PPoossttffiixx DDSSNN SSuuppppoorrtt

-------------------------------------------------------------------------------

IInnttrroodduuccttiioonn

Postfix version 2.3 introduces support for Delivery Status Notifications as
described in RFC 3464. This gives senders control over successful and failed
delivery notifications.

Specifically, DSN support gives an email sender the ability to specify:

  * What notifications are sent: success, failure, delay, or none. Normally,
    Postfix informs the sender only when mail delivery is delayed or when
    delivery fails.

  * What content is returned in case of failure: only the message headers, or
    the full message.

  * An envelope ID that is returned as part of delivery status notifications.
    This identifies the message submission transaction, and must not be
    confused with the message ID, which identifies the message content.

The implementation of DSN support involves extra parameters to the SMTP MAIL
FROM and RCPT TO commands, as well as two Postfix sendmail command line options
that provide a sub-set of the functions of the extra SMTP command parameters.

This document has information on the following topics:

  * Restricting the scope of "success" notifications
  * Postfix sendmail command-line interface
  * Postfix VERP support compatibility

RReessttrriiccttiinngg tthhee ssccooppee ooff ""ssuucccceessss"" nnoottiiffiiccaattiioonnss

Just like reports of undeliverable mail, DSN reports of successful delivery can
give away more information about the internal infrastructure than desirable.
Unfortunately, disallowing "success" notification requests requires disallowing
other DSN requests as well. The RFCs do not offer the option to negotiate
feature subsets.

This is not as bad as it sounds. When you turn off DSN for remote inbound mail,
remote senders with DSN support will still be informed that their mail reached
your Postfix gateway successfully; they just will not get successful delivery
notices from your internal systems. Remote senders lose very little: they can
no longer specify how Postfix should report delayed or failed delivery.

Use the smtpd_discard_ehlo_keyword_address_maps feature if you wish to allow
DSN requests from trusted clients but not from random strangers (see below for
how to turn this off for all clients):

    /etc/postfix/main.cf:
        smtpd_discard_ehlo_keyword_address_maps =
            cidr:/etc/postfix/esmtp_access

    /etc/postfix/esmtp_access:
        # Allow DSN requests from local subnet only
        192.168.0.0/28      silent-discard
        0.0.0.0/0           silent-discard, dsn
        ::/0                silent-discard, dsn

If you want to disallow all use of DSN requests from the network, use the
smtpd_discard_ehlo_keywords feature:

    /etc/postfix/main.cf:
        smtpd_discard_ehlo_keywords = silent-discard, dsn

PPoossttffiixx sseennddmmaaiill ccoommmmaanndd--lliinnee iinntteerrffaaccee

Postfix has two Sendmail-compatible command-line options for DSN support.

  * The first option specifies what notifications are sent for mail that is
    submitted via the Postfix sendmail(1) command line:

        $ sseennddmmaaiill --NN ssuucccceessss,,ddeellaayy,,ffaaiilluurree ...... (one or more of these)
        $ sseennddmmaaiill --NN nneevveerr ......                 (or just this by itself)

    The built-in default corresponds with "delay,failure".

  * The second option specifies an envelope ID which is reported in delivery
    status notifications for mail that is submitted via the Postfix sendmail(1)
    command line:

        $ sseennddmmaaiill --VV eennvveellooppee--iidd ......

    Note: this conflicts with VERP support in older Postfix versions, as
    discussed in the next section.

PPoossttffiixx VVEERRPP ssuuppppoorrtt ccoommppaattiibbiilliittyy

With Postfix versions before 2.3, the sendmail(1) command uses the -V command-
line option to request VERP-style delivery. In order to request VERP style
delivery with Postfix 2.3 and later, you must specify -XV instead of -V.

The Postfix 2.3 sendmail(1) command will recognize if you try to use -V for
VERP-style delivery. It will do the right thing and will remind you of the new
syntax.