_high_cipherlist">tls_high_cipherlist</a>
|
|
configuration parameter, which you are strongly encouraged to
|
|
not change. </dd>
|
|
|
|
<dt><b>medium</b></dt>
|
|
<dd> Enable "MEDIUM" grade or stronger OpenSSL ciphers. These use 128-bit
|
|
or longer symmetric bulk-encryption keys. This is the default minimum
|
|
strength for mandatory TLS encryption. The underlying cipherlist is
|
|
specified via the <a href="postconf.5.html#tls_medium_cipherlist">tls_medium_cipherlist</a> configuration parameter, which
|
|
you are strongly encouraged not to change. </dd>
|
|
|
|
<dt><b>null</b></dt>
|
|
<dd> Enable only the "NULL" OpenSSL ciphers, these provide authentication
|
|
without encryption. This setting is only appropriate in the rare
|
|
case that all clients are prepared to use NULL ciphers (not normally
|
|
enabled in TLS clients). The underlying cipherlist is specified via the
|
|
<a href="postconf.5.html#tls_null_cipherlist">tls_null_cipherlist</a> configuration parameter, which you are strongly
|
|
encouraged not to change. </dd>
|
|
|
|
<dt><b>low</b></dt>
|
|
<dd> Enable "LOW" grade or stronger OpenSSL ciphers. In Postfix
|
|
≥ 3.8 this cipher grade is always identical to "medium". Recent
|
|
versions of OpenSSL do not support any "LOW" grade ciphers. In
|
|
earlier Postfix releases the underlying cipherlist was specified
|
|
via the <a href="postconf.5.html#tls_low_cipherlist">tls_low_cipherlist</a> configuration parameter, which you are
|
|
strongly encouraged not to change. This obsolete cipher grade
|
|
SHOULD NOT be used. </dd>
|
|
|
|
<dt><b>export</b></dt>
|
|
<dd> Enable "EXPORT" grade or stronger OpenSSL ciphers. In Postfix
|
|
≥ 3.8 this cipher grade is always identical to "medium". Recent
|
|
versions of OpenSSL do not support any "EXPORT" grade ciphers. In
|
|
earlier Postfix releases the underlying cipherlist was specified
|
|
via the <a href="postconf.5.html#tls_export_cipherlist">tls_export_cipherlist</a> configuration parameter, which you are
|
|
strongly encouraged not to change. This obsolete cipher grade
|
|
SHOULD NOT be used. </dd>
|
|
|
|
</dl>
|
|
|
|
<p> Cipher types listed in
|
|
<a href="postconf.5.html#smtpd_tls_mandatory_exclude_ciphers">smtpd_tls_mandatory_exclude_ciphers</a> or <a href="postconf.5.html#smtpd_tls_exclude_ciphers">smtpd_tls_exclude_ciphers</a> are
|
|
excluded from the base definition of the selected cipher grade. See
|
|
<a href="postconf.5.html#smtpd_tls_ciphers">smtpd_tls_ciphers</a> for cipher controls that apply to opportunistic
|
|
TLS. </p>
|
|
|
|
<p> The underlying cipherlists for grades other than "null" include
|
|
anonymous ciphers, but these are automatically filtered out if the
|
|
server is configured to ask for remote SMTP client certificates. You are very
|
|
unlikely to need to take any steps to exclude anonymous ciphers, they
|
|
are excluded automatically as required. If you must exclude anonymous
|
|
ciphers even when Postfix does not need or use peer certificates, set
|
|
"<a href="postconf.5.html#smtpd_tls_exclude_ciphers">smtpd_tls_exclude_ciphers</a> = aNULL". To exclude anonymous ciphers only
|
|
when TLS is enforced, set "<a href="postconf.5.html#smtpd_tls_mandatory_exclude_ciphers">smtpd_tls_mandatory_exclude_ciphers</a> = aNULL". </p>
|
|
|
|
<p> This feature is available in Postfix 2.3 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="smtpd_tls_mandatory_exclude_ciphers">smtpd_tls_mandatory_exclude_ciphers</a>
|
|
(default: empty)</b></DT><DD>
|
|
|
|
<p> Additional list of ciphers or cipher types to exclude from the
|
|
Postfix SMTP server cipher list at mandatory TLS security levels.
|
|
This list
|
|
works in addition to the exclusions listed with <a href="postconf.5.html#smtpd_tls_exclude_ciphers">smtpd_tls_exclude_ciphers</a>
|
|
(see there for syntax details). </p>
|
|
|
|
<p> This feature is available in Postfix 2.3 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="smtpd_tls_mandatory_protocols">smtpd_tls_mandatory_protocols</a>
|
|
(default: see "postconf -d" output)</b></DT><DD>
|
|
|
|
<p> TLS protocols accepted by the Postfix SMTP server with mandatory TLS
|
|
encryption. If the list is empty, the server supports all available TLS
|
|
protocol versions. A non-empty value is a list of protocol names to
|
|
include or exclude, separated by whitespace, commas or colons. </p>
|
|
|
|
<p> The valid protocol names (see SSL_get_version(3)) are "SSLv2",
|
|
"SSLv3", "TLSv1", "TLSv1.1", "TLSv1.2" and "TLSv1.3". Starting with
|
|
Postfix 3.6, the default value is ">=TLSv1", which sets TLS 1.0 as
|
|
the lowest supported TLS protocol version (see below). Older releases
|
|
use the "!" exclusion syntax, also described below. </p>
|
|
|
|
<p> As of Postfix 3.6, the preferred way to limit the range of
|
|
acceptable protocols is to set the lowest acceptable TLS protocol
|
|
version and/or the highest acceptable TLS protocol version. To set the
|
|
lower bound include an element of the form: ">=<i>version</i>" where
|
|
<i>version</i> is a either one of the TLS protocol names listed above,
|
|
or a hexadecimal number corresponding to the desired TLS protocol
|
|
version (0301 for TLS 1.0, 0302 for TLS 1.1, etc.). For the upper
|
|
bound, use "<=<i>version</i>". There must be no whitespace between
|
|
the ">=" or "<=" symbols and the protocol name or number. </p>
|
|
|
|
<p> Hexadecimal protocol numbers make it possible to specify protocol
|
|
bounds for TLS versions that are known to OpenSSL, but might not be
|
|
known to Postfix. They cannot be used with the legacy exclusion syntax.
|
|
Leading "0" or "0x" prefixes are supported, but not required.
|
|
Therefore, "301", "0301", "0x301" and "0x0301" are all equivalent to
|
|
"TLSv1". Hexadecimal versions unknown to OpenSSL will fail to set the
|
|
upper or lower bound, and a warning will be logged. Hexadecimal
|
|
versions should only be used when Postfix is linked with some future
|
|
version of OpenSSL that supports TLS 1.4 or later, but Postfix does not
|
|
yet support a symbolic name for that protocol version. </p>
|
|
|
|
<p>Hexadecimal example (Postfix ≥ 3.6):</p>
|
|
<blockquote>
|
|
<pre>
|
|
# Allow only TLS 1.2 through (hypothetical) TLS 1.4, once supported
|
|
# in some future version of OpenSSL (presently a warning is logged).
|
|
<a href="postconf.5.html#smtpd_tls_mandatory_protocols">smtpd_tls_mandatory_protocols</a> = >=TLSv1.2, <=0305
|
|
# Allow only TLS 1.2 and up:
|
|
<a href="postconf.5.html#smtpd_tls_mandatory_protocols">smtpd_tls_mandatory_protocols</a> = >=0x0303
|
|
</pre>
|
|
</blockquote>
|
|
|
|
<p> With Postfix < 3.6 there is no support for a minimum or maximum
|
|
version, and the protocol range is configured via protocol exclusions.
|
|
To require at least TLS 1.0, set "<a href="postconf.5.html#smtpd_tls_mandatory_protocols">smtpd_tls_mandatory_protocols</a> =
|
|
!SSLv2, !SSLv3". Listing the protocols to include, rather than
|
|
protocols to exclude, is supported, but not recommended. The exclusion
|
|
form more accurately matches the underlying OpenSSL interface. </p>
|
|
|
|
<p> Support for "TLSv1.3" was introduced in OpenSSL 1.1.1. Disabling
|
|
this protocol via "!TLSv1.3" is supported since Postfix 3.4 (or patch
|
|
releases ≥ 3.0.14, 3.1.10, 3.2.7 and 3.3.2). </p>
|
|
|
|
<p> Example: </p>
|
|
|
|
<pre>
|
|
# Preferred syntax with Postfix ≥ 3.6:
|
|
<a href="postconf.5.html#smtpd_tls_mandatory_protocols">smtpd_tls_mandatory_protocols</a> = >=TLSv1.2, <=TLSv1.3
|
|
# Legacy syntax:
|
|
<a href="postconf.5.html#smtpd_tls_mandatory_protocols">smtpd_tls_mandatory_protocols</a> = !SSLv2, !SSLv3, !TLSv1, !TLSv1.1
|
|
</pre>
|
|
|
|
<p> This feature is available in Postfix 2.3 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="smtpd_tls_protocols">smtpd_tls_protocols</a>
|
|
(default: see 'postconf -d' output)</b></DT><DD>
|
|
|
|
<p> TLS protocols accepted by the Postfix SMTP server with opportunistic
|
|
TLS encryption. If the list is empty, the server supports all available
|
|
TLS protocol versions. A non-empty value is a list of protocol names to
|
|
include or exclude, separated by whitespace, commas or colons. </p>
|
|
|
|
<p> The valid protocol names (see SSL_get_version(3)) are "SSLv2",
|
|
"SSLv3", "TLSv1", "TLSv1.1", "TLSv1.2" and "TLSv1.3". Starting with
|
|
Postfix 3.6, the default value is ">=TLSv1", which sets TLS 1.0 as
|
|
the lowest supported TLS protocol version (see below). Older releases
|
|
use the "!" exclusion syntax, also described below. </p>
|
|
|
|
<p> As of Postfix 3.6, the preferred way to limit the range of
|
|
acceptable protocols is to set the lowest acceptable TLS protocol
|
|
version and/or the highest acceptable TLS protocol version. To set the
|
|
lower bound include an element of the form: ">=<i>version</i>" where
|
|
<i>version</i> is a either one of the TLS protocol names listed above,
|
|
or a hexadecimal number corresponding to the desired TLS protocol
|
|
version (0301 for TLS 1.0, 0302 for TLS 1.1, etc.). For the upper
|
|
bound, use "<=<i>version</i>". There must be no whitespace between
|
|
the ">=" or "<=" symbols and the protocol name or number. </p>
|
|
|
|
<p> Hexadecimal protocol numbers make it possible to specify protocol
|
|
bounds for TLS versions that are known to OpenSSL, but might not be
|
|
known to Postfix. They cannot be used with the legacy exclusion syntax.
|
|
Leading "0" or "0x" prefixes are supported, but not required.
|
|
Therefore, "301", "0301", "0x301" and "0x0301" are all equivalent to
|
|
"TLSv1". Hexadecimal versions unknown to OpenSSL will fail to set the
|
|
upper or lower bound, and a warning will be logged. Hexadecimal
|
|
versions should only be used when Postfix is linked with some future
|
|
version of OpenSSL that supports TLS 1.4 or later, but Postfix does not
|
|
yet support a symbolic name for that protocol version. </p>
|
|
|
|
<p>Hexadecimal example (Postfix ≥ 3.6):</p>
|
|
<blockquote>
|
|
<pre>
|
|
# Allow only TLS 1.0 through (hypothetical) TLS 1.4, once supported
|
|
# in some future version of OpenSSL (presently a warning is logged).
|
|
<a href="postconf.5.html#smtpd_tls_protocols">smtpd_tls_protocols</a> = >=TLSv1, <=0305
|
|
# Allow only TLS 1.0 and up:
|
|
<a href="postconf.5.html#smtpd_tls_protocols">smtpd_tls_protocols</a> = >=0x0301
|
|
</pre>
|
|
</blockquote>
|
|
|
|
<p> With Postfix < 3.6 there is no support for a minimum or maximum
|
|
version, and the protocol range is configured via protocol exclusions.
|
|
To require at least TLS 1.0, set "<a href="postconf.5.html#smtpd_tls_protocols">smtpd_tls_protocols</a> = !SSLv2, !SSLv3".
|
|
Listing the protocols to include, rather than protocols to exclude, is
|
|
supported, but not recommended. The exclusion form more accurately
|
|
matches the underlying OpenSSL interface. </p>
|
|
|
|
<p> Support for "TLSv1.3" was introduced in OpenSSL 1.1.1. Disabling
|
|
this protocol via "!TLSv1.3" is supported since Postfix 3.4 (or patch
|
|
releases ≥ 3.0.14, 3.1.10, 3.2.7 and 3.3.2). </p>
|
|
|
|
<p> Example: </p>
|
|
<pre>
|
|
# Preferred syntax with Postfix ≥ 3.6:
|
|
<a href="postconf.5.html#smtpd_tls_protocols">smtpd_tls_protocols</a> = >=TLSv1, <=TLSv1.3
|
|
# Legacy syntax:
|
|
<a href="postconf.5.html#smtpd_tls_protocols">smtpd_tls_protocols</a> = !SSLv2, !SSLv3
|
|
</pre>
|
|
|
|
<p> This feature is available in Postfix 2.6 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="smtpd_tls_received_header">smtpd_tls_received_header</a>
|
|
(default: no)</b></DT><DD>
|
|
|
|
<p> Request that the Postfix SMTP server produces Received: message
|
|
headers that include information about the protocol and cipher used,
|
|
as well as the remote SMTP client CommonName and client certificate issuer
|
|
CommonName. This is disabled by default, as the information may
|
|
be modified in transit through other mail servers. Only information
|
|
that was recorded by the final destination can be trusted. </p>
|
|
|
|
<p> This feature is available in Postfix 2.2 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="smtpd_tls_req_ccert">smtpd_tls_req_ccert</a>
|
|
(default: no)</b></DT><DD>
|
|
|
|
<p> With mandatory TLS encryption, require a trusted remote SMTP client
|
|
certificate in order to allow TLS connections to proceed. This
|
|
option implies "<a href="postconf.5.html#smtpd_tls_ask_ccert">smtpd_tls_ask_ccert</a> = yes". </p>
|
|
|
|
<p> When TLS encryption is optional, this setting is ignored with
|
|
a warning written to the mail log. </p>
|
|
|
|
<p> This feature is available in Postfix 2.2 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="smtpd_tls_security_level">smtpd_tls_security_level</a>
|
|
(default: empty)</b></DT><DD>
|
|
|
|
<p> The SMTP TLS security level for the Postfix SMTP server; when
|
|
a non-empty value is specified, this overrides the obsolete parameters
|
|
<a href="postconf.5.html#smtpd_use_tls">smtpd_use_tls</a> and <a href="postconf.5.html#smtpd_enforce_tls">smtpd_enforce_tls</a>. This parameter is ignored with
|
|
"<a href="postconf.5.html#smtpd_tls_wrappermode">smtpd_tls_wrappermode</a> = yes". </p>
|
|
|
|
<p> Specify one of the following security levels: </p>
|
|
|
|
<dl>
|
|
|
|
<dt><b>none</b></dt> <dd> TLS will not be used. </dd>
|
|
|
|
<dt><b>may</b></dt> <dd> Opportunistic TLS: announce STARTTLS support
|
|
to remote SMTP clients, but do not require that clients use TLS encryption.
|
|
</dd>
|
|
|
|
<dt><b>encrypt</b></dt> <dd>Mandatory TLS encryption: announce
|
|
STARTTLS support to remote SMTP clients, and reject all plaintext
|
|
commands except HELO, EHLO, XCLIENT, STARTTLS, NOOP, QUIT, and (Postfix
|
|
≥ 3.9) HELP. According to <a href="https://tools.ietf.org/html/rfc2487">RFC 2487</a> this MUST NOT be applied in case
|
|
of a publicly-referenced SMTP server. Instead, this should be used
|
|
on dedicated servers, for example submission (port 587). </dd>
|
|
|
|
</dl>
|
|
|
|
<p> Note 1: the "fingerprint", "verify" and "secure" levels are not
|
|
supported here.
|
|
The Postfix SMTP server logs a warning and uses "encrypt" instead.
|
|
To verify remote SMTP client certificates, see <a href="TLS_README.html">TLS_README</a> for a discussion
|
|
of the <a href="postconf.5.html#smtpd_tls_ask_ccert">smtpd_tls_ask_ccert</a>, <a href="postconf.5.html#smtpd_tls_req_ccert">smtpd_tls_req_ccert</a>, and <a href="postconf.5.html#permit_tls_clientcerts">permit_tls_clientcerts</a>
|
|
features. </p>
|
|
|
|
<p> Note 2: The parameter setting "<a href="postconf.5.html#smtpd_tls_security_level">smtpd_tls_security_level</a> =
|
|
encrypt" implies "<a href="postconf.5.html#smtpd_tls_auth_only">smtpd_tls_auth_only</a> = yes".</p>
|
|
|
|
<p> Note 3: when invoked via "sendmail -bs", Postfix will never
|
|
offer STARTTLS due to insufficient privileges to access the server
|
|
private key. This is intended behavior.</p>
|
|
|
|
<p> This feature is available in Postfix 2.3 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="smtpd_tls_session_cache_database">smtpd_tls_session_cache_database</a>
|
|
(default: empty)</b></DT><DD>
|
|
|
|
<p> Name of the file containing the optional Postfix SMTP server
|
|
TLS session cache. Specify a database type that supports enumeration,
|
|
such as <b>btree</b> or <b>sdbm</b>; there is no need to support
|
|
concurrent access. The file is created if it does not exist. The <a href="smtpd.8.html">smtpd(8)</a>
|
|
daemon does not use this parameter directly, rather the cache is
|
|
implemented indirectly in the <a href="tlsmgr.8.html">tlsmgr(8)</a> daemon. This means that
|
|
per-smtpd-instance <a href="master.5.html">master.cf</a> overrides of this parameter are not
|
|
effective. Note that each of the cache databases supported by <a href="tlsmgr.8.html">tlsmgr(8)</a>
|
|
daemon: $<a href="postconf.5.html#smtpd_tls_session_cache_database">smtpd_tls_session_cache_database</a>, $<a href="postconf.5.html#smtp_tls_session_cache_database">smtp_tls_session_cache_database</a>
|
|
(and with Postfix 2.3 and later $<a href="postconf.5.html#lmtp_tls_session_cache_database">lmtp_tls_session_cache_database</a>), needs to be
|
|
stored separately. It is not at this time possible to store multiple
|
|
caches in a single database. </p>
|
|
|
|
<p> Note: <b>dbm</b> databases are not suitable. TLS
|
|
session objects are too large. </p>
|
|
|
|
<p> As of version 2.5, Postfix no longer uses root privileges when
|
|
opening this file. The file should now be stored under the Postfix-owned
|
|
<a href="postconf.5.html#data_directory">data_directory</a>. As a migration aid, an attempt to open the file
|
|
under a non-Postfix directory is redirected to the Postfix-owned
|
|
<a href="postconf.5.html#data_directory">data_directory</a>, and a warning is logged. </p>
|
|
|
|
<p> As of Postfix 2.11 the preferred mechanism for session resumption
|
|
is <a href="https://tools.ietf.org/html/rfc5077">RFC 5077</a> TLS session tickets, which don't require server-side
|
|
storage. Consequently, for Postfix ≥ 2.11 this parameter should
|
|
generally be left empty. TLS session tickets require an OpenSSL
|
|
library (at least version 0.9.8h) that provides full support for
|
|
this TLS extension. See also <a href="postconf.5.html#smtpd_tls_session_cache_timeout">smtpd_tls_session_cache_timeout</a>. </p>
|
|
|
|
<p> Example: </p>
|
|
|
|
<pre>
|
|
<a href="postconf.5.html#smtpd_tls_session_cache_database">smtpd_tls_session_cache_database</a> = <a href="DATABASE_README.html#types">btree</a>:/var/lib/postfix/smtpd_scache
|
|
</pre>
|
|
|
|
<p> This feature is available in Postfix 2.2 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="smtpd_tls_session_cache_timeout">smtpd_tls_session_cache_timeout</a>
|
|
(default: 3600s)</b></DT><DD>
|
|
|
|
<p> The expiration time of Postfix SMTP server TLS session cache
|
|
information. A cache cleanup is performed periodically
|
|
every $<a href="postconf.5.html#smtpd_tls_session_cache_timeout">smtpd_tls_session_cache_timeout</a> seconds. As with
|
|
$<a href="postconf.5.html#smtpd_tls_session_cache_database">smtpd_tls_session_cache_database</a>, this parameter is implemented in the
|
|
<a href="tlsmgr.8.html">tlsmgr(8)</a> daemon and therefore per-smtpd-instance <a href="master.5.html">master.cf</a> overrides
|
|
are not possible. </p>
|
|
|
|
<p> As of Postfix 2.11 this setting cannot exceed 100 days. If set
|
|
≤ 0, session caching is disabled, not just via the database, but
|
|
also via <a href="https://tools.ietf.org/html/rfc5077">RFC 5077</a> TLS session tickets, which don't require server-side
|
|
storage. If set to a positive value less than 2 minutes, the minimum
|
|
value of 2 minutes is used instead. TLS session tickets require
|
|
an OpenSSL library (at least version 0.9.8h) that provides full
|
|
support for this TLS extension. </p>
|
|
|
|
<p> Specify a non-negative time value (an integral value plus an optional
|
|
one-letter suffix that specifies the time unit). Time units: s
|
|
(seconds), m (minutes), h (hours), d (days), w (weeks).
|
|
The default time unit is s (seconds). </p>
|
|
|
|
<p> This feature is available in Postfix 2.2 and later, and updated
|
|
for TLS session ticket support in Postfix 2.11. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="smtpd_tls_wrappermode">smtpd_tls_wrappermode</a>
|
|
(default: no)</b></DT><DD>
|
|
|
|
<p> Run the Postfix SMTP server in TLS "wrapper" mode,
|
|
instead of using the STARTTLS command. </p>
|
|
|
|
<p> If you want to support this service, enable a special port in
|
|
<a href="master.5.html">master.cf</a>, and specify "-o <a href="postconf.5.html#smtpd_tls_wrappermode">smtpd_tls_wrappermode</a>=yes" on the SMTP
|
|
server's command line. Port 465 (submissions, formerly called smtps)
|
|
is reserved for this purpose. </p>
|
|
|
|
<p> This feature is available in Postfix 2.2 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="smtpd_upstream_proxy_protocol">smtpd_upstream_proxy_protocol</a>
|
|
(default: empty)</b></DT><DD>
|
|
|
|
<p> The name of the proxy protocol used by an optional before-smtpd
|
|
proxy agent. When a proxy agent is used, this protocol conveys local
|
|
and remote address and port information. Specify
|
|
"<a href="postconf.5.html#smtpd_upstream_proxy_protocol">smtpd_upstream_proxy_protocol</a> = haproxy" to enable the haproxy
|
|
protocol; version 2 is supported with Postfix 3.5 and later. </p>
|
|
|
|
<p> NOTE: To use the nginx proxy with <a href="smtpd.8.html">smtpd(8)</a>, enable the XCLIENT
|
|
protocol with <a href="postconf.5.html#smtpd_authorized_xclient_hosts">smtpd_authorized_xclient_hosts</a>. This supports SASL
|
|
authentication in the proxy agent (Postfix 2.9 and later). <p>
|
|
|
|
<p> This feature is available in Postfix 2.10 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="smtpd_upstream_proxy_timeout">smtpd_upstream_proxy_timeout</a>
|
|
(default: 5s)</b></DT><DD>
|
|
|
|
<p> The time limit for the proxy protocol specified with the
|
|
<a href="postconf.5.html#smtpd_upstream_proxy_protocol">smtpd_upstream_proxy_protocol</a> parameter. </p>
|
|
|
|
<p> Specify a non-zero time value (an integral value plus an optional
|
|
one-letter suffix that specifies the time unit). Time units: s
|
|
(seconds), m (minutes), h (hours), d (days), w (weeks).
|
|
The default time unit is s (seconds). </p>
|
|
|
|
<p> This feature is available in Postfix 2.10 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="smtpd_use_tls">smtpd_use_tls</a>
|
|
(default: no)</b></DT><DD>
|
|
|
|
<p> Opportunistic TLS: announce STARTTLS support to remote SMTP clients,
|
|
but do not require that clients use TLS encryption. </p>
|
|
|
|
<p> Note: when invoked via "<b>sendmail -bs</b>", Postfix will never offer
|
|
STARTTLS due to insufficient privileges to access the server private
|
|
key. This is intended behavior. </p>
|
|
|
|
<p> This feature is deprecated as of Postfix 3.9. Specify
|
|
<a href="postconf.5.html#smtpd_tls_security_level">smtpd_tls_security_level</a> instead. </p>
|
|
|
|
<p> This feature is available in Postfix 2.2 and later. With
|
|
Postfix 2.3 and later use <a href="postconf.5.html#smtpd_tls_security_level">smtpd_tls_security_level</a> instead. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="smtputf8_autodetect_classes">smtputf8_autodetect_classes</a>
|
|
(default: sendmail, verify)</b></DT><DD>
|
|
|
|
<p> Detect that a message requires SMTPUTF8 support for the specified
|
|
mail origin classes. This is a workaround to avoid chicken-and-egg
|
|
problems during the initial SMTPUTF8 roll-out in environments with
|
|
pre-existing mail flows that contain UTF8. Those mail flows should
|
|
not break because Postfix suddenly refuses to deliver such mail
|
|
to down-stream MTAs that don't announce SMTPUTF8 support. </p>
|
|
|
|
<p> The problem is that Postfix cannot rely solely on the sender's
|
|
declaration that a message requires SMTPUTF8 support, because UTF8
|
|
may be introduced during local processing (for example, the client
|
|
hostname in Postfix's Received: header, adding @$<a href="postconf.5.html#myorigin">myorigin</a> or
|
|
.$<a href="postconf.5.html#mydomain">mydomain</a> to an incomplete address, address rewriting, alias
|
|
expansion, automatic BCC recipients, local forwarding, and changes
|
|
made by header checks or Milter applications). </p>
|
|
|
|
<p> For now, the default is to enable "SMTPUTF8 required" autodetection
|
|
only for Postfix sendmail command-line submissions and address
|
|
verification probes. This may change once SMTPUTF8 support achieves
|
|
world domination. However, sites that add UTF8 content via local
|
|
processing (see above) should autodetect the need for SMTPUTF8
|
|
support for all email.</p>
|
|
|
|
<p> Specify one or more of the following: </p>
|
|
|
|
<dl compact>
|
|
|
|
<dt> <b> sendmail </b> </dt> <dd> Submission with the Postfix
|
|
<a href="sendmail.1.html">sendmail(1)</a> command. </dd>
|
|
|
|
<dt> <b> smtpd </b> </dt> <dd> Mail received with the <a href="smtpd.8.html">smtpd(8)</a>
|
|
daemon. </dd>
|
|
|
|
<dt> <b> qmqpd </b> </dt> <dd> Mail received with the <a href="qmqpd.8.html">qmqpd(8)</a>
|
|
daemon. </dd>
|
|
|
|
<dt> <b> forward </b> </dt> <dd> Local forwarding or aliasing. When
|
|
a message is received with "SMTPUTF8 required", then the forwarded
|
|
(aliased) message always has "SMTPUTF8 required". </dd>
|
|
|
|
<dt> <b> bounce </b> </dt> <dd> Submission by the <a href="bounce.8.html">bounce(8)</a> daemon.
|
|
When a message is received with "SMTPUTF8 required", then the
|
|
delivery status notification always has "SMTPUTF8 required". </dd>
|
|
|
|
<dt> <b> notify </b> </dt> <dd> Postmaster notification from the
|
|
<a href="smtp.8.html">smtp(8)</a> or <a href="smtpd.8.html">smtpd(8)</a> daemon. </dd>
|
|
|
|
<dt> <b> verify </b> </dt> <dd> Address verification probe from the
|
|
<a href="verify.8.html">verify(8)</a> daemon. </dd>
|
|
|
|
<dt> <b> all </b> </dt> <dd> Enable SMTPUTF8 autodetection for all
|
|
mail. </dd>
|
|
|
|
</dl>
|
|
|
|
<p> This feature is available in Postfix 3.0 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="smtputf8_enable">smtputf8_enable</a>
|
|
(default: yes)</b></DT><DD>
|
|
|
|
<p> Enable preliminary SMTPUTF8 support for the protocols described
|
|
in <a href="https://tools.ietf.org/html/rfc6531">RFC 6531</a>, <a href="https://tools.ietf.org/html/rfc6532">RFC 6532</a>, and <a href="https://tools.ietf.org/html/rfc6533">RFC 6533</a>. This requires that Postfix is
|
|
built to support these protocols. </p>
|
|
|
|
<p> This feature is available in Postfix 3.0 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="socketmap_max_reply_size">socketmap_max_reply_size</a>
|
|
(default: 100000)</b></DT><DD>
|
|
|
|
<p> The maximum allowed reply size from a socketmap server, not
|
|
including the netstring encapsulation. </p>
|
|
|
|
<p> This feature is available in Postfix ≥ 3.10. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="soft_bounce">soft_bounce</a>
|
|
(default: no)</b></DT><DD>
|
|
|
|
<p>
|
|
Safety net to keep mail queued that would otherwise be returned to
|
|
the sender. This parameter disables locally-generated bounces,
|
|
changes the handling of negative responses from remote servers,
|
|
content filters or plugins,
|
|
and prevents the Postfix SMTP server from rejecting mail permanently
|
|
by changing 5xx reply codes into 4xx. However, <a href="postconf.5.html#soft_bounce">soft_bounce</a> is no
|
|
cure for address rewriting mistakes or mail routing mistakes.
|
|
</p>
|
|
|
|
<p>
|
|
Note: "<a href="postconf.5.html#soft_bounce">soft_bounce</a> = yes" is in some cases implemented by modifying
|
|
server responses. Therefore, the response that Postfix logs may
|
|
differ from the response that Postfix actually sends or receives.
|
|
</p>
|
|
|
|
<p>
|
|
Example:
|
|
</p>
|
|
|
|
<pre>
|
|
<a href="postconf.5.html#soft_bounce">soft_bounce</a> = yes
|
|
</pre>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="stale_lock_time">stale_lock_time</a>
|
|
(default: 500s)</b></DT><DD>
|
|
|
|
<p>
|
|
The time after which a stale exclusive mailbox lockfile is removed.
|
|
This is used for delivery to file or mailbox.
|
|
</p>
|
|
|
|
<p> Specify a non-zero time value (an integral value plus an optional
|
|
one-letter suffix that specifies the time unit). Time units: s
|
|
(seconds), m (minutes), h (hours), d (days), w (weeks).
|
|
The default time unit is s (seconds). </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="stress">stress</a>
|
|
(default: empty)</b></DT><DD>
|
|
|
|
<p> This feature is documented in the <a href="STRESS_README.html">STRESS_README</a> document. </p>
|
|
|
|
<p> This feature is available in Postfix 2.5 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="strict_7bit_headers">strict_7bit_headers</a>
|
|
(default: no)</b></DT><DD>
|
|
|
|
<p>
|
|
Reject mail with 8-bit text in message headers. This blocks mail
|
|
from poorly written applications.
|
|
</p>
|
|
|
|
<p>
|
|
This feature should not be enabled on a general purpose mail server,
|
|
because it is likely to reject legitimate email.
|
|
</p>
|
|
|
|
<p>
|
|
This feature is available in Postfix 2.0 and later.
|
|
</p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="strict_8bitmime">strict_8bitmime</a>
|
|
(default: no)</b></DT><DD>
|
|
|
|
<p>
|
|
Enable both <a href="postconf.5.html#strict_7bit_headers">strict_7bit_headers</a> and <a href="postconf.5.html#strict_8bitmime_body">strict_8bitmime_body</a>.
|
|
</p>
|
|
|
|
<p>
|
|
This feature should not be enabled on a general purpose mail server,
|
|
because it is likely to reject legitimate email.
|
|
</p>
|
|
|
|
<p>
|
|
This feature is available in Postfix 2.0 and later.
|
|
</p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="strict_8bitmime_body">strict_8bitmime_body</a>
|
|
(default: no)</b></DT><DD>
|
|
|
|
<p>
|
|
Reject 8-bit message body text without 8-bit MIME content encoding
|
|
information. This blocks mail from poorly written applications.
|
|
</p>
|
|
|
|
<p>
|
|
Unfortunately, this also rejects majordomo approval requests when
|
|
the included request contains valid 8-bit MIME mail, and it rejects
|
|
bounces from mailers that do not MIME encapsulate 8-bit content
|
|
(for example, bounces from qmail or from old versions of Postfix).
|
|
</p>
|
|
|
|
<p>
|
|
This feature should not be enabled on a general purpose mail server,
|
|
because it is likely to reject legitimate email.
|
|
</p>
|
|
|
|
<p>
|
|
This feature is available in Postfix 2.0 and later.
|
|
</p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="strict_mailbox_ownership">strict_mailbox_ownership</a>
|
|
(default: yes)</b></DT><DD>
|
|
|
|
<p> Defer delivery when a mailbox file is not owned by its recipient.
|
|
The default setting is not backwards compatible. </p>
|
|
|
|
<p> This feature is available in Postfix 2.5.3 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="strict_mime_encoding_domain">strict_mime_encoding_domain</a>
|
|
(default: no)</b></DT><DD>
|
|
|
|
<p>
|
|
Reject mail with invalid Content-Transfer-Encoding: information
|
|
for the message/* or multipart/* MIME content types. This blocks
|
|
mail from poorly written software.
|
|
</p>
|
|
|
|
<p>
|
|
This feature should not be enabled on a general purpose mail server,
|
|
because it will reject mail after a single violation.
|
|
</p>
|
|
|
|
<p>
|
|
This feature is available in Postfix 2.0 and later.
|
|
</p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="strict_rfc821_envelopes">strict_rfc821_envelopes</a>
|
|
(default: no)</b></DT><DD>
|
|
|
|
<p>
|
|
Require that addresses received in SMTP MAIL FROM and RCPT TO
|
|
commands are enclosed with <>, and that those addresses do
|
|
not contain <a href="https://tools.ietf.org/html/rfc822">RFC 822</a> style comments or phrases. This stops mail
|
|
from poorly written software.
|
|
</p>
|
|
|
|
<p>
|
|
By default, the Postfix SMTP server accepts <a href="https://tools.ietf.org/html/rfc822">RFC 822</a> syntax in MAIL
|
|
FROM and RCPT TO addresses.
|
|
</p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="strict_smtputf8">strict_smtputf8</a>
|
|
(default: no)</b></DT><DD>
|
|
|
|
<p> Enable stricter enforcement of the SMTPUTF8 protocol. The Postfix
|
|
SMTP server accepts UTF8 sender or recipient addresses only when
|
|
the client requests an SMTPUTF8 mail transaction. </p>
|
|
|
|
<p> This feature is available in Postfix 3.0 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="sun_mailtool_compatibility">sun_mailtool_compatibility</a>
|
|
(default: no)</b></DT><DD>
|
|
|
|
<p>
|
|
Obsolete SUN mailtool compatibility feature. Instead, use
|
|
"<a href="postconf.5.html#mailbox_delivery_lock">mailbox_delivery_lock</a> = dotlock".
|
|
</p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="swap_bangpath">swap_bangpath</a>
|
|
(default: yes)</b></DT><DD>
|
|
|
|
<p>
|
|
Enable the rewriting of "site!user" into "user@site". This is
|
|
necessary if your machine is connected to UUCP networks. It is
|
|
enabled by default.
|
|
</p>
|
|
|
|
<p> Note: with Postfix version 2.2, message header address rewriting
|
|
happens only when one of the following conditions is true: </p>
|
|
|
|
<ul>
|
|
|
|
<li> The message is received with the Postfix <a href="sendmail.1.html">sendmail(1)</a> command,
|
|
|
|
<li> The message is received from a network client that matches
|
|
$<a href="postconf.5.html#local_header_rewrite_clients">local_header_rewrite_clients</a>,
|
|
|
|
<li> The message is received from the network, and the
|
|
<a href="postconf.5.html#remote_header_rewrite_domain">remote_header_rewrite_domain</a> parameter specifies a non-empty value.
|
|
|
|
</ul>
|
|
|
|
<p> To get the behavior before Postfix version 2.2, specify
|
|
"<a href="postconf.5.html#local_header_rewrite_clients">local_header_rewrite_clients</a> = <a href="DATABASE_README.html#types">static</a>:all". </p>
|
|
|
|
<p>
|
|
Example:
|
|
</p>
|
|
|
|
<pre>
|
|
<a href="postconf.5.html#swap_bangpath">swap_bangpath</a> = no
|
|
</pre>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="syslog_facility">syslog_facility</a>
|
|
(default: mail)</b></DT><DD>
|
|
|
|
<p>
|
|
The syslog facility of Postfix logging. Specify a facility as
|
|
defined in syslog.conf(5). The default facility is "mail".
|
|
</p>
|
|
|
|
<p>
|
|
Warning: a non-default <a href="postconf.5.html#syslog_facility">syslog_facility</a> setting takes effect only
|
|
after a Postfix process has completed initialization. Errors during
|
|
process initialization will be logged with the default facility.
|
|
Examples are errors while parsing the command line arguments, and
|
|
errors while accessing the Postfix <a href="postconf.5.html">main.cf</a> configuration file.
|
|
</p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="syslog_name">syslog_name</a>
|
|
(default: see "postconf -d" output)</b></DT><DD>
|
|
|
|
<p>
|
|
A prefix that is prepended to the process name in syslog
|
|
records, so that, for example, "smtpd" becomes "prefix/smtpd".
|
|
</p>
|
|
|
|
<p>
|
|
Warning: a non-default <a href="postconf.5.html#syslog_name">syslog_name</a> setting takes effect only after
|
|
a Postfix process has completed initialization. Errors during
|
|
process initialization will be logged with the default name. Examples
|
|
are errors while parsing the command line arguments, and errors
|
|
while accessing the Postfix <a href="postconf.5.html">main.cf</a> configuration file.
|
|
</p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="tcp_windowsize">tcp_windowsize</a>
|
|
(default: 0)</b></DT><DD>
|
|
|
|
<p> An optional workaround for routers that break TCP window scaling.
|
|
Specify a value > 0 and < 65536 to enable this feature. With
|
|
Postfix TCP servers (<a href="smtpd.8.html">smtpd(8)</a>, <a href="qmqpd.8.html">qmqpd(8)</a>), this feature is implemented
|
|
by the Postfix <a href="master.8.html">master(8)</a> daemon. </p>
|
|
|
|
<p> To change this parameter without stopping Postfix, you need to
|
|
first terminate all Postfix TCP servers: </p>
|
|
|
|
<blockquote>
|
|
<pre>
|
|
# postconf -e <a href="postconf.5.html#master_service_disable">master_service_disable</a>=inet
|
|
# postfix reload
|
|
</pre>
|
|
</blockquote>
|
|
|
|
<p> This immediately terminates all processes that accept network
|
|
connections. Next, you enable Postfix TCP servers with the updated
|
|
<a href="postconf.5.html#tcp_windowsize">tcp_windowsize</a> setting: </p>
|
|
|
|
<blockquote>
|
|
<pre>
|
|
# postconf -e <a href="postconf.5.html#tcp_windowsize">tcp_windowsize</a>=65535 <a href="postconf.5.html#master_service_disable">master_service_disable</a>=
|
|
# postfix reload
|
|
</pre>
|
|
</blockquote>
|
|
|
|
<p> If you skip these steps with a running Postfix system, then the
|
|
<a href="postconf.5.html#tcp_windowsize">tcp_windowsize</a> change will work only for Postfix TCP clients (<a href="smtp.8.html">smtp(8)</a>,
|
|
<a href="lmtp.8.html">lmtp(8)</a>). </p>
|
|
|
|
<p> This feature is available in Postfix 2.6 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="tls_append_default_CA">tls_append_default_CA</a>
|
|
(default: no)</b></DT><DD>
|
|
|
|
<p> Append the system-supplied default Certification Authority
|
|
certificates to the ones specified with *_tls_CApath or *_tls_CAfile.
|
|
The default is "no"; this prevents Postfix from trusting third-party
|
|
certificates and giving them relay permission with
|
|
<a href="postconf.5.html#permit_tls_all_clientcerts">permit_tls_all_clientcerts</a>. </p>
|
|
|
|
<p> This feature is available in Postfix 2.4.15, 2.5.11, 2.6.8,
|
|
2.7.2 and later versions. Specify "<a href="postconf.5.html#tls_append_default_CA">tls_append_default_CA</a> = yes" for
|
|
backwards compatibility, to avoid breaking certificate verification
|
|
with sites that don't use <a href="postconf.5.html#permit_tls_all_clientcerts">permit_tls_all_clientcerts</a>. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="tls_config_file">tls_config_file</a>
|
|
(default: default)</b></DT><DD>
|
|
|
|
<p> Optional configuration file with baseline OpenSSL settings.
|
|
OpenSSL loads any SSL settings found in the configuration file for
|
|
the selected application name (see <a href="postconf.5.html#tls_config_name">tls_config_name</a>) or else the
|
|
built-in application name "openssl_conf" when no application name is
|
|
specified, or no corresponding configuration section is present.
|
|
</p>
|
|
|
|
<p> With OpenSSL releases 1.1.1 and 1.1.1a, applications (including
|
|
Postfix) can neither specify an alternative configuration file, nor
|
|
avoid loading the default configuration file. </p>
|
|
|
|
<p> With OpenSSL 1.1.1b or later, this parameter may be set to one of:
|
|
</p>
|
|
|
|
<dl>
|
|
|
|
<dt> <b>default</b> (default) </dt> <dd> Load the system-wide
|
|
"openssl.cnf" configuration file. </dd>
|
|
|
|
<dt> <b>none</b> (recommended, OpenSSL 1.1.1b or later only) </dt>
|
|
<dd> This setting disables loading of the system-wide "openssl.cnf"
|
|
file. </dd>
|
|
|
|
<dt> <b><i>/absolute-path</i></b> (OpenSSL 1.1.1b or later only) </dt>
|
|
<dd> Load the configuration file specified by <i>/absolute-path</i>.
|
|
With this setting it is an error for the file to not contain any
|
|
settings for the selected <a href="postconf.5.html#tls_config_name">tls_config_name</a>. There is no fallback to
|
|
the default "openssl_conf" name. </dd>
|
|
|
|
</dl>
|
|
|
|
<p> Failures in processing of the built-in default configuration file,
|
|
are silently ignored. Any errors in loading a non-default configuration
|
|
file are detected by Postfix, and cause TLS support to be disabled.
|
|
</p>
|
|
|
|
<p> The OpenSSL configuration file format is not documented here,
|
|
beyond giving two examples. <p>
|
|
|
|
<p> Example: Default settings for all applications. </p>
|
|
|
|
<blockquote>
|
|
<pre>
|
|
# The name 'openssl_conf' is the default application name
|
|
# The section name to the right of the '=' sign is arbitrary,
|
|
# any name will do, so long as it refers to the desired section.
|
|
#
|
|
# The name 'system_default' selects the settings applied internally
|
|
# by the SSL library as part of SSL object creation. Applications
|
|
# can then apply any additional settings of their choice.
|
|
#
|
|
# In this example, TLS versions prior to 1.2 are disabled by default.
|
|
#
|
|
openssl_conf = system_wide_settings
|
|
[system_wide_settings]
|
|
ssl_conf = ssl_library_settings
|
|
[ssl_library_settings]
|
|
system_default = initial_ssl_settings
|
|
[initial_ssl_settings]
|
|
MinProtocol = TLSv1.2
|
|
</pre>
|
|
</blockquote>
|
|
|
|
<p> Example: Custom settings for an application named "postfix". </p>
|
|
|
|
<blockquote>
|
|
<pre>
|
|
# The mapping from an application name to the corresponding configuration
|
|
# section must appear near the top of the file, (in what is sometimes called
|
|
# the "default section") prior to the start of any explicitly named
|
|
# "[sections]". The named sections can appear in any order and don't nest.
|
|
#
|
|
postfix = postfix_settings
|
|
[postfix_settings]
|
|
ssl_conf = postfix_ssl_settings
|
|
[postfix_ssl_settings]
|
|
system_default = baseline_postfix_settings
|
|
[baseline_postfix_settings]
|
|
MinProtocol = TLSv1
|
|
</pre>
|
|
</blockquote>
|
|
|
|
<p> Example: Custom OpenSSL group settings. </p>
|
|
|
|
<pre>
|
|
<a href="postconf.5.html">main.cf</a>:
|
|
<a href="postconf.5.html#tls_config_file">tls_config_file</a> = ${<a href="postconf.5.html#config_directory">config_directory</a>}/openssl.cnf
|
|
<a href="postconf.5.html#tls_config_name">tls_config_name</a> = postfix
|
|
</pre>
|
|
|
|
<pre>
|
|
openssl.cnf:
|
|
postfix = postfix_settings
|
|
</pre>
|
|
|
|
<pre>
|
|
[postfix_settings]
|
|
ssl_conf = postfix_ssl_settings
|
|
</pre>
|
|
|
|
<pre>
|
|
[postfix_ssl_settings]
|
|
system_default = baseline_postfix_settings
|
|
</pre>
|
|
|
|
<pre>
|
|
[baseline_postfix_settings]
|
|
# New OpenSSL 3.5 syntax, for older releases consider
|
|
# the Postfix default:
|
|
#
|
|
# Groups = X25519:X448:prime256v1:secp384r1:secp521r1:ffdhe2048:ffdhe3072
|
|
#
|
|
Groups = *X25519MLKEM768 / *X25519:X448 / P-256:P-384
|
|
</pre>
|
|
|
|
<p> Caution: It is typically best to just use the default OpenSSL
|
|
group settings, by setting "<a href="postconf.5.html#tls_config_file">tls_config_file</a> = none". Overly strict
|
|
system-wide TLS settings will conflict with Postfix's opportunistic
|
|
TLS, where being less restrictive is better than downgrading to
|
|
cleartext SMTP. </p>
|
|
|
|
<p> This feature is available in Postfix ≥ 3.9, 3.8.1, 3.7.6,
|
|
3.6.10, and 3.5.20. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="tls_config_name">tls_config_name</a>
|
|
(default: empty)</b></DT><DD>
|
|
|
|
<p> The application name passed by Postfix to OpenSSL library
|
|
initialization functions. This name is used to select the desired
|
|
configuration "section" in the OpenSSL configuration file specified
|
|
via the <a href="postconf.5.html#tls_config_file">tls_config_file</a> parameter. When empty, or when the
|
|
selected name is not present in the configuration file, the default
|
|
application name ("openssl_conf") is used as a fallback. </p>
|
|
|
|
<p> This feature is available in Postfix ≥ 3.9. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="tls_daemon_random_bytes">tls_daemon_random_bytes</a>
|
|
(default: 32)</b></DT><DD>
|
|
|
|
<p> The number of pseudo-random bytes that an <a href="smtp.8.html">smtp(8)</a> or <a href="smtpd.8.html">smtpd(8)</a>
|
|
process requests from the <a href="tlsmgr.8.html">tlsmgr(8)</a> server in order to seed its
|
|
internal pseudo random number generator (PRNG). The default of 32
|
|
bytes (equivalent to 256 bits) is sufficient to generate a 128bit
|
|
(or 168bit) session key. </p>
|
|
|
|
<p> This feature is available in Postfix 2.2 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="tls_dane_digest_agility">tls_dane_digest_agility</a>
|
|
(default: on)</b></DT><DD>
|
|
|
|
<p> Configure <a href="https://tools.ietf.org/html/rfc7671">RFC7671</a> DANE TLSA digest algorithm agility.
|
|
Do not change this setting from its default value. </p>
|
|
|
|
<p> See Section 8 of <a href="https://tools.ietf.org/html/rfc7671">RFC7671</a> for correct key rotation procedures. </p>
|
|
|
|
<p> This feature is available in Postfix 2.11 through 3.1. Postfix
|
|
3.2 and later ignore this configuration parameter and behave as
|
|
though it were set to "on". </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="tls_dane_digests">tls_dane_digests</a>
|
|
(default: sha512 sha256)</b></DT><DD>
|
|
|
|
<p> DANE TLSA (<a href="https://tools.ietf.org/html/rfc6698">RFC 6698</a>, <a href="https://tools.ietf.org/html/rfc7671">RFC 7671</a>, <a href="https://tools.ietf.org/html/rfc7672">RFC 7672</a>) resource-record "matching
|
|
type" digest algorithms in descending preference order. All the
|
|
specified algorithms must be supported by the underlying OpenSSL
|
|
library, otherwise the Postfix SMTP client will not support DANE
|
|
TLSA security. </p>
|
|
|
|
<p> Specify a list of digest names separated by commas and/or
|
|
whitespace. Each digest name may be followed by an optional
|
|
"=<number>" suffix. For example, "sha512" may instead be specified
|
|
as "sha512=2" and "sha256" may instead be specified as "sha256=1".
|
|
The optional number must match the <a
|
|
href="https://www.iana.org/assignments/dane-parameters/dane-parameters.xhtml#matching-types"
|
|
>IANA</a> assigned TLSA matching type number the algorithm in question.
|
|
Postfix will check this constraint for the algorithms it knows about.
|
|
Additional matching type algorithms registered with IANA can be added
|
|
with explicit numbers provided they are supported by OpenSSL. </p>
|
|
|
|
<p> Invalid list elements are logged with a warning and disable DANE
|
|
support. TLSA RRs that specify digests not included in the list are
|
|
ignored with a warning. </p>
|
|
|
|
<p> Note: It is unwise to omit sha256 from the digest list. This
|
|
digest algorithm is the only mandatory to implement digest algorithm
|
|
in <a href="https://tools.ietf.org/html/rfc6698">RFC 6698</a>, and many servers are expected to publish TLSA records
|
|
with just sha256 digests. Unless one of the standard digests is
|
|
seriously compromised and servers have had ample time to update their
|
|
TLSA records you should not omit any standard digests, just arrange
|
|
them in order from strongest to weakest. </p>
|
|
|
|
<p> This feature is available in Postfix 2.11 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="tls_dane_trust_anchor_digest_enable">tls_dane_trust_anchor_digest_enable</a>
|
|
(default: yes)</b></DT><DD>
|
|
|
|
<p> Enable support for <a href="https://tools.ietf.org/html/rfc6698">RFC 6698</a> (DANE TLSA) DNS records that contain
|
|
digests of trust-anchors with certificate usage "2". Do not change
|
|
this setting from its default value. </p>
|
|
|
|
<p> This feature is available in Postfix 2.11 through 3.1. It has
|
|
been withdrawn in Postfix 3.2, as trust-anchor TLSA records are now
|
|
widely used and have proved sufficiently reliable. Postfix 3.2 and
|
|
later ignore this configuration parameter and behaves as though it
|
|
were set to "yes". </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="tls_disable_workarounds">tls_disable_workarounds</a>
|
|
(default: see "postconf -d" output)</b></DT><DD>
|
|
|
|
<p> List or bit-mask of OpenSSL bug work-arounds to disable. </p>
|
|
|
|
<p> The OpenSSL toolkit includes a set of work-arounds for buggy SSL/TLS
|
|
implementations. Applications, such as Postfix, that want to maximize
|
|
interoperability ask the OpenSSL library to enable the full set of
|
|
recommended work-arounds. </p>
|
|
|
|
<p> From time to time, it is discovered that a work-around creates a
|
|
security issue, and should no longer be used. If upgrading OpenSSL
|
|
to a fixed version is not an option or an upgrade is not available
|
|
in a timely manner, or in closed environments where no buggy clients
|
|
or servers exist, it may be appropriate to disable some or all of the
|
|
OpenSSL interoperability work-arounds. This parameter specifies which
|
|
bug work-arounds to disable. </p>
|
|
|
|
<p> If the value of the parameter is a hexadecimal long integer starting
|
|
with "0x", the bug work-arounds corresponding to the bits specified in
|
|
its value are removed from the <b>SSL_OP_ALL</b> work-around bit-mask
|
|
(see openssl/ssl.h and SSL_CTX_set_options(3)). You can specify more
|
|
bits than are present in SSL_OP_ALL, excess bits are ignored. Specifying
|
|
0xFFFFFFFF disables all bug-workarounds on a 32-bit system. This should
|
|
also be sufficient on 64-bit systems, until OpenSSL abandons support
|
|
for 32-bit systems and starts using the high 32 bits of a 64-bit
|
|
bug-workaround mask. </p>
|
|
|
|
<p> Otherwise, the parameter is a white-space or comma separated list
|
|
of specific named bug work-arounds chosen from the list below. It
|
|
is possible that your OpenSSL version includes new bug work-arounds
|
|
added after your Postfix source code was last updated, in that case
|
|
you can only disable one of these via the hexadecimal syntax above. </p>
|
|
|
|
<dl>
|
|
|
|
<dt><b>CRYPTOPRO_TLSEXT_BUG</b></dt> <dd>New with GOST support in
|
|
OpenSSL 1.0.0.</dd>
|
|
|
|
<dt><b>DONT_INSERT_EMPTY_FRAGMENTS</b></dt> <dd>See
|
|
SSL_CTX_set_options(3)</dd>
|
|
|
|
<dt><b>LEGACY_SERVER_CONNECT</b></dt> <dd>See SSL_CTX_set_options(3)</dd>
|
|
|
|
<dt><b>MICROSOFT_BIG_SSLV3_BUFFER</b></dt> <dd>See
|
|
SSL_CTX_set_options(3)</dd>
|
|
|
|
<dt><b>MICROSOFT_SESS_ID_BUG</b></dt> <dd>See SSL_CTX_set_options(3)</dd>
|
|
|
|
<dt><b>MSIE_SSLV2_RSA_PADDING</b></dt> <dd> also aliased as
|
|
<b>CVE-2005-2969</b>. Postfix 2.8 disables this work-around by
|
|
default with OpenSSL versions that may predate the fix. Fixed in
|
|
OpenSSL 0.9.7h and OpenSSL 0.9.8a.</dd>
|
|
|
|
<dt><b>NETSCAPE_CHALLENGE_BUG</b></dt> <dd>See SSL_CTX_set_options(3)</dd>
|
|
|
|
<dt><b>NETSCAPE_REUSE_CIPHER_CHANGE_BUG</b></dt> <dd> also aliased
|
|
as <b>CVE-2010-4180</b>. Postfix 2.8 disables this work-around by
|
|
default with OpenSSL versions that may predate the fix. Fixed in
|
|
OpenSSL 0.9.8q and OpenSSL 1.0.0c.</dd>
|
|
|
|
<dt><b>SSLEAY_080_CLIENT_DH_BUG</b></dt> <dd>See
|
|
SSL_CTX_set_options(3)</dd>
|
|
|
|
<dt><b>SSLREF2_REUSE_CERT_TYPE_BUG</b></dt> <dd>See
|
|
SSL_CTX_set_options(3)</dd>
|
|
|
|
<dt><b>TLS_BLOCK_PADDING_BUG</b></dt> <dd>See SSL_CTX_set_options(3)</dd>
|
|
|
|
<dt><b>TLS_D5_BUG</b></dt> <dd>See SSL_CTX_set_options(3)</dd>
|
|
|
|
<dt><b>TLS_ROLLBACK_BUG</b></dt> <dd>See SSL_CTX_set_options(3).
|
|
This is disabled in OpenSSL 0.9.7 and later. Nobody should still
|
|
be using 0.9.6! </dd>
|
|
|
|
<dt><b>TLSEXT_PADDING</b></dt><dd>Postfix ≥ 3.4. See SSL_CTX_set_options(3).</dd>
|
|
|
|
</dl>
|
|
|
|
<p> This feature is available in Postfix 2.8 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="tls_eecdh_auto_curves">tls_eecdh_auto_curves</a>
|
|
(default: see "postconf -d" output)</b></DT><DD>
|
|
|
|
<p> The prioritized list of elliptic curves, that should be enabled in the
|
|
Postfix SMTP client and server. The selected curves should be implemented
|
|
by OpenSSL and be standardized for use in the TLS "supported groups" extension
|
|
(<a href="https://tools.ietf.org/html/rfc8422">RFC8422</a>, <a href="https://tools.ietf.org/html/rfc8446">RFC8446</a> and <a href="https://tools.ietf.org/html/rfc8447">RFC8447</a>). Be sure to include at least "x25519" and
|
|
"prime256v1" (the OpenSSL name for "secp256r1", a.k.a. "P-256"). The default
|
|
list is suitable for most users. </p>
|
|
|
|
<p> On the client side, the first curve listed will be used to construct the
|
|
client's initial TLS 1.3 "keyshare". If this is not supported by the server,
|
|
the TLS handshake may require an additional round-trip after the server issues
|
|
a HelloRetryRequest (HRR) indicating a suitable mutually supported curve. </p>
|
|
|
|
<p> Postfix skips curve names that are unknown to OpenSSL, or that are known
|
|
but not yet implemented. This makes it possible to "anticipate" support for
|
|
curves that should be used once they become available, or to deploy the same
|
|
setting on a server "farm" where not all servers support the same curves. </p>
|
|
|
|
<p> As of Postfix 3.10, when compiled with OpenSSL 3.0 or later, the "curve"
|
|
names can be more general key encapsulation mechanisms (KEMs), and/or may be
|
|
loaded from an external "provider" (via a suitable <a href="postconf.5.html#tls_config_file">tls_config_file</a>). </p>
|
|
|
|
<p> See also the "<a href="postconf.5.html#tls_ffdhe_auto_groups">tls_ffdhe_auto_groups</a>" parameter, which supports
|
|
customizing the list of FFDHE groups enabled with TLS 1.3. That setting
|
|
is introduced with Postfix 3.8, when built against OpenSSL 3.0 or later.
|
|
</p>
|
|
|
|
<p> Post-quantum cryptography support: OpenSSL 3.5 introduces new
|
|
configuration syntax that Postfix will not attempt to imitate.
|
|
Instead, with Postfix 3.6.17, 3.7.13, 3.8.8, 3.9.2, and later, set
|
|
both <a href="postconf.5.html#tls_eecdh_auto_curves">tls_eecdh_auto_curves</a> and if available <a href="postconf.5.html#tls_ffdhe_auto_groups">tls_ffdhe_auto_groups</a>
|
|
to the empty value, to enable algorithm selection through OpenSSL
|
|
configuration. See <a href="postconf.5.html#tls_config_file">tls_config_file</a> for a configuration example.
|
|
</p>
|
|
|
|
<p> This feature is available in Postfix 3.2 and later, when it is
|
|
compiled and linked with OpenSSL 1.0.2 or later on platforms where
|
|
EC algorithms have not been disabled by the vendor. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="tls_eecdh_strong_curve">tls_eecdh_strong_curve</a>
|
|
(default: prime256v1)</b></DT><DD>
|
|
|
|
<p> The elliptic curve used by the Postfix SMTP server for sensibly
|
|
strong
|
|
ephemeral ECDH key exchange. This curve is used by the Postfix SMTP
|
|
server when "<a href="postconf.5.html#smtpd_tls_eecdh_grade">smtpd_tls_eecdh_grade</a> = strong". The phrase "sensibly
|
|
strong" means approximately 128-bit security based on best known
|
|
attacks. The selected curve must be implemented by OpenSSL (as
|
|
reported by ecparam(1) with the "-list_curves" option) and be one
|
|
of the curves listed in Section 5.1.1 of <a href="https://tools.ietf.org/html/rfc8422">RFC 8422</a>. You should not
|
|
generally change this setting. Remote SMTP client implementations
|
|
must support this curve for EECDH key exchange to take place. It
|
|
is unwise to choose only "bleeding-edge" curves supported by only a
|
|
small subset of clients. </p>
|
|
|
|
<p> This feature is not used as of Postfix 3.6. Do not specify. </p>
|
|
|
|
<p> The default "strong" curve is rated in NSA <a
|
|
href="https://web.archive.org/web/20160330034144/https://www.nsa.gov/ia/programs/suiteb_cryptography/">Suite
|
|
B</a> for information classified up to SECRET. </p>
|
|
|
|
<p> Note: elliptic curve names are poorly standardized; different
|
|
standards groups are assigning different names to the same underlying
|
|
curves. The curve with the X9.62 name "prime256v1" is also known
|
|
under the SECG name "secp256r1", but OpenSSL does not recognize the
|
|
latter name. </p>
|
|
|
|
<p> If you want to take maximal advantage of ciphers that offer <a
|
|
href="FORWARD_SECRECY_README.html#dfn_fs">forward secrecy</a> see
|
|
the <a href="FORWARD_SECRECY_README.html#quick-start">Getting
|
|
started</a> section of <a
|
|
href="FORWARD_SECRECY_README.html">FORWARD_SECRECY_README</a>. The
|
|
full document conveniently presents all information about Postfix
|
|
"perfect" forward secrecy support in one place: what forward secrecy
|
|
is, how to tweak settings, and what you can expect to see when
|
|
Postfix uses ciphers with forward secrecy. </p>
|
|
|
|
<p> This feature is available in Postfix 2.6 and later, when it is
|
|
compiled and linked with OpenSSL 1.0.0 or later on platforms where
|
|
EC algorithms have not been disabled by the vendor. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="tls_eecdh_ultra_curve">tls_eecdh_ultra_curve</a>
|
|
(default: secp384r1)</b></DT><DD>
|
|
|
|
<p> The elliptic curve used by the Postfix SMTP server for maximally
|
|
strong
|
|
ephemeral ECDH key exchange. This curve is used by the Postfix SMTP
|
|
server when "<a href="postconf.5.html#smtpd_tls_eecdh_grade">smtpd_tls_eecdh_grade</a> = ultra". The phrase "maximally
|
|
strong" means approximately 192-bit security based on best known attacks.
|
|
This additional strength comes at a significant computational cost, most
|
|
users should instead set "<a href="postconf.5.html#smtpd_tls_eecdh_grade">smtpd_tls_eecdh_grade</a> = strong". The selected
|
|
curve must be implemented by OpenSSL (as reported by ecparam(1) with the
|
|
"-list_curves" option) and be one of the curves listed in Section 5.1.1
|
|
of <a href="https://tools.ietf.org/html/rfc8422">RFC 8422</a>. You should not generally change this setting. Remote SMTP
|
|
client implementations must support this curve for EECDH key exchange
|
|
to take place. It is unwise to choose only "bleeding-edge" curves
|
|
supported by only a small subset of clients. </p>
|
|
|
|
<p> This feature is not used as of Postfix 3.6. Do not specify. </p>
|
|
|
|
<p> This default "ultra" curve is rated in NSA <a
|
|
href="https://web.archive.org/web/20160330034144/https://www.nsa.gov/ia/programs/suiteb_cryptography/">Suite
|
|
B</a> for information classified up to TOP SECRET. </p>
|
|
|
|
<p> If you want to take maximal advantage of ciphers that offer <a
|
|
href="FORWARD_SECRECY_README.html#dfn_fs">forward secrecy</a> see
|
|
the <a href="FORWARD_SECRECY_README.html#quick-start">Getting
|
|
started</a> section of <a
|
|
href="FORWARD_SECRECY_README.html">FORWARD_SECRECY_README</a>. The
|
|
full document conveniently presents all information about Postfix
|
|
"perfect" forward secrecy support in one place: what forward secrecy
|
|
is, how to tweak settings, and what you can expect to see when
|
|
Postfix uses ciphers with forward secrecy. </p>
|
|
|
|
<p> This feature is available in Postfix 2.6 and later, when it is
|
|
compiled and linked with OpenSSL 1.0.0 or later on platforms where
|
|
EC algorithms have not been disabled by the vendor. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="tls_export_cipherlist">tls_export_cipherlist</a>
|
|
(default: see "postconf -d" output)</b></DT><DD>
|
|
|
|
<p> The OpenSSL cipherlist for "export" or higher grade ciphers.
|
|
Ignored as of Postfix 3.8. In earlier Postfix releases this
|
|
defined the meaning of the "export" setting in <a href="postconf.5.html#smtpd_tls_ciphers">smtpd_tls_ciphers</a>,
|
|
<a href="postconf.5.html#smtpd_tls_mandatory_ciphers">smtpd_tls_mandatory_ciphers</a>, <a href="postconf.5.html#smtp_tls_ciphers">smtp_tls_ciphers</a>,
|
|
<a href="postconf.5.html#smtp_tls_mandatory_ciphers">smtp_tls_mandatory_ciphers</a>, <a href="postconf.5.html#lmtp_tls_ciphers">lmtp_tls_ciphers</a>, and
|
|
<a href="postconf.5.html#lmtp_tls_mandatory_ciphers">lmtp_tls_mandatory_ciphers</a>. You are strongly encouraged not to
|
|
change this setting. </p>
|
|
|
|
<p> This feature is available in Postfix 2.3 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="tls_fast_shutdown_enable">tls_fast_shutdown_enable</a>
|
|
(default: yes)</b></DT><DD>
|
|
|
|
<p> A workaround for implementations that hang Postfix while shutting
|
|
down a TLS session, until Postfix times out. With this enabled,
|
|
Postfix will not wait for the remote TLS peer to respond to a TLS
|
|
'close' notification. This behavior is recommended for TLSv1.0 and
|
|
later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="tls_ffdhe_auto_groups">tls_ffdhe_auto_groups</a>
|
|
(default: see "postconf -d" output)</b></DT><DD>
|
|
|
|
<p> The prioritized list of finite-field Diffie-Hellman ephemeral
|
|
(FFDHE) key exchange groups supported by the Postfix SMTP client and
|
|
server. OpenSSL 3.0 adds support for FFDHE key agreement in TLS 1.3.
|
|
In OpenSSL 1.1.1, TLS 1.3 was only supported with elliptic-curve based
|
|
key agreement. The "<a href="postconf.5.html#tls_ffdhe_auto_groups">tls_ffdhe_auto_groups</a>" parameter makes it possible
|
|
to configure the list of FFDHE groups that the Postfix client or server
|
|
will enable in OpenSSL 3.0 and up. This parameter has no effect when
|
|
Postfix is built against earlier OpenSSL versions. </p>
|
|
|
|
<p> The default list of FFDHE groups that Postfix enables in OpenSSL 3.0
|
|
and up includes just the 2048 and 3072-bit groups. Stronger FFDHE
|
|
groups perform poorly and EC groups are a much better choice for the
|
|
same security level. Postfix ignores group names that are unknown to
|
|
OpenSSL, or that are known but not yet implemented. The FFDHE groups
|
|
are largely a backup, in case some peer does not support EC key
|
|
exchange, or EC key exchange needs to be disabled for some pressing
|
|
reason. </p>
|
|
|
|
<p> Setting this parameter empty disables FFDHE support in TLS 1.3.
|
|
Whether FFDHE key agreement is enabled in TLS 1.2 and earlier depends
|
|
on whether any of the "kDHE" ciphers are included in the cipherlist.
|
|
</p>
|
|
|
|
<p> Conversely, setting "<a href="postconf.5.html#tls_eecdh_auto_curves">tls_eecdh_auto_curves</a>" empty disables TLS 1.3
|
|
EC key agreement in OpenSSL 3.0 and later. If both are set empty,
|
|
Postfix will fall back to OpenSSL preferences as described next. </p>
|
|
|
|
<p> Post-quantum cryptography support: OpenSSL 3.5 introduces new
|
|
configuration syntax that Postfix will not attempt to imitate.
|
|
Instead, with Postfix 3.6.17, 3.7.13, 3.8.8, 3.9.2, and later, set
|
|
both <a href="postconf.5.html#tls_eecdh_auto_curves">tls_eecdh_auto_curves</a> and <a href="postconf.5.html#tls_ffdhe_auto_groups">tls_ffdhe_auto_groups</a> to the empty
|
|
value, to enable algorithm selection through OpenSSL configuration.
|
|
See <a href="postconf.5.html#tls_config_file">tls_config_file</a> for a configuration example. </p>
|
|
|
|
<p> All the default groups and EC curves should be sufficiently strong to make
|
|
"pruning" the defaults unwise. At a minimum, "x25519" and "prime256v1" (the
|
|
OpenSSL name for "secp256r1", a.k.a. "P-256") should be among the enabled EC
|
|
curves, while "dhe2048" and "dhe3072" should be among the FFDHE groups. </p>
|
|
|
|
<p> This feature is available in Postfix 3.8 and later, when it is
|
|
compiled and linked with OpenSSL 3.0 or later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="tls_high_cipherlist">tls_high_cipherlist</a>
|
|
(default: see "postconf -d" output)</b></DT><DD>
|
|
|
|
<p> The OpenSSL cipherlist for "high" grade ciphers. This defines
|
|
the meaning of the "high" setting in <a href="postconf.5.html#smtpd_tls_ciphers">smtpd_tls_ciphers</a>,
|
|
<a href="postconf.5.html#smtpd_tls_mandatory_ciphers">smtpd_tls_mandatory_ciphers</a>, <a href="postconf.5.html#smtp_tls_ciphers">smtp_tls_ciphers</a>, <a href="postconf.5.html#smtp_tls_mandatory_ciphers">smtp_tls_mandatory_ciphers</a>,
|
|
<a href="postconf.5.html#lmtp_tls_ciphers">lmtp_tls_ciphers</a>, and <a href="postconf.5.html#lmtp_tls_mandatory_ciphers">lmtp_tls_mandatory_ciphers</a>. You are strongly
|
|
encouraged not to change this setting. </p>
|
|
|
|
<p> This feature is available in Postfix 2.3 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="tls_legacy_public_key_fingerprints">tls_legacy_public_key_fingerprints</a>
|
|
(default: no)</b></DT><DD>
|
|
|
|
<p> A temporary migration aid for sites that use certificate
|
|
<i>public-key</i> fingerprints with Postfix 2.9.0..2.9.5, which use
|
|
an incorrect algorithm. This parameter has no effect on the certificate
|
|
fingerprint support that is available since Postfix 2.2. </p>
|
|
|
|
<p> Specify "<a href="postconf.5.html#tls_legacy_public_key_fingerprints">tls_legacy_public_key_fingerprints</a> = yes" temporarily,
|
|
pending a migration from configuration files with incorrect Postfix
|
|
2.9.0..2.9.5 certificate public-key finger prints, to the correct
|
|
fingerprints used by Postfix 2.9.6 and later. To compute the correct
|
|
certificate public-key fingerprints, see <a href="TLS_README.html">TLS_README</a>. </p>
|
|
|
|
<p> This feature is available in Postfix 2.9.6 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="tls_low_cipherlist">tls_low_cipherlist</a>
|
|
(default: see "postconf -d" output)</b></DT><DD>
|
|
|
|
<p> The OpenSSL cipherlist for "low" or higher grade ciphers.
|
|
Ignored as of Postfix 3.8. In earlier Postfix releases this
|
|
defined the meaning of the "low" setting in <a href="postconf.5.html#smtpd_tls_ciphers">smtpd_tls_ciphers</a>,
|
|
<a href="postconf.5.html#smtpd_tls_mandatory_ciphers">smtpd_tls_mandatory_ciphers</a>, <a href="postconf.5.html#smtp_tls_ciphers">smtp_tls_ciphers</a>,
|
|
<a href="postconf.5.html#smtp_tls_mandatory_ciphers">smtp_tls_mandatory_ciphers</a>, <a href="postconf.5.html#lmtp_tls_ciphers">lmtp_tls_ciphers</a>, and
|
|
<a href="postconf.5.html#lmtp_tls_mandatory_ciphers">lmtp_tls_mandatory_ciphers</a>. You are strongly encouraged not to
|
|
change this setting. </p>
|
|
|
|
<p> This feature is available in Postfix 2.3 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="tls_medium_cipherlist">tls_medium_cipherlist</a>
|
|
(default: see "postconf -d" output)</b></DT><DD>
|
|
|
|
<p> The OpenSSL cipherlist for "medium" or higher grade ciphers. This
|
|
defines the meaning of the "medium" setting in <a href="postconf.5.html#smtpd_tls_ciphers">smtpd_tls_ciphers</a>,
|
|
<a href="postconf.5.html#smtpd_tls_mandatory_ciphers">smtpd_tls_mandatory_ciphers</a>, <a href="postconf.5.html#smtp_tls_ciphers">smtp_tls_ciphers</a>, <a href="postconf.5.html#smtp_tls_mandatory_ciphers">smtp_tls_mandatory_ciphers</a>,
|
|
<a href="postconf.5.html#lmtp_tls_ciphers">lmtp_tls_ciphers</a>, and <a href="postconf.5.html#lmtp_tls_mandatory_ciphers">lmtp_tls_mandatory_ciphers</a>. This is the
|
|
default cipherlist for mandatory TLS encryption in the TLS client
|
|
(with anonymous ciphers disabled when verifying server certificates).
|
|
This is the default cipherlist for opportunistic TLS with Postfix
|
|
releases after the middle of 2015. You are strongly encouraged not
|
|
to change this setting. </p>
|
|
|
|
<p> This feature is available in Postfix 2.3 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="tls_null_cipherlist">tls_null_cipherlist</a>
|
|
(default: eNULL:!aNULL)</b></DT><DD>
|
|
|
|
<p> The OpenSSL cipherlist for "NULL" grade ciphers that provide
|
|
authentication without encryption. This defines the meaning of the "null"
|
|
setting in <a href="postconf.5.html#smtpd_tls_mandatory_ciphers">smtpd_tls_mandatory_ciphers</a>, <a href="postconf.5.html#smtp_tls_mandatory_ciphers">smtp_tls_mandatory_ciphers</a> and
|
|
<a href="postconf.5.html#lmtp_tls_mandatory_ciphers">lmtp_tls_mandatory_ciphers</a>. You are strongly encouraged not to
|
|
change this setting. </p>
|
|
|
|
<p> This feature is available in Postfix 2.3 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="tls_preempt_cipherlist">tls_preempt_cipherlist</a>
|
|
(default: no)</b></DT><DD>
|
|
|
|
<p> With SSLv3 and later, use the Postfix SMTP server's cipher
|
|
preference order instead of the remote client's cipher preference
|
|
order. </p>
|
|
|
|
<p> By default, the OpenSSL server selects the client's most preferred
|
|
cipher that the server supports. With SSLv3 and later, the server may
|
|
choose its own most preferred cipher that is supported (offered) by
|
|
the client. Setting "<a href="postconf.5.html#tls_preempt_cipherlist">tls_preempt_cipherlist</a> = yes" enables server cipher
|
|
preferences. </p>
|
|
|
|
<p> While server cipher selection may in some cases lead to a more secure
|
|
or performant cipher choice, there is some risk of interoperability
|
|
issues. In the past, some SSL clients have listed lower priority ciphers
|
|
that they did not implement correctly. If the server chooses a cipher
|
|
that the client prefers less, it may select a cipher whose client
|
|
implementation is flawed. Most notably Windows 2003 Microsoft
|
|
Exchange servers have flawed implementations of DES-CBC3-SHA, which
|
|
OpenSSL considers stronger than RC4-SHA. Enabling server cipher-suite
|
|
selection may create interoperability issues with Windows 2003
|
|
Microsoft Exchange clients. </p>
|
|
|
|
<p> This feature is available in Postfix 2.8 and later, in combination
|
|
with OpenSSL 0.9.7 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="tls_random_bytes">tls_random_bytes</a>
|
|
(default: 32)</b></DT><DD>
|
|
|
|
<p> The number of bytes that <a href="tlsmgr.8.html">tlsmgr(8)</a> reads from $<a href="postconf.5.html#tls_random_source">tls_random_source</a>
|
|
when (re)seeding the in-memory pseudo random number generator (PRNG)
|
|
pool. The default of 32 bytes (256 bits) is good enough for 128bit
|
|
symmetric keys. If using EGD or a device file, a maximum of 255
|
|
bytes is read. </p>
|
|
|
|
<p> This feature is available in Postfix 2.2 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="tls_random_exchange_name">tls_random_exchange_name</a>
|
|
(default: see "postconf -d" output)</b></DT><DD>
|
|
|
|
<p> Name of the pseudo random number generator (PRNG) state file
|
|
that is maintained by <a href="tlsmgr.8.html">tlsmgr(8)</a>. The file is created when it does
|
|
not exist, and its length is fixed at 1024 bytes. </p>
|
|
|
|
<p> As of version 2.5, Postfix no longer uses root privileges when
|
|
opening this file, and the default file location was changed from
|
|
${<a href="postconf.5.html#config_directory">config_directory</a>}/prng_exch to ${<a href="postconf.5.html#data_directory">data_directory</a>}/prng_exch. As
|
|
a migration aid, an attempt to open the file under a non-Postfix
|
|
directory is redirected to the Postfix-owned <a href="postconf.5.html#data_directory">data_directory</a>, and a
|
|
warning is logged. </p>
|
|
|
|
<p> This feature is available in Postfix 2.2 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="tls_random_prng_update_period">tls_random_prng_update_period</a>
|
|
(default: 3600s)</b></DT><DD>
|
|
|
|
<p> The time between attempts by <a href="tlsmgr.8.html">tlsmgr(8)</a> to save the state of
|
|
the pseudo random number generator (PRNG) to the file specified
|
|
with $<a href="postconf.5.html#tls_random_exchange_name">tls_random_exchange_name</a>. </p>
|
|
|
|
<p> Specify a non-zero time value (an integral value plus an optional
|
|
one-letter suffix that specifies the time unit). Time units: s
|
|
(seconds), m (minutes), h (hours), d (days), w (weeks).
|
|
The default time unit is s (seconds). </p>
|
|
|
|
<p> This feature is available in Postfix 2.2 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="tls_random_reseed_period">tls_random_reseed_period</a>
|
|
(default: 3600s)</b></DT><DD>
|
|
|
|
<p> The maximal time between attempts by <a href="tlsmgr.8.html">tlsmgr(8)</a> to re-seed the
|
|
in-memory pseudo random number generator (PRNG) pool from external
|
|
sources. The actual time between re-seeding attempts is calculated
|
|
using the PRNG, and is between 0 and the time specified. </p>
|
|
|
|
<p> Specify a non-zero time value (an integral value plus an optional
|
|
one-letter suffix that specifies the time unit). Time units: s
|
|
(seconds), m (minutes), h (hours), d (days), w (weeks).
|
|
The default time unit is s (seconds). </p>
|
|
|
|
<p> This feature is available in Postfix 2.2 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="tls_random_source">tls_random_source</a>
|
|
(default: see "postconf -d" output)</b></DT><DD>
|
|
|
|
<p> The external entropy source for the in-memory <a href="tlsmgr.8.html">tlsmgr(8)</a> pseudo
|
|
random number generator (PRNG) pool. Be sure to specify a non-blocking
|
|
source. If this source is not a regular file, the entropy source
|
|
type must be prepended: egd:/path/to/egd_socket for a source with
|
|
EGD compatible socket interface, or dev:/path/to/device for a
|
|
device file. </p>
|
|
|
|
<p> Note: on OpenBSD systems specify dev:/dev/arandom when dev:/dev/urandom
|
|
gives timeout errors. </p>
|
|
|
|
<p> This feature is available in Postfix 2.2 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="tls_required_enable">tls_required_enable</a>
|
|
(default: yes)</b></DT><DD>
|
|
|
|
<p> Enable support for the "TLS-Required: no" message header, defined
|
|
in <a href="https://tools.ietf.org/html/rfc8689">RFC 8689</a>. By adding this header to a message, a sender requests
|
|
no enforcement of TLS policy. This limits the Postfix SMTP client
|
|
TLS security level to "may", that is, do not verify remote SMTP
|
|
server certificates, and fall back to plaintext if TLS is unavailable.
|
|
If a message contains a "TLS-Required: no" header, then Postfix
|
|
will add that header to a delivery status notification for that
|
|
message. </p>
|
|
|
|
<p> This feature is available in Postfix ≥ 3.10. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="tls_server_sni_maps">tls_server_sni_maps</a>
|
|
(default: empty)</b></DT><DD>
|
|
|
|
<p> Optional lookup tables that map names received from remote SMTP
|
|
clients via the TLS Server Name Indication (SNI) extension to the
|
|
appropriate keys and certificate chains. This parameter is implemented
|
|
in the Postfix TLS library, and applies to both <a href="smtpd.8.html">smtpd(8)</a> and the SMTP
|
|
server mode of <a href="tlsproxy.8.html">tlsproxy(8)</a>. </p>
|
|
|
|
<p> When this parameter is non-empty, the Postfix SMTP server enables
|
|
SNI extension processing, and logs SNI values that are invalid or
|
|
don't match an entry in the specified tables. When an entry
|
|
does match, the SNI name is logged as part of the connection summary
|
|
at log levels 1 and higher. </p>
|
|
|
|
<p> The lookup key is either the verbatim SNI domain name or an
|
|
ancestor domain prefixed with a leading dot. For internationalized
|
|
domains, the lookup key must be in IDNA 2008 A-label form (as
|
|
required in the TLS SNI extension). </p>
|
|
|
|
<p> The syntax of the lookup value is the same as with the
|
|
<a href="postconf.5.html#smtp_tls_chain_files">smtp_tls_chain_files</a> parameter (see there for additional details),
|
|
but here scoped to just TLS connections in which the client sends
|
|
a matching SNI domain name. </p>
|
|
|
|
<p> Example: </p>
|
|
<blockquote>
|
|
<pre>
|
|
/etc/postfix/<a href="postconf.5.html">main.cf</a>:
|
|
#
|
|
# The indexed SNI table must be created with "postmap -F"
|
|
#
|
|
indexed = ${<a href="postconf.5.html#default_database_type">default_database_type</a>}:${<a href="postconf.5.html#config_directory">config_directory</a>}/
|
|
<a href="postconf.5.html#tls_server_sni_maps">tls_server_sni_maps</a> = ${indexed}sni
|
|
</pre>
|
|
</blockquote>
|
|
|
|
<blockquote>
|
|
<pre>
|
|
/etc/postfix/sni:
|
|
#
|
|
# The example.com domain has both an RSA and ECDSA certificate
|
|
# chain. The chain files MUST start with the private key,
|
|
# with the certificate chain next, starting with the leaf
|
|
# (server) certificate, and then the issuer certificates.
|
|
#
|
|
example.com /etc/postfix/sni-chains/rsa2048.example.com.pem,
|
|
/etc/postfix/sni-chains/ecdsa-p256.example.com.pem
|
|
#
|
|
# The example.net domain has a wildcard certificate, and two
|
|
# additional DNS names. So its certificate chain is also used
|
|
# with any subdomain, plus the additional names.
|
|
#
|
|
example.net /etc/postfix/sni-chains/example.net.pem
|
|
.example.net /etc/postfix/sni-chains/example.net.pem
|
|
example.info /etc/postfix/sni-chains/example.net.pem
|
|
example.org /etc/postfix/sni-chains/example.net.pem
|
|
</pre>
|
|
</blockquote>
|
|
|
|
<p> Note that the SNI lookup tables should also have entries for
|
|
the domains that correspond to the Postfix SMTP server's default
|
|
certificate(s). This ensures that the remote SMTP client's TLS SNI
|
|
extension gets a positive response when it specifies one of the
|
|
Postfix SMTP server's <a href="ADDRESS_CLASS_README.html#default_domain_class">default domains</a>, and ensures that the Postfix
|
|
SMTP server will not log an SNI name mismatch for such a domain.
|
|
The Postfix SMTP server's default certificates are then only used
|
|
when the client sends no SNI or when it sends SNI with a domain
|
|
that the server knows no certificate(s) for. </p>
|
|
|
|
<p> The mapping from an SNI domain name to a certificate chain is indirect. In
|
|
the input source files for "cdb", "hash", "btree" or other tables that are
|
|
converted to on-disk indexed files via <a href="postmap.1.html">postmap(1)</a>, the value specified for each
|
|
key is a list of filenames. When <a href="postmap.1.html">postmap(1)</a> is used with the <b>-F</b> option,
|
|
the generated table stores for each lookup key the base64-encoded contents of
|
|
the associated files. When querying tables via <b>postmap -Fq</b>, the table
|
|
value is decoded from base64, yielding the original file content, plus a new
|
|
line. </p>
|
|
|
|
<p> With "regexp", "pcre", "inline", "texthash", "static" and similar
|
|
tables that are interpreted at run-time, and don't have a separate
|
|
source format, the table value is again a list files, that are loaded
|
|
into memory when the table is opened. </p>
|
|
|
|
<p> With tables whose content is managed outside of Postfix, such
|
|
as LDAP, MySQL, PostgreSQL, socketmap and tcp, the value must be a
|
|
concatenation of the desired PEM keys and certificate chains, that
|
|
is then further encoded to yield a single-line base64 string.
|
|
Creation of such tables and secure storage (the value includes
|
|
private key material) are outside the responsibility of Postfix. </p>
|
|
|
|
<p> With "socketmap" and "tcp" the data will be transmitted in the clear, and
|
|
there is no query access control, so these are generally unsuitable for storing
|
|
SNI chains. With LDAP and SQL, you should restrict read access and use TLS to
|
|
protect the sensitive data in transit. </p>
|
|
|
|
<p> Typically there is only one private key and its chain of certificates
|
|
starting with the "leaf" certificate corresponding to that key, and
|
|
continuing with the appropriate intermediate issuer CA certificates,
|
|
with each certificate ideally followed by its issuer. Servers
|
|
that have keys and certificates for more than one algorithm (e.g.
|
|
both an RSA key and an ECDSA key, or even RSA, ECDSA and Ed25519)
|
|
can use multiple chains concatenated together, with the key always
|
|
listed before the corresponding certificates. </p>
|
|
|
|
<p> This feature is available in Postfix 3.4 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="tls_session_ticket_cipher">tls_session_ticket_cipher</a>
|
|
(default: Postfix ≥ 3.0: aes-256-cbc, Postfix < 3.0: aes-128-cbc)</b></DT><DD>
|
|
|
|
<p> Algorithm used to encrypt <a href="https://tools.ietf.org/html/rfc5077">RFC5077</a> TLS session tickets. This
|
|
algorithm must use CBC mode, have a 128-bit block size, and must
|
|
have a key length between 128 and 256 bits. The default is
|
|
aes-256-cbc. Overriding the default to choose a different algorithm
|
|
is discouraged. </p>
|
|
|
|
<p> Setting this parameter empty disables session ticket support
|
|
in the Postfix SMTP server. Another way to disable session ticket
|
|
support is via the <a href="postconf.5.html#tls_ssl_options">tls_ssl_options</a> parameter. </p>
|
|
|
|
<p> This feature is available in Postfix 3.0 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="tls_ssl_options">tls_ssl_options</a>
|
|
(default: empty)</b></DT><DD>
|
|
|
|
<p> List or bit-mask of OpenSSL options to enable. </p>
|
|
|
|
<p> The OpenSSL toolkit provides a set of options that applications
|
|
can enable to tune the OpenSSL behavior. Some of these work around
|
|
bugs in other implementations and are on by default. You can use
|
|
the <a href="postconf.5.html#tls_disable_workarounds">tls_disable_workarounds</a> parameter to selectively disable some
|
|
or all of the bug work-arounds, making OpenSSL more strict at the
|
|
cost of non-interoperability with SSL clients or servers that exhibit
|
|
the bugs. </p>
|
|
|
|
<p> Other options are off by default, and typically enable or disable
|
|
features rather than bug work-arounds. These may be turned on (with
|
|
care) via the <a href="postconf.5.html#tls_ssl_options">tls_ssl_options</a> parameter. The value is a white-space
|
|
or comma separated list of named options chosen from the list below.
|
|
The names are not case-sensitive, you can use lower-case if you
|
|
prefer. The upper case values below match the corresponding macro
|
|
name in the ssl.h header file with the SSL_OP_ prefix removed. It
|
|
is possible that your OpenSSL version includes new options added
|
|
after your Postfix source code was last updated, in that case you
|
|
can only enable one of these via the hexadecimal syntax below. </p>
|
|
|
|
<p> You should only enable features via the hexadecimal mask when
|
|
the need to control the feature is critical (to deal with a new
|
|
vulnerability or a serious interoperability problem). Postfix DOES
|
|
NOT promise backwards compatible behavior with respect to the mask
|
|
bits. A feature enabled via the mask in one release may be enabled
|
|
by other means in a later release, and the mask bit will then be
|
|
ignored. Therefore, use of the hexadecimal mask is only a temporary
|
|
measure until a new Postfix or OpenSSL release provides a better
|
|
solution. </p>
|
|
|
|
<p> If the value of the parameter is a hexadecimal long integer
|
|
starting with "0x", the options corresponding to the bits specified
|
|
in its value are enabled (see openssl/ssl.h and SSL_CTX_set_options(3)).
|
|
You can only enable options not already controlled by other Postfix
|
|
settings. For example, you cannot disable protocols or enable
|
|
server cipher preference. Do not attempt to enable all features by
|
|
specifying 0xFFFFFFFF, this is unlikely to be a good idea. Some
|
|
bug work-arounds are also valid here, allowing them to be re-enabled
|
|
if/when they're no longer enabled by default. The supported values
|
|
include: </p>
|
|
|
|
<dl>
|
|
|
|
<dt><b>ENABLE_MIDDLEBOX_COMPAT</b></dt> <dd>Postfix ≥ 3.4. See
|
|
SSL_CTX_set_options(3).</dd>
|
|
|
|
<dt><b>LEGACY_SERVER_CONNECT</b></dt> <dd>See SSL_CTX_set_options(3).</dd>
|
|
|
|
<dt><b>NO_TICKET</b></dt> <dd>Enabled by default when needed in
|
|
fully-patched Postfix ≥ 2.7. Not needed at all for Postfix ≥
|
|
2.11, unless for some reason you do not want to support TLS session
|
|
resumption. Best not set explicitly. See SSL_CTX_set_options(3).</dd>
|
|
|
|
<dt><b>NO_COMPRESSION</b></dt> <dd>Disable SSL compression even if
|
|
supported by the OpenSSL library. Compression is CPU-intensive,
|
|
and compression before encryption does not always improve security. </dd>
|
|
|
|
<dt><b>NO_RENEGOTIATION</b></dt> <dd>Postfix ≥ 3.4. This can
|
|
reduce opportunities for a potential CPU exhaustion attack. See
|
|
SSL_CTX_set_options(3).</dd>
|
|
|
|
<dt><b>NO_SESSION_RESUMPTION_ON_RENEGOTIATION</b></dt> <dd>Postfix
|
|
≥ 3.4. See SSL_CTX_set_options(3).</dd>
|
|
|
|
<dt><b>PRIORITIZE_CHACHA</b></dt> <dd>Postfix ≥ 3.4. See SSL_CTX_set_options(3).</dd>
|
|
|
|
</dl>
|
|
|
|
<p> This feature is available in Postfix 2.11 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="tls_wildcard_matches_multiple_labels">tls_wildcard_matches_multiple_labels</a>
|
|
(default: yes)</b></DT><DD>
|
|
|
|
<p> Match multiple DNS labels with "*" in wildcard certificates.
|
|
</p>
|
|
|
|
<p> Some mail service providers prepend the customer domain name
|
|
to a base domain for which they have a wildcard TLS certificate.
|
|
For example, the MX records for example.com hosted by example.net
|
|
may be: </p>
|
|
|
|
<blockquote>
|
|
<pre>
|
|
example.com. IN MX 0 example.com.mx1.example.net.
|
|
example.com. IN MX 0 example.com.mx2.example.net.
|
|
</pre>
|
|
</blockquote>
|
|
|
|
<p> and the TLS certificate may be for "*.example.net". The "*"
|
|
then corresponds with multiple labels in the mail server domain
|
|
name. While multi-label wildcards are not widely supported, and
|
|
are not blessed by any standard, there is little to be gained by
|
|
disallowing their use in this context. </p>
|
|
|
|
<p> Notes: <p>
|
|
|
|
<ul>
|
|
|
|
<li> <p> In a certificate name, the "*" is special only when it is
|
|
used as the first label. </p>
|
|
|
|
<li> <p> While Postfix (2.11 or later) can match "*" with multiple
|
|
domain name labels, other implementations likely will not. </p>
|
|
|
|
<li> <p> Earlier Postfix implementations behave as if
|
|
"<a href="postconf.5.html#tls_wildcard_matches_multiple_labels">tls_wildcard_matches_multiple_labels</a> = no". </p>
|
|
|
|
</ul>
|
|
|
|
<p> This feature is available in Postfix 2.11 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="tlsmgr_service_name">tlsmgr_service_name</a>
|
|
(default: tlsmgr)</b></DT><DD>
|
|
|
|
<p> The name of the <a href="tlsmgr.8.html">tlsmgr(8)</a> service entry in <a href="master.5.html">master.cf</a>. This
|
|
service maintains TLS session caches and other information in support
|
|
of TLS. </p>
|
|
|
|
<p> This feature is available in Postfix 2.11 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="tlsproxy_client_CAfile">tlsproxy_client_CAfile</a>
|
|
(default: $<a href="postconf.5.html#smtp_tls_CAfile">smtp_tls_CAfile</a>)</b></DT><DD>
|
|
|
|
<p> A file containing CA certificates of root CAs trusted to sign
|
|
either remote TLS server certificates or intermediate CA certificates.
|
|
See <a href="postconf.5.html#smtp_tls_CAfile">smtp_tls_CAfile</a> for further details. </p>
|
|
|
|
<p> This feature is available in Postfix 3.4 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="tlsproxy_client_CApath">tlsproxy_client_CApath</a>
|
|
(default: $<a href="postconf.5.html#smtp_tls_CApath">smtp_tls_CApath</a>)</b></DT><DD>
|
|
|
|
<p> Directory with PEM format Certification Authority certificates
|
|
that the Postfix <a href="tlsproxy.8.html">tlsproxy(8)</a> client uses to verify a remote TLS
|
|
server certificate. See <a href="postconf.5.html#smtp_tls_CApath">smtp_tls_CApath</a> for further details. </p>
|
|
|
|
<p> This feature is available in Postfix 3.4 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="tlsproxy_client_cert_file">tlsproxy_client_cert_file</a>
|
|
(default: $<a href="postconf.5.html#smtp_tls_cert_file">smtp_tls_cert_file</a>)</b></DT><DD>
|
|
|
|
<p> File with the Postfix <a href="tlsproxy.8.html">tlsproxy(8)</a> client RSA certificate in PEM
|
|
format. See <a href="postconf.5.html#smtp_tls_cert_file">smtp_tls_cert_file</a> for further details. The preferred way
|
|
to configure tlsproxy client keys and certificates is via the
|
|
"<a href="postconf.5.html#tlsproxy_client_chain_files">tlsproxy_client_chain_files</a>" parameter. </p>
|
|
|
|
<p> This feature is available in Postfix 3.4 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="tlsproxy_client_chain_files">tlsproxy_client_chain_files</a>
|
|
(default: $<a href="postconf.5.html#smtp_tls_chain_files">smtp_tls_chain_files</a>)</b></DT><DD>
|
|
|
|
<p> Files with the Postfix <a href="tlsproxy.8.html">tlsproxy(8)</a> client keys and certificate
|
|
chains in PEM format. See <a href="postconf.5.html#smtp_tls_chain_files">smtp_tls_chain_files</a> for further details. </p>
|
|
|
|
<p> This feature is available in Postfix 3.4 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="tlsproxy_client_dcert_file">tlsproxy_client_dcert_file</a>
|
|
(default: $<a href="postconf.5.html#smtp_tls_dcert_file">smtp_tls_dcert_file</a>)</b></DT><DD>
|
|
|
|
<p> File with the Postfix <a href="tlsproxy.8.html">tlsproxy(8)</a> client DSA certificate in PEM
|
|
format. See <a href="postconf.5.html#smtp_tls_dcert_file">smtp_tls_dcert_file</a> for further details. DSA is obsolete and
|
|
should not be used. </p>
|
|
|
|
<p> This feature is available in Postfix 3.4 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="tlsproxy_client_dkey_file">tlsproxy_client_dkey_file</a>
|
|
(default: $<a href="postconf.5.html#smtp_tls_dkey_file">smtp_tls_dkey_file</a>)</b></DT><DD>
|
|
|
|
<p> File with the Postfix <a href="tlsproxy.8.html">tlsproxy(8)</a> client DSA private key in PEM
|
|
format. See <a href="postconf.5.html#smtp_tls_dkey_file">smtp_tls_dkey_file</a> for further details. DSA is obsolete and
|
|
should not be used. </p>
|
|
|
|
<p> This feature is available in Postfix 3.4 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="tlsproxy_client_eccert_file">tlsproxy_client_eccert_file</a>
|
|
(default: $<a href="postconf.5.html#smtp_tls_eccert_file">smtp_tls_eccert_file</a>)</b></DT><DD>
|
|
|
|
<p> File with the Postfix <a href="tlsproxy.8.html">tlsproxy(8)</a> client ECDSA certificate in PEM
|
|
format. See <a href="postconf.5.html#smtp_tls_eccert_file">smtp_tls_eccert_file</a> for further details. The preferred way
|
|
to configure tlsproxy client keys and certificates is via the
|
|
"<a href="postconf.5.html#tlsproxy_client_chain_files">tlsproxy_client_chain_files</a>" parameter. </p>
|
|
|
|
<p> This feature is available in Postfix 3.4 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="tlsproxy_client_eckey_file">tlsproxy_client_eckey_file</a>
|
|
(default: $<a href="postconf.5.html#smtp_tls_eckey_file">smtp_tls_eckey_file</a>)</b></DT><DD>
|
|
|
|
<p> File with the Postfix <a href="tlsproxy.8.html">tlsproxy(8)</a> client ECDSA private key in PEM
|
|
format. See <a href="postconf.5.html#smtp_tls_eckey_file">smtp_tls_eckey_file</a> for further details. The preferred way
|
|
to configure tlsproxy client keys and certificates is via the
|
|
"<a href="postconf.5.html#tlsproxy_client_chain_files">tlsproxy_client_chain_files</a>" parameter. </p>
|
|
|
|
<p> This feature is available in Postfix 3.4 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="tlsproxy_client_enforce_tls">tlsproxy_client_enforce_tls</a>
|
|
(default: $<a href="postconf.5.html#smtp_enforce_tls">smtp_enforce_tls</a>)</b></DT><DD>
|
|
|
|
<p> Enforcement mode: require that SMTP servers use TLS encryption.
|
|
See <a href="postconf.5.html#smtp_enforce_tls">smtp_enforce_tls</a> for further details. Use
|
|
<a href="postconf.5.html#tlsproxy_client_security_level">tlsproxy_client_security_level</a> instead. </p>
|
|
|
|
<p> This feature is deprecated as of Postfix 3.9. Specify
|
|
<a href="postconf.5.html#tlsproxy_client_security_level">tlsproxy_client_security_level</a> instead. </p>
|
|
|
|
<p> This feature is available in Postfix 3.4 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="tlsproxy_client_fingerprint_digest">tlsproxy_client_fingerprint_digest</a>
|
|
(default: $<a href="postconf.5.html#smtp_tls_fingerprint_digest">smtp_tls_fingerprint_digest</a>)</b></DT><DD>
|
|
|
|
<p> The message digest algorithm used to construct remote TLS server
|
|
certificate fingerprints. See <a href="postconf.5.html#smtp_tls_fingerprint_digest">smtp_tls_fingerprint_digest</a> for
|
|
further details. </p>
|
|
|
|
<p> This feature is available in Postfix 3.4 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="tlsproxy_client_key_file">tlsproxy_client_key_file</a>
|
|
(default: $<a href="postconf.5.html#smtp_tls_key_file">smtp_tls_key_file</a>)</b></DT><DD>
|
|
|
|
<p> File with the Postfix <a href="tlsproxy.8.html">tlsproxy(8)</a> client RSA private key in PEM
|
|
format. See <a href="postconf.5.html#smtp_tls_key_file">smtp_tls_key_file</a> for further details. The preferred way to
|
|
configure tlsproxy client keys and certificates is via the
|
|
"<a href="postconf.5.html#tlsproxy_client_chain_files">tlsproxy_client_chain_files</a>" parameter. </p>
|
|
|
|
<p> This feature is available in Postfix 3.4 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="tlsproxy_client_level">tlsproxy_client_level</a>
|
|
(default: $<a href="postconf.5.html#smtp_tls_security_level">smtp_tls_security_level</a>)</b></DT><DD>
|
|
|
|
<p> The default TLS security level for the Postfix <a href="tlsproxy.8.html">tlsproxy(8)</a>
|
|
client. See <a href="postconf.5.html#smtp_tls_security_level">smtp_tls_security_level</a> for further details. </p>
|
|
|
|
<p> This feature is available in Postfix 3.4 - 3.6. It was
|
|
renamed to <a href="postconf.5.html#tlsproxy_client_security_level">tlsproxy_client_security_level</a> in Postfix 3.7. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="tlsproxy_client_loglevel">tlsproxy_client_loglevel</a>
|
|
(default: $<a href="postconf.5.html#smtp_tls_loglevel">smtp_tls_loglevel</a>)</b></DT><DD>
|
|
|
|
<p> Enable additional Postfix <a href="tlsproxy.8.html">tlsproxy(8)</a> client logging of TLS
|
|
activity. See <a href="postconf.5.html#smtp_tls_loglevel">smtp_tls_loglevel</a> for further details. </p>
|
|
|
|
<p> This feature is available in Postfix 3.4 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="tlsproxy_client_loglevel_parameter">tlsproxy_client_loglevel_parameter</a>
|
|
(default: <a href="postconf.5.html#smtp_tls_loglevel">smtp_tls_loglevel</a>)</b></DT><DD>
|
|
|
|
<p> The name of the parameter that provides the <a href="postconf.5.html#tlsproxy_client_loglevel">tlsproxy_client_loglevel</a>
|
|
value. </p>
|
|
|
|
<p> This feature is available in Postfix 3.4 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="tlsproxy_client_per_site">tlsproxy_client_per_site</a>
|
|
(default: $<a href="postconf.5.html#smtp_tls_per_site">smtp_tls_per_site</a>)</b></DT><DD>
|
|
|
|
<p> Optional lookup tables with the Postfix <a href="tlsproxy.8.html">tlsproxy(8)</a> client TLS
|
|
usage policy by next-hop destination and by remote TLS server
|
|
hostname. See <a href="postconf.5.html#smtp_tls_per_site">smtp_tls_per_site</a> for further details. </p>
|
|
|
|
<p> This feature is deprecated as of Postfix 3.9. Specify
|
|
<a href="postconf.5.html#tlsproxy_client_policy_maps">tlsproxy_client_policy_maps</a> instead. </p>
|
|
|
|
<p> This feature is available in Postfix 3.4 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="tlsproxy_client_policy">tlsproxy_client_policy</a>
|
|
(default: $<a href="postconf.5.html#smtp_tls_policy_maps">smtp_tls_policy_maps</a>)</b></DT><DD>
|
|
|
|
<p> Optional lookup tables with the Postfix <a href="tlsproxy.8.html">tlsproxy(8)</a> client TLS
|
|
security policy by next-hop destination. See <a href="postconf.5.html#smtp_tls_policy_maps">smtp_tls_policy_maps</a>
|
|
for further details. </p>
|
|
|
|
<p> This feature is available in Postfix 3.4 - 3.6. It was
|
|
renamed to <a href="postconf.5.html#tlsproxy_client_policy_maps">tlsproxy_client_policy_maps</a> in Postfix 3.7. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="tlsproxy_client_policy_maps">tlsproxy_client_policy_maps</a>
|
|
(default: $<a href="postconf.5.html#smtp_tls_policy_maps">smtp_tls_policy_maps</a>)</b></DT><DD>
|
|
|
|
<p> Optional lookup tables with the Postfix <a href="tlsproxy.8.html">tlsproxy(8)</a> client TLS
|
|
security policy by next-hop destination. See <a href="postconf.5.html#smtp_tls_policy_maps">smtp_tls_policy_maps</a>
|
|
for further details. </p>
|
|
|
|
<p> This feature is available in Postfix 3.7 and later. It
|
|
was previously called <a href="postconf.5.html#tlsproxy_client_policy">tlsproxy_client_policy</a>. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="tlsproxy_client_scert_verifydepth">tlsproxy_client_scert_verifydepth</a>
|
|
(default: $<a href="postconf.5.html#smtp_tls_scert_verifydepth">smtp_tls_scert_verifydepth</a>)</b></DT><DD>
|
|
|
|
<p> The verification depth for remote TLS server certificates.
|
|
See <a href="postconf.5.html#smtp_tls_scert_verifydepth">smtp_tls_scert_verifydepth</a> for further details. </p>
|
|
|
|
<p> This feature is available in Postfix 3.4 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="tlsproxy_client_security_level">tlsproxy_client_security_level</a>
|
|
(default: $<a href="postconf.5.html#smtp_tls_security_level">smtp_tls_security_level</a>)</b></DT><DD>
|
|
|
|
<p> The default TLS security level for the Postfix <a href="tlsproxy.8.html">tlsproxy(8)</a>
|
|
client. See <a href="postconf.5.html#smtp_tls_security_level">smtp_tls_security_level</a> for further details. </p>
|
|
|
|
<p> This feature is available in Postfix 3.7 and later. It
|
|
was previously called <a href="postconf.5.html#tlsproxy_client_level">tlsproxy_client_level</a>. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="tlsproxy_client_use_tls">tlsproxy_client_use_tls</a>
|
|
(default: $<a href="postconf.5.html#smtp_use_tls">smtp_use_tls</a>)</b></DT><DD>
|
|
|
|
<p> Opportunistic mode: use TLS when a remote server announces TLS
|
|
support. See <a href="postconf.5.html#smtp_use_tls">smtp_use_tls</a> for further details. Use
|
|
<a href="postconf.5.html#tlsproxy_client_security_level">tlsproxy_client_security_level</a> instead. </p>
|
|
|
|
<p> This feature is deprecated as of Postfix 3.9. Specify
|
|
<a href="postconf.5.html#tlsproxy_client_security_level">tlsproxy_client_security_level</a> instead. </p>
|
|
|
|
<p> This feature is available in Postfix 3.4 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="tlsproxy_enforce_tls">tlsproxy_enforce_tls</a>
|
|
(default: $<a href="postconf.5.html#smtpd_enforce_tls">smtpd_enforce_tls</a>)</b></DT><DD>
|
|
|
|
<p> Mandatory TLS: announce STARTTLS support to remote SMTP clients, and
|
|
require that clients use TLS encryption. See <a href="postconf.5.html#smtpd_enforce_tls">smtpd_enforce_tls</a> for
|
|
further details. Use <a href="postconf.5.html#tlsproxy_tls_security_level">tlsproxy_tls_security_level</a> instead. </p>
|
|
|
|
<p> This feature is deprecated as of Postfix 3.9. Specify
|
|
<a href="postconf.5.html#tlsproxy_tls_security_level">tlsproxy_tls_security_level</a> instead. </p>
|
|
|
|
<p> This feature is available in Postfix 2.8 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="tlsproxy_service_name">tlsproxy_service_name</a>
|
|
(default: tlsproxy)</b></DT><DD>
|
|
|
|
<p> The name of the <a href="tlsproxy.8.html">tlsproxy(8)</a> service entry in <a href="master.5.html">master.cf</a>. This
|
|
service performs plaintext <=> TLS ciphertext conversion. <p>
|
|
|
|
<p> This feature is available in Postfix 2.8 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="tlsproxy_tls_CAfile">tlsproxy_tls_CAfile</a>
|
|
(default: $<a href="postconf.5.html#smtpd_tls_CAfile">smtpd_tls_CAfile</a>)</b></DT><DD>
|
|
|
|
<p> A file containing (PEM format) CA certificates of root CAs
|
|
trusted to sign either remote SMTP client certificates or intermediate
|
|
CA certificates. See <a href="postconf.5.html#smtpd_tls_CAfile">smtpd_tls_CAfile</a> for further details. </p>
|
|
|
|
<p> This feature is available in Postfix 2.8 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="tlsproxy_tls_CApath">tlsproxy_tls_CApath</a>
|
|
(default: $<a href="postconf.5.html#smtpd_tls_CApath">smtpd_tls_CApath</a>)</b></DT><DD>
|
|
|
|
<p> A directory containing (PEM format) CA certificates of root CAs
|
|
trusted to sign either remote SMTP client certificates or intermediate
|
|
CA certificates. See <a href="postconf.5.html#smtpd_tls_CApath">smtpd_tls_CApath</a> for further details. </p>
|
|
|
|
<p> This feature is available in Postfix 2.8 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="tlsproxy_tls_always_issue_session_ids">tlsproxy_tls_always_issue_session_ids</a>
|
|
(default: $<a href="postconf.5.html#smtpd_tls_always_issue_session_ids">smtpd_tls_always_issue_session_ids</a>)</b></DT><DD>
|
|
|
|
<p> Force the Postfix <a href="tlsproxy.8.html">tlsproxy(8)</a> server to issue a TLS session id,
|
|
even when TLS session caching is turned off. See
|
|
<a href="postconf.5.html#smtpd_tls_always_issue_session_ids">smtpd_tls_always_issue_session_ids</a> for further details. </p>
|
|
|
|
<p> This feature is available in Postfix 2.8 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="tlsproxy_tls_ask_ccert">tlsproxy_tls_ask_ccert</a>
|
|
(default: $<a href="postconf.5.html#smtpd_tls_ask_ccert">smtpd_tls_ask_ccert</a>)</b></DT><DD>
|
|
|
|
<p> Ask a remote SMTP client for a client certificate. See
|
|
<a href="postconf.5.html#smtpd_tls_ask_ccert">smtpd_tls_ask_ccert</a> for further details. </p>
|
|
|
|
<p> This feature is available in Postfix 2.8 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="tlsproxy_tls_ccert_verifydepth">tlsproxy_tls_ccert_verifydepth</a>
|
|
(default: $<a href="postconf.5.html#smtpd_tls_ccert_verifydepth">smtpd_tls_ccert_verifydepth</a>)</b></DT><DD>
|
|
|
|
<p> The verification depth for remote SMTP client certificates. A
|
|
depth of 1 is sufficient if the issuing CA is listed in a local CA
|
|
file. See <a href="postconf.5.html#smtpd_tls_ccert_verifydepth">smtpd_tls_ccert_verifydepth</a> for further details. </p>
|
|
|
|
<p> This feature is available in Postfix 2.8 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="tlsproxy_tls_cert_file">tlsproxy_tls_cert_file</a>
|
|
(default: $<a href="postconf.5.html#smtpd_tls_cert_file">smtpd_tls_cert_file</a>)</b></DT><DD>
|
|
|
|
<p> File with the Postfix <a href="tlsproxy.8.html">tlsproxy(8)</a> server RSA certificate in PEM
|
|
format. This file may also contain the Postfix <a href="tlsproxy.8.html">tlsproxy(8)</a> server
|
|
private RSA key. See <a href="postconf.5.html#smtpd_tls_cert_file">smtpd_tls_cert_file</a> for further details. With
|
|
Postfix ≥ 3.4 the preferred way to configure tlsproxy server keys and
|
|
certificates is via the "<a href="postconf.5.html#tlsproxy_tls_chain_files">tlsproxy_tls_chain_files</a>" parameter. </p>
|
|
|
|
<p> This feature is available in Postfix 2.8 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="tlsproxy_tls_chain_files">tlsproxy_tls_chain_files</a>
|
|
(default: $<a href="postconf.5.html#smtpd_tls_chain_files">smtpd_tls_chain_files</a>)</b></DT><DD>
|
|
|
|
<p> Files with the Postfix <a href="tlsproxy.8.html">tlsproxy(8)</a> server keys and certificate
|
|
chains in PEM format. See <a href="postconf.5.html#smtpd_tls_chain_files">smtpd_tls_chain_files</a> for further details. </p>
|
|
|
|
<p> This feature is available in Postfix 3.4 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="tlsproxy_tls_ciphers">tlsproxy_tls_ciphers</a>
|
|
(default: $<a href="postconf.5.html#smtpd_tls_ciphers">smtpd_tls_ciphers</a>)</b></DT><DD>
|
|
|
|
<p> The minimum TLS cipher grade that the Postfix <a href="tlsproxy.8.html">tlsproxy(8)</a> server
|
|
will use with opportunistic TLS encryption. See <a href="postconf.5.html#smtpd_tls_ciphers">smtpd_tls_ciphers</a>
|
|
for further details. </p>
|
|
|
|
<p> This feature is available in Postfix 2.8 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="tlsproxy_tls_dcert_file">tlsproxy_tls_dcert_file</a>
|
|
(default: $<a href="postconf.5.html#smtpd_tls_dcert_file">smtpd_tls_dcert_file</a>)</b></DT><DD>
|
|
|
|
<p> File with the Postfix <a href="tlsproxy.8.html">tlsproxy(8)</a> server DSA certificate in PEM
|
|
format. This file may also contain the Postfix <a href="tlsproxy.8.html">tlsproxy(8)</a> server
|
|
private DSA key. DSA is obsolete and should not be used. See
|
|
<a href="postconf.5.html#smtpd_tls_dcert_file">smtpd_tls_dcert_file</a> for further details. </p>
|
|
|
|
<p> This feature is available in Postfix 2.8 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="tlsproxy_tls_dh1024_param_file">tlsproxy_tls_dh1024_param_file</a>
|
|
(default: $<a href="postconf.5.html#smtpd_tls_dh1024_param_file">smtpd_tls_dh1024_param_file</a>)</b></DT><DD>
|
|
|
|
<p> File with DH parameters that the Postfix <a href="tlsproxy.8.html">tlsproxy(8)</a> server
|
|
should use with non-export EDH ciphers. See <a href="postconf.5.html#smtpd_tls_dh1024_param_file">smtpd_tls_dh1024_param_file</a>
|
|
for further details. </p>
|
|
|
|
<p> This feature is deprecated as of Postfix 3.9. Do not specify. </p>
|
|
|
|
<p> This feature is available in Postfix 2.8 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="tlsproxy_tls_dh512_param_file">tlsproxy_tls_dh512_param_file</a>
|
|
(default: $<a href="postconf.5.html#smtpd_tls_dh512_param_file">smtpd_tls_dh512_param_file</a>)</b></DT><DD>
|
|
|
|
<p> File with DH parameters that the Postfix <a href="tlsproxy.8.html">tlsproxy(8)</a> server
|
|
should use with export-grade EDH ciphers. See <a href="postconf.5.html#smtpd_tls_dh512_param_file">smtpd_tls_dh512_param_file</a>
|
|
for further details. The default SMTP server cipher grade is
|
|
"medium" with Postfix releases after the middle of 2015, and as a
|
|
result export-grade cipher suites are by default not used. </p>
|
|
|
|
<p> With Postfix ≥ 3.6 export-grade Diffie-Hellman key exchange
|
|
is no longer supported, and this parameter is silently ignored. </p>
|
|
|
|
<p> This feature is available in Postfix 2.8 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="tlsproxy_tls_dkey_file">tlsproxy_tls_dkey_file</a>
|
|
(default: $<a href="postconf.5.html#smtpd_tls_dkey_file">smtpd_tls_dkey_file</a>)</b></DT><DD>
|
|
|
|
<p> File with the Postfix <a href="tlsproxy.8.html">tlsproxy(8)</a> server DSA private key in PEM
|
|
format. This file may be combined with the Postfix <a href="tlsproxy.8.html">tlsproxy(8)</a> server
|
|
DSA certificate file specified with $<a href="postconf.5.html#smtpd_tls_dcert_file">smtpd_tls_dcert_file</a>. DSA is
|
|
obsolete and should not be used. See <a href="postconf.5.html#smtpd_tls_dkey_file">smtpd_tls_dkey_file</a> for further
|
|
details. </p>
|
|
|
|
<p> This feature is available in Postfix 2.8 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="tlsproxy_tls_eccert_file">tlsproxy_tls_eccert_file</a>
|
|
(default: $<a href="postconf.5.html#smtpd_tls_eccert_file">smtpd_tls_eccert_file</a>)</b></DT><DD>
|
|
|
|
<p> File with the Postfix <a href="tlsproxy.8.html">tlsproxy(8)</a> server ECDSA certificate in PEM
|
|
format. This file may also contain the Postfix <a href="tlsproxy.8.html">tlsproxy(8)</a> server
|
|
private ECDSA key. See <a href="postconf.5.html#smtpd_tls_eccert_file">smtpd_tls_eccert_file</a> for further details. With
|
|
Postfix ≥ 3.4 the preferred way to configure tlsproxy server keys and
|
|
certificates is via the "<a href="postconf.5.html#tlsproxy_tls_chain_files">tlsproxy_tls_chain_files</a>" parameter. </p>
|
|
|
|
<p> This feature is available in Postfix 2.8 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="tlsproxy_tls_eckey_file">tlsproxy_tls_eckey_file</a>
|
|
(default: $<a href="postconf.5.html#smtpd_tls_eckey_file">smtpd_tls_eckey_file</a>)</b></DT><DD>
|
|
|
|
<p> File with the Postfix <a href="tlsproxy.8.html">tlsproxy(8)</a> server ECDSA private key in PEM
|
|
format. This file may be combined with the Postfix <a href="tlsproxy.8.html">tlsproxy(8)</a> server
|
|
ECDSA certificate file specified with $<a href="postconf.5.html#smtpd_tls_eccert_file">smtpd_tls_eccert_file</a>. See
|
|
<a href="postconf.5.html#smtpd_tls_eckey_file">smtpd_tls_eckey_file</a> for further details. With Postfix ≥ 3.4 the
|
|
preferred way to configure tlsproxy server keys and certificates is via
|
|
the "<a href="postconf.5.html#tlsproxy_tls_chain_files">tlsproxy_tls_chain_files</a>" parameter. </p>
|
|
|
|
<p> This feature is available in Postfix 2.8 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="tlsproxy_tls_eecdh_grade">tlsproxy_tls_eecdh_grade</a>
|
|
(default: $<a href="postconf.5.html#smtpd_tls_eecdh_grade">smtpd_tls_eecdh_grade</a>)</b></DT><DD>
|
|
|
|
<p> The Postfix <a href="tlsproxy.8.html">tlsproxy(8)</a> server security grade for ephemeral
|
|
elliptic-curve Diffie-Hellman (EECDH) key exchange. See
|
|
<a href="postconf.5.html#smtpd_tls_eecdh_grade">smtpd_tls_eecdh_grade</a> for further details. </p>
|
|
|
|
<p> This feature is not used as of Postfix 3.6. Do not specify. </p>
|
|
|
|
<p> This feature is available in Postfix 2.8 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="tlsproxy_tls_enable_rpk">tlsproxy_tls_enable_rpk</a>
|
|
(default: $<a href="postconf.5.html#smtpd_tls_enable_rpk">smtpd_tls_enable_rpk</a>)</b></DT><DD>
|
|
|
|
<p> Request that remote SMTP clients send an <a href="https://tools.ietf.org/html/rfc7250">RFC7250</a> raw public key
|
|
instead of an X.509 certificate, when asking or requiring client
|
|
authentication. See $<a href="postconf.5.html#smtpd_tls_enable_rpk">smtpd_tls_enable_rpk</a> for details. </p>
|
|
|
|
<p> This feature is available in Postfix 3.9 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="tlsproxy_tls_exclude_ciphers">tlsproxy_tls_exclude_ciphers</a>
|
|
(default: $<a href="postconf.5.html#smtpd_tls_exclude_ciphers">smtpd_tls_exclude_ciphers</a>)</b></DT><DD>
|
|
|
|
<p> List of ciphers or cipher types to exclude from the <a href="tlsproxy.8.html">tlsproxy(8)</a>
|
|
server cipher list at all TLS security levels. See
|
|
<a href="postconf.5.html#smtpd_tls_exclude_ciphers">smtpd_tls_exclude_ciphers</a> for further details. </p>
|
|
|
|
<p> This feature is available in Postfix 2.8 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="tlsproxy_tls_fingerprint_digest">tlsproxy_tls_fingerprint_digest</a>
|
|
(default: $<a href="postconf.5.html#smtpd_tls_fingerprint_digest">smtpd_tls_fingerprint_digest</a>)</b></DT><DD>
|
|
|
|
<p> The message digest algorithm to construct remote SMTP
|
|
client-certificate
|
|
fingerprints. See <a href="postconf.5.html#smtpd_tls_fingerprint_digest">smtpd_tls_fingerprint_digest</a> for further details.
|
|
</p>
|
|
|
|
<p> This feature is available in Postfix 2.8 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="tlsproxy_tls_key_file">tlsproxy_tls_key_file</a>
|
|
(default: $<a href="postconf.5.html#smtpd_tls_key_file">smtpd_tls_key_file</a>)</b></DT><DD>
|
|
|
|
<p> File with the Postfix <a href="tlsproxy.8.html">tlsproxy(8)</a> server RSA private key in PEM
|
|
format. This file may be combined with the Postfix <a href="tlsproxy.8.html">tlsproxy(8)</a> server
|
|
RSA certificate file specified with $<a href="postconf.5.html#smtpd_tls_cert_file">smtpd_tls_cert_file</a>. See
|
|
<a href="postconf.5.html#smtpd_tls_key_file">smtpd_tls_key_file</a> for further details. With Postfix ≥ 3.4 the
|
|
preferred way to configure tlsproxy server keys and certificates is via
|
|
the "<a href="postconf.5.html#tlsproxy_tls_chain_files">tlsproxy_tls_chain_files</a>" parameter. </p>
|
|
|
|
<p> This feature is available in Postfix 2.8 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="tlsproxy_tls_loglevel">tlsproxy_tls_loglevel</a>
|
|
(default: $<a href="postconf.5.html#smtpd_tls_loglevel">smtpd_tls_loglevel</a>)</b></DT><DD>
|
|
|
|
<p> Enable additional Postfix <a href="tlsproxy.8.html">tlsproxy(8)</a> server logging of TLS
|
|
activity. Each logging level also includes the information that
|
|
is logged at a lower logging level. See <a href="postconf.5.html#smtpd_tls_loglevel">smtpd_tls_loglevel</a> for
|
|
further details. </p>
|
|
|
|
<p> This feature is available in Postfix 2.8 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="tlsproxy_tls_mandatory_ciphers">tlsproxy_tls_mandatory_ciphers</a>
|
|
(default: $<a href="postconf.5.html#smtpd_tls_mandatory_ciphers">smtpd_tls_mandatory_ciphers</a>)</b></DT><DD>
|
|
|
|
<p> The minimum TLS cipher grade that the Postfix <a href="tlsproxy.8.html">tlsproxy(8)</a> server
|
|
will use with mandatory TLS encryption. See <a href="postconf.5.html#smtpd_tls_mandatory_ciphers">smtpd_tls_mandatory_ciphers</a>
|
|
for further details. </p>
|
|
|
|
<p> This feature is available in Postfix 2.8 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="tlsproxy_tls_mandatory_exclude_ciphers">tlsproxy_tls_mandatory_exclude_ciphers</a>
|
|
(default: $<a href="postconf.5.html#smtpd_tls_mandatory_exclude_ciphers">smtpd_tls_mandatory_exclude_ciphers</a>)</b></DT><DD>
|
|
|
|
<p> Additional list of ciphers or cipher types to exclude from the
|
|
<a href="tlsproxy.8.html">tlsproxy(8)</a> server cipher list at mandatory TLS security levels.
|
|
See <a href="postconf.5.html#smtpd_tls_mandatory_exclude_ciphers">smtpd_tls_mandatory_exclude_ciphers</a> for further details. </p>
|
|
|
|
<p> This feature is available in Postfix 2.8 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="tlsproxy_tls_mandatory_protocols">tlsproxy_tls_mandatory_protocols</a>
|
|
(default: $<a href="postconf.5.html#smtpd_tls_mandatory_protocols">smtpd_tls_mandatory_protocols</a>)</b></DT><DD>
|
|
|
|
<p> The SSL/TLS protocols accepted by the Postfix <a href="tlsproxy.8.html">tlsproxy(8)</a> server
|
|
with mandatory TLS encryption. If the list is empty, the server
|
|
supports all available SSL/TLS protocol versions. See
|
|
<a href="postconf.5.html#smtpd_tls_mandatory_protocols">smtpd_tls_mandatory_protocols</a> for further details. </p>
|
|
|
|
<p> This feature is available in Postfix 2.8 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="tlsproxy_tls_protocols">tlsproxy_tls_protocols</a>
|
|
(default: $<a href="postconf.5.html#smtpd_tls_protocols">smtpd_tls_protocols</a>)</b></DT><DD>
|
|
|
|
<p> List of TLS protocols that the Postfix <a href="tlsproxy.8.html">tlsproxy(8)</a> server will
|
|
exclude or include with opportunistic TLS encryption. See
|
|
<a href="postconf.5.html#smtpd_tls_protocols">smtpd_tls_protocols</a> for further details. </p>
|
|
|
|
<p> This feature is available in Postfix 2.8 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="tlsproxy_tls_req_ccert">tlsproxy_tls_req_ccert</a>
|
|
(default: $<a href="postconf.5.html#smtpd_tls_req_ccert">smtpd_tls_req_ccert</a>)</b></DT><DD>
|
|
|
|
<p> With mandatory TLS encryption, require a trusted remote SMTP
|
|
client certificate in order to allow TLS connections to proceed.
|
|
See <a href="postconf.5.html#smtpd_tls_req_ccert">smtpd_tls_req_ccert</a> for further details. </p>
|
|
|
|
<p> This feature is available in Postfix 2.8 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="tlsproxy_tls_security_level">tlsproxy_tls_security_level</a>
|
|
(default: $<a href="postconf.5.html#smtpd_tls_security_level">smtpd_tls_security_level</a>)</b></DT><DD>
|
|
|
|
<p> The SMTP TLS security level for the Postfix <a href="tlsproxy.8.html">tlsproxy(8)</a> server;
|
|
when a non-empty value is specified, this overrides the obsolete
|
|
parameters <a href="postconf.5.html#smtpd_use_tls">smtpd_use_tls</a> and <a href="postconf.5.html#smtpd_enforce_tls">smtpd_enforce_tls</a>. See
|
|
<a href="postconf.5.html#smtpd_tls_security_level">smtpd_tls_security_level</a> for further details. </p>
|
|
|
|
<p> This feature is available in Postfix 2.8 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="tlsproxy_tls_session_cache_timeout">tlsproxy_tls_session_cache_timeout</a>
|
|
(default: $<a href="postconf.5.html#smtpd_tls_session_cache_timeout">smtpd_tls_session_cache_timeout</a>)</b></DT><DD>
|
|
|
|
<p> Obsolete expiration time of Postfix <a href="tlsproxy.8.html">tlsproxy(8)</a> server TLS session
|
|
cache information. Since the cache is shared with <a href="smtpd.8.html">smtpd(8)</a> and managed
|
|
by <a href="tlsmgr.8.html">tlsmgr(8)</a>, there is only one expiration time for the SMTP server cache
|
|
shared by all three services, namely <a href="postconf.5.html#smtpd_tls_session_cache_timeout">smtpd_tls_session_cache_timeout</a>. </p>
|
|
|
|
<p> This feature is available in Postfix 2.8-2.10. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="tlsproxy_use_tls">tlsproxy_use_tls</a>
|
|
(default: $<a href="postconf.5.html#smtpd_use_tls">smtpd_use_tls</a>)</b></DT><DD>
|
|
|
|
<p> Opportunistic TLS: announce STARTTLS support to remote SMTP clients,
|
|
but do not require that clients use TLS encryption. See <a href="postconf.5.html#smtpd_use_tls">smtpd_use_tls</a>
|
|
for further details. Use <a href="postconf.5.html#tlsproxy_tls_security_level">tlsproxy_tls_security_level</a> instead. </p>
|
|
|
|
<p> This feature is deprecated as of Postfix 3.9. Specify
|
|
<a href="postconf.5.html#tlsproxy_tls_security_level">tlsproxy_tls_security_level</a> instead. </p>
|
|
|
|
<p> This feature is available in Postfix 2.8 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="tlsproxy_watchdog_timeout">tlsproxy_watchdog_timeout</a>
|
|
(default: 10s)</b></DT><DD>
|
|
|
|
<p> How much time a <a href="tlsproxy.8.html">tlsproxy(8)</a> process may take to process local
|
|
or remote I/O before it is terminated by a built-in watchdog timer.
|
|
This is a safety mechanism that prevents <a href="tlsproxy.8.html">tlsproxy(8)</a> from becoming
|
|
non-responsive due to a bug in Postfix itself or in system software.
|
|
To avoid false alarms and unnecessary cache corruption this limit
|
|
cannot be set under 10s. </p>
|
|
|
|
<p> Specify a non-zero time value (an integral value plus an optional
|
|
one-letter suffix that specifies the time unit). Time units: s
|
|
(seconds), m (minutes), h (hours), d (days), w (weeks).
|
|
The default time unit is s (seconds). </p>
|
|
|
|
<p> This feature is available in Postfix 2.8 and later </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="trace_service_name">trace_service_name</a>
|
|
(default: trace)</b></DT><DD>
|
|
|
|
<p>
|
|
The name of the trace service. This service is implemented by the
|
|
<a href="bounce.8.html">bounce(8)</a> daemon and maintains a record
|
|
of mail deliveries and produces a mail delivery report when verbose
|
|
delivery is requested with "<b>sendmail -v</b>".
|
|
</p>
|
|
|
|
<p>
|
|
This feature is available in Postfix 2.1 and later.
|
|
</p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="transport_delivery_slot_cost">transport_delivery_slot_cost</a>
|
|
(default: $<a href="postconf.5.html#default_delivery_slot_cost">default_delivery_slot_cost</a>)</b></DT><DD>
|
|
|
|
<p> A transport-specific override for the <a href="postconf.5.html#default_delivery_slot_cost">default_delivery_slot_cost</a>
|
|
parameter value, where <i>transport</i> is the <a href="master.5.html">master.cf</a> name of
|
|
the message delivery transport. </p>
|
|
|
|
<p> Note: <a href="postconf.5.html#transport_delivery_slot_cost"><i>transport</i>_delivery_slot_cost</a> parameters will not
|
|
show up in "postconf" command output before Postfix version 2.9.
|
|
This limitation applies to many parameters whose name is a combination
|
|
of a <a href="master.5.html">master.cf</a> service name and a built-in suffix (in this case:
|
|
"_delivery_slot_cost"). </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="transport_delivery_slot_discount">transport_delivery_slot_discount</a>
|
|
(default: $<a href="postconf.5.html#default_delivery_slot_discount">default_delivery_slot_discount</a>)</b></DT><DD>
|
|
|
|
<p> A transport-specific override for the <a href="postconf.5.html#default_delivery_slot_discount">default_delivery_slot_discount</a>
|
|
parameter value, where <i>transport</i> is the <a href="master.5.html">master.cf</a> name of
|
|
the message delivery transport. </p>
|
|
|
|
<p> Note: <a href="postconf.5.html#transport_delivery_slot_discount"><i>transport</i>_delivery_slot_discount</a> parameters will
|
|
not show up in "postconf" command output before Postfix version
|
|
2.9. This limitation applies to many parameters whose name is a
|
|
combination of a <a href="master.5.html">master.cf</a> service name and a built-in suffix (in
|
|
this case: "_delivery_slot_discount"). </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="transport_delivery_slot_loan">transport_delivery_slot_loan</a>
|
|
(default: $<a href="postconf.5.html#default_delivery_slot_loan">default_delivery_slot_loan</a>)</b></DT><DD>
|
|
|
|
<p> A transport-specific override for the <a href="postconf.5.html#default_delivery_slot_loan">default_delivery_slot_loan</a>
|
|
parameter value, where <i>transport</i> is the <a href="master.5.html">master.cf</a> name of
|
|
the message delivery transport. </p>
|
|
|
|
<p> Note: <a href="postconf.5.html#transport_delivery_slot_loan"><i>transport</i>_delivery_slot_loan</a> parameters will not
|
|
show up in "postconf" command output before Postfix version 2.9.
|
|
This limitation applies to many parameters whose name is a combination
|
|
of a <a href="master.5.html">master.cf</a> service name and a built-in suffix (in this case:
|
|
"_delivery_slot_loan"). </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="transport_destination_concurrency_failed_cohort_limit">transport_destination_concurrency_failed_cohort_limit</a>
|
|
(default: $<a href="postconf.5.html#default_destination_concurrency_failed_cohort_limit">default_destination_concurrency_failed_cohort_limit</a>)</b></DT><DD>
|
|
|
|
<p> A transport-specific override for the
|
|
<a href="postconf.5.html#default_destination_concurrency_failed_cohort_limit">default_destination_concurrency_failed_cohort_limit</a> parameter value,
|
|
where <i>transport</i> is the <a href="master.5.html">master.cf</a> name of the message delivery
|
|
transport. </p>
|
|
|
|
<p> Note: some <a href="postconf.5.html#transport_destination_concurrency_failed_cohort_limit"><i>transport</i>_destination_concurrency_failed_cohort_limit</a>
|
|
parameters will not show up in "postconf" command output before
|
|
Postfix version 2.9. This limitation applies to many parameters
|
|
whose name is a combination of a <a href="master.5.html">master.cf</a> service name and a
|
|
built-in suffix (in this case:
|
|
"_destination_concurrency_failed_cohort_limit"). </p>
|
|
|
|
<p> This feature is available in Postfix 2.5 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="transport_destination_concurrency_limit">transport_destination_concurrency_limit</a>
|
|
(default: $<a href="postconf.5.html#default_destination_concurrency_limit">default_destination_concurrency_limit</a>)</b></DT><DD>
|
|
|
|
<p> A transport-specific override for the
|
|
<a href="postconf.5.html#default_destination_concurrency_limit">default_destination_concurrency_limit</a> parameter value, where
|
|
<i>transport</i> is the <a href="master.5.html">master.cf</a> name of the message delivery
|
|
transport. </p>
|
|
|
|
<p> Note: some <a href="postconf.5.html#transport_destination_concurrency_limit"><i>transport</i>_destination_concurrency_limit</a>
|
|
parameters will not show up in "postconf" command output before
|
|
Postfix version 2.9. This limitation applies to many parameters
|
|
whose name is a combination of a <a href="master.5.html">master.cf</a> service name and a
|
|
built-in suffix (in this case: "_destination_concurrency_limit").
|
|
</p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="transport_destination_concurrency_negative_feedback">transport_destination_concurrency_negative_feedback</a>
|
|
(default: $<a href="postconf.5.html#default_destination_concurrency_negative_feedback">default_destination_concurrency_negative_feedback</a>)</b></DT><DD>
|
|
|
|
<p> A transport-specific override for the
|
|
<a href="postconf.5.html#default_destination_concurrency_negative_feedback">default_destination_concurrency_negative_feedback</a> parameter value,
|
|
where <i>transport</i> is the <a href="master.5.html">master.cf</a> name of the message delivery
|
|
transport. </p>
|
|
|
|
<p> Note: some <a href="postconf.5.html#transport_destination_concurrency_negative_feedback"><i>transport</i>_destination_concurrency_negative_feedback</a>
|
|
parameters will not show up in "postconf" command output before
|
|
Postfix version 2.9. This limitation applies to many parameters
|
|
whose name is a combination of a <a href="master.5.html">master.cf</a> service name and a
|
|
built-in suffix (in this case:
|
|
"_destination_concurrency_negative_feedback"). </p>
|
|
|
|
<p> This feature is available in Postfix 2.5 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="transport_destination_concurrency_positive_feedback">transport_destination_concurrency_positive_feedback</a>
|
|
(default: $<a href="postconf.5.html#default_destination_concurrency_positive_feedback">default_destination_concurrency_positive_feedback</a>)</b></DT><DD>
|
|
|
|
<p> A transport-specific override for the
|
|
<a href="postconf.5.html#default_destination_concurrency_positive_feedback">default_destination_concurrency_positive_feedback</a> parameter value,
|
|
where <i>transport</i> is the <a href="master.5.html">master.cf</a> name of the message delivery
|
|
transport. </p>
|
|
|
|
<p> Note: some <a href="postconf.5.html#transport_destination_concurrency_positive_feedback"><i>transport</i>_destination_concurrency_positive_feedback</a>
|
|
parameters will not show up in "postconf" command output before
|
|
Postfix version 2.9. This limitation applies to many parameters
|
|
whose name is a combination of a <a href="master.5.html">master.cf</a> service name and a
|
|
built-in suffix (in this case:
|
|
"_destination_concurrency_positive_feedback"). </p>
|
|
|
|
<p> This feature is available in Postfix 2.5 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="transport_destination_rate_delay">transport_destination_rate_delay</a>
|
|
(default: $<a href="postconf.5.html#default_destination_rate_delay">default_destination_rate_delay</a>)</b></DT><DD>
|
|
|
|
<p> A transport-specific override for the <a href="postconf.5.html#default_destination_rate_delay">default_destination_rate_delay</a>
|
|
parameter value, where <i>transport</i> is the <a href="master.5.html">master.cf</a> name of
|
|
the message delivery transport. </p>
|
|
|
|
<p> Note: some <a href="postconf.5.html#transport_destination_rate_delay"><i>transport</i>_destination_rate_delay</a> parameters
|
|
will not show up in "postconf" command output before Postfix version
|
|
2.9. This limitation applies to many parameters whose name is a
|
|
combination of a <a href="master.5.html">master.cf</a> service name and a built-in suffix (in
|
|
this case: "_destination_rate_delay"). </p>
|
|
|
|
<p> This feature is available in Postfix 2.5 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="transport_destination_recipient_limit">transport_destination_recipient_limit</a>
|
|
(default: $<a href="postconf.5.html#default_destination_recipient_limit">default_destination_recipient_limit</a>)</b></DT><DD>
|
|
|
|
<p> A transport-specific override for the
|
|
<a href="postconf.5.html#default_destination_recipient_limit">default_destination_recipient_limit</a> parameter value, where
|
|
<i>transport</i> is the <a href="master.5.html">master.cf</a> name of the message delivery
|
|
transport. </p>
|
|
|
|
<p> Note: some <a href="postconf.5.html#transport_destination_recipient_limit"><i>transport</i>_destination_recipient_limit</a> parameters
|
|
will not show up in "postconf" command output before Postfix version
|
|
2.9. This limitation applies to many parameters whose name is a
|
|
combination of a <a href="master.5.html">master.cf</a> service name and a built-in suffix (in
|
|
this case: "_destination_recipient_limit"). </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="transport_extra_recipient_limit">transport_extra_recipient_limit</a>
|
|
(default: $<a href="postconf.5.html#default_extra_recipient_limit">default_extra_recipient_limit</a>)</b></DT><DD>
|
|
|
|
<p> A transport-specific override for the <a href="postconf.5.html#default_extra_recipient_limit">default_extra_recipient_limit</a>
|
|
parameter value, where <i>transport</i> is the <a href="master.5.html">master.cf</a> name of
|
|
the message delivery transport. </p>
|
|
|
|
<p> Note: <a href="postconf.5.html#transport_extra_recipient_limit"><i>transport</i>_extra_recipient_limit</a> parameters will
|
|
not show up in "postconf" command output before Postfix version
|
|
2.9. This limitation applies to many parameters whose name is a
|
|
combination of a <a href="master.5.html">master.cf</a> service name and a built-in suffix (in
|
|
this case: "_extra_recipient_limit"). </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="transport_initial_destination_concurrency">transport_initial_destination_concurrency</a>
|
|
(default: $<a href="postconf.5.html#initial_destination_concurrency">initial_destination_concurrency</a>)</b></DT><DD>
|
|
|
|
<p> A transport-specific override for the <a href="postconf.5.html#initial_destination_concurrency">initial_destination_concurrency</a>
|
|
parameter value, where <i>transport</i> is the <a href="master.5.html">master.cf</a> name of
|
|
the message delivery transport. </p>
|
|
|
|
<p> Note: some <a href="postconf.5.html#transport_initial_destination_concurrency"><i>transport</i>_initial_destination_concurrency</a>
|
|
parameters will not show up in "postconf" command output before
|
|
Postfix version 2.9. This limitation applies to many parameters
|
|
whose name is a combination of a <a href="master.5.html">master.cf</a> service name and a
|
|
built-in suffix (in this case: "_initial_destination_concurrency").
|
|
</p>
|
|
|
|
<p> This feature is available in Postfix 2.5 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="transport_maps">transport_maps</a>
|
|
(default: empty)</b></DT><DD>
|
|
|
|
<p>
|
|
Optional lookup tables with mappings from recipient address to
|
|
(message delivery transport, next-hop destination). See <a href="transport.5.html">transport(5)</a>
|
|
for syntax details.
|
|
</p>
|
|
|
|
<p> This information may override the message delivery transport
|
|
and/or next-hop destination that are specified with $<a href="postconf.5.html#local_transport">local_transport</a>,
|
|
$<a href="postconf.5.html#virtual_transport">virtual_transport</a>, $<a href="postconf.5.html#relay_transport">relay_transport</a>, $<a href="postconf.5.html#default_transport">default_transport</a>,
|
|
$<a href="postconf.5.html#sender_dependent_relayhost_maps">sender_dependent_relayhost_maps</a>, $<a href="postconf.5.html#relayhost">relayhost</a>,
|
|
$<a href="postconf.5.html#sender_dependent_default_transport_maps">sender_dependent_default_transport_maps</a>, or the recipient domain.
|
|
</p>
|
|
|
|
<p>
|
|
Specify zero or more "<a href="DATABASE_README.html">type:table</a>" lookup tables, separated by
|
|
whitespace or comma. Tables will be searched in the specified order
|
|
until a match is found. If you use this
|
|
feature with local files, run "<b>postmap /etc/postfix/transport</b>"
|
|
after making a change. </p>
|
|
|
|
<p> Pattern matching of domain names is controlled by the presence
|
|
or absence of "<a href="postconf.5.html#transport_maps">transport_maps</a>" in the <a href="postconf.5.html#parent_domain_matches_subdomains">parent_domain_matches_subdomains</a>
|
|
parameter value. </p>
|
|
|
|
<p> For safety reasons, as of Postfix 2.3 this feature does not
|
|
allow $number substitutions in regular expression maps. </p>
|
|
|
|
<p>
|
|
Examples:
|
|
</p>
|
|
|
|
<pre>
|
|
<a href="postconf.5.html#transport_maps">transport_maps</a> = <a href="DATABASE_README.html#types">dbm</a>:/etc/postfix/transport
|
|
<a href="postconf.5.html#transport_maps">transport_maps</a> = <a href="DATABASE_README.html#types">hash</a>:/etc/postfix/transport
|
|
</pre>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="transport_minimum_delivery_slots">transport_minimum_delivery_slots</a>
|
|
(default: $<a href="postconf.5.html#default_minimum_delivery_slots">default_minimum_delivery_slots</a>)</b></DT><DD>
|
|
|
|
<p> A transport-specific override for the <a href="postconf.5.html#default_minimum_delivery_slots">default_minimum_delivery_slots</a>
|
|
parameter value, where <i>transport</i> is the <a href="master.5.html">master.cf</a> name of
|
|
the message delivery transport. </p>
|
|
|
|
<p> Note: <a href="postconf.5.html#transport_minimum_delivery_slots"><i>transport</i>_minimum_delivery_slots</a> parameters will
|
|
not show up in "postconf" command output before Postfix version
|
|
2.9. This limitation applies to many parameters whose name is a
|
|
combination of a <a href="master.5.html">master.cf</a> service name and a built-in suffix (in
|
|
this case: "_minimum_delivery_slots"). </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="transport_recipient_limit">transport_recipient_limit</a>
|
|
(default: $<a href="postconf.5.html#default_recipient_limit">default_recipient_limit</a>)</b></DT><DD>
|
|
|
|
<p> A transport-specific override for the <a href="postconf.5.html#default_recipient_limit">default_recipient_limit</a>
|
|
parameter value, where <i>transport</i> is the <a href="master.5.html">master.cf</a> name of
|
|
the message delivery transport. </p>
|
|
|
|
<p> Note: some <a href="postconf.5.html#transport_recipient_limit"><i>transport</i>_recipient_limit</a> parameters will not
|
|
show up in "postconf" command output before Postfix version 2.9.
|
|
This limitation applies to many parameters whose name is a combination
|
|
of a <a href="master.5.html">master.cf</a> service name and a built-in suffix (in this case:
|
|
"_recipient_limit"). </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="transport_recipient_refill_delay">transport_recipient_refill_delay</a>
|
|
(default: $<a href="postconf.5.html#default_recipient_refill_delay">default_recipient_refill_delay</a>)</b></DT><DD>
|
|
|
|
<p> A transport-specific override for the <a href="postconf.5.html#default_recipient_refill_delay">default_recipient_refill_delay</a>
|
|
parameter value, where <i>transport</i> is the <a href="master.5.html">master.cf</a> name of
|
|
the message delivery transport. </p>
|
|
|
|
<p> Note: <a href="postconf.5.html#transport_recipient_refill_delay"><i>transport</i>_recipient_refill_delay</a> parameters will
|
|
not show up in "postconf" command output before Postfix version
|
|
2.9. This limitation applies to many parameters whose name is a
|
|
combination of a <a href="master.5.html">master.cf</a> service name and a built-in suffix (in
|
|
this case: "_recipient_refill_delay"). </p>
|
|
|
|
<p> This feature is available in Postfix 2.4 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="transport_recipient_refill_limit">transport_recipient_refill_limit</a>
|
|
(default: $<a href="postconf.5.html#default_recipient_refill_limit">default_recipient_refill_limit</a>)</b></DT><DD>
|
|
|
|
<p> A transport-specific override for the <a href="postconf.5.html#default_recipient_refill_limit">default_recipient_refill_limit</a>
|
|
parameter value, where <i>transport</i> is the <a href="master.5.html">master.cf</a> name of
|
|
the message delivery transport. </p>
|
|
|
|
<p> Note: <a href="postconf.5.html#transport_recipient_refill_limit"><i>transport</i>_recipient_refill_limit</a> parameters will
|
|
not show up in "postconf" command output before Postfix version
|
|
2.9. This limitation applies to many parameters whose name is a
|
|
combination of a <a href="master.5.html">master.cf</a> service name and a built-in suffix (in
|
|
this case: "_recipient_refill_limit"). </p>
|
|
|
|
<p> This feature is available in Postfix 2.4 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="transport_retry_time">transport_retry_time</a>
|
|
(default: 60s)</b></DT><DD>
|
|
|
|
<p>
|
|
The time between attempts by the Postfix queue manager to contact
|
|
a malfunctioning message delivery transport.
|
|
</p>
|
|
|
|
<p> Specify a non-zero time value (an integral value plus an optional
|
|
one-letter suffix that specifies the time unit). Time units: s
|
|
(seconds), m (minutes), h (hours), d (days), w (weeks).
|
|
The default time unit is s (seconds). </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="transport_time_limit">transport_time_limit</a>
|
|
(default: $<a href="postconf.5.html#command_time_limit">command_time_limit</a>)</b></DT><DD>
|
|
|
|
<p> A transport-specific override for the <a href="postconf.5.html#command_time_limit">command_time_limit</a> parameter
|
|
value, where <i>transport</i> is the <a href="master.5.html">master.cf</a> name of the message
|
|
delivery transport. </p>
|
|
|
|
<p> Specify a non-zero time value (an integral value plus an optional
|
|
one-letter suffix that specifies the time unit). Time units: s
|
|
(seconds), m (minutes), h (hours), d (days), w (weeks).
|
|
The default time unit is s (seconds). </p>
|
|
|
|
<p> Note: <a href="postconf.5.html#transport_time_limit"><i>transport</i>_time_limit</a> parameters will not show up
|
|
in "postconf" command output before Postfix version 2.9. This
|
|
limitation applies to many parameters whose name is a combination
|
|
of a <a href="master.5.html">master.cf</a> service name and a built-in suffix (in this case:
|
|
"_time_limit"). </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="transport_transport_rate_delay">transport_transport_rate_delay</a>
|
|
(default: $<a href="postconf.5.html#default_transport_rate_delay">default_transport_rate_delay</a>)</b></DT><DD>
|
|
|
|
<p> A transport-specific override for the <a href="postconf.5.html#default_transport_rate_delay">default_transport_rate_delay</a>
|
|
parameter value, where the initial <i>transport</i> in the parameter
|
|
name is the <a href="master.5.html">master.cf</a> name of the message delivery transport. </p>
|
|
|
|
<p> Specify a non-negative time value (an integral value plus an optional
|
|
one-letter suffix that specifies the time unit). Time units: s
|
|
(seconds), m (minutes), h (hours), d (days), w (weeks).
|
|
The default time unit is s (seconds). </p>
|
|
|
|
<p> Note: <a href="postconf.5.html#transport_transport_rate_delay"><i>transport</i>_transport_rate_delay</a> parameters will
|
|
not show up in "postconf" command output before Postfix version
|
|
2.9. This limitation applies to many parameters whose name is a
|
|
combination of a <a href="master.5.html">master.cf</a> service name and a built-in suffix (in
|
|
this case: "_transport_rate_delay"). </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="trigger_timeout">trigger_timeout</a>
|
|
(default: 10s)</b></DT><DD>
|
|
|
|
<p>
|
|
The time limit for sending a trigger to a Postfix daemon (for
|
|
example, the <a href="pickup.8.html">pickup(8)</a> or <a href="qmgr.8.html">qmgr(8)</a> daemon). This time limit prevents
|
|
programs from getting stuck when the mail system is under heavy
|
|
load.
|
|
</p>
|
|
|
|
<p> Specify a non-zero time value (an integral value plus an optional
|
|
one-letter suffix that specifies the time unit). Time units: s
|
|
(seconds), m (minutes), h (hours), d (days), w (weeks).
|
|
The default time unit is s (seconds). </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="undisclosed_recipients_header">undisclosed_recipients_header</a>
|
|
(default: see "postconf -d" output)</b></DT><DD>
|
|
|
|
<p>
|
|
Message header that the Postfix <a href="cleanup.8.html">cleanup(8)</a> server inserts when a
|
|
message contains no To: or Cc: message header. With Postfix 2.8
|
|
and later, the default value is empty. With Postfix 2.4-2.7,
|
|
specify an empty value to disable this feature. </p>
|
|
|
|
<p> Example: </p>
|
|
|
|
<pre>
|
|
# Default value before Postfix 2.8.
|
|
# Note: the ":" and ";" are both required.
|
|
<a href="postconf.5.html#undisclosed_recipients_header">undisclosed_recipients_header</a> = To: undisclosed-recipients:;
|
|
</pre>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="unknown_address_reject_code">unknown_address_reject_code</a>
|
|
(default: 450)</b></DT><DD>
|
|
|
|
<p>
|
|
The numerical response code when the Postfix SMTP server rejects a
|
|
sender or recipient address because its domain is unknown. This
|
|
is one of the possible replies from the restrictions
|
|
<a href="postconf.5.html#reject_unknown_sender_domain">reject_unknown_sender_domain</a> and <a href="postconf.5.html#reject_unknown_recipient_domain">reject_unknown_recipient_domain</a>.
|
|
</p>
|
|
|
|
<p>
|
|
Do not change this unless you have a complete understanding of <a href="https://tools.ietf.org/html/rfc5321">RFC 5321</a>.
|
|
</p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="unknown_address_tempfail_action">unknown_address_tempfail_action</a>
|
|
(default: $<a href="postconf.5.html#reject_tempfail_action">reject_tempfail_action</a>)</b></DT><DD>
|
|
|
|
<p> The Postfix SMTP server's action when <a href="postconf.5.html#reject_unknown_sender_domain">reject_unknown_sender_domain</a>
|
|
or <a href="postconf.5.html#reject_unknown_recipient_domain">reject_unknown_recipient_domain</a> fail due to a temporary error
|
|
condition. Specify "defer" to defer the remote SMTP client request
|
|
immediately. With the default "<a href="postconf.5.html#defer_if_permit">defer_if_permit</a>" action, the Postfix
|
|
SMTP server continues to look for opportunities to reject mail, and
|
|
defers the client request only if it would otherwise be accepted.
|
|
</p>
|
|
|
|
<p> This feature is available in Postfix 2.6 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="unknown_client_reject_code">unknown_client_reject_code</a>
|
|
(default: 450)</b></DT><DD>
|
|
|
|
<p>
|
|
The numerical Postfix SMTP server response code when a client
|
|
without valid address <=> name mapping is rejected by the
|
|
<a href="postconf.5.html#reject_unknown_client_hostname">reject_unknown_client_hostname</a> restriction. The SMTP server always replies
|
|
with 450 when the mapping failed due to a temporary error condition.
|
|
</p>
|
|
|
|
<p>
|
|
Do not change this unless you have a complete understanding of <a href="https://tools.ietf.org/html/rfc5321">RFC 5321</a>.
|
|
</p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="unknown_helo_hostname_tempfail_action">unknown_helo_hostname_tempfail_action</a>
|
|
(default: $<a href="postconf.5.html#reject_tempfail_action">reject_tempfail_action</a>)</b></DT><DD>
|
|
|
|
<p> The Postfix SMTP server's action when <a href="postconf.5.html#reject_unknown_helo_hostname">reject_unknown_helo_hostname</a>
|
|
fails due to a temporary error condition. Specify "defer" to defer
|
|
the remote SMTP client request immediately. With the default
|
|
"<a href="postconf.5.html#defer_if_permit">defer_if_permit</a>" action, the Postfix SMTP server continues to look
|
|
for opportunities to reject mail, and defers the client request
|
|
only if it would otherwise be accepted. </p>
|
|
|
|
<p> This feature is available in Postfix 2.6 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="unknown_hostname_reject_code">unknown_hostname_reject_code</a>
|
|
(default: 450)</b></DT><DD>
|
|
|
|
<p>
|
|
The numerical Postfix SMTP server response code when the hostname
|
|
specified with the HELO or EHLO command is rejected by the
|
|
<a href="postconf.5.html#reject_unknown_helo_hostname">reject_unknown_helo_hostname</a> restriction.
|
|
</p>
|
|
|
|
<p>
|
|
Do not change this unless you have a complete understanding of <a href="https://tools.ietf.org/html/rfc5321">RFC 5321</a>.
|
|
</p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="unknown_local_recipient_reject_code">unknown_local_recipient_reject_code</a>
|
|
(default: 550)</b></DT><DD>
|
|
|
|
<p>
|
|
The numerical Postfix SMTP server response code when a recipient
|
|
address is local, and $<a href="postconf.5.html#local_recipient_maps">local_recipient_maps</a> specifies a list of
|
|
lookup tables that does not match the recipient. A recipient
|
|
address is local when its domain matches $<a href="postconf.5.html#mydestination">mydestination</a>,
|
|
$<a href="postconf.5.html#proxy_interfaces">proxy_interfaces</a> or $<a href="postconf.5.html#inet_interfaces">inet_interfaces</a>.
|
|
</p>
|
|
|
|
<p>
|
|
The default setting is 550 (reject mail) but it is safer to initially
|
|
use 450 (try again later) so you have time to find out if your
|
|
<a href="postconf.5.html#local_recipient_maps">local_recipient_maps</a> settings are OK.
|
|
</p>
|
|
|
|
<p>
|
|
Example:
|
|
</p>
|
|
|
|
<pre>
|
|
<a href="postconf.5.html#unknown_local_recipient_reject_code">unknown_local_recipient_reject_code</a> = 450
|
|
</pre>
|
|
|
|
<p>
|
|
This feature is available in Postfix 2.0 and later.
|
|
</p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="unknown_relay_recipient_reject_code">unknown_relay_recipient_reject_code</a>
|
|
(default: 550)</b></DT><DD>
|
|
|
|
<p>
|
|
The numerical Postfix SMTP server reply code when a recipient
|
|
address matches $<a href="postconf.5.html#relay_domains">relay_domains</a>, and <a href="postconf.5.html#relay_recipient_maps">relay_recipient_maps</a> specifies
|
|
a list of lookup tables that does not match the recipient address.
|
|
</p>
|
|
|
|
<p>
|
|
This feature is available in Postfix 2.0 and later.
|
|
</p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="unknown_virtual_alias_reject_code">unknown_virtual_alias_reject_code</a>
|
|
(default: 550)</b></DT><DD>
|
|
|
|
<p>
|
|
The Postfix SMTP server reply code when a recipient address matches
|
|
$<a href="postconf.5.html#virtual_alias_domains">virtual_alias_domains</a>, and $<a href="postconf.5.html#virtual_alias_maps">virtual_alias_maps</a> specifies a list
|
|
of lookup tables that does not match the recipient address.
|
|
</p>
|
|
|
|
<p>
|
|
This feature is available in Postfix 2.0 and later.
|
|
</p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="unknown_virtual_mailbox_reject_code">unknown_virtual_mailbox_reject_code</a>
|
|
(default: 550)</b></DT><DD>
|
|
|
|
<p>
|
|
The Postfix SMTP server reply code when a recipient address matches
|
|
$<a href="postconf.5.html#virtual_mailbox_domains">virtual_mailbox_domains</a>, and $<a href="postconf.5.html#virtual_mailbox_maps">virtual_mailbox_maps</a> specifies a list
|
|
of lookup tables that does not match the recipient address.
|
|
</p>
|
|
|
|
<p>
|
|
This feature is available in Postfix 2.0 and later.
|
|
</p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="unverified_recipient_defer_code">unverified_recipient_defer_code</a>
|
|
(default: 450)</b></DT><DD>
|
|
|
|
<p>
|
|
The numerical Postfix SMTP server response when a recipient address
|
|
probe fails due to a temporary error condition.
|
|
</p>
|
|
|
|
<p>
|
|
Unlike elsewhere in Postfix, you can specify 250 in order to
|
|
accept the address anyway.
|
|
</p>
|
|
|
|
<p>
|
|
Do not change this unless you have a complete understanding of <a href="https://tools.ietf.org/html/rfc5321">RFC 5321</a>.
|
|
</p>
|
|
|
|
<p>
|
|
This feature is available in Postfix 2.6 and later.
|
|
</p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="unverified_recipient_reject_code">unverified_recipient_reject_code</a>
|
|
(default: 450)</b></DT><DD>
|
|
|
|
<p>
|
|
The numerical Postfix SMTP server response when a recipient address
|
|
is rejected by the <a href="postconf.5.html#reject_unverified_recipient">reject_unverified_recipient</a> restriction.
|
|
</p>
|
|
|
|
<p>
|
|
Unlike elsewhere in Postfix, you can specify 250 in order to
|
|
accept the address anyway.
|
|
</p>
|
|
|
|
<p>
|
|
Do not change this unless you have a complete understanding of <a href="https://tools.ietf.org/html/rfc5321">RFC 5321</a>.
|
|
</p>
|
|
|
|
<p>
|
|
This feature is available in Postfix 2.1 and later.
|
|
</p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="unverified_recipient_reject_reason">unverified_recipient_reject_reason</a>
|
|
(default: empty)</b></DT><DD>
|
|
|
|
<p> The Postfix SMTP server's reply when rejecting mail with
|
|
<a href="postconf.5.html#reject_unverified_recipient">reject_unverified_recipient</a>. Do not include the numeric SMTP reply
|
|
code or the enhanced status code. By default, the response includes
|
|
actual address verification details.
|
|
|
|
<p> Example: </p>
|
|
|
|
<pre>
|
|
<a href="postconf.5.html#unverified_recipient_reject_reason">unverified_recipient_reject_reason</a> = Recipient address lookup failed
|
|
</pre>
|
|
|
|
<p> This feature is available in Postfix 2.6 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="unverified_recipient_tempfail_action">unverified_recipient_tempfail_action</a>
|
|
(default: $<a href="postconf.5.html#reject_tempfail_action">reject_tempfail_action</a>)</b></DT><DD>
|
|
|
|
<p> The Postfix SMTP server's action when <a href="postconf.5.html#reject_unverified_recipient">reject_unverified_recipient</a>
|
|
fails due to a temporary error condition. Specify "defer" to defer
|
|
the remote SMTP client request immediately. With the default
|
|
"<a href="postconf.5.html#defer_if_permit">defer_if_permit</a>" action, the Postfix SMTP server continues to look
|
|
for opportunities to reject mail, and defers the client request
|
|
only if it would otherwise be accepted. </p>
|
|
|
|
<p> This feature is available in Postfix 2.6 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="unverified_sender_defer_code">unverified_sender_defer_code</a>
|
|
(default: 450)</b></DT><DD>
|
|
|
|
<p>
|
|
The numerical Postfix SMTP server response code when a sender address
|
|
probe fails due to a temporary error condition.
|
|
</p>
|
|
|
|
<p>
|
|
Unlike elsewhere in Postfix, you can specify 250 in order to
|
|
accept the address anyway.
|
|
</p>
|
|
|
|
<p>
|
|
Do not change this unless you have a complete understanding of <a href="https://tools.ietf.org/html/rfc5321">RFC 5321</a>.
|
|
</p>
|
|
|
|
<p>
|
|
This feature is available in Postfix 2.6 and later.
|
|
</p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="unverified_sender_reject_code">unverified_sender_reject_code</a>
|
|
(default: 450)</b></DT><DD>
|
|
|
|
<p>
|
|
The numerical Postfix SMTP server response code when a recipient
|
|
address is rejected by the <a href="postconf.5.html#reject_unverified_sender">reject_unverified_sender</a> restriction.
|
|
</p>
|
|
|
|
<p>
|
|
Unlike elsewhere in Postfix, you can specify 250 in order to
|
|
accept the address anyway.
|
|
</p>
|
|
|
|
<p>
|
|
Do not change this unless you have a complete understanding of <a href="https://tools.ietf.org/html/rfc5321">RFC 5321</a>.
|
|
</p>
|
|
|
|
<p>
|
|
This feature is available in Postfix 2.1 and later.
|
|
</p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="unverified_sender_reject_reason">unverified_sender_reject_reason</a>
|
|
(default: empty)</b></DT><DD>
|
|
|
|
<p> The Postfix SMTP server's reply when rejecting mail with
|
|
<a href="postconf.5.html#reject_unverified_sender">reject_unverified_sender</a>. Do not include the numeric SMTP reply
|
|
code or the enhanced status code. By default, the response includes
|
|
actual address verification details.
|
|
|
|
<p> Example: </p>
|
|
|
|
<pre>
|
|
<a href="postconf.5.html#unverified_sender_reject_reason">unverified_sender_reject_reason</a> = Sender address lookup failed
|
|
</pre>
|
|
|
|
<p> This feature is available in Postfix 2.6 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="unverified_sender_tempfail_action">unverified_sender_tempfail_action</a>
|
|
(default: $<a href="postconf.5.html#reject_tempfail_action">reject_tempfail_action</a>)</b></DT><DD>
|
|
|
|
<p> The Postfix SMTP server's action when <a href="postconf.5.html#reject_unverified_sender">reject_unverified_sender</a>
|
|
fails due to a temporary error condition. Specify "defer" to defer
|
|
the remote SMTP client request immediately. With the default
|
|
"<a href="postconf.5.html#defer_if_permit">defer_if_permit</a>" action, the Postfix SMTP server continues to look
|
|
for opportunities to reject mail, and defers the client request
|
|
only if it would otherwise be accepted. </p>
|
|
|
|
<p> This feature is available in Postfix 2.6 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="use_srv_lookup">use_srv_lookup</a>
|
|
(default: empty)</b></DT><DD>
|
|
|
|
<p> Enables discovery for the specified service(s) using DNS SRV
|
|
records. For example, with "<a href="postconf.5.html#use_srv_lookup">use_srv_lookup</a> = submission" and
|
|
"<a href="postconf.5.html#relayhost">relayhost</a> = example.com:submission", the Postfix SMTP client will
|
|
look up DNS SRV records for _submission._tcp.example.com, and will
|
|
relay email through the hosts and ports that are specified with
|
|
those records. See <a href="https://tools.ietf.org/html/rfc2782">RFC 2782</a> for details of the host selection
|
|
process. </p>
|
|
|
|
<p> Specify zero or more service names separated by comma and/or
|
|
whitespace. Any name in the services(5) database may be specified,
|
|
though in practice only submission or submissions (formerly called
|
|
smtp) make sense. </p>
|
|
|
|
<p> When SRV record lookup is enabled with <a href="postconf.5.html#use_srv_lookup">use_srv_lookup</a>, you can
|
|
enclose a domain name in "[]" to force IP address lookup instead
|
|
of SRV record lookup. </p>
|
|
|
|
<p> Example 1: MUA-to-MTA submission using SRV record lookup for
|
|
the "submission" service for domain "example.com". This uses the
|
|
default SMTP delivery agent with STARTTLS, and looks up SRV records
|
|
for "_submission._tcp.example.com". </p>
|
|
|
|
<pre>
|
|
/etc/postfix/<a href="postconf.5.html">main.cf</a>:
|
|
<a href="postconf.5.html#use_srv_lookup">use_srv_lookup</a> = submission
|
|
<a href="postconf.5.html#relayhost">relayhost</a> = example.com:submission
|
|
<a href="postconf.5.html#smtp_tls_security_level">smtp_tls_security_level</a> = may
|
|
...see <a href="SASL_README.html">SASL_README</a> for sasl configuration...
|
|
</pre>
|
|
|
|
<p> Example 2: MUA-to-MTA submission using SRV record lookup for
|
|
the "submissions" service for domain "example.org". This uses a
|
|
dedicated SMTP delivery agent (smtp-wraptls) with tls_wrappermode
|
|
turned on, and looks up SRV records for "_submissions._tcp.example.org".
|
|
</p>
|
|
|
|
<p> Note: specify the older name "smtps" instead of "submissions"
|
|
when a provider has DNS SRV records like "_smtps._tcp.example.org"
|
|
instead of "_submissions._tcp.example.org". </p>
|
|
|
|
<pre>
|
|
/etc/postfix/<a href="postconf.5.html">main.cf</a>:
|
|
<a href="postconf.5.html#use_srv_lookup">use_srv_lookup</a> = submissions
|
|
<a href="postconf.5.html#default_transport">default_transport</a> = smtp-wraptls:example.org:submissions
|
|
...see <a href="SASL_README.html">SASL_README</a> for sasl configuration...
|
|
</pre>
|
|
|
|
<pre>
|
|
/etc/postfix/<a href="master.5.html">master.cf</a>:
|
|
smtp-wraptls unix ... ... ... ... ... smtp
|
|
-o { <a href="postconf.5.html#smtp_tls_wrappermode">smtp_tls_wrappermode</a> = yes }
|
|
-o { <a href="postconf.5.html#smtp_tls_security_level">smtp_tls_security_level</a> = encrypt }
|
|
</pre>
|
|
|
|
<p> Example 3: Sender-dependent selection for a combination of
|
|
MUA-to-MTA submission services. This combines examples 1 and 2 with
|
|
examples of how to disable SRV and look up IP address records for
|
|
"smtp-relay.example.net" and "smtp-relay.other.example". Again,
|
|
specify the older name "smtps" instead of "submissions" when a
|
|
provider has DNS SRV records like "_smtps._tcp.example.org" instead
|
|
of "_submissions._tcp.example.org". </p>
|
|
|
|
<pre>
|
|
/etc/postfix/<a href="postconf.5.html">main.cf</a>:
|
|
<a href="postconf.5.html#use_srv_lookup">use_srv_lookup</a> = submission, submissions
|
|
<a href="postconf.5.html#sender_dependent_default_transport_maps">sender_dependent_default_transport_maps</a> = <a href="DATABASE_README.html#types">inline</a>:{
|
|
# Destinations that support SRV record lookup.
|
|
{ user1@example.com = <a href="smtp.8.html">smtp</a>:example.com:submission }
|
|
{ user2@example.org = smtp-wraptls:example.org:submissions }
|
|
# Use [destination] to force IP address lookups.
|
|
{ user3@example.net = <a href="smtp.8.html">smtp</a>:[smtp-relay.example.net]:submission }
|
|
{ user4@other.example =
|
|
smtp-wraptls:[smtp-relay.other.example]:submissions } }
|
|
...see <a href="SASL_README.html">SASL_README</a> for sasl configuration...
|
|
</pre>
|
|
|
|
<p> Example 4: MTA-to-MTA traffic, using SRV record lookup for the
|
|
SMTP service. This is useful for Postfix tests, and may be useful
|
|
in environments where ports are dynamically assigned to servers.
|
|
</p>
|
|
|
|
<pre>
|
|
/etc/postfix/<a href="postconf.5.html">main.cf</a>:
|
|
<a href="postconf.5.html#use_srv_lookup">use_srv_lookup</a> = smtp
|
|
# Fall back to MX record lookup when SRV records are unavailable.
|
|
#<a href="postconf.5.html#allow_srv_lookup_fallback">allow_srv_lookup_fallback</a> = yes
|
|
#<a href="postconf.5.html#ignore_srv_lookup_error">ignore_srv_lookup_error</a> = yes
|
|
</pre>
|
|
|
|
<p> This feature is available in Postfix 3.8 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="verp_delimiter_filter">verp_delimiter_filter</a>
|
|
(default: -=+)</b></DT><DD>
|
|
|
|
<p>
|
|
The characters Postfix accepts as VERP delimiter characters on the
|
|
Postfix <a href="sendmail.1.html">sendmail(1)</a> command line and in SMTP commands.
|
|
</p>
|
|
|
|
<p>
|
|
This feature is available in Postfix 1.1 and later.
|
|
</p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="virtual_alias_address_length_limit">virtual_alias_address_length_limit</a>
|
|
(default: 1000)</b></DT><DD>
|
|
|
|
<p>
|
|
The maximal length of an email address after virtual alias expansion.
|
|
This stops <a href="ADDRESS_REWRITING_README.html#virtual">virtual aliasing</a> loops that increase the address length
|
|
exponentially.
|
|
</p>
|
|
|
|
<p>
|
|
This feature is available in Postfix 3.0 and later.
|
|
</p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="virtual_alias_domains">virtual_alias_domains</a>
|
|
(default: $<a href="postconf.5.html#virtual_alias_maps">virtual_alias_maps</a>)</b></DT><DD>
|
|
|
|
<p> Postfix is the final destination for the specified list of virtual
|
|
alias domains, that is, domains for which all addresses are aliased
|
|
to addresses in other local or remote domains. The SMTP server
|
|
validates recipient addresses with $<a href="postconf.5.html#virtual_alias_maps">virtual_alias_maps</a> and rejects
|
|
non-existent recipients. See also the <a href="ADDRESS_CLASS_README.html#virtual_alias_class">virtual alias domain</a> class
|
|
in the <a href="ADDRESS_CLASS_README.html">ADDRESS_CLASS_README</a> file </p>
|
|
|
|
<p>
|
|
This feature is available in Postfix 2.0 and later. The default
|
|
value is backwards compatible with Postfix version 1.1.
|
|
</p>
|
|
|
|
<p>
|
|
The default value is $<a href="postconf.5.html#virtual_alias_maps">virtual_alias_maps</a> so that you can keep all
|
|
information about <a href="ADDRESS_CLASS_README.html#virtual_alias_class">virtual alias domains</a> in one place. If you have
|
|
many users, it is better to separate information that changes more
|
|
frequently (virtual address -> local or remote address mapping)
|
|
from information that changes less frequently (the list of virtual
|
|
domain names).
|
|
</p>
|
|
|
|
<p> Specify a list of host or domain names, "/file/name" or
|
|
"<a href="DATABASE_README.html">type:table</a>" patterns, separated by commas and/or whitespace. A
|
|
"/file/name" pattern is replaced by its contents; a "<a href="DATABASE_README.html">type:table</a>"
|
|
lookup table is matched when a table entry matches a host or domain name
|
|
(the lookup result is ignored). Continue long lines by starting
|
|
the next line with whitespace. Specify "!pattern" to exclude a host
|
|
or domain name from the list. The form "!/file/name" is supported
|
|
only in Postfix version 2.4 and later. </p>
|
|
|
|
<p>
|
|
See also the <a href="VIRTUAL_README.html">VIRTUAL_README</a> and <a href="ADDRESS_CLASS_README.html">ADDRESS_CLASS_README</a> documents
|
|
for further information.
|
|
</p>
|
|
|
|
<p>
|
|
Example:
|
|
</p>
|
|
|
|
<pre>
|
|
<a href="postconf.5.html#virtual_alias_domains">virtual_alias_domains</a> = virtual1.tld virtual2.tld
|
|
</pre>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="virtual_alias_expansion_limit">virtual_alias_expansion_limit</a>
|
|
(default: 1000)</b></DT><DD>
|
|
|
|
<p>
|
|
The maximal number of addresses that virtual alias expansion produces
|
|
from each original recipient.
|
|
</p>
|
|
|
|
<p>
|
|
This feature is available in Postfix 2.1 and later.
|
|
</p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="virtual_alias_maps">virtual_alias_maps</a>
|
|
(default: $<a href="postconf.5.html#virtual_maps">virtual_maps</a>)</b></DT><DD>
|
|
|
|
<p>
|
|
Optional lookup tables that are often searched with a full email
|
|
address (including domain) and that apply to all recipients: <a href="local.8.html">local(8)</a>,
|
|
virtual, and remote; this is unlike <a href="postconf.5.html#alias_maps">alias_maps</a> that are only searched
|
|
with an email address localpart (no domain) and that apply
|
|
only to <a href="local.8.html">local(8)</a> recipients.
|
|
The <a href="postconf.5.html#virtual_alias_maps">virtual_alias_maps</a> table format and lookups
|
|
are documented in <a href="virtual.5.html">virtual(5)</a>. For an overview of Postfix address
|
|
manipulations see the <a href="ADDRESS_REWRITING_README.html">ADDRESS_REWRITING_README</a> document.
|
|
</p>
|
|
|
|
<p>
|
|
This feature is available in Postfix 2.0 and later. The default
|
|
value is backwards compatible with Postfix version 1.1.
|
|
</p>
|
|
|
|
<p>
|
|
Specify zero or more "type:name" lookup tables, separated by
|
|
whitespace or comma. Tables will be searched in the specified order
|
|
until a match is found.
|
|
Note: these lookups are recursive.
|
|
</p>
|
|
|
|
<p>
|
|
If you use this feature with indexed files, run "<b>postmap
|
|
/etc/postfix/virtual</b>" after changing the file.
|
|
</p>
|
|
|
|
<p>
|
|
Examples:
|
|
</p>
|
|
|
|
<pre>
|
|
<a href="postconf.5.html#virtual_alias_maps">virtual_alias_maps</a> = <a href="DATABASE_README.html#types">dbm</a>:/etc/postfix/virtual
|
|
<a href="postconf.5.html#virtual_alias_maps">virtual_alias_maps</a> = <a href="DATABASE_README.html#types">hash</a>:/etc/postfix/virtual
|
|
</pre>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="virtual_alias_recursion_limit">virtual_alias_recursion_limit</a>
|
|
(default: 1000)</b></DT><DD>
|
|
|
|
<p>
|
|
The maximal nesting depth of virtual alias expansion. Currently
|
|
the recursion limit is applied only to the left branch of the
|
|
expansion graph, so the depth of the tree can in the worst case
|
|
reach the sum of the expansion and recursion limits. This may
|
|
change in the future.
|
|
</p>
|
|
|
|
<p>
|
|
This feature is available in Postfix 2.1 and later.
|
|
</p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="virtual_delivery_status_filter">virtual_delivery_status_filter</a>
|
|
(default: $<a href="postconf.5.html#default_delivery_status_filter">default_delivery_status_filter</a>)</b></DT><DD>
|
|
|
|
<p> Optional filter for the <a href="virtual.8.html">virtual(8)</a> delivery agent to change the
|
|
delivery status code or explanatory text of successful or unsuccessful
|
|
deliveries. See <a href="postconf.5.html#default_delivery_status_filter">default_delivery_status_filter</a> for details. </p>
|
|
|
|
<p> This feature is available in Postfix 3.0 and later. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="virtual_destination_concurrency_limit">virtual_destination_concurrency_limit</a>
|
|
(default: $<a href="postconf.5.html#default_destination_concurrency_limit">default_destination_concurrency_limit</a>)</b></DT><DD>
|
|
|
|
<p> The maximal number of parallel deliveries to the same destination
|
|
via the virtual message delivery transport. This limit is enforced
|
|
by the queue manager. The message delivery transport name is the
|
|
first field in the entry in the <a href="master.5.html">master.cf</a> file. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="virtual_destination_recipient_limit">virtual_destination_recipient_limit</a>
|
|
(default: $<a href="postconf.5.html#default_destination_recipient_limit">default_destination_recipient_limit</a>)</b></DT><DD>
|
|
|
|
<p> The maximal number of recipients per message for the virtual
|
|
message delivery transport. This limit is enforced by the queue
|
|
manager. The message delivery transport name is the first field in
|
|
the entry in the <a href="master.5.html">master.cf</a> file. </p>
|
|
|
|
<p> Setting this parameter to a value of 1 changes the meaning of
|
|
<a href="postconf.5.html#virtual_destination_concurrency_limit">virtual_destination_concurrency_limit</a> from concurrency per domain
|
|
into concurrency per recipient. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="virtual_gid_maps">virtual_gid_maps</a>
|
|
(default: empty)</b></DT><DD>
|
|
|
|
<p>
|
|
Lookup tables with the per-recipient group ID for <a href="virtual.8.html">virtual(8)</a> mailbox
|
|
delivery.
|
|
</p>
|
|
|
|
<p> This parameter is specific to the <a href="virtual.8.html">virtual(8)</a> delivery agent.
|
|
It does not apply when mail is delivered with a different mail
|
|
delivery program. </p>
|
|
|
|
<p>
|
|
Specify zero or more "type:name" lookup tables, separated by
|
|
whitespace or comma. Tables will be searched in the specified order
|
|
until a match is found.
|
|
</p>
|
|
|
|
<p>
|
|
In a lookup table, specify a left-hand side of "@domain.tld" to
|
|
match any user in the specified domain that does not have a specific
|
|
"user@domain.tld" entry.
|
|
</p>
|
|
|
|
<p>
|
|
When a recipient address has an optional address extension
|
|
(user+foo@domain.tld), the <a href="virtual.8.html">virtual(8)</a> delivery agent looks up
|
|
the full address first, and when the lookup fails, it looks up the
|
|
unextended address (user@domain.tld).
|
|
</p>
|
|
|
|
<p>
|
|
Note 1: for security reasons, the <a href="virtual.8.html">virtual(8)</a> delivery agent disallows
|
|
regular expression substitution of $1 etc. in regular expression
|
|
lookup tables, because that would open a security hole.
|
|
</p>
|
|
|
|
<p>
|
|
Note 2: for security reasons, the <a href="virtual.8.html">virtual(8)</a> delivery agent will
|
|
silently ignore requests to use the <a href="proxymap.8.html">proxymap(8)</a> server. Instead
|
|
it will open the table directly. Before Postfix version 2.2, the
|
|
<a href="virtual.8.html">virtual(8)</a> delivery agent will terminate with a fatal error.
|
|
</p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="virtual_mailbox_base">virtual_mailbox_base</a>
|
|
(default: empty)</b></DT><DD>
|
|
|
|
<p>
|
|
A prefix that the <a href="virtual.8.html">virtual(8)</a> delivery agent prepends to all pathname
|
|
results from $<a href="postconf.5.html#virtual_mailbox_maps">virtual_mailbox_maps</a> table lookups. This is a safety
|
|
measure to ensure that an out of control map doesn't litter the
|
|
file system with mailboxes. While <a href="postconf.5.html#virtual_mailbox_base">virtual_mailbox_base</a> could be
|
|
set to "/", this setting isn't recommended.
|
|
</p>
|
|
|
|
<p> This parameter is specific to the <a href="virtual.8.html">virtual(8)</a> delivery agent.
|
|
It does not apply when mail is delivered with a different mail
|
|
delivery program. </p>
|
|
|
|
<p>
|
|
Example:
|
|
</p>
|
|
|
|
<pre>
|
|
<a href="postconf.5.html#virtual_mailbox_base">virtual_mailbox_base</a> = /var/mail
|
|
</pre>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="virtual_mailbox_domains">virtual_mailbox_domains</a>
|
|
(default: $<a href="postconf.5.html#virtual_mailbox_maps">virtual_mailbox_maps</a>)</b></DT><DD>
|
|
|
|
<p> Postfix is the final destination for the specified list of domains;
|
|
mail is delivered via the $<a href="postconf.5.html#virtual_transport">virtual_transport</a> mail delivery transport.
|
|
By default this is the Postfix <a href="virtual.8.html">virtual(8)</a> delivery agent. The SMTP
|
|
server validates recipient addresses with $<a href="postconf.5.html#virtual_mailbox_maps">virtual_mailbox_maps</a>
|
|
and rejects mail for non-existent recipients. See also the virtual
|
|
mailbox domain class in the <a href="ADDRESS_CLASS_README.html">ADDRESS_CLASS_README</a> file. </p>
|
|
|
|
<p> This parameter expects the same syntax as the <a href="postconf.5.html#mydestination">mydestination</a>
|
|
configuration parameter. </p>
|
|
|
|
<p>
|
|
This feature is available in Postfix 2.0 and later. The default
|
|
value is backwards compatible with Postfix version 1.1.
|
|
</p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="virtual_mailbox_limit">virtual_mailbox_limit</a>
|
|
(default: 51200000)</b></DT><DD>
|
|
|
|
<p>
|
|
The maximal size in bytes of an individual <a href="virtual.8.html">virtual(8)</a> mailbox or
|
|
maildir file, or zero (no limit). </p>
|
|
|
|
<p> This parameter is specific to the <a href="virtual.8.html">virtual(8)</a> delivery agent.
|
|
It does not apply when mail is delivered with a different mail
|
|
delivery program. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="virtual_mailbox_lock">virtual_mailbox_lock</a>
|
|
(default: see "postconf -d" output)</b></DT><DD>
|
|
|
|
<p>
|
|
How to lock a UNIX-style <a href="virtual.8.html">virtual(8)</a> mailbox before attempting
|
|
delivery. For a list of available file locking methods, use the
|
|
"<b>postconf -l</b>" command.
|
|
</p>
|
|
|
|
<p> This parameter is specific to the <a href="virtual.8.html">virtual(8)</a> delivery agent.
|
|
It does not apply when mail is delivered with a different mail
|
|
delivery program. </p>
|
|
|
|
<p>
|
|
This setting is ignored with <b>maildir</b> style delivery, because
|
|
such deliveries are safe without application-level locks.
|
|
</p>
|
|
|
|
<p>
|
|
Note 1: the <b>dotlock</b> method requires that the recipient UID
|
|
or GID has write access to the parent directory of the recipient's
|
|
mailbox file.
|
|
</p>
|
|
|
|
<p>
|
|
Note 2: the default setting of this parameter is system dependent.
|
|
</p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="virtual_mailbox_maps">virtual_mailbox_maps</a>
|
|
(default: empty)</b></DT><DD>
|
|
|
|
<p>
|
|
Optional lookup tables with all valid addresses in the domains that
|
|
match $<a href="postconf.5.html#virtual_mailbox_domains">virtual_mailbox_domains</a>.
|
|
</p>
|
|
|
|
<p>
|
|
Specify zero or more "type:name" lookup tables, separated by
|
|
whitespace or comma. Tables will be searched in the specified order
|
|
until a match is found.
|
|
</p>
|
|
|
|
<p>
|
|
In a lookup table, specify a left-hand side of "@domain.tld" to
|
|
match any user in the specified domain that does not have a specific
|
|
"user@domain.tld" entry.
|
|
</p>
|
|
|
|
<p>
|
|
With the default "<a href="postconf.5.html#virtual_mailbox_domains">virtual_mailbox_domains</a> = $<a href="postconf.5.html#virtual_mailbox_maps">virtual_mailbox_maps</a>",
|
|
lookup tables also need entries with a left-hand side of "domain.tld"
|
|
to satisfy virtual_mailbox_domain lookups (the right-hand side is
|
|
required but will not be used).
|
|
</p>
|
|
|
|
<p> The remainder of this text is specific to the <a href="virtual.8.html">virtual(8)</a> delivery
|
|
agent. It does not apply when mail is delivered with a different
|
|
mail delivery program. </p>
|
|
|
|
<p>
|
|
The <a href="virtual.8.html">virtual(8)</a> delivery agent uses this table to look up the
|
|
per-recipient mailbox or maildir pathname. If the lookup result
|
|
ends in a slash ("/"), maildir-style delivery is carried out,
|
|
otherwise the path is assumed to specify a UNIX-style mailbox file.
|
|
Note that $<a href="postconf.5.html#virtual_mailbox_base">virtual_mailbox_base</a> is unconditionally prepended to
|
|
this path.
|
|
</p>
|
|
|
|
<p>
|
|
When a recipient address has an optional address extension
|
|
(user+foo@domain.tld), the <a href="virtual.8.html">virtual(8)</a> delivery agent looks up
|
|
the full address first, and when the lookup fails, it looks up the
|
|
unextended address (user@domain.tld).
|
|
</p>
|
|
|
|
<p>
|
|
Note 1: for security reasons, the <a href="virtual.8.html">virtual(8)</a> delivery agent disallows
|
|
regular expression substitution of $1 etc. in regular expression
|
|
lookup tables, because that would open a security hole.
|
|
</p>
|
|
|
|
<p>
|
|
Note 2: for security reasons, the <a href="virtual.8.html">virtual(8)</a> delivery agent will
|
|
silently ignore requests to use the <a href="proxymap.8.html">proxymap(8)</a> server. Instead
|
|
it will open the table directly. Before Postfix version 2.2, the
|
|
<a href="virtual.8.html">virtual(8)</a> delivery agent will terminate with a fatal error.
|
|
</p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="virtual_maps">virtual_maps</a>
|
|
(default: empty)</b></DT><DD>
|
|
|
|
<p> Optional lookup tables with a) names of domains for which all
|
|
addresses are aliased to addresses in other local or remote domains,
|
|
and b) addresses that are aliased to addresses in other local or
|
|
remote domains. Available before Postfix version 2.0. With Postfix
|
|
version 2.0 and later, this is replaced by separate controls: <a href="postconf.5.html#virtual_alias_domains">virtual_alias_domains</a>
|
|
and <a href="postconf.5.html#virtual_alias_maps">virtual_alias_maps</a>. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="virtual_minimum_uid">virtual_minimum_uid</a>
|
|
(default: 100)</b></DT><DD>
|
|
|
|
<p>
|
|
The minimum user ID value that the <a href="virtual.8.html">virtual(8)</a> delivery agent accepts
|
|
as a result from $<a href="postconf.5.html#virtual_uid_maps">virtual_uid_maps</a> table lookup. Returned
|
|
values less than this will be rejected, and the message will be
|
|
deferred.
|
|
</p>
|
|
|
|
<p> This parameter is specific to the <a href="virtual.8.html">virtual(8)</a> delivery agent.
|
|
It does not apply when mail is delivered with a different mail
|
|
delivery program. </p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="virtual_transport">virtual_transport</a>
|
|
(default: virtual)</b></DT><DD>
|
|
|
|
<p>
|
|
The default mail delivery transport and next-hop destination for
|
|
final delivery to domains listed with $<a href="postconf.5.html#virtual_mailbox_domains">virtual_mailbox_domains</a>.
|
|
This information can be overruled with the <a href="transport.5.html">transport(5)</a> table.
|
|
</p>
|
|
|
|
<p>
|
|
Specify a string of the form <i>transport:nexthop</i>, where <i>transport</i>
|
|
is the name of a mail delivery transport defined in <a href="master.5.html">master.cf</a>.
|
|
The <i>:nexthop</i> destination is optional; its syntax is documented
|
|
in the manual page of the corresponding delivery agent.
|
|
</p>
|
|
|
|
<p>
|
|
This feature is available in Postfix 2.0 and later.
|
|
</p>
|
|
|
|
|
|
</DD>
|
|
|
|
<DT><b><a name="virtual_uid_maps">virtual_uid_maps</a>
|
|
(default: empty)</b></DT><DD>
|
|
|
|
<p>
|
|
Lookup tables with the per-recipient user ID that the <a href="virtual.8.html">virtual(8)</a>
|
|
delivery agent uses while writing to the recipient's mailbox.
|
|
</p>
|
|
|
|
<p> This parameter is specific to the <a href="virtual.8.html">virtual(8)</a> delivery agent.
|
|
It does not apply when mail is delivered with a different mail
|
|
delivery program. </p>
|
|
|
|
<p>
|
|
Specify zero or more "type:name" lookup tables, separated by
|
|
whitespace or comma. Tables will be searched in the specified order
|
|
until a match is found.
|
|
</p>
|
|
|
|
<p>
|
|
In a lookup table, specify a left-hand side of "@domain.tld"
|
|
to match any user in the specified domain that does not have a
|
|
specific "user@domain.tld" entry.
|
|
</p>
|
|
|
|
<p>
|
|
When a recipient address has an optional address extension
|
|
(user+foo@domain.tld), the <a href="virtual.8.html">virtual(8)</a> delivery agent looks up
|
|
the full address first, and when the lookup fails, it looks up the
|
|
unextended address (user@domain.tld).
|
|
</p>
|
|
|
|
<p>
|
|
Note 1: for security reasons, the <a href="virtual.8.html">virtual(8)</a> delivery agent disallows
|
|
regular expression substitution of $1 etc. in regular expression
|
|
lookup tables, because that would open a security hole.
|
|
</p>
|
|
|
|
<p>
|
|
Note 2: for security reasons, the <a href="virtual.8.html">virtual(8)</a> delivery agent will
|
|
silently ignore requests to use the <a href="proxymap.8.html">proxymap(8)</a> server. Instead
|
|
it will open the table directly. Before Postfix version 2.2, the
|
|
<a href="virtual.8.html">virtual(8)</a> delivery agent will terminate with a fatal error.
|
|
</p>
|
|
|
|
|
|
</DD>
|
|
|
|
</dl>
|
|
|
|
</body>
|
|
|
|
</html>
|