diff options
Diffstat (limited to 'proto/postconf.proto')
| -rw-r--r-- | proto/postconf.proto | 18715 |
1 files changed, 18715 insertions, 0 deletions
diff --git a/proto/postconf.proto b/proto/postconf.proto new file mode 100644 index 0000000..10b47cf --- /dev/null +++ b/proto/postconf.proto @@ -0,0 +1,18715 @@ +# This is the input file for automatically generating the postconf(5) +# manual page, the summaries of parameters in on-line manual pages, +# and for the postconf.5.html hyperlinked document. +# +# The following tools operate on information from this file: +# +# xpostconf +# Extracts specific parameter definitions from this file, or +# produces a sorted version of all the information in this +# document. +# +# postconf2html +# Adds parameter name +default headers. The result can be embedded +# into the postconf.5.html hyperlinked document. +# +# postconf2man +# Converts this file into something that can be embedded into +# the postconf(5) UNIX-style manual page. This tool knows only +# a limited subset of HTML as described below. +# +# postconf2src +# Converts this file result into something that can be embedded +# into Postfix source code files. +# +# The subset of HTML that you can use is limited by the postconf2man +# tool: +# +# * Supported HTML elements are: blockquote, ul, li, dl, dt, dd, +# p, pre, b, i, h, and the escapes for < <= >= >. Sorry, no +# tables. +# +# * HTML elements must be specified in lower case. +# +# * Lists cannot be nested. +# +# * The postconf2man tool leaves unrecognized HTML in place as a +# reminder that it is not supported. +# +# * Text between <!-- and --> is stripped out. The <!-- and --> +# must appear on separate lines. +# +# * Use <nroffescape .sp> to request an empty line in the middle +# of a block of text. This is needed with indented lists. +# +# * Blank lines are special for postconf2man: it replaces them by +# a "new paragraph" command. Don't put any blank lines inside +# <blockquote> text. Instead, put those blank lines between +# </blockquote> and <blockquote>. +# +# * Text after a blank line must start with an HTML element. +# +# Also: +# +# * All <dt> and <dd>text must be closed with </dt> and </dd>. +# +# * Use <blockquote><pre>..</pre></blockquote> for examples +# between narrative text, instead of indenting examples by hand. +# +# * Use <pre>..</pre> for the "Examples:" section at the end +# of a parameter description. +# +# The postlink tool automatically inserts hyperlinks for the following, +# so you must not hyperlink that information yourself: +# +# * Postfix manual pages +# * URLs +# * RFCs +# * Postfix configuration parameters +# * Postfix README files +# * Address classes and other terminology. +# +# The xpostconf and postconf2html tools expect the file format described +# in the comments below. The description includes the transformation +# that is done by the postconf2html tool. +# +# * The format of this file is blocks of text separated by one or +# more empty (or all whitespace) lines. +# +# * A text block that begins with %PARAM specifies a parameter name +# and its default value, separated by whitespace. The text in +# the blocks that follow is the parameter description. +# +# * The first line (text up to the first ". ") is used in Postfix +# on-line manual pages, in the one-line configuration parameter +# summaries. +# +# * A text block that begins with the "<" character is treated as +# literal HTML. For example, to specify a "dl" list element one +# would write: +# +# |<dt><b>name</b></dt> <dd> +# | +# |text that describes "name". +# | +# |</dd> ... +# +# As described below, the text that describes "name" will be +# enclosed with <p> and </p>. +# +# An "ul" list element would be written like this: +# +# |<li> text for this list element. +# +# * Any text block that does not begin with < is an error. + +%CLASS address-verification Address verification (Postfix 2.1 and later) + +<p> +Sender/recipient address verification is implemented by sending +probe email messages that are not actually delivered. This feature +is requested via the reject_unverified_sender and +reject_unverified_recipient access restrictions. The status of +verification probes is maintained by the address verification +service. See the file ADDRESS_VERIFICATION_README for information +about how to configure and operate the Postfix sender/recipient +address verification service. +</p> + +%CLASS smtpd-compatibility Compatibility controls + +%CLASS resource-control Resource controls + +%CLASS after-queue-filter After-queue content filter + +<p> +As of version 1.0, Postfix can be configured to send new mail to +an external content filter AFTER the mail is queued. This content +filter is expected to inject mail back into a (Postfix or other) +MTA for further delivery. See the FILTER_README document for +details. +</p> + +%CLASS before-queue-filter Before-queue content filter + +<p> +The Postfix SMTP server can be configured to send incoming mail to +a real-time SMTP-based content filter BEFORE mail is queued. This +content filter is expected to inject mail back into Postfix. See +the SMTPD_PROXY_README document for details on how to configure +and operate this feature. +</p> + +%CLASS basic-config Basic configuration parameters + +%CLASS smtpd-access-relay SMTP server access and relay control + +%CLASS smtpd-sasl SMTP server SASL authentication + +%CLASS unknown-recipients Rejecting mail for unknown recipients + +%CLASS smtpd-reply-code SMTP server response codes + +%CLASS other Other configuration parameters + +%PARAM access_map_reject_code 554 + +<p> +The numerical Postfix SMTP server response code for +an access(5) map "reject" action. +</p> + +<p> +Do not change this unless you have a complete understanding of RFC 5321. +</p> + +%PARAM access_map_defer_code 450 + +<p> +The numerical Postfix SMTP server response code for +an access(5) map "defer" action, including "defer_if_permit" +or "defer_if_reject". Prior to Postfix 2.6, the response +is hard-coded as "450". +</p> + +<p> +Do not change this unless you have a complete understanding of RFC 5321. +</p> + +<p> +This feature is available in Postfix 2.6 and later. +</p> + +%PARAM address_verify_default_transport $default_transport + +<p> +Overrides the default_transport parameter setting for address +verification probes. +</p> + +<p> +This feature is available in Postfix 2.1 and later. +</p> + +%PARAM address_verify_local_transport $local_transport + +<p> +Overrides the local_transport parameter setting for address +verification probes. +</p> + +<p> +This feature is available in Postfix 2.1 and later. +</p> + +%PARAM address_verify_map see "postconf -d" output + +<p> +Lookup table for persistent address verification status +storage. The table is maintained by the verify(8) service, and +is opened before the process releases privileges. +</p> + +<p> +The lookup table is persistent by default (Postfix 2.7 and later). +Specify an empty table name to keep the information in volatile +memory which is lost after "<b>postfix reload</b>" or "<b>postfix +stop</b>". This is the default with Postfix version 2.6 and earlier. +</p> + +<p> +Specify a location in a file system that will not fill up. If the +database becomes corrupted, the world comes to an end. To recover, +delete (NOT: truncate) the file and do "<b>postfix reload</b>". +</p> + +<p> Postfix daemon processes do not use root privileges when opening +this file (Postfix 2.5 and later). The file must therefore be +stored under a Postfix-owned directory such as the data_directory. +As a migration aid, an attempt to open the file under a non-Postfix +directory is redirected to the Postfix-owned data_directory, and a +warning is logged. </p> + +<p> +Examples: +</p> + +<pre> +address_verify_map = hash:/var/lib/postfix/verify +address_verify_map = btree:/var/lib/postfix/verify +</pre> + +<p> +This feature is available in Postfix 2.1 and later. +</p> + +%PARAM address_verify_negative_cache yes + +<p> +Enable caching of failed address verification probe results. When +this feature is enabled, the cache may pollute quickly with garbage. +When this feature is disabled, Postfix will generate an address +probe for every lookup. +</p> + +<p> +This feature is available in Postfix 2.1 and later. +</p> + +%PARAM address_verify_negative_expire_time 3d + +<p> +The time after which a failed probe expires from the address +verification cache. +</p> + +<p> Specify a non-zero time value (an integral value plus an optional +one-letter suffix that specifies the time unit). Time units: s +(seconds), m (minutes), h (hours), d (days), w (weeks). +The default time unit is d (days). </p> + +<p> +This feature is available in Postfix 2.1 and later. +</p> + +%PARAM address_verify_negative_refresh_time 3h + +<p> +The time after which a failed address verification probe needs to +be refreshed. +</p> + +<p> Specify a non-zero time value (an integral value plus an optional +one-letter suffix that specifies the time unit). Time units: s +(seconds), m (minutes), h (hours), d (days), w (weeks). +The default time unit is h (hours). </p> + +<p> +This feature is available in Postfix 2.1 and later. +</p> + +%PARAM address_verify_cache_cleanup_interval 12h + +<p> The amount of time between verify(8) address verification +database cleanup runs. This feature requires that the database +supports the "delete" and "sequence" operators. Specify a zero +interval to disable database cleanup. </p> + +<p> After each database cleanup run, the verify(8) daemon logs the +number of entries that were retained and dropped. A cleanup run is +logged as "partial" when the daemon terminates early after "<b>postfix +reload</b>", "<b>postfix stop</b>", or no requests for $max_idle +seconds. </p> + +<p> Specify a non-negative time value (an integral value plus an optional +one-letter suffix that specifies the time unit). Time units: s +(seconds), m (minutes), h (hours), d (days), w (weeks). +The default time unit is h (hours). </p> + +<p> This feature is available in Postfix 2.7. </p> + +%PARAM address_verify_poll_count normal: 3, overload: 1 + +<p> +How many times to query the verify(8) service for the completion +of an address verification request in progress. +</p> + +<p> By default, the Postfix SMTP server polls the verify(8) service +up to three times under non-overload conditions, and only once when +under overload. With Postfix version 2.5 and earlier, the SMTP +server always polls the verify(8) service up to three times by +default. </p> + +<p> +Specify 1 to implement a crude form of greylisting, that is, always +defer the first delivery request for a new address. +</p> + +<p> +Examples: +</p> + +<pre> +# Postfix ≤ 2.6 default +address_verify_poll_count = 3 +# Poor man's greylisting +address_verify_poll_count = 1 +</pre> + +<p> +This feature is available in Postfix 2.1 and later. +</p> + +%PARAM address_verify_poll_delay 3s + +<p> +The delay between queries for the completion of an address +verification request in progress. +</p> + +<p> +The default polling delay is 3 seconds. +</p> + +<p> Specify a non-zero time value (an integral value plus an optional +one-letter suffix that specifies the time unit). Time units: s +(seconds), m (minutes), h (hours), d (days), w (weeks). +The default time unit is s (seconds). </p> + +<p> +This feature is available in Postfix 2.1 and later. +</p> + +%PARAM address_verify_positive_expire_time 31d + +<p> +The time after which a successful probe expires from the address +verification cache. +</p> + +<p> Specify a non-zero time value (an integral value plus an optional +one-letter suffix that specifies the time unit). Time units: s +(seconds), m (minutes), h (hours), d (days), w (weeks). +The default time unit is d (days). </p> + +<p> +This feature is available in Postfix 2.1 and later. +</p> + +%PARAM address_verify_positive_refresh_time 7d + +<p> +The time after which a successful address verification probe needs +to be refreshed. The address verification status is not updated +when the probe fails (optimistic caching). +</p> + +<p> Specify a non-zero time value (an integral value plus an optional +one-letter suffix that specifies the time unit). Time units: s +(seconds), m (minutes), h (hours), d (days), w (weeks). +The default time unit is d (days). </p> + +<p> +This feature is available in Postfix 2.1 and later. +</p> + +%PARAM address_verify_relay_transport $relay_transport + +<p> +Overrides the relay_transport parameter setting for address +verification probes. +</p> + +<p> +This feature is available in Postfix 2.1 and later. +</p> + +%PARAM address_verify_relayhost $relayhost + +<p> +Overrides the relayhost parameter setting for address verification +probes. This information can be overruled with the transport(5) table. +</p> + +<p> +This feature is available in Postfix 2.1 and later. +</p> + +%PARAM address_verify_sender $double_bounce_sender + +<p> The sender address to use in address verification probes; prior +to Postfix 2.5 the default was "postmaster". To +avoid problems with address probes that are sent in response to +address probes, the Postfix SMTP server excludes the probe sender +address from all SMTPD access blocks. </p> + +<p> +Specify an empty value (address_verify_sender =) or <> if you want +to use the null sender address. Beware, some sites reject mail from +<>, even though RFCs require that such addresses be accepted. +</p> + +<p> +Examples: +</p> + +<pre> +address_verify_sender = <> +address_verify_sender = postmaster@my.domain +</pre> + +<p> +This feature is available in Postfix 2.1 and later. +</p> + +%PARAM address_verify_transport_maps $transport_maps + +<p> +Overrides the transport_maps parameter setting for address verification +probes. +</p> + +<p> +This feature is available in Postfix 2.1 and later. +</p> + +%PARAM address_verify_virtual_transport $virtual_transport + +<p> +Overrides the virtual_transport parameter setting for address +verification probes. +</p> + +<p> +This feature is available in Postfix 2.1 and later. +</p> + +%PARAM alias_database see "postconf -d" output + +<p> +The alias databases for local(8) delivery that are updated with +"<b>newaliases</b>" or with "<b>sendmail -bi</b>". +</p> + +<p> +This is a separate configuration parameter because not all the +tables specified with $alias_maps have to be local files. +</p> + +<p> +Examples: +</p> + +<pre> +alias_database = hash:/etc/aliases +alias_database = hash:/etc/mail/aliases +</pre> + +%PARAM alias_maps see "postconf -d" output + +<p> +The alias databases that are used for local(8) delivery. See +aliases(5) for syntax details. +Specify zero or more "type:name" lookup tables, separated by +whitespace or comma. Tables will be searched in the specified order +until a match is found. +Note: these lookups are recursive. +</p> + +<p> +The default list is system dependent. On systems with NIS, the +default is to search the local alias database, then the NIS alias +database. +</p> + +<p> +If you change the alias database, run "<b>postalias /etc/aliases</b>" +(or wherever your system stores the mail alias file), or simply +run "<b>newaliases</b>" to build the necessary DBM or DB file. +</p> + +<p> +The local(8) delivery agent disallows regular expression substitution +of $1 etc. in alias_maps, because that would open a security hole. +</p> + +<p> +The local(8) delivery agent will silently ignore requests to use +the proxymap(8) server within alias_maps. Instead it will open the +table directly. Before Postfix version 2.2, the local(8) delivery +agent will terminate with a fatal error. +</p> + +<p> +Examples: +</p> + +<pre> +alias_maps = hash:/etc/aliases, nis:mail.aliases +alias_maps = hash:/etc/aliases +</pre> + +%PARAM allow_mail_to_commands alias, forward + +<p> +Restrict local(8) mail delivery to external commands. The default +is to disallow delivery to "|command" in :include: files (see +aliases(5) for the text that defines this terminology). +</p> + +<p> +Specify zero or more of: <b>alias</b>, <b>forward</b> or <b>include</b>, +in order to allow commands in aliases(5), .forward files or in +:include: files, respectively. +</p> + +<p> +Example: +</p> + +<pre> +allow_mail_to_commands = alias,forward,include +</pre> + +%PARAM allow_mail_to_files alias, forward + +<p> +Restrict local(8) mail delivery to external files. The default is +to disallow "/file/name" destinations in :include: files (see +aliases(5) for the text that defines this terminology). +</p> + +<p> +Specify zero or more of: <b>alias</b>, <b>forward</b> or <b>include</b>, +in order to allow "/file/name" destinations in aliases(5), .forward +files and in :include: files, respectively. +</p> + +<p> +Example: +</p> + +<pre> +allow_mail_to_files = alias,forward,include +</pre> + +%PARAM allow_min_user no + +<p> +Allow a sender or recipient address to have `-' as the first +character. By +default, this is not allowed, to avoid accidents with software that +passes email addresses via the command line. Such software +would not be able to distinguish a malicious address from a +bona fide command-line option. Although this can be prevented by +inserting a "--" option terminator into the command line, this is +difficult to enforce consistently and globally. </p> + +<p> As of Postfix version 2.5, this feature is implemented by +trivial-rewrite(8). With earlier versions this feature was implemented +by qmgr(8) and was limited to recipient addresses only. </p> + +%PARAM allow_percent_hack yes + +<p> +Enable the rewriting of the form "user%domain" to "user@domain". +This is enabled by default. +</p> + +<p> Note: as of Postfix version 2.2, message header address rewriting +happens only when one of the following conditions is true: </p> + +<ul> + +<li> The message is received with the Postfix sendmail(1) command, + +<li> The message is received from a network client that matches +$local_header_rewrite_clients, + +<li> The message is received from the network, and the +remote_header_rewrite_domain parameter specifies a non-empty value. + +</ul> + +<p> To get the behavior before Postfix version 2.2, specify +"local_header_rewrite_clients = static:all". </p> + +<p> +Example: +</p> + +<pre> +allow_percent_hack = no +</pre> + +%PARAM allow_untrusted_routing no + +<p> +Forward mail with sender-specified routing (user[@%!]remote[@%!]site) +from untrusted clients to destinations matching $relay_domains. +</p> + +<p> +By default, this feature is turned off. This closes a nasty open +relay loophole where a backup MX host can be tricked into forwarding +junk mail to a primary MX host which then spams it out to the world. +</p> + +<p> +This parameter also controls if non-local addresses with sender-specified +routing can match Postfix access tables. By default, such addresses +cannot match Postfix access tables, because the address is ambiguous. +</p> + +%PARAM always_bcc + +<p> +Optional address that receives a "blind carbon copy" of each message +that is received by the Postfix mail system. +</p> + +<p> +Note: with Postfix 2.3 and later the BCC address is added as if it +was specified with NOTIFY=NONE. The sender will not be notified +when the BCC address is undeliverable, as long as all down-stream +software implements RFC 3461. +</p> + +<p> +Note: with Postfix 2.2 and earlier the sender will be notified +when the BCC address is undeliverable. +</p> + +<p> Note: automatic BCC recipients are produced only for new mail. +To avoid mailer loops, automatic BCC recipients are not generated +after Postfix forwards mail internally, or after Postfix generates +mail itself. </p> + +%PARAM berkeley_db_create_buffer_size 16777216 + +<p> +The per-table I/O buffer size for programs that create Berkeley DB +hash or btree tables. Specify a byte count. +</p> + +<p> +This feature is available in Postfix 2.0 and later. +</p> + +%PARAM berkeley_db_read_buffer_size 131072 + +<p> +The per-table I/O buffer size for programs that read Berkeley DB +hash or btree tables. Specify a byte count. +</p> + +<p> +This feature is available in Postfix 2.0 and later. +</p> + +%PARAM best_mx_transport + +<p> +Where the Postfix SMTP client should deliver mail when it detects +a "mail loops back to myself" error condition. This happens when +the local MTA is the best SMTP mail exchanger for a destination +not listed in $mydestination, $inet_interfaces, $proxy_interfaces, +$virtual_alias_domains, or $virtual_mailbox_domains. By default, +the Postfix SMTP client returns such mail as undeliverable. +</p> + +<p> +Specify, for example, "best_mx_transport = local" to pass the mail +from the Postfix SMTP client to the local(8) delivery agent. You +can specify +any message delivery "transport" or "transport:nexthop" that is +defined in the master.cf file. See the transport(5) manual page +for the syntax and meaning of "transport" or "transport:nexthop". +</p> + +<p> +However, this feature is expensive because it ties up a Postfix +SMTP client process while the local(8) delivery agent is doing its +work. It is more efficient (for Postfix) to list all hosted domains +in a table or database. +</p> + +%PARAM biff yes + +<p> +Whether or not to use the local biff service. This service sends +"new mail" notifications to users who have requested new mail +notification with the UNIX command "biff y". +</p> + +<p> +For compatibility reasons this feature is on by default. On systems +with lots of interactive users, the biff service can be a performance +drain. Specify "biff = no" in main.cf to disable. +</p> + +%PARAM body_checks + +<p> Optional lookup tables for content inspection as specified in +the body_checks(5) manual page. </p> + +<p> Note: with Postfix versions before 2.0, these rules inspect +all content after the primary message headers. </p> + +%PARAM body_checks_size_limit 51200 + +<p> +How much text in a message body segment (or attachment, if you +prefer to use that term) is subjected to body_checks inspection. +The amount of text is limited to avoid scanning huge attachments. +</p> + +<p> +This feature is available in Postfix 2.0 and later. +</p> + +%PARAM bounce_queue_lifetime 5d + +<p> +Consider a bounce message as undeliverable, when delivery fails +with a temporary error, and the time in the queue has reached the +bounce_queue_lifetime limit. By default, this limit is the same +as for regular mail. +</p> + +<p> Specify a non-negative time value (an integral value plus an optional +one-letter suffix that specifies the time unit). Time units: s +(seconds), m (minutes), h (hours), d (days), w (weeks). +The default time unit is d (days). </p> + +<p> +Specify 0 when mail delivery should be tried only once. +</p> + +<p> +This feature is available in Postfix 2.1 and later. +</p> + +%PARAM bounce_size_limit 50000 + +<p> The maximal amount of original message text that is sent in a +non-delivery notification. Specify a byte count. A message is +returned as either message/rfc822 (the complete original) or as +text/rfc822-headers (the headers only). With Postfix version 2.4 +and earlier, a message is always returned as message/rfc822 and is +truncated when it exceeds the size limit. +</p> + +<p> Notes: </p> + +<ul> + +<li> <p> If you increase this limit, then you should increase the +mime_nesting_limit value proportionally. </p> + +<li> <p> Be careful when making changes. Excessively large values +will result in the loss of non-delivery notifications, when a bounce +message size exceeds a local or remote MTA's message size limit. +</p> + +</ul> + +%PARAM canonical_maps + +<p> +Optional address mapping lookup tables for message headers and +envelopes. The mapping is applied to both sender and recipient +addresses, in both envelopes and in headers, as controlled +with the canonical_classes parameter. This is typically used +to clean up dirty addresses from legacy mail systems, or to replace +login names by Firstname.Lastname. The table format and lookups +are documented in canonical(5). For an overview of Postfix address +manipulations see the ADDRESS_REWRITING_README document. +</p> + +<p> +Specify zero or more "type:name" lookup tables, separated by +whitespace or comma. Tables will be searched in the specified order +until a match is found. +Note: these lookups are recursive. +</p> + +<p> +If you use this feature, run "<b>postmap /etc/postfix/canonical</b>" to +build the necessary DBM or DB file after every change. The changes +will become visible after a minute or so. Use "<b>postfix reload</b>" +to eliminate the delay. +</p> + +<p> Note: with Postfix version 2.2, message header address mapping +happens only when message header address rewriting is enabled: </p> + +<ul> + +<li> The message is received with the Postfix sendmail(1) command, + +<li> The message is received from a network client that matches +$local_header_rewrite_clients, + +<li> The message is received from the network, and the +remote_header_rewrite_domain parameter specifies a non-empty value. + +</ul> + +<p> To get the behavior before Postfix version 2.2, specify +"local_header_rewrite_clients = static:all". </p> + +<p> +Examples: +</p> + +<pre> +canonical_maps = dbm:/etc/postfix/canonical +canonical_maps = hash:/etc/postfix/canonical +</pre> + +%PARAM canonical_classes envelope_sender, envelope_recipient, header_sender, header_recipient + +<p> What addresses are subject to canonical_maps address mapping. +By default, canonical_maps address mapping is applied to envelope +sender and recipient addresses, and to header sender and header +recipient addresses. </p> + +<p> Specify one or more of: envelope_sender, envelope_recipient, +header_sender, header_recipient </p> + +<p> This feature is available in Postfix 2.2 and later. </p> + +%PARAM sender_canonical_classes envelope_sender, header_sender + +<p> What addresses are subject to sender_canonical_maps address +mapping. By default, sender_canonical_maps address mapping is +applied to envelope sender addresses, and to header sender addresses. +</p> + +<p> Specify one or more of: envelope_sender, header_sender </p> + +<p> This feature is available in Postfix 2.2 and later. </p> + +%PARAM recipient_canonical_classes envelope_recipient, header_recipient + +<p> What addresses are subject to recipient_canonical_maps address +mapping. By default, recipient_canonical_maps address mapping is +applied to envelope recipient addresses, and to header recipient +addresses. </p> + +<p> Specify one or more of: envelope_recipient, header_recipient +</p> + +<p> This feature is available in Postfix 2.2 and later. </p> + +%PARAM command_directory see "postconf -d" output + +<p> +The location of all postfix administrative commands. +</p> + +%PARAM command_time_limit 1000s + +<p> +Time limit for delivery to external commands. This limit is used +by the local(8) delivery agent, and is the default time limit for +delivery by the pipe(8) delivery agent. +</p> + +<p> +Note: if you set this time limit to a large value you must update the +global ipc_timeout parameter as well. +</p> + +%PARAM daemon_directory see "postconf -d" output + +<p> +The directory with Postfix support programs and daemon programs. +These should not be invoked directly by humans. The directory must +be owned by root. +</p> + +%PARAM daemon_timeout 18000s + +<p> How much time a Postfix daemon process may take to handle a +request before it is terminated by a built-in watchdog timer. </p> + +<p> Specify a non-zero time value (an integral value plus an optional +one-letter suffix that specifies the time unit). Time units: s +(seconds), m (minutes), h (hours), d (days), w (weeks). +The default time unit is s (seconds). </p> + +%PARAM debug_peer_level 2 + +<p> The increment in verbose logging level when a nexthop destination, +remote client or server name or network address matches a pattern +given with the debug_peer_list parameter. </p> + +<p> Per-nexthop debug logging is available in Postfix 3.6 and later. </p> + +%PARAM debug_peer_list + +<p> Optional list of nexthop destination, remote client or server +name or network address patterns that, if matched, cause the verbose +logging level to increase by the amount specified in $debug_peer_level. +</p> + +<p> Per-nexthop debug logging is available in Postfix 3.6 and later. </p> + +<p> Specify domain names, network/netmask patterns, "/file/name" +patterns or "type:table" lookup tables. The right-hand side result +from "type:table" lookups is ignored. </p> + +<p> Pattern matching of domain names is controlled by the presence +or absence of "debug_peer_list" in the parent_domain_matches_subdomains +parameter value. </p> + +<p> +Examples: +</p> + +<pre> +debug_peer_list = 127.0.0.1 +debug_peer_list = example.com +</pre> + +%PARAM default_database_type see "postconf -d" output + +<p> +The default database type for use in newaliases(1), postalias(1) +and postmap(1) commands. On many UNIX systems the default type is +either <b>dbm</b> or <b>hash</b>. The default setting is frozen +when the Postfix system is built. +</p> + +<p> +Examples: +</p> + +<pre> +default_database_type = hash +default_database_type = dbm +</pre> + +%PARAM default_delivery_slot_cost 5 + +<p> +How often the Postfix queue manager's scheduler is allowed to +preempt delivery of one message with another. +</p> + +<p> +Each transport maintains a so-called "available delivery slot counter" +for each message. One message can be preempted by another one when +the other message can be delivered using no more delivery slots +(i.e., invocations of delivery agents) than the current message +counter has accumulated (or will eventually accumulate - see about +slot loans below). This parameter controls how often the counter is +incremented - it happens after each default_delivery_slot_cost +recipients have been delivered. +</p> + +<p> +The cost of 0 is used to disable the preempting scheduling completely. +The minimum value the scheduling algorithm can use is 2 - use it +if you want to maximize the message throughput rate. Although there +is no maximum, it doesn't make much sense to use values above say +50. +</p> + +<p> +The only reason why the value of 2 is not the default is the way +this parameter affects the delivery of mailing-list mail. In the +worst case, delivery can take somewhere between (cost+1/cost) +and (cost/cost-1) times more than if the preemptive scheduler was +disabled. The default value of 5 turns out to provide reasonable +message response times while making sure the mailing-list deliveries +are not extended by more than 20-25 percent even in the worst case. +</p> + +<p> Use <i>transport</i>_delivery_slot_cost to specify a +transport-specific override, where <i>transport</i> is the master.cf +name of the message delivery transport. +</p> + +<p> +Examples: +</p> + +<pre> +default_delivery_slot_cost = 0 +default_delivery_slot_cost = 2 +</pre> + +%PARAM default_destination_concurrency_limit 20 + +<p> +The default maximal number of parallel deliveries to the same +destination. This is the default limit for delivery via the lmtp(8), +pipe(8), smtp(8) and virtual(8) delivery agents. +With a per-destination recipient limit > 1, a destination is a domain, +otherwise it is a recipient. +</p> + +<p> Use <i>transport</i>_destination_concurrency_limit to specify a +transport-specific override, where <i>transport</i> is the master.cf +name of the message delivery transport. +</p> + +%PARAM default_destination_recipient_limit 50 + +<p> +The default maximal number of recipients per message delivery. +This is the default limit for delivery via the lmtp(8), pipe(8), +smtp(8) and virtual(8) delivery agents. +</p> + +<p> Setting this parameter to a value of 1 affects email deliveries +as follows:</p> + +<ul> + +<li> <p> It changes the meaning of the corresponding per-destination +concurrency limit, from concurrency of deliveries to the <i>same +domain</i> into concurrency of deliveries to the <i>same recipient</i>. +Different recipients are delivered in parallel, subject to the +process limits specified in master.cf. </p> + +<li> <p> It changes the meaning of the corresponding per-destination +rate delay, from the delay between deliveries to the <i>same +domain</i> into the delay between deliveries to the <i>same +recipient</i>. Again, different recipients are delivered in parallel, +subject to the process limits specified in master.cf. </p> + +<li> <p> It changes the meaning of other corresponding per-destination +settings in a similar manner, from settings for delivery to the +<i>same domain</i> into settings for delivery to the <i>same +recipient</i>. + +</ul> + +<p> Use <i>transport</i>_destination_recipient_limit to specify a +transport-specific override, where <i>transport</i> is the master.cf +name of the message delivery transport. +</p> + +%PARAM default_extra_recipient_limit 1000 + +<p> +The default value for the extra per-transport limit imposed on the +number of in-memory recipients. This extra recipient space is +reserved for the cases when the Postfix queue manager's scheduler +preempts one message with another and suddenly needs some extra +recipient slots for the chosen message in order to avoid performance +degradation. +</p> + +<p> Use <i>transport</i>_extra_recipient_limit to specify a +transport-specific override, where <i>transport</i> is the master.cf +name of the message delivery transport. +</p> + +%PARAM default_minimum_delivery_slots 3 + +<p> +How many recipients a message must have in order to invoke the +Postfix queue manager's scheduling algorithm at all. Messages +which would never accumulate at least this many delivery slots +(subject to slot cost parameter as well) are never preempted. +</p> + +<p> Use <i>transport</i>_minimum_delivery_slots to specify a +transport-specific override, where <i>transport</i> is the master.cf +name of the message delivery transport. +</p> + +%PARAM default_privs nobody + +<p> +The default rights used by the local(8) delivery agent for delivery +to an external file or command. These rights are used when delivery +is requested from an aliases(5) file that is owned by <b>root</b>, or +when delivery is done on behalf of <b>root</b>. <b>DO NOT SPECIFY A +PRIVILEGED USER OR THE POSTFIX OWNER</b>. +</p> + +%PARAM default_process_limit 100 + +<p> +The default maximal number of Postfix child processes that provide +a given service. This limit can be overruled for specific services +in the master.cf file. +</p> + +%PARAM default_rbl_reply see "postconf -d" output + +<p> +The default Postfix SMTP server response template for a request that is +rejected by an RBL-based restriction. This template can be overruled +by specific entries in the optional rbl_reply_maps lookup table. +</p> + +<p> +This feature is available in Postfix 2.0 and later. +</p> + +<p> +The template does not support Postfix configuration parameter $name +substitution. Instead, it supports exactly one level of $name +substitution for the following attributes: +</p> + +<dl> + +<dt><b>$client</b></dt> + +<dd>The client hostname and IP address, formatted as name[address]. </dd> + +<dt><b>$client_address</b></dt> + +<dd>The client IP address. </dd> + +<dt><b>$client_name</b></dt> + +<dd>The client hostname or "unknown". See reject_unknown_client_hostname +for more details. </dd> + +<dt><b>$reverse_client_name</b></dt> + +<dd>The client hostname from address->name lookup, or "unknown". +See reject_unknown_reverse_client_hostname for more details. </dd> + +#<dt><b>$forward_client_name</b></dt> +# +#<dd>The client hostname from address->name lookup followed by +#name->address lookup, or "unknown". See +#reject_unknown_forward_client_hostname for more details. </dd> + +<dt><b>$helo_name</b></dt> + +<dd>The hostname given in HELO or EHLO command or empty string. </dd> + +<dt><b>$rbl_class</b></dt> + +<dd>The denylisted entity type: Client host, Helo command, Sender +address, or Recipient address. </dd> + +<dt><b>$rbl_code</b></dt> + +<dd>The numerical SMTP response code, as specified with the +maps_rbl_reject_code configuration parameter. Note: The numerical +SMTP response code is required, and must appear at the start of the +reply. With Postfix version 2.3 and later this information may be followed +by an RFC 3463 enhanced status code. </dd> + +<dt><b>$rbl_domain</b></dt> + +<dd>The RBL domain where $rbl_what is denylisted. </dd> + +<dt><b>$rbl_reason</b></dt> + +<dd>The reason why $rbl_what is denylisted, or an empty string. </dd> + +<dt><b>$rbl_what</b></dt> + +<dd>The entity that is denylisted (an IP address, a hostname, a domain +name, or an email address whose domain was denylisted). </dd> + +<dt><b>$recipient</b></dt> + +<dd>The recipient address or <> in case of the null address. </dd> + +<dt><b>$recipient_domain</b></dt> + +<dd>The recipient domain or empty string. </dd> + +<dt><b>$recipient_name</b></dt> + +<dd>The recipient address localpart or <> in case of null address. </dd> + +<dt><b>$sender</b></dt> + +<dd>The sender address or <> in case of the null address. </dd> + +<dt><b>$sender_domain</b></dt> + +<dd>The sender domain or empty string. </dd> + +<dt><b>$sender_name</b></dt> + +<dd>The sender address localpart or <> in case of the null address. </dd> + +<dt><b>${name?value}</b></dt> + +<dt><b>${name?{value}}</b> (Postfix ≥ 3.0)</dt> + +<dd>Expands to <i>value</i> when <i>$name</i> is non-empty. </dd> + +<dt><b>${name:value}</b></dt> + +<dt><b>${name:{value}}</b> (Postfix ≥ 3.0)</dt> + +<dd>Expands to <i>value</i> when <i>$name</i> is empty. </dd> + +<dt><b>${name?{value1}:{value2}}</b> (Postfix ≥ 3.0)</dt> + +<dd>Expands to <i>value1</i> when <i>$name</i> is non-empty, +<i>value2</i> otherwise. </dd> + +</dl> + +<p> +Instead of $name you can also specify ${name} or $(name). +</p> + +<p> Note: when an enhanced status code is specified in an RBL reply +template, it is subject to modification. The following transformations +are needed when the same RBL reply template is used for client, +helo, sender, or recipient access restrictions. </p> + +<ul> + +<li> <p> When rejecting a sender address, the Postfix SMTP server +will transform a recipient DSN status (e.g., 4.1.1-4.1.6) into the +corresponding sender DSN status, and vice versa. </p> + +<li> <p> When rejecting non-address information (such as the HELO +command argument or the client hostname/address), the Postfix SMTP +server will transform a sender or recipient DSN status into a generic +non-address DSN status (e.g., 4.0.0). </p> + +</ul> + +%PARAM default_recipient_limit 20000 + +<p> +The default per-transport upper limit on the number of in-memory +recipients. These limits take priority over the global +qmgr_message_recipient_limit after the message has been assigned +to the respective transports. See also default_extra_recipient_limit +and qmgr_message_recipient_minimum. +</p> + +<p> Use <i>transport</i>_recipient_limit to specify a +transport-specific override, where <i>transport</i> is the master.cf +name of the message delivery transport. +</p> + +%PARAM default_recipient_refill_limit 100 + +<p> +The default per-transport limit on the number of recipients refilled at +once. When not all message recipients fit into memory at once, keep +loading more of them in batches of at least this many at a time. See also +$default_recipient_refill_delay, which may result in recipient batches +lower than this when this limit is too high for too slow deliveries. +</p> + +<p> Use <i>transport</i>_recipient_refill_limit to specify a +transport-specific override, where <i>transport</i> is the master.cf +name of the message delivery transport. +</p> + +<p> This feature is available in Postfix 2.4 and later. </p> + +%PARAM default_recipient_refill_delay 5s + +<p> +The default per-transport maximum delay between refilling recipients. +When not all message recipients fit into memory at once, keep loading +more of them at least once every this many seconds. This is used to +make sure the recipients are refilled in a timely manner even when +$default_recipient_refill_limit is too high for too slow deliveries. +</p> + +<p> Use <i>transport</i>_recipient_refill_delay to specify a +transport-specific override, where <i>transport</i> is the master.cf +name of the message delivery transport. +</p> + +<p> This feature is available in Postfix 2.4 and later. </p> + +%PARAM default_transport smtp + +<p> +The default mail delivery transport and next-hop destination for +destinations that do not match $mydestination, $inet_interfaces, +$proxy_interfaces, $virtual_alias_domains, $virtual_mailbox_domains, +or $relay_domains. This information can be overruled with the +sender_dependent_default_transport_maps parameter and with the +transport(5) table. </p> + +<p> +In order of decreasing precedence, the nexthop destination is taken +from $sender_dependent_default_transport_maps, $default_transport, +$sender_dependent_relayhost_maps, $relayhost, or from the recipient +domain. +</p> + +<p> +Specify a string of the form <i>transport:nexthop</i>, where <i>transport</i> +is the name of a mail delivery transport defined in master.cf. +The <i>:nexthop</i> destination is optional; its syntax is documented +in the manual page of the corresponding delivery agent. In the case of +SMTP or LMTP, specify one or more destinations separated by comma or +whitespace (with Postfix 3.5 and later). +</p> + +<p> +Example: +</p> + +<pre> +default_transport = uucp:relayhostname +</pre> + +%PARAM defer_code 450 + +<p> +The numerical Postfix SMTP server response code when a remote SMTP +client request is rejected by the "defer" restriction. +</p> + +<p> +Do not change this unless you have a complete understanding of RFC 5321. +</p> + +%PARAM defer_transports + +<p> +The names of message delivery transports that should not deliver mail +unless someone issues "<b>sendmail -q</b>" or equivalent. Specify zero +or more mail delivery transport names that appear in the +first field of master.cf. +</p> + +<p> +Example: +</p> + +<pre> +defer_transports = smtp +</pre> + +%PARAM deliver_lock_attempts 20 + +<p> +The maximal number of attempts to acquire an exclusive lock on a +mailbox file or bounce(8) logfile. +</p> + +%PARAM deliver_lock_delay 1s + +<p> +The time between attempts to acquire an exclusive lock on a mailbox +file or bounce(8) logfile. +</p> + +<p> Specify a non-zero time value (an integral value plus an optional +one-letter suffix that specifies the time unit). Time units: s +(seconds), m (minutes), h (hours), d (days), w (weeks). +The default time unit is s (seconds). </p> + +%PARAM disable_vrfy_command no + +<p> +Disable the SMTP VRFY command. This stops some techniques used to +harvest email addresses. +</p> + +<p> +Example: +</p> + +<pre> +disable_vrfy_command = no +</pre> + +%PARAM double_bounce_sender double-bounce + +<p> The sender address of postmaster notifications that are generated +by the mail system. All mail to this address is silently discarded, +in order to terminate mail bounce loops. </p> + +%PARAM duplicate_filter_limit 1000 + +<p> The maximal number of addresses remembered by the address +duplicate filter for aliases(5) or virtual(5) alias expansion, or +for showq(8) queue displays. </p> + +%PARAM enable_original_recipient yes + +<p> Enable support for the original recipient address after an +address is rewritten to a different address (for example with +aliasing or with canonical mapping). </p> + +<p> The original recipient address is used as follows: </p> + +<dl> + +<dt> Final delivery </dt> <dd> With "enable_original_recipient = +yes", the original recipient address is stored in the <b>X-Original-To</b> +message header. This header may be used to distinguish between +different recipients that share the same mailbox. </dd> + +<dt> Recipient deduplication </dt> <dd> With "enable_original_recipient += yes", the cleanup(8) daemon performs duplicate recipient elimination +based on the content of (original recipient, maybe-rewritten +recipient) pairs. Otherwise, the cleanup(8) daemon performs duplicate +recipient elimination based only on the maybe-rewritten recipient +address. </dd> + +</dl> + +<p> Note: with Postfix ≤ 3.2 the "setting enable_original_recipient += <b>no</b>" breaks address verification for addresses that are +aliased or otherwise rewritten (Postfix is unable to store the +address verification result under the original probe destination +address; instead, it can store the result only under the rewritten +address). </p> + +<p> This feature is available in Postfix 2.1 and later. Postfix +version 2.0 behaves as if this parameter is always set to <b>yes</b>. +Postfix versions before 2.0 have no support for the original recipient +address. </p> + +%PARAM export_environment see "postconf -d" output + +<p> +The list of environment variables that a Postfix process will export +to non-Postfix processes. The TZ variable is needed for sane +time keeping on System-V-ish systems. +</p> + +<p> +Specify a list of names and/or name=value pairs, separated by +whitespace or comma. Specify "{ name=value }" to protect whitespace +or comma in parameter values (whitespace after the opening "{" and +before the closing "}" +is ignored). The form name=value is supported with Postfix version +2.1 and later; the use of {} is supported with Postfix 3.0 and +later. </p> + +<p> +Example: +</p> + +<pre> +export_environment = TZ PATH=/bin:/usr/bin +</pre> + +%PARAM smtp_fallback_relay $fallback_relay + +<p> +Optional list of relay hosts for SMTP destinations that can't be +found or that are unreachable. With Postfix 2.2 and earlier this +parameter is called fallback_relay. </p> + +<p> +By default, mail is returned to the sender when a destination is +not found, and delivery is deferred when a destination is unreachable. +</p> + +<p> With bulk email deliveries, it can be beneficial to run the +fallback relay MTA on the same host, so that it can reuse the sender +IP address. This speeds up deliveries that are delayed by IP-based +reputation systems (greylist, etc.). </p> + +<p> The fallback relays must be SMTP destinations. Specify a domain, +host, host:port, [host]:port, [address] or [address]:port; the form +[host] turns off MX lookups. If you specify multiple SMTP +destinations, Postfix will try them in the specified order. </p> + +<p> To prevent mailer loops between MX hosts and fall-back hosts, +Postfix version 2.2 and later will not use the fallback relays for +destinations that it is MX host for (assuming DNS lookup is turned on). +</p> + +%PARAM fallback_relay + +<p> +Optional list of relay hosts for SMTP destinations that can't be +found or that are unreachable. With Postfix 2.3 this parameter +is renamed to smtp_fallback_relay. </p> + +<p> +By default, mail is returned to the sender when a destination is +not found, and delivery is deferred when a destination is unreachable. +</p> + +<p> The fallback relays must be SMTP destinations. Specify a domain, +host, host:port, [host]:port, [address] or [address]:port; the form +[host] turns off MX lookups. If you specify multiple SMTP +destinations, Postfix will try them in the specified order. </p> + +<p> Note: before Postfix 2.2, do not use the fallback_relay feature +when relaying mail +for a backup or primary MX domain. Mail would loop between the +Postfix MX host and the fallback_relay host when the final destination +is unavailable. </p> + +<ul> + +<li> In main.cf specify "relay_transport = relay", + +<li> In master.cf specify "-o fallback_relay =" (i.e., empty) at +the end of the <tt>relay</tt> entry. + +<li> In transport maps, specify "relay:<i>nexthop...</i>" +as the right-hand side for backup or primary MX domain entries. + +</ul> + +<p> Postfix version 2.2 and later will not use the fallback_relay feature +for destinations that it is MX host for. +</p> + +%PARAM lmtp_fallback_relay + +<p> Optional list of relay hosts for LMTP destinations that can't be +found or that are unreachable. In main.cf elements are separated by +whitespace or commas. </p> + +<p> By default, mail is returned to the sender when a destination is not +found, and delivery is deferred when a destination is unreachable. </p> + +<p> The fallback relays must be TCP destinations, specified without +a leading "inet:" prefix. Specify a host or host:port. Since MX +lookups do not apply with LMTP, there is no need to use the "[host]" or +"[host]:port" forms. If you specify multiple LMTP destinations, Postfix +will try them in the specified order. </p> + +<p> +This feature is available in Postfix 3.1 and later. +</p> + +%PARAM fast_flush_domains $relay_domains + +<p> +Optional list of destinations that are eligible for per-destination +logfiles with mail that is queued to those destinations. +</p> + +<p> +By default, Postfix maintains "fast flush" logfiles only for +destinations that the Postfix SMTP server is willing to relay to +(i.e. the default is: "fast_flush_domains = $relay_domains"; see +the relay_domains parameter in the postconf(5) manual). +</p> + +<p> Specify a list of hosts or domains, "/file/name" patterns or +"type:table" lookup tables, separated by commas and/or whitespace. +Continue long lines by starting the next line with whitespace. A +"/file/name" pattern is replaced by its contents; a "type:table" +lookup table is matched when the domain or its parent domain appears +as lookup key. </p> + +<p> Pattern matching of domain names is controlled by the presence +or absence of "fast_flush_domains" in the parent_domain_matches_subdomains +parameter value. </p> + +<p> +Specify "fast_flush_domains =" (i.e., empty) to disable the feature +altogether. +</p> + +%PARAM fast_flush_purge_time 7d + +<p> +The time after which an empty per-destination "fast flush" logfile +is deleted. +</p> + +<p> +You can specify the time as a number, or as a number followed by +a letter that indicates the time unit: s=seconds, m=minutes, h=hours, +d=days, w=weeks. The default time unit is days. +</p> + +%PARAM fast_flush_refresh_time 12h + +<p> +The time after which a non-empty but unread per-destination "fast +flush" logfile needs to be refreshed. The contents of a logfile +are refreshed by requesting delivery of all messages listed in the +logfile. +</p> + +<p> +You can specify the time as a number, or as a number followed by +a letter that indicates the time unit: s=seconds, m=minutes, h=hours, +d=days, w=weeks. The default time unit is hours. +</p> + +%PARAM fork_attempts 5 + +<p> The maximal number of attempts to fork() a child process. </p> + +%PARAM fork_delay 1s + +<p> The delay between attempts to fork() a child process. </p> + +<p> Specify a non-zero time value (an integral value plus an optional +one-letter suffix that specifies the time unit). Time units: s +(seconds), m (minutes), h (hours), d (days), w (weeks). +The default time unit is s (seconds). </p> + +%PARAM execution_directory_expansion_filter see "postconf -d" output + +<p> Restrict the characters that the local(8) delivery agent allows +in $name expansions of $command_execution_directory. Characters +outside the allowed set are replaced by underscores. </p> + +<p> This feature is available in Postfix 2.2 and later. </p> + +%PARAM command_execution_directory + +<p> The local(8) delivery agent working directory for delivery to +external commands. Failure to change directory causes the delivery +to be deferred. </p> + +<p> The command_execution_directory value is not subject to Postfix +configuration parameter $name expansion. Instead, the following +$name expansions are done on command_execution_directory before the +directory is used. Expansion happens in the context +of the delivery request. The result of $name expansion is filtered +with the character set that is specified with the +execution_directory_expansion_filter parameter. </p> + +<dl> + +<dt><b>$user</b></dt> + +<dd>The recipient's username. </dd> + +<dt><b>$shell</b></dt> + +<dd>The recipient's login shell pathname. </dd> + +<dt><b>$home</b></dt> + +<dd>The recipient's home directory. </dd> + +<dt><b>$recipient</b></dt> + +<dd>The full recipient address. </dd> + +<dt><b>$extension</b></dt> + +<dd>The optional recipient address extension. </dd> + +<dt><b>$domain</b></dt> + +<dd>The recipient domain. </dd> + +<dt><b>$local</b></dt> + +<dd>The entire recipient localpart. </dd> + +<dt><b>$recipient_delimiter</b></dt> + +<dd>The address extension delimiter that was found in the recipient +address (Postfix 2.11 and later), or the system-wide recipient +address extension delimiter (Postfix 2.10 and earlier). </dd> + +<dt><b>${name?value}</b></dt> + +<dt><b>${name?{value}}</b> (Postfix ≥ 3.0)</dt> + +<dd>Expands to <i>value</i> when <i>$name</i> is non-empty. </dd> + +<dt><b>${name:value}</b></dt> + +<dt><b>${name:{value}}</b> (Postfix ≥ 3.0)</dt> + +<dd>Expands to <i>value</i> when <i>$name</i> is empty. </dd> + +<dt><b>${name?{value1}:{value2}}</b> (Postfix ≥ 3.0)</dt> + +<dd>Expands to <i>value1</i> when <i>$name</i> is non-empty, +<i>value2</i> otherwise. </dd> + +</dl> + +<p> +Instead of $name you can also specify ${name} or $(name). +</p> + +<p> This feature is available in Postfix 2.2 and later. </p> + +%PARAM forward_path see "postconf -d" output + +<p> The local(8) delivery agent search list for finding a .forward +file with user-specified delivery methods. The first file that is +found is used. </p> + +<p> The forward_path value is not subject to Postfix configuration +parameter $name expansion. Instead, the following $name expansions +are done on forward_path before the search actually happens. +The result of $name expansion is +filtered with the character set that is specified with the +forward_expansion_filter parameter. </p> + +<dl> + +<dt><b>$user</b></dt> + +<dd>The recipient's username. </dd> + +<dt><b>$shell</b></dt> + +<dd>The recipient's login shell pathname. </dd> + +<dt><b>$home</b></dt> + +<dd>The recipient's home directory. </dd> + +<dt><b>$recipient</b></dt> + +<dd>The full recipient address. </dd> + +<dt><b>$extension</b></dt> + +<dd>The optional recipient address extension. </dd> + +<dt><b>$domain</b></dt> + +<dd>The recipient domain. </dd> + +<dt><b>$local</b></dt> + +<dd>The entire recipient localpart. </dd> + +<dt><b>$recipient_delimiter</b></dt> + +<dd>The address extension delimiter that was found in the recipient +address (Postfix 2.11 and later), or the 'first' delimiter specified +with the system-wide recipient address extension delimiter (Postfix +3.5.22, 3.5.12, 3.7.8, 3.8.3 and later). Historically, this was +always the system-wide recipient +address extension delimiter (Postfix 2.10 and earlier). </dd> + +<dt><b>${name?value}</b></dt> + +<dt><b>${name?{value}}</b> (Postfix ≥ 3.0)</dt> + +<dd>Expands to <i>value</i> when <i>$name</i> is non-empty. </dd> + +<dt><b>${name:value}</b></dt> + +<dt><b>${name:{value}}</b> (Postfix ≥ 3.0)</dt> + +<dd>Expands to <i>value</i> when <i>$name</i> is empty. </dd> + +<dt><b>${name?{value1}:{value2}}</b> (Postfix ≥ 3.0)</dt> + +<dd>Expands to <i>value1</i> when <i>$name</i> is non-empty, +<i>value2</i> otherwise. </dd> + +</dl> + +<p> +Instead of $name you can also specify ${name} or $(name). +</p> + +<p> +Examples: +</p> + +<pre> +forward_path = /var/forward/$user +forward_path = + /var/forward/$user/.forward$recipient_delimiter$extension, + /var/forward/$user/.forward +</pre> + +%CLASS queue-hashing Queue directory hashing + +<p> +Queue directory hashing is a performance feature. Splitting one +queue directory across multiple subdirectory levels can speed up +file access by reducing the number of files per directory. +</p> + +<p> +Unfortunately, deeply hashing the incoming or deferred queue can +actually slow down the mail system (with a depth of 2, mailq with +an empty queue can take several seconds). +</p> + +<p> +Hashing must NOT be used with a world-writable maildrop directory. +Hashing MUST be used for the defer logfile directory, to avoid poor +performance when handling lots of deferred mail. +</p> + +%PARAM hash_queue_depth 1 + +<p> +The number of subdirectory levels for queue directories listed with +the hash_queue_names parameter. Queue hashing is implemented by +creating one or more levels of directories with one-character names. +Originally, these directory names were equal to the first characters +of the queue file name, with the hexadecimal representation of the +file creation time in microseconds. </p> + +<p> With long queue file names, queue hashing produces the same +results as with short names. The file creation time in microseconds +is converted into hexadecimal form before the result is used for +queue hashing. The base 16 encoding gives finer control over the +number of subdirectories than is possible with the base 52 encoding +of long queue file names. </p> + +<p> +After changing the hash_queue_names or hash_queue_depth parameter, +execute the command "<b>postfix reload</b>". +</p> + +%PARAM hash_queue_names deferred, defer + +<p> +The names of queue directories that are split across multiple +subdirectory levels. +</p> + +<p> Before Postfix version 2.2, the default list of hashed queues +was significantly larger. Claims about improvements in file system +technology suggest that hashing of the incoming and active queues +is no longer needed. Fewer hashed directories speed up the time +needed to restart Postfix. </p> + +<p> +After changing the hash_queue_names or hash_queue_depth parameter, +execute the command "<b>postfix reload</b>". +</p> + +%CLASS headerbody-checks Content inspection built-in features + +<p> +The Postfix cleanup(8) server has a limited ability to inspect +message headers and body content for signs of trouble. This is not +meant to be a substitute for content filters that do complex +processing such attachment decoding and unzipping. +</p> + +%PARAM header_checks + +<p> +Optional lookup tables for content inspection of primary non-MIME +message headers, as specified in the header_checks(5) manual page. +</p> + +%PARAM header_size_limit 102400 + +<p> +The maximal amount of memory in bytes for storing a message header. +If a header is larger, the excess is discarded. The limit is +enforced by the cleanup(8) server. +</p> + +%PARAM home_mailbox + +<p> +Optional pathname of a mailbox file relative to a local(8) user's +home directory. +</p> + +<p> +Specify a pathname ending in "/" for qmail-style delivery. +</p> + +<p> The precedence of local(8) delivery features from high to low +is: aliases, .forward files, mailbox_transport_maps, mailbox_transport, +mailbox_command_maps, mailbox_command, home_mailbox, mail_spool_directory, +fallback_transport_maps, fallback_transport and luser_relay. </p> + +<p> +Examples: +</p> + +<pre> +home_mailbox = Mailbox +home_mailbox = Maildir/ +</pre> + +%PARAM hopcount_limit 50 + +<p> +The maximal number of Received: message headers that is allowed +in the primary message headers. A message that exceeds the limit +is bounced, in order to stop a mailer loop. +</p> + +%PARAM ignore_mx_lookup_error no + +<p> Ignore DNS MX lookups that produce no response. By default, +the Postfix SMTP client defers delivery and tries again after some +delay. This behavior is required by the SMTP standard. </p> + +<p> +Specify "ignore_mx_lookup_error = yes" to force a DNS A record +lookup instead. This violates the SMTP standard and can result in +mis-delivery of mail. +</p> + +%PARAM import_environment see "postconf -d" output + +<p> The list of environment variables that a privileged Postfix +process will import from a non-Postfix parent process, or name=value +environment overrides. Unprivileged utilities will enforce the +name=value overrides, but otherwise will not change their process +environment. Examples of relevant environment variables: </p> + +<dl> + +<dt><b>TZ</b></dt> + +<dd>May be needed for sane time keeping on most System-V-ish systems. +</dd> + +<dt><b>DISPLAY</b></dt> + +<dd>Needed for debugging Postfix daemons with an X-windows debugger. </dd> + +<dt><b>XAUTHORITY</b></dt> + +<dd>Needed for debugging Postfix daemons with an X-windows debugger. </dd> + +<dt><b>MAIL_CONFIG</b></dt> + +<dd>Needed to make "<b>postfix -c</b>" work. </dd> + +</dl> + +<p> Specify a list of names and/or name=value pairs, separated by +whitespace or comma. Specify "{ name=value }" to protect whitespace +or comma in environment variable values (whitespace after the opening "{" and +before the closing "}" +is ignored). The form name=value is supported with Postfix version +2.1 and later; the use of {} is supported with Postfix 3.0 and +later. </p> + +%PARAM in_flow_delay 1s + +<p> Time to pause before accepting a new message, when the message +arrival rate exceeds the message delivery rate. This feature is +turned on by default (it's disabled on SCO UNIX due to an SCO bug). +</p> + +<p> +With the default 100 Postfix SMTP server process limit, "in_flow_delay += 1s" limits the mail inflow to 100 messages per second above the +number of messages delivered per second. +</p> + +<p> +Specify 0 to disable the feature. Valid delays are 0..10. +</p> + +%PARAM inet_interfaces all + +<p> The network interface addresses that this mail system receives +mail on. Specify "all" to receive mail on all network +interfaces (default), and "loopback-only" to receive mail +on loopback network interfaces only (Postfix version 2.2 and later). The +parameter also controls delivery of mail to <tt>user@[ip.address]</tt>. +</p> + +<p> +Note 1: you need to stop and start Postfix when this parameter changes. +</p> + +<p> Note 2: address information may be enclosed inside <tt>[]</tt>, +but this form is not required here. </p> + +<p> When inet_interfaces specifies just one IPv4 and/or IPv6 address +that is not a loopback address, the Postfix SMTP client will use +this address as the IP source address for outbound mail. Support +for IPv6 is available in Postfix version 2.2 and later. </p> + +<p> +On a multi-homed firewall with separate Postfix instances listening on the +"inside" and "outside" interfaces, this can prevent each instance from +being able to reach remote SMTP servers on the "other side" of the +firewall. Setting +smtp_bind_address to 0.0.0.0 avoids the potential problem for +IPv4, and setting smtp_bind_address6 to :: solves the problem +for IPv6. </p> + +<p> +A better solution for multi-homed firewalls is to leave inet_interfaces +at the default value and instead use explicit IP addresses in +the master.cf SMTP server definitions. This preserves the Postfix +SMTP client's +loop detection, by ensuring that each side of the firewall knows that the +other IP address is still the same host. Setting $inet_interfaces to a +single IPv4 and/or IPV6 address is primarily useful with virtual +hosting of domains on +secondary IP addresses, when each IP address serves a different domain +(and has a different $myhostname setting). </p> + +<p> +See also the proxy_interfaces parameter, for network addresses that +are forwarded to Postfix by way of a proxy or address translator. +</p> + +<p> +Examples: +</p> + +<pre> +inet_interfaces = all (DEFAULT) +inet_interfaces = loopback-only (Postfix version 2.2 and later) +inet_interfaces = 127.0.0.1 +inet_interfaces = 127.0.0.1, [::1] (Postfix version 2.2 and later) +inet_interfaces = 192.168.1.2, 127.0.0.1 +</pre> + +%PARAM inet_protocols see 'postconf -d output' + +<p> The Internet protocols Postfix will attempt to use when making +or accepting connections. Specify one or more of "ipv4" +or "ipv6", separated by whitespace or commas. The form +"all" is equivalent to "ipv4, ipv6" or "ipv4", depending +on whether the operating system implements IPv6. </p> + +<p> With Postfix 2.8 and earlier the default is "ipv4". For backwards +compatibility with these releases, the Postfix 2.9 and later upgrade +procedure appends an explicit "inet_protocols = ipv4" setting to +main.cf when no explicit setting is present. This compatibility +workaround will be phased out as IPv6 deployment becomes more common. +</p> + +<p> This feature is available in Postfix 2.2 and later. </p> + +<p> Note: you MUST stop and start Postfix after changing this +parameter. </p> + +<p> On systems that pre-date IPV6_V6ONLY support (RFC 3493), an +IPv6 server will also accept IPv4 connections, even when IPv4 is +turned off with the inet_protocols parameter. On systems with +IPV6_V6ONLY support, Postfix will use separate server sockets for +IPv6 and IPv4, and each will accept only connections for the +corresponding protocol. </p> + +<p> When IPv4 support is enabled via the inet_protocols parameter, +Postfix will look up DNS type A records, and will convert +IPv4-in-IPv6 client IP addresses (::ffff:1.2.3.4) to their original +IPv4 form (1.2.3.4). The latter is needed on hosts that pre-date +IPV6_V6ONLY support (RFC 3493). </p> + +<p> When IPv6 support is enabled via the inet_protocols parameter, +Postfix will do DNS type AAAA record lookups. </p> + +<p> When both IPv4 and IPv6 support are enabled, the Postfix SMTP +client will choose the protocol as specified with the +smtp_address_preference parameter. Postfix versions before 2.8 +attempt to connect via IPv6 before attempting to use IPv4. </p> + +<p> +Examples: +</p> + +<pre> +inet_protocols = ipv4 +inet_protocols = all (DEFAULT) +inet_protocols = ipv6 +inet_protocols = ipv4, ipv6 +</pre> + +%PARAM initial_destination_concurrency 5 + +<p> +The initial per-destination concurrency level for parallel delivery +to the same destination. +With per-destination recipient limit > 1, a destination is a domain, +otherwise it is a recipient. +</p> + +<p> Use <i>transport</i>_initial_destination_concurrency to specify +a transport-specific override, where <i>transport</i> is the master.cf +name of the message delivery transport (Postfix 2.5 and later). </p> + +<p> +Warning: with concurrency of 1, one bad message can be enough to +block all mail to a site. +</p> + +%PARAM invalid_hostname_reject_code 501 + +<p> +The numerical Postfix SMTP server response code when the client +HELO or EHLO command parameter is rejected by the reject_invalid_helo_hostname +restriction. +</p> + +<p> +Do not change this unless you have a complete understanding of RFC 5321. +</p> + +%PARAM ipc_idle version dependent + +<p> +The time after which a client closes an idle internal communication +channel. The purpose is to allow Postfix daemon processes to +terminate voluntarily after they become idle. This is used, for +example, by the Postfix address resolving and rewriting clients. +</p> + +<p> With Postfix 2.4 the default value was reduced from 100s to 5s. </p> + +<p> Specify a non-zero time value (an integral value plus an optional +one-letter suffix that specifies the time unit). Time units: s +(seconds), m (minutes), h (hours), d (days), w (weeks). +The default time unit is s (seconds). </p> + +%PARAM ipc_timeout 3600s + +<p> +The time limit for sending or receiving information over an internal +communication channel. The purpose is to break out of deadlock +situations. If the time limit is exceeded the software aborts with a +fatal error. +</p> + +<p> Specify a non-zero time value (an integral value plus an optional +one-letter suffix that specifies the time unit). Time units: s +(seconds), m (minutes), h (hours), d (days), w (weeks). +The default time unit is s (seconds). </p> + +%PARAM ipc_ttl 1000s + +<p> +The time after which a client closes an active internal communication +channel. The purpose is to allow Postfix daemon processes to +terminate voluntarily +after reaching their client limit. This is used, for example, by +the Postfix address resolving and rewriting clients. +</p> + +<p> Specify a non-zero time value (an integral value plus an optional +one-letter suffix that specifies the time unit). Time units: s +(seconds), m (minutes), h (hours), d (days), w (weeks). +The default time unit is s (seconds). </p> + +<p> +This feature is available in Postfix 2.1 and later. +</p> + +%PARAM line_length_limit 2048 + +<p> Upon input, long lines are chopped up into pieces of at most +this length; upon delivery, long lines are reconstructed. </p> + +%PARAM lmtp_connect_timeout 0s + +<p> The Postfix LMTP client time limit for completing a TCP connection, or +zero (use the operating system built-in time limit). When no +connection can be made within the deadline, the LMTP client tries +the next address on the mail exchanger list. </p> + +<p> Specify a non-negative time value (an integral value plus an optional +one-letter suffix that specifies the time unit). Time units: s +(seconds), m (minutes), h (hours), d (days), w (weeks). +The default time unit is s (seconds). </p> + +<p> +Example: +</p> + +<pre> +lmtp_connect_timeout = 30s +</pre> + +%PARAM lmtp_data_done_timeout 600s + +<p> The Postfix LMTP client time limit for sending the LMTP ".", +and for receiving the remote LMTP server response. When no response +is received within the deadline, a warning is logged that the mail +may be delivered multiple times. </p> + +<p> Specify a non-zero time value (an integral value plus an optional +one-letter suffix that specifies the time unit). Time units: s +(seconds), m (minutes), h (hours), d (days), w (weeks). +The default time unit is s (seconds). </p> + +%PARAM lmtp_data_init_timeout 120s + +<p> +The Postfix LMTP client time limit for sending the LMTP DATA command, +and +for receiving the remote LMTP server response. +</p> + +<p> Specify a non-zero time value (an integral value plus an optional +one-letter suffix that specifies the time unit). Time units: s +(seconds), m (minutes), h (hours), d (days), w (weeks). +The default time unit is s (seconds). </p> + +%PARAM lmtp_data_xfer_timeout 180s + +<p> +The Postfix LMTP client time limit for sending the LMTP message +content. +When the connection stalls for more than $lmtp_data_xfer_timeout +the LMTP client terminates the transfer. +</p> + +<p> Specify a non-zero time value (an integral value plus an optional +one-letter suffix that specifies the time unit). Time units: s +(seconds), m (minutes), h (hours), d (days), w (weeks). +The default time unit is s (seconds). </p> + +%PARAM lmtp_lhlo_timeout 300s + +<p> The Postfix LMTP client time limit for receiving the LMTP +greeting banner. When the remote LMTP server drops the connection +without sending a +greeting banner, or when it sends no greeting banner within the +deadline, the LMTP client tries the next address on the mail +exchanger list. </p> + +<p> Specify a non-zero time value (an integral value plus an optional +one-letter suffix that specifies the time unit). Time units: s +(seconds), m (minutes), h (hours), d (days), w (weeks). +The default time unit is s (seconds). </p> + +%PARAM lmtp_mail_timeout 300s + +<p> +The Postfix LMTP client time limit for sending the MAIL FROM command, +and for receiving the remote LMTP server response. +</p> + +<p> Specify a non-zero time value (an integral value plus an optional +one-letter suffix that specifies the time unit). Time units: s +(seconds), m (minutes), h (hours), d (days), w (weeks). +The default time unit is s (seconds). </p> + +%PARAM lmtp_quit_timeout 300s + +<p> +The Postfix LMTP client time limit for sending the QUIT command, +and for receiving the remote LMTP server response. +</p> + +<p> Specify a non-zero time value (an integral value plus an optional +one-letter suffix that specifies the time unit). Time units: s +(seconds), m (minutes), h (hours), d (days), w (weeks). +The default time unit is s (seconds). </p> + +%PARAM lmtp_rcpt_timeout 300s + +<p> +The Postfix LMTP client time limit for sending the RCPT TO command, +and for receiving the remote LMTP server response. +</p> + +<p> Specify a non-zero time value (an integral value plus an optional +one-letter suffix that specifies the time unit). Time units: s +(seconds), m (minutes), h (hours), d (days), w (weeks). +The default time unit is s (seconds). </p> + +%PARAM lmtp_rset_timeout 20s + +<p> The Postfix LMTP client time limit for sending the RSET command, +and for receiving the remote LMTP server response. The LMTP client +sends RSET in +order to finish a recipient address probe, or to verify that a +cached connection is still alive. </p> + +<p> Specify a non-zero time value (an integral value plus an optional +one-letter suffix that specifies the time unit). Time units: s +(seconds), m (minutes), h (hours), d (days), w (weeks). +The default time unit is s (seconds). </p> + +%PARAM lmtp_send_xforward_command no + +<p> +Send an XFORWARD command to the remote LMTP server when the LMTP LHLO +server response announces XFORWARD support. This allows an lmtp(8) +delivery agent, used for content filter message injection, to +forward the name, address, protocol and HELO name of the original +client to the content filter and downstream LMTP server. +Before you change the value to yes, it is best to make sure that +your content filter supports this command. +</p> + +<p> +This feature is available in Postfix 2.1 and later. +</p> + +%PARAM lmtp_skip_quit_response no + +<p> +Wait for the response to the LMTP QUIT command. +</p> + +%PARAM lmtp_xforward_timeout 300s + +<p> +The Postfix LMTP client time limit for sending the XFORWARD command, +and for receiving the remote LMTP server response. +</p> + +<p> +In case of problems the client does NOT try the next address on +the mail exchanger list. +</p> + +<p> Specify a non-zero time value (an integral value plus an optional +one-letter suffix that specifies the time unit). Time units: s +(seconds), m (minutes), h (hours), d (days), w (weeks). +The default time unit is s (seconds). </p> + +<p> +This feature is available in Postfix 2.1 and later. +</p> + +%PARAM local_command_shell + +<p> +Optional shell program for local(8) delivery to non-Postfix commands. +By default, non-Postfix commands are executed directly; commands +are given to the default shell (typically, /bin/sh) only when they +contain shell meta characters or shell built-in commands. +</p> + +<p> "sendmail's restricted shell" (smrsh) is what most people will +use in order to restrict what programs can be run from e.g. .forward +files (smrsh is part of the Sendmail distribution). </p> + +<p> Note: when a shell program is specified, it is invoked even +when the command contains no shell built-in commands or meta +characters. </p> + +<p> +Example: +</p> + +<pre> +local_command_shell = /some/where/smrsh -c +local_command_shell = /bin/bash -c +</pre> + +%PARAM local_destination_concurrency_limit 2 + +<p> The maximal number of parallel deliveries via the local mail +delivery transport to the same recipient (when +"local_destination_recipient_limit = 1") or the maximal number of +parallel deliveries to the same local domain (when +"local_destination_recipient_limit > 1"). This limit is enforced by +the queue manager. The message delivery transport name is the first +field in the entry in the master.cf file. </p> + +<p> A low limit of 2 is recommended, just in case someone has an +expensive shell command in a .forward file or in an alias (e.g., +a mailing list manager). You don't want to run lots of those at +the same time. </p> + +%PARAM local_destination_recipient_limit 1 + +<p> The maximal number of recipients per message delivery via the +local mail delivery transport. This limit is enforced by the queue +manager. The message delivery transport name is the first field in +the entry in the master.cf file. </p> + +<p> Setting this parameter to a value > 1 changes the meaning of +local_destination_concurrency_limit from concurrency per recipient +into concurrency per domain. </p> + +%PARAM local_recipient_maps proxy:unix:passwd.byname $alias_maps + +<p> Lookup tables with all names or addresses of local recipients: +a recipient address is local when its domain matches $mydestination, +$inet_interfaces or $proxy_interfaces. Specify @domain as a +wild-card for domains that do not have a valid recipient list. +Technically, tables listed with $local_recipient_maps are used as +lists: Postfix needs to know only if a lookup string is found or +not, but it does not use the result from table lookup. </p> + +<p> +Specify zero or more "type:name" lookup tables, separated by +whitespace or comma. Tables will be searched in the specified order +until a match is found. +</p> + +<p> +If this parameter is non-empty (the default), then the Postfix SMTP +server will reject mail for unknown local users. +</p> + +<p> +To turn off local recipient checking in the Postfix SMTP server, +specify "local_recipient_maps =" (i.e. empty). +</p> + +<p> +The default setting assumes that you use the default Postfix local +delivery agent for local delivery. You need to update the +local_recipient_maps setting if: +</p> + +<ul> + +<li>You redefine the local delivery agent in master.cf. + +<li>You redefine the "local_transport" setting in main.cf. + +<li>You use the "luser_relay", "mailbox_transport", or "fallback_transport" +feature of the Postfix local(8) delivery agent. + +</ul> + +<p> +Details are described in the LOCAL_RECIPIENT_README file. +</p> + +<p> +Beware: if the Postfix SMTP server runs chrooted, you need to access +the passwd file via the proxymap(8) service, in order to overcome +chroot access restrictions. The alternative, maintaining a copy of +the system password file in the chroot jail is not practical. +</p> + +<p> +Examples: +</p> + +<pre> +local_recipient_maps = +</pre> + +%PARAM local_transport local:$myhostname + +<p> The default mail delivery transport and next-hop destination +for final delivery to domains listed with mydestination, and for +[ipaddress] destinations that match $inet_interfaces or $proxy_interfaces. +This information can be overruled with the transport(5) table. </p> + +<p> +By default, local mail is delivered to the transport called "local", +which is just the name of a service that is defined the master.cf file. +</p> + +<p> +Specify a string of the form <i>transport:nexthop</i>, where <i>transport</i> +is the name of a mail delivery transport defined in master.cf. +The <i>:nexthop</i> destination is optional; its syntax is documented +in the manual page of the corresponding delivery agent. +</p> + +<p> +Beware: if you override the default local delivery agent then you +need to review the LOCAL_RECIPIENT_README document, otherwise the +SMTP server may reject mail for local recipients. +</p> + +%PARAM luser_relay + +<p> +Optional catch-all destination for unknown local(8) recipients. +By default, mail for unknown recipients in domains that match +$mydestination, $inet_interfaces or $proxy_interfaces is returned +as undeliverable. +</p> + +<p> +The luser_relay value is not subject to Postfix configuration +parameter $name expansion. Instead, the following $name expansions +are done: +</p> + +<dl> + +<dt><b>$domain</b></dt> + +<dd>The recipient domain. </dd> + +<dt><b>$extension</b></dt> + +<dd>The recipient address extension. </dd> + +<dt><b>$home</b></dt> + +<dd>The recipient's home directory. </dd> + +<dt><b>$local</b></dt> + +<dd>The entire recipient address localpart. </dd> + +<dt><b>$recipient</b></dt> + +<dd>The full recipient address. </dd> + +<dt><b>$recipient_delimiter</b></dt> + +<dd>The address extension delimiter that was found in the recipient +address (Postfix 2.11 and later), or the system-wide recipient +address extension delimiter (Postfix 2.10 and earlier). </dd> + +<dt><b>$shell</b></dt> + +<dd>The recipient's login shell. </dd> + +<dt><b>$user</b></dt> + +<dd>The recipient username. </dd> + +<dt><b>${name?value}</b></dt> + +<dt><b>${name?{value}}</b> (Postfix ≥ 3.0)</dt> + +<dd>Expands to <i>value</i> when <i>$name</i> is non-empty. </dd> + +<dt><b>${name:value}</b></dt> + +<dt><b>${name:{value}}</b> (Postfix ≥ 3.0)</dt> + +<dd>Expands to <i>value</i> when <i>$name</i> is empty. </dd> + +<dt><b>${name?{value1}:{value2}}</b> (Postfix ≥ 3.0)</dt> + +<dd>Expands to <i>value1</i> when <i>$name</i> is non-empty, +<i>value2</i> otherwise. </dd> + +</dl> + +<p> +Instead of $name you can also specify ${name} or $(name). +</p> + +<p> +Note: luser_relay works only for the Postfix local(8) delivery agent. +</p> + +<p> +Note: if you use this feature for accounts not in the UNIX password +file, then you must specify "local_recipient_maps =" (i.e. empty) +in the main.cf file, otherwise the Postfix SMTP server will reject mail +for non-UNIX accounts with "User unknown in local recipient table". +</p> + +<p> +Examples: +</p> + +<pre> +luser_relay = $user@other.host +luser_relay = $local@other.host +luser_relay = admin+$local +</pre> + +%PARAM mail_name Postfix + +<p> +The mail system name that is displayed in Received: headers, in +the SMTP greeting banner, and in bounced mail. +</p> + +%PARAM mail_owner postfix + +<p> +The UNIX system account that owns the Postfix queue and most Postfix +daemon processes. Specify the name of an unprivileged user account +that does not share a user or group ID with other accounts, and that +owns no other files +or processes on the system. In particular, don't specify nobody +or daemon. PLEASE USE A DEDICATED USER ID AND GROUP ID. +</p> + +<p> +When this parameter value is changed you need to re-run "<b>postfix +set-permissions</b>" (with Postfix version 2.0 and earlier: +"<b>/etc/postfix/post-install set-permissions</b>". +</p> + +%PARAM mail_spool_directory see "postconf -d" output + +<p> +The directory where local(8) UNIX-style mailboxes are kept. The +default setting depends on the system type. Specify a name ending +in / for maildir-style delivery. +</p> + +<p> +Note: maildir delivery is done with the privileges of the recipient. +If you use the mail_spool_directory setting for maildir style +delivery, then you must create the top-level maildir directory in +advance. Postfix will not create it. +</p> + +<p> +Examples: +</p> + +<pre> +mail_spool_directory = /var/mail +mail_spool_directory = /var/spool/mail +</pre> + +%PARAM mail_version see "postconf -d" output + +<p> +The version of the mail system. Stable releases are named +<i>major</i>.<i>minor</i>.<i>patchlevel</i>. Experimental releases +also include the release date. The version string can be used in, +for example, the SMTP greeting banner. +</p> + +%PARAM mailbox_command + +<p> +Optional external command that the local(8) delivery agent should +use for mailbox delivery. The command is run with the user ID and +the primary group ID privileges of the recipient. Exception: +command delivery for root executes with $default_privs privileges. +This is not a problem, because 1) mail for root should always be +aliased to a real user and 2) don't log in as root, use "su" instead. +</p> + +<p> +The following environment variables are exported to the command: +</p> + +<dl> + +<dt><b>CLIENT_ADDRESS</b></dt> + +<dd>Remote client network address. Available in Postfix version 2.2 and +later. </dd> + +<dt><b>CLIENT_HELO</b></dt> + +<dd>Remote client EHLO command parameter. Available in Postfix version 2.2 +and later.</dd> + +<dt><b>CLIENT_HOSTNAME</b></dt> + +<dd>Remote client hostname. Available in Postfix version 2.2 and later. +</dd> + +<dt><b>CLIENT_PROTOCOL</b></dt> + +<dd>Remote client protocol. Available in Postfix version 2.2 and later. +</dd> + +<dt><b>DOMAIN</b></dt> + +<dd>The domain part of the recipient address. </dd> + +<dt><b>EXTENSION</b></dt> + +<dd>The optional address extension. </dd> + +<dt><b>HOME</b></dt> + +<dd>The recipient home directory. </dd> + +<dt><b>LOCAL</b></dt> + +<dd>The recipient address localpart. </dd> + +<dt><b>LOGNAME</b></dt> + +<dd>The recipient's username. </dd> + +<dt><b>ORIGINAL_RECIPIENT</b></dt> + +<dd>The entire recipient address, before any address rewriting or +aliasing. </dd> + +<dt><b>RECIPIENT</b></dt> + +<dd>The full recipient address. </dd> + +<dt><b>SASL_METHOD</b></dt> + +<dd>SASL authentication method specified in the remote client AUTH +command. Available in Postfix version 2.2 and later. </dd> + +<dt><b>SASL_SENDER</b></dt> + +<dd>SASL sender address specified in the remote client MAIL FROM +command. Available in Postfix version 2.2 and later. </dd> + +<dt><b>SASL_USER</b></dt> + +<dd>SASL username specified in the remote client AUTH command. +Available in Postfix version 2.2 and later. </dd> + +<dt><b>SENDER</b></dt> + +<dd>The full sender address. </dd> + +<dt><b>SHELL</b></dt> + +<dd>The recipient's login shell. </dd> + +<dt><b>USER</b></dt> + +<dd>The recipient username. </dd> + +</dl> + +<p> +Unlike other Postfix configuration parameters, the mailbox_command +parameter is not subjected to $name substitutions. This is to make +it easier to specify shell syntax (see example below). +</p> + +<p> +If you can, avoid shell meta characters because they will force +Postfix to run an expensive shell process. If you're delivering +via "procmail" then running a shell won't make a noticeable difference +in the total cost. +</p> + +<p> +Note: if you use the mailbox_command feature to deliver mail +system-wide, you must set up an alias that forwards mail for root +to a real user. +</p> + +<p> The precedence of local(8) delivery features from high to low +is: aliases, .forward files, mailbox_transport_maps, mailbox_transport, +mailbox_command_maps, mailbox_command, home_mailbox, mail_spool_directory, +fallback_transport_maps, fallback_transport and luser_relay. </p> + +<p> +Examples: +</p> + +<pre> +mailbox_command = /some/where/procmail +mailbox_command = /some/where/procmail -a "$EXTENSION" +mailbox_command = /some/where/maildrop -d "$USER" + -f "$SENDER" "$EXTENSION" +</pre> + +%PARAM mailbox_size_limit 51200000 + +<p> The maximal size of any local(8) individual mailbox or maildir +file, or zero (no limit). In fact, this limits the size of any +file that is written to upon local delivery, including files written +by external commands that are executed by the local(8) delivery +agent. The value cannot exceed LONG_MAX (typically, a 32-bit or +64-bit signed integer). +</p> + +<p> +This limit must not be smaller than the message size limit. +</p> + +%PARAM maps_rbl_reject_code 554 + +<p> +The numerical Postfix SMTP server response code when a remote SMTP +client request is blocked by the reject_rbl_client, reject_rhsbl_client, +reject_rhsbl_reverse_client, reject_rhsbl_sender or +reject_rhsbl_recipient restriction. +</p> + +<p> +Do not change this unless you have a complete understanding of RFC 5321. +</p> + +%PARAM masquerade_classes envelope_sender, header_sender, header_recipient + +<p> +What addresses are subject to address masquerading. +</p> + +<p> +By default, address masquerading is limited to envelope sender +addresses, and to header sender and header recipient addresses. +This allows you to use address masquerading on a mail gateway while +still being able to forward mail to users on individual machines. +</p> + +<p> +Specify zero or more of: envelope_sender, envelope_recipient, +header_sender, header_recipient +</p> + +%PARAM masquerade_domains + +<p> +Optional list of domains whose subdomain structure will be stripped +off in email addresses. +</p> + +<p> +The list is processed left to right, and processing stops at the +first match. Thus, +</p> + +<blockquote> +<pre> +masquerade_domains = foo.example.com example.com +</pre> +</blockquote> + +<p> +strips "user@any.thing.foo.example.com" to "user@foo.example.com", +but strips "user@any.thing.else.example.com" to "user@example.com". +</p> + +<p> +A domain name prefixed with ! means do not masquerade this domain +or its subdomains. Thus, +</p> + +<blockquote> +<pre> +masquerade_domains = !foo.example.com example.com +</pre> +</blockquote> + +<p> +does not change "user@any.thing.foo.example.com" or "user@foo.example.com", +but strips "user@any.thing.else.example.com" to "user@example.com". +</p> + +<p> Note: with Postfix version 2.2, message header address masquerading +happens only when message header address rewriting is enabled: </p> + +<ul> + +<li> The message is received with the Postfix sendmail(1) command, + +<li> The message is received from a network client that matches +$local_header_rewrite_clients, + +<li> The message is received from the network, and the +remote_header_rewrite_domain parameter specifies a non-empty value. + +</ul> + +<p> To get the behavior before Postfix version 2.2, specify +"local_header_rewrite_clients = static:all". </p> + + +<p> +Example: +</p> + +<pre> +masquerade_domains = $mydomain +</pre> + +%PARAM masquerade_exceptions + +<p> +Optional list of user names that are not subjected to address +masquerading, even when their addresses match $masquerade_domains. +</p> + +<p> +By default, address masquerading makes no exceptions. +</p> + +<p> +Specify a list of user names, "/file/name" or "type:table" patterns, +separated by commas and/or whitespace. The list is matched left to +right, and the search stops on the first match. A "/file/name" +pattern is replaced +by its contents; a "type:table" lookup table is matched when a name +matches a lookup key (the lookup result is ignored). Continue long +lines by starting the next line with whitespace. Specify "!pattern" +to exclude a name from the list. The form "!/file/name" is supported +only in Postfix version 2.4 and later. </p> + +<p> +Examples: +</p> + +<pre> +masquerade_exceptions = root, mailer-daemon +masquerade_exceptions = root +</pre> + +%PARAM max_idle 100s + +<p> +The maximum amount of time that an idle Postfix daemon process waits +for an incoming connection before terminating voluntarily. This +parameter +is ignored by the Postfix queue manager and by other long-lived +Postfix daemon processes. +</p> + +<p> Specify a non-zero time value (an integral value plus an optional +one-letter suffix that specifies the time unit). Time units: s +(seconds), m (minutes), h (hours), d (days), w (weeks). +The default time unit is s (seconds). </p> + +%PARAM max_use 100 + +<p> +The maximal number of incoming connections that a Postfix daemon +process will service before terminating voluntarily. This parameter +is ignored by the Postfix queue +manager and by other long-lived Postfix daemon processes. +</p> + +%PARAM maximal_backoff_time 4000s + +<p> +The maximal time between attempts to deliver a deferred message. +</p> + +<p> This parameter should be set to a value greater than or equal +to $minimal_backoff_time. See also $queue_run_delay. </p> + +<p> Specify a non-zero time value (an integral value plus an optional +one-letter suffix that specifies the time unit). Time units: s +(seconds), m (minutes), h (hours), d (days), w (weeks). +The default time unit is s (seconds). </p> + +%PARAM maximal_queue_lifetime 5d + +<p> +Consider a message as undeliverable, when delivery fails with a +temporary error, and the time in the queue has reached the +maximal_queue_lifetime limit. +</p> + +<p> Specify a non-negative time value (an integral value plus an optional +one-letter suffix that specifies the time unit). Time units: s +(seconds), m (minutes), h (hours), d (days), w (weeks). +The default time unit is d (days). </p> + +<p> +Specify 0 when mail delivery should be tried only once. +</p> + +%PARAM lmdb_map_size 16777216 + +<p> +The initial OpenLDAP LMDB database size limit in bytes. Each time +a database becomes full, its size limit is doubled. +</p> + +<p> +This feature is available in Postfix 2.11 and later. +</p> + +%PARAM message_size_limit 10240000 + +<p> +The maximal size in bytes of a message, including envelope information. +The value cannot exceed LONG_MAX (typically, a 32-bit or 64-bit +signed integer). +</p> + +<p> Note: be careful when making changes. Excessively small values +will result in the loss of non-delivery notifications, when a bounce +message size exceeds the local or remote MTA's message size limit. +</p> + +%PARAM minimal_backoff_time 300s + +<p> +The minimal time between attempts to deliver a deferred message; +prior to Postfix 2.4 the default value was 1000s. +</p> + +<p> +This parameter also limits the time an unreachable destination is +kept in the short-term, in-memory, destination status cache. +</p> + +<p> This parameter should be set greater than or equal to +$queue_run_delay. See also $maximal_backoff_time. </p> + +<p> Specify a non-zero time value (an integral value plus an optional +one-letter suffix that specifies the time unit). Time units: s +(seconds), m (minutes), h (hours), d (days), w (weeks). +The default time unit is s (seconds). </p> + +%PARAM multi_recipient_bounce_reject_code 550 + +<p> +The numerical Postfix SMTP server response code when a remote SMTP +client request is blocked by the reject_multi_recipient_bounce +restriction. +</p> + +<p> +Do not change this unless you have a complete understanding of RFC 5321. +</p> + +<p> +This feature is available in Postfix 2.1 and later. +</p> + +%PARAM mydestination $myhostname, localhost.$mydomain, localhost + +<p> The list of domains that are delivered via the $local_transport +mail delivery transport. By default this is the Postfix local(8) +delivery agent which looks up all recipients in /etc/passwd and +/etc/aliases. The SMTP server validates recipient addresses with +$local_recipient_maps and rejects non-existent recipients. See also +the local domain class in the ADDRESS_CLASS_README file. +</p> + +<p> +The default mydestination value specifies names for the local +machine only. On a mail domain gateway, you should also include +$mydomain. +</p> + +<p> +The $local_transport delivery method is also selected for mail +addressed to user@[the.net.work.address] of the mail system (the +IP addresses specified with the inet_interfaces and proxy_interfaces +parameters). +</p> + +<p> +Warnings: +</p> + +<ul> + +<li><p>Do not specify the names of virtual domains - those domains +are specified elsewhere. See VIRTUAL_README for more information. </p> + +<li><p>Do not specify the names of domains that this machine is +backup MX host for. See STANDARD_CONFIGURATION_README for how to +set up backup MX hosts. </p> + +<li><p>By default, the Postfix SMTP server rejects mail for recipients +not listed with the local_recipient_maps parameter. See the +postconf(5) manual for a description of the local_recipient_maps +and unknown_local_recipient_reject_code parameters. </p> + +</ul> + +<p> +Specify a list of host or domain names, "/file/name" or "type:table" +patterns, separated by commas and/or whitespace. A "/file/name" +pattern is replaced by its contents; a "type:table" lookup table +is matched when a name matches a lookup key (the lookup result is +ignored). Continue long lines by starting the next line with +whitespace. </p> + +<p> +Examples: +</p> + +<pre> +mydestination = $myhostname, localhost.$mydomain $mydomain +mydestination = $myhostname, localhost.$mydomain www.$mydomain, ftp.$mydomain +</pre> + +%PARAM mydomain see "postconf -d" output + +<p> +The internet domain name of this mail system. The default is to +use $myhostname minus the first component, or "localdomain" (Postfix +2.3 and later). $mydomain is used as +a default value for many other configuration parameters. +</p> + +<p> +Example: +</p> + +<pre> +mydomain = domain.tld +</pre> + +%PARAM myhostname see "postconf -d" output + +<p> +The internet hostname of this mail system. The default is to use +the fully-qualified domain name (FQDN) from gethostname(), or to +use the non-FQDN result from gethostname() and append ".$mydomain". +$myhostname is used as a default value for many other configuration +parameters. </p> + +<p> +Example: +</p> + +<pre> +myhostname = host.example.com +</pre> + +%PARAM mynetworks see "postconf -d" output + +<p> +The list of "trusted" remote SMTP clients that have more privileges than +"strangers". +</p> + +<p> +In particular, "trusted" SMTP clients are allowed to relay mail +through Postfix. See the smtpd_relay_restrictions parameter +description in the postconf(5) manual. +</p> + +<p> +You can specify the list of "trusted" network addresses by hand +or you can let Postfix do it for you (which is the default). +See the description of the mynetworks_style parameter for more +information. +</p> + +<p> +If you specify the mynetworks list by hand, +Postfix ignores the mynetworks_style setting. +</p> + +<p> Specify a list of network addresses or network/netmask patterns, +separated by commas and/or whitespace. Continue long lines by +starting the next line with whitespace. </p> + +<p> The netmask specifies the number of bits in the network part +of a host address. You can also specify "/file/name" or "type:table" +patterns. A "/file/name" pattern is replaced by its contents; a +"type:table" lookup table is matched when a table entry matches a +lookup string (the lookup result is ignored). </p> + +<p> The list is matched left to right, and the search stops on the +first match. Specify "!pattern" to exclude an address or network +block from the list. The form "!/file/name" is supported only +in Postfix version 2.4 and later. </p> + +<p> Note 1: Pattern matching of domain names is controlled by the +presence or absence of "mynetworks" in the parent_domain_matches_subdomains +parameter value. </p> + +<p> Note 2: IP version 6 address information must be specified inside +<tt>[]</tt> in the mynetworks value, and in files specified with +"/file/name". IP version 6 addresses contain the ":" character, +and would otherwise be confused with a "type:table" pattern. </p> + +<p> Note 3: CIDR ranges cannot be specified in hash tables. Use cidr +tables if CIDR ranges are used. </p> + +<p> Examples: </p> + +<pre> +mynetworks = 127.0.0.0/8 168.100.189.0/28 +mynetworks = !192.168.0.1, 192.168.0.0/28 +mynetworks = 127.0.0.0/8 168.100.189.0/28 [::1]/128 [2001:240:587::]/64 +mynetworks = $config_directory/mynetworks +mynetworks = hash:/etc/postfix/network_table +mynetworks = cidr:/etc/postfix/network_table.cidr +</pre> + +%PARAM myorigin $myhostname + +<p> +The domain name that locally-posted mail appears to come +from, and that locally posted mail is delivered to. The default, +$myhostname, is adequate for small sites. If you run a domain with +multiple machines, you should (1) change this to $mydomain and (2) +set up a domain-wide alias database that aliases each user to +user@that.users.mailhost. +</p> + +<p> +Example: +</p> + +<pre> +myorigin = $mydomain +</pre> + +%PARAM notify_classes resource, software + +<p> +The list of error classes that are reported to the postmaster. These +postmaster notifications do not replace user notifications. The +default is to report only the most serious problems. The paranoid +may wish to turn on the policy (UCE and mail relaying) and protocol +error (broken mail software) reports. +</p> + +<p> NOTE: postmaster notifications may contain confidential information +such as SASL passwords or message content. It is the system +administrator's responsibility to treat such information with care. +</p> + +<p> +The error classes are: +</p> + +<dl> + +<dt><b>bounce</b> (also implies <b>2bounce</b>)</dt> + +<dd>Send the postmaster copies of the headers of bounced mail, and +send transcripts of SMTP sessions when Postfix rejects mail. The +notification is sent to the address specified with the +bounce_notice_recipient configuration parameter (default: postmaster). +</dd> + +<dt><b>2bounce</b></dt> + +<dd>Send undeliverable bounced mail to the postmaster. The notification +is sent to the address specified with the 2bounce_notice_recipient +configuration parameter (default: postmaster). </dd> + +<dt><b>data</b></dt> + +<dd>Send the postmaster a transcript of the SMTP session with an +error because a critical data file was unavailable. The notification +is sent to the address specified with the error_notice_recipient +configuration parameter (default: postmaster). <br> This feature +is available in Postfix 2.9 and later. </dd> + +<dt><b>delay</b></dt> + +<dd>Send the postmaster copies of the headers of delayed mail (see +delay_warning_time). The +notification is sent to the address specified with the +delay_notice_recipient configuration parameter (default: postmaster). +</dd> + +<dt><b>policy</b></dt> + +<dd>Send the postmaster a transcript of the SMTP session when a +client request was rejected because of (UCE) policy. The notification +is sent to the address specified with the error_notice_recipient +configuration parameter (default: postmaster). </dd> + +<dt><b>protocol</b></dt> + +<dd>Send the postmaster a transcript of the SMTP session in case +of client or server protocol errors. The notification is sent to +the address specified with the error_notice_recipient configuration +parameter (default: postmaster). </dd> + +<dt><b>resource</b></dt> + +<dd>Inform the postmaster of mail not delivered due to resource +problems. The notification is sent to the address specified with +the error_notice_recipient configuration parameter (default: +postmaster). </dd> + +<dt><b>software</b></dt> + +<dd>Inform the postmaster of mail not delivered due to software +problems. The notification is sent to the address specified with +the error_notice_recipient configuration parameter (default: +postmaster). </dd> + +</dl> + +<p> +Examples: +</p> + +<pre> +notify_classes = bounce, delay, policy, protocol, resource, software +notify_classes = 2bounce, resource, software +</pre> + +%PARAM parent_domain_matches_subdomains see "postconf -d" output + +<p> +A list of Postfix features where the pattern "example.com" also +matches subdomains of example.com, +instead of requiring an explicit ".example.com" pattern. This is +planned backwards compatibility: eventually, all Postfix features +are expected to require explicit ".example.com" style patterns when +you really want to match subdomains. +</p> + +<p> The following Postfix feature names are supported. </p> + +<dl> + +<dt> Postfix version 1.0 and later</dt> + +<dd> +debug_peer_list, +fast_flush_domains, +mynetworks, +permit_mx_backup_networks, +relay_domains, +transport_maps +</dd> + +<dt> Postfix version 1.1 and later</dt> + +<dd> +qmqpd_authorized_clients, +<a href="SMTPD_ACCESS_README.html">smtpd_access_maps</a>, +</dd> + +<dt> Postfix version 2.8 and later </dt> + +<dd> +postscreen_access_list +</dd> + +<dt> Postfix version 3.0 and later </dt> + +<dd> +smtpd_client_event_limit_exceptions +</dd> + +</dl> + +%PARAM propagate_unmatched_extensions canonical, virtual + +<p> +What address lookup tables copy an address extension from the lookup +key to the lookup result. +</p> + +<p> +For example, with a virtual(5) mapping of "<i>joe@example.com => +joe.user@example.net</i>", the address "<i>joe+foo@example.com</i>" +would rewrite to "<i>joe.user+foo@example.net</i>". +</p> + +<p> +Specify zero or more of <b>canonical</b>, <b>virtual</b>, <b>alias</b>, +<b>forward</b>, <b>include</b> or <b>generic</b>. These cause +address extension +propagation with canonical(5), virtual(5), and aliases(5) maps, +with local(8) .forward and :include: file lookups, and with smtp(8) +generic maps, respectively. </p> + +<p> +Note: enabling this feature for types other than <b>canonical</b> +and <b>virtual</b> is likely to cause problems when mail is forwarded +to other sites, especially with mail that is sent to a mailing list +exploder address. +</p> + +<p> +Examples: +</p> + +<pre> +propagate_unmatched_extensions = canonical, virtual, alias, + forward, include +propagate_unmatched_extensions = canonical, virtual +</pre> + +%PARAM proxy_interfaces + +<p> +The network interface addresses that this mail system receives mail +on by way of a proxy or network address translation unit. +</p> + +<p> +This feature is available in Postfix 2.0 and later. +</p> + +<p> You must specify your "outside" proxy/NAT addresses when your +system is a backup MX host for other domains, otherwise mail delivery +loops will happen when the primary MX host is down. </p> + +<p> +Example: +</p> + +<pre> +proxy_interfaces = 1.2.3.4 +</pre> + +%PARAM qmgr_message_active_limit 20000 + +<p> +The maximal number of messages in the active queue. +</p> + +%PARAM qmgr_message_recipient_limit 20000 + +<p> The maximal number of recipients held in memory by the Postfix +queue manager, and the maximal size of the short-term, +in-memory "dead" destination status cache. </p> + +%PARAM qmgr_message_recipient_minimum 10 + +<p> +The minimal number of in-memory recipients for any message. This +takes priority over any other in-memory recipient limits (i.e., +the global qmgr_message_recipient_limit and the per transport +_recipient_limit) if necessary. The minimum value allowed for this +parameter is 1. +</p> + +%PARAM qmqpd_authorized_clients + +<p> +What remote QMQP clients are allowed to connect to the Postfix QMQP +server port. +</p> + +<p> +By default, no client is allowed to use the service. This is +because the QMQP server will relay mail to any destination. +</p> + +<p> +Specify a list of client patterns. A list pattern specifies a host +name, a domain name, an internet address, or a network/mask pattern, +where the mask specifies the number of bits in the network part. +When a pattern specifies a file name, its contents are substituted +for the file name; when a pattern is a "type:table" table specification, +table lookup is used instead. </p> + +<p> +Patterns are separated by whitespace and/or commas. In order to +reverse the result, precede a pattern with an +exclamation point (!). The form "!/file/name" is supported only +in Postfix version 2.4 and later. +</p> + +<p> Pattern matching of domain names is controlled by the presence +or absence of "qmqpd_authorized_clients" in the +parent_domain_matches_subdomains parameter value. </p> + +<p> +Example: +</p> + +<pre> +qmqpd_authorized_clients = !192.168.0.1, 192.168.0.0/24 +</pre> + +%PARAM qmqpd_error_delay 1s + +<p> +How long the Postfix QMQP server will pause before sending a negative +reply to the remote QMQP client. The purpose is to slow down confused +or malicious clients. +</p> + +<p> Specify a non-negative time value (an integral value plus an optional +one-letter suffix that specifies the time unit). Time units: s +(seconds), m (minutes), h (hours), d (days), w (weeks). +The default time unit is s (seconds). </p> + +%PARAM qmqpd_timeout 300s + +<p> +The time limit for sending or receiving information over the network. +If a read or write operation blocks for more than $qmqpd_timeout +seconds the Postfix QMQP server gives up and disconnects. +</p> + +<p> Specify a non-zero time value (an integral value plus an optional +one-letter suffix that specifies the time unit). Time units: s +(seconds), m (minutes), h (hours), d (days), w (weeks). +The default time unit is s (seconds). </p> + +%PARAM queue_minfree 0 + +<p> +The minimal amount of free space in bytes in the queue file system +that is needed to receive mail. This is currently used by the +Postfix SMTP server to decide if it will accept any mail at all. +</p> + +<p> +By default, the Postfix SMTP server rejects MAIL FROM commands when +the amount of free space is less than 1.5*$message_size_limit +(Postfix version 2.1 and later). +To specify a higher minimum free space limit, specify a queue_minfree +value that is at least 1.5*$message_size_limit. +</p> + +<p> +With Postfix versions 2.0 and earlier, a queue_minfree value of +zero means there is no minimum required amount of free space. +</p> + +%PARAM queue_run_delay 300s + +<p> +The time between deferred queue scans by the queue manager; +prior to Postfix 2.4 the default value was 1000s. +</p> + +<p> This parameter should be set less than or equal to +$minimal_backoff_time. See also $maximal_backoff_time. </p> + +<p> Specify a non-zero time value (an integral value plus an optional +one-letter suffix that specifies the time unit). Time units: s +(seconds), m (minutes), h (hours), d (days), w (weeks). +The default time unit is s (seconds). </p> + +%PARAM rbl_reply_maps + +<p> +Optional lookup tables with RBL response templates. The tables are +indexed by the RBL domain name. By default, Postfix uses the default +template as specified with the default_rbl_reply configuration +parameter. See there for a discussion of the syntax of RBL reply +templates. +</p> + +<p> +This feature is available in Postfix 2.0 and later. +</p> + +%PARAM receive_override_options + +<p> Enable or disable recipient validation, built-in content +filtering, or address mapping. Typically, these are specified in +master.cf as command-line arguments for the smtpd(8), qmqpd(8) or +pickup(8) daemons. </p> + +<p> Specify zero or more of the following options. The options +override main.cf settings and are either implemented by smtpd(8), +qmqpd(8), or pickup(8) themselves, or they are forwarded to the +cleanup server. </p> + +<dl> + +<dt><b><a name="no_unknown_recipient_checks">no_unknown_recipient_checks</a></b></dt> + +<dd>Do not try to reject unknown recipients (SMTP server only). +This is typically specified AFTER an external content filter. +</dd> + +<dt><b><a name="no_address_mappings">no_address_mappings</a></b></dt> + +<dd>Disable canonical address mapping, virtual alias map expansion, +address masquerading, and automatic BCC (blind carbon-copy) +recipients. This is typically specified BEFORE an external content +filter. </dd> + +<dt><b><a name="no_header_body_checks">no_header_body_checks</a></b></dt> + +<dd>Disable header/body_checks. This is typically specified AFTER +an external content filter. </dd> + +<dt><b><a name="no_milters">no_milters</a></b></dt> + +<dd>Disable Milter (mail filter) applications. This is typically +specified AFTER an external content filter. </dd> + +</dl> + +<p> +Note: when the "BEFORE content filter" receive_override_options +setting is specified in the main.cf file, specify the "AFTER content +filter" receive_override_options setting in master.cf (and vice +versa). +</p> + +<p> +Examples: +</p> + +<pre> +receive_override_options = + no_unknown_recipient_checks, no_header_body_checks +receive_override_options = no_address_mappings +</pre> + +<p> +This feature is available in Postfix 2.1 and later. +</p> + +%PARAM recipient_bcc_maps + +<p> +Optional BCC (blind carbon-copy) address lookup tables, indexed by +recipient address. The BCC address (multiple results are not +supported) is added when mail enters from outside of Postfix. +</p> + +<p> +Specify zero or more "type:name" lookup tables, separated by +whitespace or comma. Tables will be searched in the specified order +until a match is found. +</p> + +<p> +The table search order is as follows: +</p> + +<ul> + +<li> Look up the "user+extension@domain.tld" address including the +optional address extension. + +<li> Look up the "user@domain.tld" address without the optional +address extension. + +<li> Look up the "user+extension" address local part when the +recipient domain equals $myorigin, $mydestination, $inet_interfaces +or $proxy_interfaces. + +<li> Look up the "user" address local part when the recipient domain +equals $myorigin, $mydestination, $inet_interfaces or $proxy_interfaces. + +<li> Look up the "@domain.tld" part. + +</ul> + +<p> +Note: with Postfix 2.3 and later the BCC address is added as if it +was specified with NOTIFY=NONE. The sender will not be notified +when the BCC address is undeliverable, as long as all down-stream +software implements RFC 3461. +</p> + +<p> +Note: with Postfix 2.2 and earlier the sender will unconditionally +be notified when the BCC address is undeliverable. +</p> + +<p> Note: automatic BCC recipients are produced only for new mail. +To avoid mailer loops, automatic BCC recipients are not generated +after Postfix forwards mail internally, or after Postfix generates +mail itself. </p> + +<p> +Example: +</p> + +<pre> +recipient_bcc_maps = hash:/etc/postfix/recipient_bcc +</pre> + +<p> +After a change, run "<b>postmap /etc/postfix/recipient_bcc</b>". +</p> + +<p> +This feature is available in Postfix 2.1 and later. +</p> + +%PARAM recipient_canonical_maps + +<p> +Optional address mapping lookup tables for envelope and header +recipient addresses. +The table format and lookups are documented in canonical(5). +</p> + +<p> +Note: $recipient_canonical_maps is processed before $canonical_maps. +</p> + +<p> +Example: +</p> + +<pre> +recipient_canonical_maps = hash:/etc/postfix/recipient_canonical +</pre> + +%PARAM recipient_delimiter + +<p> The set of characters that can separate an email address +localpart, user name, or a .forward file name from its extension. +For example, with "recipient_delimiter = +", the software tries +user+foo@example.com before trying user@example.com, user+foo before +trying user, and .forward+foo before trying .forward. </p> + +<p> More formally, an email address localpart or user name is +separated from its extension by the first character that matches +the recipient_delimiter set. The delimiter character and extension +may then be used to generate an extended .forward file name. This +implementation recognizes one delimiter character and one extension +per email address localpart or email address. With Postfix 2.10 and +earlier, the recipient_delimiter specifies a single character. </p> + +<p> See canonical(5), local(8), relocated(5) and virtual(5) for the +effects of recipient_delimiter on lookups in aliases, canonical, +virtual, and relocated maps, and see the propagate_unmatched_extensions +parameter for propagating an extension from one email address to +another. </p> + +<p> When used in command_execution_directory, forward_path, or +luser_relay, ${recipient_delimiter} is replaced with the actual +recipient delimiter that was found in the recipient email address +(Postfix 2.11 and later), or it is replaced with the main.cf +recipient_delimiter parameter value (Postfix 2.10 and earlier). +</p> + +<p> The recipient_delimiter is not applied to the mailer-daemon +address, the postmaster address, or the double-bounce address. With +the default "owner_request_special = yes" setting, the recipient_delimiter +is also not applied to addresses with the special "owner-" prefix +or the special "-request" suffix. </p> + +<p> +Examples: +</p> + +<pre> +# Handle Postfix-style extensions. +recipient_delimiter = + +</pre> + +<pre> +# Handle both Postfix and qmail extensions (Postfix 2.11 and later). +recipient_delimiter = +- +</pre> + +<pre> +# Use .forward for mail without address extension, and for mail with +# an unrecognized address extension. +forward_path = $home/.forward${recipient_delimiter}${extension}, + $home/.forward +</pre> + +%PARAM reject_code 554 + +<p> +The numerical Postfix SMTP server response code when a remote SMTP +client request is rejected by the "reject" restriction. +</p> + +<p> +Do not change this unless you have a complete understanding of RFC 5321. +</p> + +%PARAM relay_domains Postfix ≥ 3.0: empty, Postfix < 3.0: $mydestination + +<p> What destination domains (and subdomains thereof) this system +will relay mail to. For details about how +the relay_domains value is used, see the description of the +permit_auth_destination and reject_unauth_destination SMTP recipient +restrictions. </p> + +<p> Domains that match $relay_domains are delivered with the +$relay_transport mail delivery transport. The SMTP server validates +recipient addresses with $relay_recipient_maps and rejects non-existent +recipients. See also the relay domains address class in the +ADDRESS_CLASS_README file. </p> + +<p> Note: Postfix will not automatically forward mail for domains +that list this system as their primary or backup MX host. See the +permit_mx_backup restriction in the postconf(5) manual page. </p> + +<p> Specify a list of host or domain names, "/file/name" patterns +or "type:table" lookup tables, separated by commas and/or whitespace. +Continue long lines by starting the next line with whitespace. A +"/file/name" pattern is replaced by its contents; a "type:table" +lookup table is matched when a (parent) domain appears as lookup +key. Specify "!pattern" to exclude a domain from the list. The form +"!/file/name" is supported only in Postfix version 2.4 and later. +</p> + +<p> Pattern matching of domain names is controlled by the presence +or absence of "relay_domains" in the parent_domain_matches_subdomains +parameter value. </p> + +%PARAM relay_domains_reject_code 554 + +<p> +The numerical Postfix SMTP server response code when a client +request is rejected by the reject_unauth_destination recipient +restriction. +</p> + +<p> +Do not change this unless you have a complete understanding of RFC 5321. +</p> + +%PARAM relay_recipient_maps + +<p> Optional lookup tables with all valid addresses in the domains +that match $relay_domains. Specify @domain as a wild-card for +domains that have no valid recipient list, and become a source of +backscatter mail: Postfix accepts spam for non-existent recipients +and then floods innocent people with undeliverable mail. Technically, +tables +listed with $relay_recipient_maps are used as lists: Postfix needs +to know only if a lookup string is found or not, but it does not +use the result from the table lookup. </p> + +<p> +Specify zero or more "type:name" lookup tables, separated by +whitespace or comma. Tables will be searched in the specified order +until a match is found. +</p> + +<p> +If this parameter is non-empty, then the Postfix SMTP server will reject +mail to unknown relay users. This feature is off by default. +</p> + +<p> +See also the relay domains address class in the ADDRESS_CLASS_README +file. +</p> + +<p> +Example: +</p> + +<pre> +relay_recipient_maps = hash:/etc/postfix/relay_recipients +</pre> + +<p> +This feature is available in Postfix 2.0 and later. +</p> + +%PARAM relayhost + +<p> +The next-hop destination(s) for non-local mail; overrides non-local +domains in recipient addresses. This information is overruled with +relay_transport, sender_dependent_default_transport_maps, +default_transport, sender_dependent_relayhost_maps +and with the transport(5) table. +</p> + +<p> +On an intranet, specify the organizational domain name. If your +internal DNS uses no MX records, specify the name of the intranet +gateway host instead. +</p> + +<p> +In the case of SMTP or LMTP delivery, specify one or more destinations +in the form of a domain name, hostname, hostname:port, [hostname]:port, +[hostaddress] or [hostaddress]:port, separated by comma or whitespace. +The form [hostname] turns off MX lookups. Multiple destinations are +supported in Postfix 3.5 and later. +</p> + +<p> +If you're connected via UUCP, see the UUCP_README file for useful +information. +</p> + +<p> +Examples: +</p> + +<pre> +relayhost = $mydomain +relayhost = [gateway.example.com] +relayhost = mail1.example:587, mail2.example:587 +relayhost = [an.ip.add.ress] +</pre> + +%PARAM relocated_maps + +<p> +Optional lookup tables with new contact information for users or +domains that no longer exist. The table format and lookups are +documented in relocated(5). +</p> + +<p> +Specify zero or more "type:name" lookup tables, separated by +whitespace or comma. Tables will be searched in the specified order +until a match is found. +</p> + +<p> +If you use this feature, run "<b>postmap /etc/postfix/relocated</b>" to +build the necessary DBM or DB file after change, then "<b>postfix +reload</b>" to make the changes visible. +</p> + +<p> +Examples: +</p> + +<pre> +relocated_maps = dbm:/etc/postfix/relocated +relocated_maps = hash:/etc/postfix/relocated +</pre> + +%PARAM require_home_directory no + +<p> +Require that a local(8) recipient's home directory exists +before mail delivery is attempted. By default this test is disabled. +It can be useful for environments that import home directories to +the mail server (IMPORTING HOME DIRECTORIES IS NOT RECOMMENDED). +</p> + +%PARAM resolve_dequoted_address yes + +<p> Resolve a recipient address safely instead of correctly, by +looking inside quotes. </p> + +<p> By default, the Postfix address resolver does not quote the +address localpart as per RFC 822, so that additional @ or % or ! +operators remain visible. This behavior is safe but it is also +technically incorrect. </p> + +<p> If you specify "resolve_dequoted_address = no", then +the Postfix +resolver will not know about additional @ etc. operators in the +address localpart. This opens opportunities for obscure mail relay +attacks with user@domain@domain addresses when Postfix provides +backup MX service for Sendmail systems. </p> + +%PARAM resolve_null_domain no + +<p> Resolve an address that ends in the "@" null domain as if the +local hostname were specified, instead of rejecting the address as +invalid. </p> + +<p> This feature is available in Postfix 2.1 and later. +Earlier versions always resolve the null domain as the local +hostname. </p> + +<p> The Postfix SMTP server uses this feature to reject mail from +or to addresses that end in the "@" null domain, and from addresses +that rewrite into a form that ends in the "@" null domain. </p> + +%PARAM sender_bcc_maps + +<p> Optional BCC (blind carbon-copy) address lookup tables, indexed +by sender address. The BCC address (multiple results are not +supported) is added when mail enters from outside of Postfix. </p> + +<p> +Specify zero or more "type:name" lookup tables, separated by +whitespace or comma. Tables will be searched in the specified order +until a match is found. +</p> + +<p> +The table search order is as follows: +</p> + +<ul> + +<li> Look up the "user+extension@domain.tld" address including the +optional address extension. + +<li> Look up the "user@domain.tld" address without the optional +address extension. + +<li> Look up the "user+extension" address local part when the +sender domain equals $myorigin, $mydestination, $inet_interfaces +or $proxy_interfaces. + +<li> Look up the "user" address local part when the sender domain +equals $myorigin, $mydestination, $inet_interfaces or $proxy_interfaces. + +<li> Look up the "@domain.tld" part. + +</ul> + +<p> +Note: with Postfix 2.3 and later the BCC address is added as if it +was specified with NOTIFY=NONE. The sender will not be notified +when the BCC address is undeliverable, as long as all down-stream +software implements RFC 3461. +</p> + +<p> +Note: with Postfix 2.2 and earlier the sender will be notified +when the BCC address is undeliverable. +</p> + +<p> Note: automatic BCC recipients are produced only for new mail. +To avoid mailer loops, automatic BCC recipients are not generated +after Postfix forwards mail internally, or after Postfix generates +mail itself. </p> + +<p> +Example: +</p> + +<pre> +sender_bcc_maps = hash:/etc/postfix/sender_bcc +</pre> + +<p> +After a change, run "<b>postmap /etc/postfix/sender_bcc</b>". +</p> + +<p> +This feature is available in Postfix 2.1 and later. +</p> + +%PARAM sender_canonical_maps + +<p> +Optional address mapping lookup tables for envelope and header +sender addresses. +The table format and lookups are documented in canonical(5). +</p> + +<p> +Example: you want to rewrite the SENDER address "user@ugly.domain" +to "user@pretty.domain", while still being able to send mail to +the RECIPIENT address "user@ugly.domain". +</p> + +<p> +Note: $sender_canonical_maps is processed before $canonical_maps. +</p> + +<p> +Example: +</p> + +<pre> +sender_canonical_maps = hash:/etc/postfix/sender_canonical +</pre> + +%PARAM smtp_always_send_ehlo yes + +<p> +Always send EHLO at the start of an SMTP session. +</p> + +<p> +With "smtp_always_send_ehlo = no", the Postfix SMTP client sends +EHLO only when +the word "ESMTP" appears in the server greeting banner (example: +220 spike.porcupine.org ESMTP Postfix). +</p> + +%PARAM smtp_bind_address + +<p> +An optional numerical network address that the Postfix SMTP client +should bind to when making an IPv4 connection. +</p> + +<p> +This can be specified in the main.cf file for all SMTP clients, or +it can be specified in the master.cf file for a specific client, +for example: +</p> + +<blockquote> +<pre> +/etc/postfix/master.cf: + smtp ... smtp -o smtp_bind_address=11.22.33.44 +</pre> +</blockquote> + +<p> See smtp_bind_address_enforce for how Postfix should handle +errors (Postfix 3.7 and later). </p> + +<p> Note 1: when inet_interfaces specifies no more than one IPv4 +address, and that address is a non-loopback address, it is +automatically used as the smtp_bind_address. This supports virtual +IP hosting, but can be a problem on multi-homed firewalls. See the +inet_interfaces documentation for more detail. </p> + +<p> Note 2: address information may be enclosed inside <tt>[]</tt>, +but this form is not required here. </p> + +%PARAM smtp_bind_address6 + +<p> +An optional numerical network address that the Postfix SMTP client +should bind to when making an IPv6 connection. +</p> + +<p> This feature is available in Postfix 2.2 and later. </p> + +<p> +This can be specified in the main.cf file for all SMTP clients, or +it can be specified in the master.cf file for a specific client, +for example: +</p> + +<blockquote> +<pre> +/etc/postfix/master.cf: + smtp ... smtp -o smtp_bind_address6=1:2:3:4:5:6:7:8 +</pre> +</blockquote> + +<p> See smtp_bind_address_enforce for how Postfix should handle +errors (Postfix 3.7 and later). </p> + +<p> Note 1: when inet_interfaces specifies no more than one IPv6 +address, and that address is a non-loopback address, it is +automatically used as the smtp_bind_address6. This supports virtual +IP hosting, but can be a problem on multi-homed firewalls. See the +inet_interfaces documentation for more detail. </p> + +<p> Note 2: address information may be enclosed inside <tt>[]</tt>, +but this form is not recommended here. </p> + +%PARAM smtp_connection_cache_time_limit 2s + +<p> When SMTP connection caching is enabled, the amount of time that +an unused SMTP client socket is kept open before it is closed. Do +not specify larger values without permission from the remote sites. +</p> + +<p> This feature is available in Postfix 2.2 and later. </p> + +%PARAM smtp_connection_reuse_time_limit 300s + +<p> The amount of time during which Postfix will use an SMTP +connection repeatedly. The timer starts when the connection is +initiated (i.e. it includes the connect, greeting and helo latency, +in addition to the latencies of subsequent mail delivery transactions). +</p> + +<p> This feature addresses a performance stability problem with +remote SMTP servers. This problem is not specific to Postfix: it +can happen when any MTA sends large amounts of SMTP email to a site +that has multiple MX hosts. </p> + +<p> The problem starts when one of a set of MX hosts becomes slower +than the rest. Even though SMTP clients connect to fast and slow +MX hosts with equal probability, the slow MX host ends up with more +simultaneous inbound connections than the faster MX hosts, because +the slow MX host needs more time to serve each client request. </p> + +<p> The slow MX host becomes a connection attractor. If one MX +host becomes N times slower than the rest, it dominates mail delivery +latency unless there are more than N fast MX hosts to counter the +effect. And if the number of MX hosts is smaller than N, the mail +delivery latency becomes effectively that of the slowest MX host +divided by the total number of MX hosts. </p> + +<p> The solution uses connection caching in a way that differs from +Postfix version 2.2. By limiting the amount of time during which a connection +can be used repeatedly (instead of limiting the number of deliveries +over that connection), Postfix not only restores fairness in the +distribution of simultaneous connections across a set of MX hosts, +it also favors deliveries over connections that perform well, which +is exactly what we want. </p> + +<p> The default reuse time limit, 300s, is comparable to the various +smtp transaction timeouts which are fair estimates of maximum excess +latency for a slow delivery. Note that hosts may accept thousands +of messages over a single connection within the default connection +reuse time limit. This number is much larger than the default Postfix +version 2.2 limit of 10 messages per cached connection. It may prove necessary +to lower the limit to avoid interoperability issues with MTAs that +exhibit bugs when many messages are delivered via a single connection. +A lower reuse time limit risks losing the benefit of connection +reuse when the average connection and mail delivery latency exceeds +the reuse time limit. </p> + +<p> This feature is available in Postfix 2.3 and later. </p> + +%PARAM smtp_connection_cache_destinations + +<p> Permanently enable SMTP connection caching for the specified +destinations. With SMTP connection caching, a connection is not +closed immediately after completion of a mail transaction. Instead, +the connection is kept open for up to $smtp_connection_cache_time_limit +seconds. This allows connections to be reused for other deliveries, +and can improve mail delivery performance. </p> + +<p> Specify a comma or white space separated list of destinations +or pseudo-destinations: </p> + +<ul> + +<li> if mail is sent without a relay host: a domain name (the +right-hand side of an email address, without the [] around a numeric +IP address), + +<li> if mail is sent via a relay host: a relay host name (without +[] or non-default TCP port), as specified in main.cf or in the +transport map, + +<li> if mail is sent via a UNIX-domain socket: a pathname (without +the unix: prefix), + +<li> a /file/name with domain names and/or relay host names as +defined above, + +<li> a "type:table" with domain names and/or relay host names on +the left-hand side. The right-hand side result from "type:table" +lookups is ignored. + +</ul> + +<p> This feature is available in Postfix 2.2 and later. </p> + +%PARAM smtp_connection_cache_on_demand yes + +<p> Temporarily enable SMTP connection caching while a destination +has a high volume of mail in the active queue. With SMTP connection +caching, a connection is not closed immediately after completion +of a mail transaction. Instead, the connection is kept open for +up to $smtp_connection_cache_time_limit seconds. This allows +connections to be reused for other deliveries, and can improve mail +delivery performance. </p> + +<p> This feature is available in Postfix 2.2 and later. </p> + +%PARAM smtp_connect_timeout 30s + +<p> +The Postfix SMTP client time limit for completing a TCP connection, or +zero (use the operating system built-in time limit). +</p> + +<p> +When no connection can be made within the deadline, the Postfix +SMTP client +tries the next address on the mail exchanger list. Specify 0 to +disable the time limit (i.e. use whatever timeout is implemented by +the operating system). +</p> + +<p> Specify a non-negative time value (an integral value plus an optional +one-letter suffix that specifies the time unit). Time units: s +(seconds), m (minutes), h (hours), d (days), w (weeks). +The default time unit is s (seconds). </p> + +%PARAM smtp_data_done_timeout 600s + +<p> +The Postfix SMTP client time limit for sending the SMTP ".", and +for receiving the remote SMTP server response. +</p> + +<p> +When no response is received within the deadline, a warning is +logged that the mail may be delivered multiple times. +</p> + +<p> Specify a non-zero time value (an integral value plus an optional +one-letter suffix that specifies the time unit). Time units: s +(seconds), m (minutes), h (hours), d (days), w (weeks). +The default time unit is s (seconds). </p> + +%PARAM smtp_data_init_timeout 120s + +<p> +The Postfix SMTP client time limit for sending the SMTP DATA command, +and for receiving the remote SMTP server response. +</p> + +<p> +Time units: s (seconds), m (minutes), h (hours), d (days), w (weeks). +The default time unit is s (seconds). +</p> + +%PARAM smtp_data_xfer_timeout 180s + +<p> +The Postfix SMTP client time limit for sending the SMTP message content. +When the connection makes no progress for more than $smtp_data_xfer_timeout +seconds the Postfix SMTP client terminates the transfer. +</p> + +<p> +Time units: s (seconds), m (minutes), h (hours), d (days), w (weeks). +The default time unit is s (seconds). +</p> + +%PARAM smtp_defer_if_no_mx_address_found no + +<p> +Defer mail delivery when no MX record resolves to an IP address. +</p> + +<p> +The default (no) is to return the mail as undeliverable. With older +Postfix versions the default was to keep trying to deliver the mail +until someone fixed the MX record or until the mail was too old. +</p> + +<p> +Note: the Postfix SMTP client always ignores MX records with equal +or worse preference +than the local MTA itself. +</p> + +<p> +This feature is available in Postfix 2.1 and later. +</p> + +%PARAM lmtp_destination_concurrency_limit $default_destination_concurrency_limit + +<p> The maximal number of parallel deliveries to the same destination +via the lmtp message delivery transport. This limit is enforced by +the queue manager. The message delivery transport name is the first +field in the entry in the master.cf file. </p> + +%PARAM lmtp_destination_recipient_limit $default_destination_recipient_limit + +<p> The maximal number of recipients per message for the lmtp +message delivery transport. This limit is enforced by the queue +manager. The message delivery transport name is the first field in +the entry in the master.cf file. </p> + +<p> Setting this parameter to a value of 1 changes the meaning of +lmtp_destination_concurrency_limit from concurrency per domain into +concurrency per recipient. </p> + +%PARAM relay_destination_concurrency_limit $default_destination_concurrency_limit + +<p> The maximal number of parallel deliveries to the same destination +via the relay message delivery transport. This limit is enforced +by the queue manager. The message delivery transport name is the +first field in the entry in the master.cf file. </p> + +<p> This feature is available in Postfix 2.0 and later. </p> + +%PARAM relay_destination_recipient_limit $default_destination_recipient_limit + +<p> The maximal number of recipients per message for the relay +message delivery transport. This limit is enforced by the queue +manager. The message delivery transport name is the first field in +the entry in the master.cf file. </p> + +<p> Setting this parameter to a value of 1 changes the meaning of +relay_destination_concurrency_limit from concurrency per domain +into concurrency per recipient. </p> + +<p> This feature is available in Postfix 2.0 and later. </p> + +%PARAM smtp_destination_concurrency_limit $default_destination_concurrency_limit + +<p> The maximal number of parallel deliveries to the same destination +via the smtp message delivery transport. This limit is enforced by +the queue manager. The message delivery transport name is the first +field in the entry in the master.cf file. </p> + +%PARAM smtp_destination_recipient_limit $default_destination_recipient_limit + +<p> The maximal number of recipients per message for the smtp +message delivery transport. This limit is enforced by the queue +manager. The message delivery transport name is the first field in +the entry in the master.cf file. </p> + +<p> Setting this parameter to a value of 1 changes the meaning of +smtp_destination_concurrency_limit from concurrency per domain +into concurrency per recipient. </p> + +%PARAM virtual_destination_concurrency_limit $default_destination_concurrency_limit + +<p> The maximal number of parallel deliveries to the same destination +via the virtual message delivery transport. This limit is enforced +by the queue manager. The message delivery transport name is the +first field in the entry in the master.cf file. </p> + +%PARAM virtual_destination_recipient_limit $default_destination_recipient_limit + +<p> The maximal number of recipients per message for the virtual +message delivery transport. This limit is enforced by the queue +manager. The message delivery transport name is the first field in +the entry in the master.cf file. </p> + +<p> Setting this parameter to a value of 1 changes the meaning of +virtual_destination_concurrency_limit from concurrency per domain +into concurrency per recipient. </p> + +%PARAM smtp_helo_name $myhostname + +<p> +The hostname to send in the SMTP HELO or EHLO command. +</p> + +<p> +The default value is the machine hostname. Specify a hostname or +[ip.add.re.ss]. +</p> + +<p> +This information can be specified in the main.cf file for all SMTP +clients, or it can be specified in the master.cf file for a specific +client, for example: +</p> + +<blockquote> +<pre> +/etc/postfix/master.cf: + mysmtp ... smtp -o smtp_helo_name=foo.bar.com +</pre> +</blockquote> + +<p> +This feature is available in Postfix 2.0 and later. +</p> + +%PARAM smtp_helo_timeout 300s + +<p> +The Postfix SMTP client time limit for sending the HELO or EHLO command, +and for receiving the initial remote SMTP server response. +</p> + +<p> Specify a non-zero time value (an integral value plus an optional +one-letter suffix that specifies the time unit). Time units: s +(seconds), m (minutes), h (hours), d (days), w (weeks). +The default time unit is s (seconds). </p> + +%PARAM smtp_host_lookup dns + +<p> +What mechanisms the Postfix SMTP client uses to look up a host's +IP address. This parameter is ignored when DNS lookups are disabled +(see: disable_dns_lookups and smtp_dns_support_level). The "dns" +mechanism is always tried before "native" if both are listed. +</p> + +<p> +Specify one of the following: +</p> + +<dl> + +<dt><b>dns</b></dt> + +<dd>Hosts can be found in the DNS (preferred). </dd> + +<dt><b>native</b></dt> + +<dd>Use the native naming service only (nsswitch.conf, or equivalent +mechanism). </dd> + +<dt><b>dns, native</b></dt> + +<dd>Use the native service for hosts not found in the DNS. </dd> + +</dl> + +<p> +This feature is available in Postfix 2.1 and later. +</p> + +%PARAM smtp_line_length_limit 998 + +<p> +The maximal length of message header and body lines that Postfix +will send via SMTP. This limit does not include the <CR><LF> +at the end of each line. Longer lines are broken by inserting +"<CR><LF><SPACE>", to minimize the damage to MIME +formatted mail. Specify zero to disable this limit. +</p> + +<p> +The Postfix limit of 998 characters not including <CR><LF> +is consistent with the SMTP limit of 1000 characters including +<CR><LF>. The Postfix limit was 990 with Postfix 2.8 +and earlier. +</p> + +%PARAM smtp_mail_timeout 300s + +<p> +The Postfix SMTP client time limit for sending the MAIL FROM command, +and for receiving the remote SMTP server response. +</p> + +<p> Specify a non-zero time value (an integral value plus an optional +one-letter suffix that specifies the time unit). Time units: s +(seconds), m (minutes), h (hours), d (days), w (weeks). +The default time unit is s (seconds). </p> + +%PARAM smtp_mx_address_limit 5 + +<p> +The maximal number of MX (mail exchanger) IP addresses that can +result from Postfix SMTP client mail exchanger lookups, or zero (no +limit). Prior to +Postfix version 2.3, this limit was disabled by default. +</p> + +<p> +This feature is available in Postfix 2.1 and later. +</p> + +%PARAM smtp_mx_session_limit 2 + +<p> The maximal number of SMTP sessions per delivery request before +the Postfix SMTP client +gives up or delivers to a fall-back relay host, or zero (no +limit). This restriction ignores sessions that fail to complete the +SMTP initial handshake (Postfix version 2.2 and earlier) or that fail to +complete the EHLO and TLS handshake (Postfix version 2.3 and later). </p> + +<p> This feature is available in Postfix 2.1 and later. </p> + +%PARAM smtp_never_send_ehlo no + +<p> Never send EHLO at the start of an SMTP session. See also the +smtp_always_send_ehlo parameter. </p> + +%PARAM smtp_pix_workaround_threshold_time 500s + +<p> How long a message must be queued before the Postfix SMTP client +turns on the PIX firewall "<CR><LF>.<CR><LF>" +bug workaround for delivery through firewalls with "smtp fixup" +mode turned on. </p> + +<p> Specify a non-negative time value (an integral value plus an optional +one-letter suffix that specifies the time unit). Time units: s +(seconds), m (minutes), h (hours), d (days), w (weeks). +The default time unit is s (seconds). </p> + +<p> +By default, the workaround is turned off for mail that is queued +for less than 500 seconds. In other words, the workaround is normally +turned off for the first delivery attempt. +</p> + +<p> +Specify 0 to enable the PIX firewall +"<CR><LF>.<CR><LF>" bug workaround upon the +first delivery attempt. +</p> + +%PARAM smtp_quit_timeout 300s + +<p> +The Postfix SMTP client time limit for sending the QUIT command, +and for receiving the remote SMTP server response. +</p> + +<p> Specify a non-zero time value (an integral value plus an optional +one-letter suffix that specifies the time unit). Time units: s +(seconds), m (minutes), h (hours), d (days), w (weeks). +The default time unit is s (seconds). </p> + +%PARAM smtp_quote_rfc821_envelope yes + +<p> +Quote addresses in Postfix SMTP client MAIL FROM and RCPT TO commands +as required +by RFC 5321. This includes putting quotes around an address localpart +that ends in ".". +</p> + +<p> +The default is to comply with RFC 5321. If you have to send mail to +a broken SMTP server, configure a special SMTP client in master.cf: +</p> + +<blockquote> +<pre> +/etc/postfix/master.cf: + broken-smtp . . . smtp -o smtp_quote_rfc821_envelope=no +</pre> +</blockquote> + +<p> +and route mail for the destination in question to the "broken-smtp" +message delivery with a transport(5) table. +</p> + +<p> +This feature is available in Postfix 2.1 and later. +</p> + +%PARAM smtp_rcpt_timeout 300s + +<p> +The Postfix SMTP client time limit for sending the SMTP RCPT TO +command, and for receiving the remote SMTP server response. +</p> + +<p> Specify a non-zero time value (an integral value plus an optional +one-letter suffix that specifies the time unit). Time units: s +(seconds), m (minutes), h (hours), d (days), w (weeks). +The default time unit is s (seconds). </p> + +%PARAM smtp_sasl_auth_enable no + +<p> +Enable SASL authentication in the Postfix SMTP client. By default, +the Postfix SMTP client uses no authentication. +</p> + +<p> +Example: +</p> + +<pre> +smtp_sasl_auth_enable = yes +</pre> + +%PARAM smtp_sasl_password_maps + +<p> +Optional Postfix SMTP client lookup tables with one username:password +entry per sender, remote hostname or next-hop domain. Per-sender +lookup is done only when sender-dependent authentication is enabled. +If no username:password entry is found, then the Postfix SMTP client +will not attempt to authenticate to the remote host. +</p> + +<p> +The Postfix SMTP client opens the lookup table before going to +chroot jail, so you can leave the password file in /etc/postfix. +</p> + +<p> +Specify zero or more "type:name" lookup tables, separated by +whitespace or comma. Tables will be searched in the specified order +until a match is found. +</p> + +%PARAM smtp_sasl_security_options noplaintext, noanonymous + +<p> Postfix SMTP client SASL security options; as of Postfix 2.3 +the list of available +features depends on the SASL client implementation that is selected +with <b>smtp_sasl_type</b>. </p> + +<p> The following security features are defined for the <b>cyrus</b> +client SASL implementation: </p> + +<p> +Specify zero or more of the following: +</p> + +<dl> + +<dt><b>noplaintext</b></dt> + +<dd>Disallow methods that use plaintext passwords. </dd> + +<dt><b>noactive</b></dt> + +<dd>Disallow methods subject to active (non-dictionary) attack. +</dd> + +<dt><b>nodictionary</b></dt> + +<dd>Disallow methods subject to passive (dictionary) attack. </dd> + +<dt><b>noanonymous</b></dt> + +<dd>Disallow methods that allow anonymous authentication. </dd> + +<dt><b>mutual_auth</b></dt> + +<dd>Only allow methods that provide mutual authentication (not +available with SASL version 1). </dd> + +</dl> + +<p> +Example: +</p> + +<pre> +smtp_sasl_security_options = noplaintext +</pre> + +%PARAM smtp_sasl_mechanism_filter + +<p> +If non-empty, a Postfix SMTP client filter for the remote SMTP +server's list of offered SASL mechanisms. Different client and +server implementations may support different mechanism lists; by +default, the Postfix SMTP client will use the intersection of the +two. smtp_sasl_mechanism_filter specifies an optional third mechanism +list to intersect with. </p> + +<p> Specify mechanism names, "/file/name" patterns or "type:table" +lookup tables. The right-hand side result from "type:table" lookups +is ignored. Specify "!pattern" to exclude a mechanism name from the +list. The form "!/file/name" is supported only in Postfix version +2.4 and later. </p> + +<p> This feature is available in Postfix 2.2 and later. </p> + +<p> +Examples: +</p> + +<pre> +smtp_sasl_mechanism_filter = plain, login +smtp_sasl_mechanism_filter = /etc/postfix/smtp_mechs +smtp_sasl_mechanism_filter = !gssapi, !login, static:rest +</pre> + +%PARAM smtp_send_xforward_command no + +<p> +Send the non-standard XFORWARD command when the Postfix SMTP server +EHLO response announces XFORWARD support. +</p> + +<p> +This allows a Postfix SMTP delivery agent, used for injecting mail +into +a content filter, to forward the name, address, protocol and HELO +name of the original client to the content filter and downstream +queuing SMTP server. This can produce more useful logging than +localhost[127.0.0.1] etc. +</p> + +<p> +This feature is available in Postfix 2.1 and later. +</p> + +%PARAM smtp_skip_4xx_greeting yes + +<p> +Skip SMTP servers that greet with a 4XX status code (go away, try +again later). +</p> + +<p> +By default, the Postfix SMTP client moves on the next mail exchanger. +Specify +"smtp_skip_4xx_greeting = no" if Postfix should defer delivery +immediately. +</p> + +<p> This feature is available in Postfix 2.0 and earlier. +Later Postfix versions always skip remote SMTP servers that greet +with a +4XX status code. </p> + +%PARAM smtp_skip_5xx_greeting yes + +<p> +Skip remote SMTP servers that greet with a 5XX status code. +</p> + +<p> By default, the Postfix SMTP client moves on the next mail +exchanger. Specify "smtp_skip_5xx_greeting = no" if Postfix should +bounce the mail immediately. Caution: the latter behavior appears +to contradict RFC 2821. </p> + +%PARAM smtp_skip_quit_response yes + +<p> +Do not wait for the response to the SMTP QUIT command. +</p> + +%PARAM smtp_xforward_timeout 300s + +<p> +The Postfix SMTP client time limit for sending the XFORWARD command, +and for receiving the remote SMTP server response. +</p> + +<p> Specify a non-zero time value (an integral value plus an optional +one-letter suffix that specifies the time unit). Time units: s +(seconds), m (minutes), h (hours), d (days), w (weeks). +The default time unit is s (seconds). </p> + +<p> +This feature is available in Postfix 2.1 and later. +</p> + +%PARAM authorized_verp_clients $mynetworks + +<p> What remote SMTP clients are allowed to specify the XVERP command. +This command requests that mail be delivered one recipient at a +time with a per recipient return address. </p> + +<p> By default, only trusted clients are allowed to specify XVERP. +</p> + +<p> This parameter was introduced with Postfix version 1.1. Postfix +version 2.1 renamed this parameter to smtpd_authorized_verp_clients +and changed the default to none. </p> + +<p> Specify a list of network/netmask patterns, separated by commas +and/or whitespace. The mask specifies the number of bits in the +network part of a host address. You can also specify hostnames or +.domain names (the initial dot causes the domain to match any name +below it), "/file/name" or "type:table" patterns. A "/file/name" +pattern is replaced by its contents; a "type:table" lookup table +is matched when a table entry matches a lookup string (the lookup +result is ignored). Continue long lines by starting the next line +with whitespace. Specify "!pattern" to exclude an address or network +block from the list. The form "!/file/name" is supported only in +Postfix version 2.4 and later. </p> + +<p> Note: IP version 6 address information must be specified inside +<tt>[]</tt> in the authorized_verp_clients value, and in files +specified with "/file/name". IP version 6 addresses contain the +":" character, and would otherwise be confused with a "type:table" +pattern. </p> + +%PARAM smtpd_authorized_verp_clients $authorized_verp_clients + +<p> What remote SMTP clients are allowed to specify the XVERP command. +This command requests that mail be delivered one recipient at a +time with a per recipient return address. </p> + +<p> By default, no clients are allowed to specify XVERP. </p> + +<p> This parameter was renamed with Postfix version 2.1. The default value +is backwards compatible with Postfix version 2.0. </p> + +<p> Specify a list of network/netmask patterns, separated by commas +and/or whitespace. The mask specifies the number of bits in the +network part of a host address. You can also specify hostnames or +.domain names (the initial dot causes the domain to match any name +below it), "/file/name" or "type:table" patterns. A "/file/name" +pattern is replaced by its contents; a "type:table" lookup table +is matched when a table entry matches a lookup string (the lookup +result is ignored). Continue long lines by starting the next line +with whitespace. Specify "!pattern" to exclude an address or network +block from the list. The form "!/file/name" is supported only in +Postfix version 2.4 and later. </p> + +<p> Note: IP version 6 address information must be specified inside +<tt>[]</tt> in the smtpd_authorized_verp_clients value, and in +files specified with "/file/name". IP version 6 addresses contain +the ":" character, and would otherwise be confused with a "type:table" +pattern. </p> + +%PARAM smtpd_authorized_xclient_hosts + +<p> +What remote SMTP clients are allowed to use the XCLIENT feature. This +command overrides remote SMTP client information that is used for access +control. Typical use is for SMTP-based content filters, fetchmail-like +programs, or SMTP server access rule testing. See the XCLIENT_README +document for details. +</p> + +<p> +This feature is available in Postfix 2.1 and later. +</p> + +<p> +By default, no clients are allowed to specify XCLIENT. +</p> + +<p> +Specify a list of network/netmask patterns, separated by commas +and/or whitespace. The mask specifies the number of bits in the +network part of a host address. You can also specify hostnames or +.domain names (the initial dot causes the domain to match any name +below it), "/file/name" or "type:table" patterns. A "/file/name" +pattern is replaced by its contents; a "type:table" lookup table +is matched when a table entry matches a lookup string (the lookup +result is ignored). Continue long lines by starting the next line +with whitespace. Specify "!pattern" to exclude an address or network +block from the list. The form "!/file/name" is supported only in +Postfix version 2.4 and later. </p> + +<p> Note: IP version 6 address information must be specified inside +<tt>[]</tt> in the smtpd_authorized_xclient_hosts value, and in +files specified with "/file/name". IP version 6 addresses contain +the ":" character, and would otherwise be confused with a "type:table" +pattern. </p> + +%PARAM smtpd_authorized_xforward_hosts + +<p> +What remote SMTP clients are allowed to use the XFORWARD feature. This +command forwards information that is used to improve logging after +SMTP-based content filters. See the XFORWARD_README document for +details. +</p> + +<p> +This feature is available in Postfix 2.1 and later. +</p> + +<p> +By default, no clients are allowed to specify XFORWARD. +</p> + +<p> +Specify a list of network/netmask patterns, separated by commas +and/or whitespace. The mask specifies the number of bits in the +network part of a host address. You can also specify hostnames or +.domain names (the initial dot causes the domain to match any name +below it), "/file/name" or "type:table" patterns. A "/file/name" +pattern is replaced by its contents; a "type:table" lookup table +is matched when a table entry matches a lookup string (the lookup +result is ignored). Continue long lines by starting the next line +with whitespace. Specify "!pattern" to exclude an address or network +block from the list. The form "!/file/name" is supported only in +Postfix version 2.4 and later. </p> + +<p> Note: IP version 6 address information must be specified inside +<tt>[]</tt> in the smtpd_authorized_xforward_hosts value, and in +files specified with "/file/name". IP version 6 addresses contain +the ":" character, and would otherwise be confused with a "type:table" +pattern. </p> + +%PARAM smtpd_banner $myhostname ESMTP $mail_name + +<p> +The text that follows the 220 status code in the SMTP greeting +banner. Some people like to see the mail version advertised. By +default, Postfix shows no version. +</p> + +<p> +You MUST specify $myhostname at the start of the text. This is +required by the SMTP protocol. +</p> + +<p> +Example: +</p> + +<pre> +smtpd_banner = $myhostname ESMTP $mail_name ($mail_version) +</pre> + +%PARAM smtpd_client_connection_count_limit 50 + +<p> +How many simultaneous connections any client is allowed to +make to this service. By default, the limit is set to half +the default process limit value. +</p> + +<p> +To disable this feature, specify a limit of 0. +</p> + +<p> +WARNING: The purpose of this feature is to limit abuse. It must +not be used to regulate legitimate mail traffic. +</p> + +<p> +This feature is available in Postfix 2.2 and later. +</p> + +%PARAM smtpd_client_event_limit_exceptions $mynetworks + +<p> +Clients that are excluded from smtpd_client_*_count/rate_limit +restrictions. See the mynetworks parameter +description for the parameter value syntax. +</p> + +<p> +By default, clients in trusted networks are excluded. Specify a +list of network blocks, hostnames or .domain names (the initial +dot causes the domain to match any name below it). +</p> + +<p> Note: IP version 6 address information must be specified inside +<tt>[]</tt> in the smtpd_client_event_limit_exceptions value, and +in files specified with "/file/name". IP version 6 addresses +contain the ":" character, and would otherwise be confused with a +"type:table" pattern. </p> + +<p> Pattern matching of domain names is controlled by the presence +or absence of "smtpd_client_event_limit_exceptions" in the +parent_domain_matches_subdomains parameter value (Postfix 3.0 and +later). </p> + +<p> +This feature is available in Postfix 2.2 and later. +</p> + +%PARAM smtpd_client_connection_rate_limit 0 + +<p> +The maximal number of connection attempts any client is allowed to +make to this service per time unit. The time unit is specified +with the anvil_rate_time_unit configuration parameter. +</p> + +<p> +By default, a client can make as many connections per time unit as +Postfix can accept. +</p> + +<p> +To disable this feature, specify a limit of 0. +</p> + +<p> +WARNING: The purpose of this feature is to limit abuse. It must +not be used to regulate legitimate mail traffic. +</p> + +<p> +This feature is available in Postfix 2.2 and later. +</p> + +<p> +Example: +</p> + +<pre> +smtpd_client_connection_rate_limit = 1000 +</pre> + +%PARAM smtpd_client_message_rate_limit 0 + +<p> +The maximal number of message delivery requests that any client is +allowed to make to this service per time unit, regardless of whether +or not Postfix actually accepts those messages. The time unit is +specified with the anvil_rate_time_unit configuration parameter. +</p> + +<p> +By default, a client can send as many message delivery requests +per time unit as Postfix can accept. +</p> + +<p> +To disable this feature, specify a limit of 0. +</p> + +<p> +WARNING: The purpose of this feature is to limit abuse. It must +not be used to regulate legitimate mail traffic. +</p> + +<p> +This feature is available in Postfix 2.2 and later. +</p> + +<p> +Example: +</p> + +<pre> +smtpd_client_message_rate_limit = 1000 +</pre> + +%PARAM smtpd_client_recipient_rate_limit 0 + +<p> +The maximal number of recipient addresses that any client is allowed +to send to this service per time unit, regardless of whether or not +Postfix actually accepts those recipients. The time unit is specified +with the anvil_rate_time_unit configuration parameter. +</p> + +<p> +By default, a client can send as many recipient addresses per time +unit as Postfix can accept. +</p> + +<p> +To disable this feature, specify a limit of 0. +</p> + +<p> +WARNING: The purpose of this feature is to limit abuse. It must +not be used to regulate legitimate mail traffic. +</p> + +<p> +This feature is available in Postfix 2.2 and later. +</p> + +<p> +Example: +</p> + +<pre> +smtpd_client_recipient_rate_limit = 1000 +</pre> + +%PARAM smtpd_client_new_tls_session_rate_limit 0 + +<p> +The maximal number of new (i.e., uncached) TLS sessions that a +remote SMTP client is allowed to negotiate with this service per +time unit. The time unit is specified with the anvil_rate_time_unit +configuration parameter. +</p> + +<p> +By default, a remote SMTP client can negotiate as many new TLS +sessions per time unit as Postfix can accept. +</p> + +<p> +To disable this feature, specify a limit of 0. Otherwise, specify +a limit that is at least the per-client concurrent session limit, +or else legitimate client sessions may be rejected. +</p> + +<p> +WARNING: The purpose of this feature is to limit abuse. It must +not be used to regulate legitimate mail traffic. +</p> + +<p> +This feature is available in Postfix 2.3 and later. +</p> + +<p> +Example: +</p> + +<pre> +smtpd_client_new_tls_session_rate_limit = 100 +</pre> + +%PARAM smtpd_client_auth_rate_limit 0 + +<p> +The maximal number of AUTH commands that any client is allowed to +send to this service per time unit, regardless of whether or not +Postfix actually accepts those commands. The time unit is specified +with the anvil_rate_time_unit configuration parameter. +</p> + +<p> +By default, there is no limit on the number of AUTH commands that a +client may send. +</p> + +<p> +To disable this feature, specify a limit of 0. +</p> + +<p> +WARNING: The purpose of this feature is to limit abuse. It must +not be used to regulate legitimate mail traffic. +</p> + +<p> +This feature is available in Postfix 3.1 and later. +</p> + +%PARAM smtpd_client_restrictions + +<p> +Optional restrictions that the Postfix SMTP server applies in the +context of a client connection request. +See SMTPD_ACCESS_README, section "Delayed evaluation of SMTP access +restriction lists" for a discussion of evaluation context and time. +</p> + +<p> +The default is to allow all connection requests. +</p> + +<p> +Specify a list of restrictions, separated by commas and/or whitespace. +Continue long lines by starting the next line with whitespace. +Restrictions are applied in the order as specified; the first +restriction that matches wins. +</p> + +<p> +The following restrictions are specific to client hostname or +client network address information. +</p> + +<dl> + +<dt><b><a name="check_ccert_access">check_ccert_access</a> <i><a href="DATABASE_README.html">type:table</a></i></b></dt> + +<dd> By default use the remote SMTP client certificate fingerprint +or the public key +fingerprint (Postfix 2.9 and later) as the lookup key for the specified +access(5) database; with Postfix version 2.2, also require that the +remote SMTP client certificate is verified successfully. +The fingerprint digest algorithm is configurable via the +smtpd_tls_fingerprint_digest parameter (hard-coded as md5 prior to +Postfix version 2.5). This feature requires "smtpd_tls_ask_ccert += yes" and is available with Postfix version +2.2 and later. </dd> + +<dd> The default algorithm is <b>sha256</b> with Postfix ≥ 3.6 +and the <b>compatibility_level</b> set to 3.6 or higher. With Postfix +≤ 3.5, the default algorithm is <b>md5</b>. The best-practice +algorithm is now <b>sha256</b>. Recent advances in hash function +cryptanalysis have led to md5 and sha1 being deprecated in favor of +sha256. However, as long as there are no known "second pre-image" +attacks against the older algorithms, their use in this context, though +not recommended, is still likely safe. </dd> + +<dd> Alternatively, check_ccert_access accepts an explicit search +order (Postfix 3.5 and later). The default search order as described +above corresponds with: </dd> + +<dd> check_ccert_access { type:table, { search_order = cert_fingerprint, +pubkey_fingerprint } } </dd> + +<dd> The commas are optional. </dd> + +<dt><b><a name="check_client_access">check_client_access</a> <i><a href="DATABASE_README.html">type:table</a></i></b></dt> + +<dd>Search the specified access database for the client hostname, +parent domains, client IP address, or networks obtained by stripping +least significant octets. See the access(5) manual page for details. </dd> + +<dt><b><a name="check_client_a_access">check_client_a_access</a> <i><a href="DATABASE_README.html">type:table</a></i></b></dt> + +<dd>Search the specified access(5) database for the IP addresses for the +client hostname, and execute the corresponding action. Note: a result +of "OK" is not allowed for safety reasons. Instead, use DUNNO in order +to exclude specific hosts from denylists. This feature is available +in Postfix 3.0 and later. </dd> + +<dt><b><a name="check_client_mx_access">check_client_mx_access</a> <i><a href="DATABASE_README.html">type:table</a></i></b></dt> + +<dd>Search the specified access(5) database for the MX hosts for the +client hostname, and execute the corresponding action. If no MX +record is found, look up A or AAAA records, just like the Postfix +SMTP client would. Note: a result +of "OK" is not allowed for safety reasons. Instead, use DUNNO in order +to exclude specific hosts from denylists. This feature is available +in Postfix 2.7 and later. </dd> + +<dt><b><a name="check_client_ns_access">check_client_ns_access</a> <i><a href="DATABASE_README.html">type:table</a></i></b></dt> + +<dd>Search the specified access(5) database for the DNS servers for +the client hostname, and execute the corresponding action. Note: a +result of "OK" is not allowed for safety reasons. Instead, use DUNNO +in order to exclude specific hosts from denylists. This feature is +available in Postfix 2.7 and later. </dd> + +<dt><b><a name="check_reverse_client_hostname_access">check_reverse_client_hostname_access</a> <i><a href="DATABASE_README.html">type:table</a></i></b></dt> + +<dd>Search the specified access database for the unverified reverse +client hostname, parent domains, client IP address, or networks +obtained by stripping least significant octets. See the access(5) +manual page for details. Note: a result of "OK" is not allowed for +safety reasons. Instead, use DUNNO in order to exclude specific +hosts from denylists. This feature is available in Postfix 2.6 +and later.</dd> + +<dt><b><a name="check_reverse_client_hostname_a_access">check_reverse_client_hostname_a_access</a> <i><a href="DATABASE_README.html">type:table</a></i></b></dt> + +<dd>Search the specified access(5) database for the IP addresses for the +unverified reverse client hostname, and execute the corresponding +action. Note: a result of "OK" is not allowed for safety reasons. +Instead, use DUNNO in order to exclude specific hosts from denylists. +This feature is available in Postfix 3.0 and later. </dd> + +<dt><b><a name="check_reverse_client_hostname_mx_access">check_reverse_client_hostname_mx_access</a> <i><a href="DATABASE_README.html">type:table</a></i></b></dt> + +<dd>Search the specified access(5) database for the MX hosts for the +unverified reverse client hostname, and execute the corresponding +action. If no MX record is found, look up A or AAAA records, just +like the Postfix SMTP client would. +Note: a result of "OK" is not allowed for safety reasons. +Instead, use DUNNO in order to exclude specific hosts from denylists. +This feature is available in Postfix 2.7 and later. </dd> + +<dt><b><a name="check_reverse_client_hostname_ns_access">check_reverse_client_hostname_ns_access</a> <i><a href="DATABASE_README.html">type:table</a></i></b></dt> + +<dd>Search the specified access(5) database for the DNS servers for +the unverified reverse client hostname, and execute the corresponding +action. Note: a result of "OK" is not allowed for safety reasons. +Instead, use DUNNO in order to exclude specific hosts from denylists. +This feature is available in Postfix 2.7 and later. </dd> + +<dt><b><a name="check_sasl_access">check_sasl_access</a> <i><a href="DATABASE_README.html">type:table</a></i></b></dt> + +<dd> Use the remote SMTP client SASL user name as the lookup key for +the specified access(5) database. The lookup key has the form +"username@domainname" when the smtpd_sasl_local_domain parameter +value is non-empty. Unlike the check_client_access feature, +check_sasl_access does not perform matches of parent domains or IP +subnet ranges. This feature is available with Postfix version 2.11 +and later. </dd> + +<dt><b><a name="permit_inet_interfaces">permit_inet_interfaces</a></b></dt> + +<dd>Permit the request when the client IP address matches +$inet_interfaces. </dd> + +<dt><b><a name="permit_mynetworks">permit_mynetworks</a></b></dt> + +<dd>Permit the request when the client IP address matches any +network or network address listed in $mynetworks. </dd> + +<dt><b><a name="permit_sasl_authenticated">permit_sasl_authenticated</a></b></dt> + +<dd> Permit the request when the client is successfully +authenticated via the RFC 4954 (AUTH) protocol. </dd> + + +<dt><b><a name="permit_tls_all_clientcerts">permit_tls_all_clientcerts</a></b></dt> + +<dd> Permit the request when the remote SMTP client certificate is +verified successfully. This option must be used only if a special +CA issues the certificates and only this CA is listed as a trusted +CA. Otherwise, clients with a third-party certificate would also +be allowed to relay. Specify "tls_append_default_CA = no" when the +trusted CA is specified with smtpd_tls_CAfile or smtpd_tls_CApath, +to prevent Postfix from appending the system-supplied default CAs. +This feature requires "smtpd_tls_ask_ccert = yes" and is available +with Postfix version 2.2 and later.</dd> + +<dt><b><a name="permit_tls_clientcerts">permit_tls_clientcerts</a></b></dt> + +<dd>Permit the request when the remote SMTP client certificate +fingerprint or public key fingerprint (Postfix 2.9 and later) is +listed in $relay_clientcerts. +The fingerprint digest algorithm is configurable via the +smtpd_tls_fingerprint_digest parameter (hard-coded as md5 prior to +Postfix version 2.5). This feature requires "smtpd_tls_ask_ccert += yes" and is available with Postfix version 2.2 and later.</dd> + +<dd> The default algorithm is <b>sha256</b> with Postfix ≥ 3.6 +and the <b>compatibility_level</b> set to 3.6 or higher. With Postfix +≤ 3.5, the default algorithm is <b>md5</b>. The best-practice +algorithm is now <b>sha256</b>. Recent advances in hash function +cryptanalysis have led to md5 and sha1 being deprecated in favor of +sha256. However, as long as there are no known "second pre-image" +attacks against the older algorithms, their use in this context, though +not recommended, is still likely safe. </dd> + +<dt><b><a name="reject_rbl_client">reject_rbl_client <i>rbl_domain=d.d.d.d</i></a></b></dt> + +<dd>Reject the request when the reversed client network address is +listed with the A record "<i>d.d.d.d</i>" under <i>rbl_domain</i> +(Postfix version 2.1 and later only). Each "<i>d</i>" is a number, +or a pattern inside "[]" that contains one or more ";"-separated +numbers or number..number ranges (Postfix version 2.8 and later). +If no "<i>=d.d.d.d</i>" is specified, reject the request when the +reversed client network address is listed with any A record under +<i>rbl_domain</i>. <br> +The maps_rbl_reject_code parameter specifies the response code for +rejected requests (default: 554), the default_rbl_reply parameter +specifies the default server reply, and the rbl_reply_maps parameter +specifies tables with server replies indexed by <i>rbl_domain</i>. +This feature is available in Postfix 2.0 and later. </dd> + +<dt><b><a name="permit_dnswl_client">permit_dnswl_client <i>dnswl_domain=d.d.d.d</i></a></b></dt> + +<dd>Accept the request when the reversed client network address is +listed with the A record "<i>d.d.d.d</i>" under <i>dnswl_domain</i>. +Each "<i>d</i>" is a number, or a pattern inside "[]" that contains +one or more ";"-separated numbers or number..number ranges. +If no "<i>=d.d.d.d</i>" is specified, accept the request when the +reversed client network address is listed with any A record under +<i>dnswl_domain</i>. <br> For safety, permit_dnswl_client is silently +ignored when it would override reject_unauth_destination. The +result is DEFER_IF_REJECT when allowlist lookup fails. This feature +is available in Postfix 2.8 and later. </dd> + +<dt><b><a name="reject_rhsbl_client">reject_rhsbl_client <i>rbl_domain=d.d.d.d</i></a></b></dt> + +<dd>Reject the request when the client hostname is listed with the +A record "<i>d.d.d.d</i>" under <i>rbl_domain</i> (Postfix version +2.1 and later only). Each "<i>d</i>" is a number, or a pattern +inside "[]" that contains one or more ";"-separated numbers or +number..number ranges (Postfix version 2.8 and later). If no +"<i>=d.d.d.d</i>" is specified, reject the request when the client +hostname is listed with +any A record under <i>rbl_domain</i>. See the reject_rbl_client +description above for additional RBL related configuration parameters. +This feature is available in Postfix 2.0 and later; with Postfix +version 2.8 and later, reject_rhsbl_reverse_client will usually +produce better results. </dd> + +<dt><b><a name="permit_rhswl_client">permit_rhswl_client <i>rhswl_domain=d.d.d.d</i></a></b></dt> + +<dd>Accept the request when the client hostname is listed with the +A record "<i>d.d.d.d</i>" under <i>rhswl_domain</i>. Each "<i>d</i>" +is a number, or a pattern inside "[]" that contains one or more +";"-separated numbers or number..number ranges. If no +"<i>=d.d.d.d</i>" is specified, accept the request when the client +hostname is listed with any A record under <i>rhswl_domain</i>. +<br> Caution: client name allowlisting is fragile, since the client +name lookup can fail due to temporary outages. Client name +allowlisting should be used only to reduce false positives in e.g. +DNS-based blocklists, and not for making access rule exceptions. +<br> For safety, permit_rhswl_client is silently ignored when it +would override reject_unauth_destination. The result is DEFER_IF_REJECT +when allowlist lookup fails. This feature is available in Postfix +2.8 and later. </dd> + +<dt><b><a name="reject_rhsbl_reverse_client">reject_rhsbl_reverse_client <i>rbl_domain=d.d.d.d</i></a></b></dt> + +<dd>Reject the request when the unverified reverse client hostname +is listed with the A record "<i>d.d.d.d</i>" under <i>rbl_domain</i>. +Each "<i>d</i>" is a number, or a pattern inside "[]" that contains +one or more ";"-separated numbers or number..number ranges. +If no "<i>=d.d.d.d</i>" is specified, reject the request when the +unverified reverse client hostname is listed with any A record under +<i>rbl_domain</i>. See the reject_rbl_client description above for +additional RBL related configuration parameters. This feature is +available in Postfix 2.8 and later. </dd> + +<dt><b><a name="reject_unknown_client_hostname">reject_unknown_client_hostname</a></b> (with Postfix < 2.3: reject_unknown_client)</dt> + +<dd>Reject the request when 1) the client IP address->name mapping +fails, or 2) the name->address mapping fails, or 3) the name->address +mapping does not match the client IP address. <br> This is a +stronger restriction than the reject_unknown_reverse_client_hostname +feature, which triggers only under condition 1) above. <br> The +unknown_client_reject_code parameter specifies the response code +for rejected requests (default: 450). The reply is always 450 in +case the address->name or name->address lookup failed due to +a temporary problem. </dd> + +<dt><b><a name="reject_unknown_reverse_client_hostname">reject_unknown_reverse_client_hostname</a></b></dt> + +<dd>Reject the request when the client IP address has no address->name +mapping. <br> This is a weaker restriction than the +reject_unknown_client_hostname feature, which requires not only +that the address->name and name->address mappings exist, but +also that the two mappings reproduce the client IP address. <br> +The unknown_client_reject_code parameter specifies the response +code for rejected requests (default: 450). The reply is always 450 +in case the address->name lookup failed due to a temporary +problem. <br> This feature is available in Postfix 2.3 and +later. </dd> + +#<dt><b><a name="reject_unknown_forward_client_hostname">reject_unknown_forward_client_hostname</a></b></dt> +# +#<dd>Reject the request when the client IP address has no address->name +#or name ->address mapping. <br> This is a weaker restriction +#than the reject_unknown_client_hostname feature, which requires not +#only that the address->name and name->address mappings exist, +#but also that the two mappings reproduce the client IP address. +#<br> The unknown_client_reject_code parameter specifies the response +#code for rejected requests (default: 450). The reply is always 450 +#in case the address->name or name ->address lookup failed due +#to a temporary problem. <br> This feature is available in Postfix +#version 2.3 and later. </dd> + +</dl> + +<p> +In addition, you can use any of the following <a name="generic"> +generic</a> restrictions. These restrictions are applicable in +any SMTP command context. +</p> + +<dl> + +<dt><b><a name="check_policy_service">check_policy_service <i>servername</i></a></b></dt> + +<dd>Query the specified policy server. See the SMTPD_POLICY_README +document for details. This feature is available in Postfix 2.1 +and later. </dd> + +<dt><b><a name="defer">defer</a></b></dt> + +<dd>Defer the request. The client is told to try again later. This +restriction is useful at the end of a restriction list, to make +the default policy explicit. <br> The defer_code parameter specifies +the SMTP server reply code (default: 450).</dd> + +<dt><b><a name="defer_if_permit">defer_if_permit</a></b></dt> + +<dd>Defer the request if some later restriction would result in an +explicit or implicit PERMIT action. This is useful when a denylisting +feature fails due to a temporary problem. This feature is available +in Postfix version 2.1 and later. </dd> + +<dt><b><a name="defer_if_reject">defer_if_reject</a></b></dt> + +<dd>Defer the request if some later restriction would result in a +REJECT action. This is useful when an allowlisting feature fails +due to a temporary problem. This feature is available in Postfix +version 2.1 and later. </dd> + +<dt><b><a name="permit">permit</a></b></dt> + +<dd>Permit the request. This restriction is useful at the end of +a restriction list, to make the default policy explicit.</dd> + +<dt><b><a name="reject_multi_recipient_bounce">reject_multi_recipient_bounce</a></b></dt> + +<dd>Reject the request when the envelope sender is the null address, +and the message has multiple envelope recipients. This usage has +rare but legitimate applications: under certain conditions, +multi-recipient mail that was posted with the DSN option NOTIFY=NEVER +may be forwarded with the null sender address. +<br> Note: this restriction can only work reliably +when used in smtpd_data_restrictions or +smtpd_end_of_data_restrictions, because the total number of +recipients is not known at an earlier stage of the SMTP conversation. +Use at the RCPT stage will only reject the second etc. recipient. +<br> +The multi_recipient_bounce_reject_code parameter specifies the +response code for rejected requests (default: 550). This feature +is available in Postfix 2.1 and later. </dd> + +<dt><b><a name="reject_plaintext_session">reject_plaintext_session</a></b></dt> + +<dd>Reject the request when the connection is not encrypted. This +restriction should not be used before the client has had a chance +to negotiate encryption with the AUTH or STARTTLS commands. +<br> +The plaintext_reject_code parameter specifies the response +code for rejected requests (default: 450). This feature is available +in Postfix 2.3 and later. </dd> + +<dt><b><a name="reject_unauth_pipelining">reject_unauth_pipelining</a></b></dt> + +<dd>Reject the request when the client sends SMTP commands ahead +of time where it is not allowed, or when the client sends SMTP +commands ahead of time without knowing that Postfix actually supports +ESMTP command pipelining. This stops mail from bulk mail software +that improperly uses ESMTP command pipelining in order to speed up +deliveries. +<br> With Postfix 2.6 and later, the SMTP server sets a per-session +flag whenever it detects illegal pipelining, including pipelined +HELO or EHLO commands. The reject_unauth_pipelining feature simply +tests whether the flag was set at any point in time during the +session. +<br> With older Postfix versions, reject_unauth_pipelining checks +the current status of the input read queue, and its usage is not +recommended in contexts other than smtpd_data_restrictions. </dd> + +<dt><b><a name="reject">reject</a></b></dt> + +<dd>Reject the request. This restriction is useful at the end of +a restriction list, to make the default policy explicit. The +reject_code configuration parameter specifies the response code for +rejected requests (default: 554).</dd> + +<dt><b><a name="sleep">sleep <i>seconds</i></a></b></dt> + +<dd>Pause for the specified number of seconds and proceed with +the next restriction in the list, if any. This may stop zombie +mail when used as: +<pre> +/etc/postfix/main.cf: + smtpd_client_restrictions = + sleep 1, reject_unauth_pipelining + smtpd_delay_reject = no +</pre> +This feature is available in Postfix 2.3. </dd> + +<dt><b><a name="warn_if_reject">warn_if_reject</a></b></dt> + +<dd> A safety net for testing. When "warn_if_reject" is placed +before a reject-type restriction, access table query, or +check_policy_service query, this logs a "reject_warning" message +instead of rejecting a request (when a reject-type restriction fails +due to a temporary error, this logs a "reject_warning" message for +any implicit "defer_if_permit" actions that would normally prevent +mail from being accepted by some later access restriction). This +feature has no effect on defer_if_reject restrictions. </dd> + +</dl> + +<p> +Other restrictions that are valid in this context: +</p> + +<ul> + +<li> SMTP command specific restrictions that are described under +the smtpd_helo_restrictions, smtpd_sender_restrictions or +smtpd_recipient_restrictions parameters. When helo, sender or +recipient restrictions are listed under smtpd_client_restrictions, +they have effect only with "smtpd_delay_reject = yes", so that +$smtpd_client_restrictions is evaluated at the time of the RCPT TO +command. + +</ul> + +<p> +Example: +</p> + +<pre> +smtpd_client_restrictions = permit_mynetworks, reject_unknown_client_hostname +</pre> + +%CLASS smtpd-tarpit Tarpit features + +<p> +When a remote SMTP client makes errors, the Postfix SMTP server +can insert delays before responding. This can help to slow down +run-away software. The behavior is controlled by an error counter +that counts the number of errors within an SMTP session that a +client makes without delivering mail. +</p> + +<ul> + +<li><p>When the error counter is less than $smtpd_soft_error_limit the +Postfix SMTP server replies immediately (Postfix version 2.0 and earlier +delay their 4xx or 5xx error response). </p> + +<li><p>When the error counter reaches $smtpd_soft_error_limit, the Postfix +SMTP server delays all its responses. </p> + +<li><p>When the error counter reaches $smtpd_hard_error_limit the Postfix +SMTP server breaks the connection. </p> + +</ul> + +%PARAM smtpd_error_sleep_time 1s + +<p>With Postfix version 2.1 and later: the SMTP server response delay after +a client has made more than $smtpd_soft_error_limit errors, and +fewer than $smtpd_hard_error_limit errors, without delivering mail. +</p> + +<p>With Postfix version 2.0 and earlier: the SMTP server delay +before sending a reject (4xx or 5xx) response, when the client has +made fewer than $smtpd_soft_error_limit errors without delivering +mail. When the client has made $smtpd_soft_error_limit or more errors, +delay all responses with the larger of (number of errors) seconds +or $smtpd_error_sleep_time. </p> + +<p> Specify a non-negative time value (an integral value plus an optional +one-letter suffix that specifies the time unit). Time units: s +(seconds), m (minutes), h (hours), d (days), w (weeks). +The default time unit is s (seconds). </p> + +%PARAM smtpd_soft_error_limit 10 + +<p> +The number of errors a remote SMTP client is allowed to make without +delivering mail before the Postfix SMTP server slows down all its +responses. +</p> + +<ul> + +<li><p>With Postfix version 2.1 and later, when the error count +is > $smtpd_soft_error_limit, the Postfix SMTP server +delays all responses by $smtpd_error_sleep_time. </p> + +<li><p>With Postfix versions 2.0 and earlier, when the error count +is > $smtpd_soft_error_limit, the Postfix SMTP server delays all +responses by the larger of (number of errors) seconds or +$smtpd_error_sleep_time. </p> + +<li><p>With Postfix versions 2.0 and earlier, when the error count +is ≤ $smtpd_soft_error_limit, the Postfix SMTP server delays 4XX +and 5XX responses by $smtpd_error_sleep_time. </p> + +</ul> + +%PARAM smtpd_hard_error_limit normal: 20, overload: 1 + +<p> +The maximal number of errors a remote SMTP client is allowed to +make without delivering mail. The Postfix SMTP server disconnects +when the limit is reached. Normally the default limit is 20, but +it changes under overload to just 1. With Postfix 2.5 and earlier, +the SMTP server always allows up to 20 errors by default. +Valid values are greater than zero. + +</p> + +%PARAM smtpd_junk_command_limit normal: 100, overload: 1 + +<p> +The number of junk commands (NOOP, VRFY, ETRN or RSET) that a remote +SMTP client can send before the Postfix SMTP server starts to +increment the error counter with each junk command. The junk +command count is reset after mail is delivered. See also the +smtpd_error_sleep_time and smtpd_soft_error_limit configuration +parameters. Normally the default limit is 100, but it changes under +overload to just 1. With Postfix 2.5 and earlier, the SMTP server +always allows up to 100 junk commands by default. </p> + +%PARAM smtpd_recipient_overshoot_limit 1000 + +<p> The number of recipients that a remote SMTP client can send in +excess of the limit specified with $smtpd_recipient_limit, before +the Postfix SMTP server increments the per-session error count +for each excess recipient. </p> + +%PARAM smtpd_etrn_restrictions + +<p> +Optional restrictions that the Postfix SMTP server applies in the +context of a client ETRN command. +See SMTPD_ACCESS_README, section "Delayed evaluation of SMTP access +restriction lists" for a discussion of evaluation context and time. +</p> + +<p> +The Postfix ETRN implementation accepts only destinations that are +eligible for the Postfix "fast flush" service. See the ETRN_README +file for details. +</p> + +<p> +Specify a list of restrictions, separated by commas and/or whitespace. +Continue long lines by starting the next line with whitespace. +Restrictions are applied in the order as specified; the first +restriction that matches wins. +</p> + +<p> +The following restrictions are specific to the domain name information +received with the ETRN command. +</p> + +<dl> + +<dt><b><a name="check_etrn_access">check_etrn_access</a> <i><a href="DATABASE_README.html">type:table</a></i></b></dt> + +<dd>Search the specified access database for the ETRN domain name +or its parent domains. See the access(5) manual page for details. +</dd> + +</dl> + +<p> +Other restrictions that are valid in this context: +</p> + +<ul> + +<li><a href="#generic">Generic</a> restrictions that can be used +in any SMTP command context, described under smtpd_client_restrictions. + +<li>SMTP command specific restrictions described under +smtpd_client_restrictions and smtpd_helo_restrictions. + +</ul> + +<p> +Example: +</p> + +<pre> +smtpd_etrn_restrictions = permit_mynetworks, reject +</pre> + +%PARAM smtpd_expansion_filter see "postconf -d" output + +<p> +What characters are allowed in $name expansions of RBL reply +templates. Characters not in the allowed set are replaced by "_". +Use C like escapes to specify special characters such as whitespace. +</p> + +<p> +The smtpd_expansion_filter value is not subject to Postfix configuration +parameter $name expansion. +</p> + +<p> +This feature is available in Postfix 2.0 and later. +</p> + +%PARAM smtpd_forbidden_commands CONNECT GET POST regexp:{{/^[^A-Z]/ Bogus}} + +<p> +List of commands that cause the Postfix SMTP server to immediately +terminate the session with a 221 code. This can be used to disconnect +clients that obviously attempt to abuse the system. In addition to the +commands listed in this parameter, commands that follow the "Label:" +format of message headers will also cause a disconnect. With Postfix +versions 3.6 and earlier, the default value is "CONNECT GET POST". +</p> + +<p> +This feature is available in Postfix 2.2 and later. +</p> + +<p> +Support for inline regular expressions was added in Postfix version +3.7. See regexp_table(5) for a description of the syntax and features. +</p> + +%PARAM smtpd_helo_required no + +<p> +Require that a remote SMTP client introduces itself with the HELO +or EHLO command before sending the MAIL command or other commands +that require EHLO negotiation. +</p> + +<p> +Example: +</p> + +<pre> +smtpd_helo_required = yes +</pre> + +%PARAM smtpd_helo_restrictions + +<p> +Optional restrictions that the Postfix SMTP server applies in the +context of a client HELO command. +See SMTPD_ACCESS_README, section "Delayed evaluation of SMTP access +restriction lists" for a discussion of evaluation context and time. +</p> + +<p> +The default is to permit everything. +</p> + +<p> Note: specify "smtpd_helo_required = yes" to fully enforce this +restriction (without "smtpd_helo_required = yes", a client can +simply skip smtpd_helo_restrictions by not sending HELO or EHLO). +</p> + +<p> +Specify a list of restrictions, separated by commas and/or whitespace. +Continue long lines by starting the next line with whitespace. +Restrictions are applied in the order as specified; the first +restriction that matches wins. +</p> + +<p> +The following restrictions are specific to the hostname information +received with the HELO or EHLO command. +</p> + +<dl> + +<dt><b><a name="check_helo_access">check_helo_access</a> <i><a href="DATABASE_README.html">type:table</a></i></b></dt> + +<dd>Search the specified access(5) database for the HELO or EHLO +hostname or parent domains, and execute the corresponding action. +Note: specify "smtpd_helo_required = yes" to fully enforce this +restriction (without "smtpd_helo_required = yes", a client can +simply skip check_helo_access by not sending HELO or EHLO). </dd> + +<dt><b><a name="check_helo_a_access">check_helo_a_access</a> <i><a href="DATABASE_README.html">type:table</a></i></b></dt> + +<dd>Search the specified access(5) database for the IP addresses for +the HELO or EHLO hostname, and execute the corresponding action. +Note 1: a result of "OK" is not allowed for safety reasons. Instead, +use DUNNO in order to exclude specific hosts from denylists. Note +2: specify "smtpd_helo_required = yes" to fully enforce this +restriction (without "smtpd_helo_required = yes", a client can +simply skip check_helo_a_access by not sending HELO or EHLO). This +feature is available in Postfix 3.0 and later. +</dd> + +<dt><b><a name="check_helo_mx_access">check_helo_mx_access</a> <i><a href="DATABASE_README.html">type:table</a></i></b></dt> + +<dd>Search the specified access(5) database for the MX hosts for +the HELO or EHLO hostname, and execute the corresponding action. +If no MX record is found, look up A or AAAA records, just like the +Postfix SMTP client would. +Note 1: a result of "OK" is not allowed for safety reasons. Instead, +use DUNNO in order to exclude specific hosts from denylists. Note +2: specify "smtpd_helo_required = yes" to fully enforce this +restriction (without "smtpd_helo_required = yes", a client can +simply skip check_helo_mx_access by not sending HELO or EHLO). This +feature is available in Postfix 2.1 and later. +</dd> + +<dt><b><a name="check_helo_ns_access">check_helo_ns_access</a> <i><a href="DATABASE_README.html">type:table</a></i></b></dt> + +<dd>Search the specified access(5) database for the DNS servers +for the HELO or EHLO hostname, and execute the corresponding action. +Note 1: a result of "OK" is not allowed for safety reasons. Instead, +use DUNNO in order to exclude specific hosts from denylists. Note +2: specify "smtpd_helo_required = yes" to fully enforce this +restriction (without "smtpd_helo_required = yes", a client can +simply skip check_helo_ns_access by not sending HELO or EHLO). This +feature is available in Postfix 2.1 and later. +</dd> + +<dt><b><a name="reject_invalid_helo_hostname">reject_invalid_helo_hostname</a></b> (with Postfix < 2.3: reject_invalid_hostname)</dt> + +<dd>Reject the request when the HELO or EHLO hostname is malformed. +Note: specify "smtpd_helo_required = yes" to fully enforce +this restriction (without "smtpd_helo_required = yes", a client can simply +skip reject_invalid_helo_hostname by not sending HELO or EHLO). +<br> The invalid_hostname_reject_code specifies the response code +for rejected requests (default: 501).</dd> + +<dt><b><a name="reject_non_fqdn_helo_hostname">reject_non_fqdn_helo_hostname</a></b> (with Postfix < 2.3: reject_non_fqdn_hostname)</dt> + +<dd>Reject the request when the HELO or EHLO hostname is not in +fully-qualified domain or address literal form, as required by the +RFC. Note: specify +"smtpd_helo_required = yes" to fully enforce this restriction +(without "smtpd_helo_required = yes", a client can simply skip +reject_non_fqdn_helo_hostname by not sending HELO or EHLO). <br> +The non_fqdn_reject_code parameter specifies the response code for +rejected requests (default: 504).</dd> + +<dt><b><a name="reject_rhsbl_helo">reject_rhsbl_helo <i>rbl_domain=d.d.d.d</i></a></b></dt> + +<dd>Reject the request when the HELO or EHLO hostname is +listed with the A record "<i>d.d.d.d</i>" under <i>rbl_domain</i> +(Postfix version 2.1 and later only). Each "<i>d</i>" is a number, +or a pattern inside "[]" that contains one or more ";"-separated +numbers or number..number ranges (Postfix version 2.8 and later). +If no "<i>=d.d.d.d</i>" is +specified, reject the request when the HELO or EHLO hostname is +listed with any A record under <i>rbl_domain</i>. See the +reject_rbl_client description for additional RBL related configuration +parameters. Note: specify "smtpd_helo_required = yes" to fully +enforce this restriction (without "smtpd_helo_required = yes", a +client can simply skip reject_rhsbl_helo by not sending HELO or +EHLO). This feature is available in Postfix 2.0 +and later. </dd> + +<dt><b><a name="reject_unknown_helo_hostname">reject_unknown_helo_hostname</a></b> (with Postfix < 2.3: reject_unknown_hostname)</dt> + +<dd>Reject the request when the HELO or EHLO hostname has no DNS A +or MX record. <br> The reply is specified with the +unknown_hostname_reject_code parameter (default: 450) or +unknown_helo_hostname_tempfail_action (default: defer_if_permit). +See the respective parameter descriptions for details. <br> +Note: specify "smtpd_helo_required = yes" to fully +enforce this restriction (without "smtpd_helo_required = yes", a +client can simply skip reject_unknown_helo_hostname by not sending +HELO or EHLO). </dd> + +</dl> + +<p> +Other restrictions that are valid in this context: +</p> + +<ul> + +<li> <a href="#generic">Generic</a> restrictions that can be used +in any SMTP command context, described under smtpd_client_restrictions. + +<li> Client hostname or network address specific restrictions +described under smtpd_client_restrictions. + +<li> SMTP command specific restrictions described under +smtpd_sender_restrictions or smtpd_recipient_restrictions. When +sender or recipient restrictions are listed under smtpd_helo_restrictions, +they have effect only with "smtpd_delay_reject = yes", so that +$smtpd_helo_restrictions is evaluated at the time of the RCPT TO +command. + +</ul> + +<p> +Examples: +</p> + +<pre> +smtpd_helo_restrictions = permit_mynetworks, reject_invalid_helo_hostname +smtpd_helo_restrictions = permit_mynetworks, reject_unknown_helo_hostname +</pre> + +%PARAM smtpd_history_flush_threshold 100 + +<p> +The maximal number of lines in the Postfix SMTP server command history +before it is flushed upon receipt of EHLO, RSET, or end of DATA. +</p> + +%PARAM smtpd_noop_commands + +<p> +List of commands that the Postfix SMTP server replies to with "250 +Ok", without doing any syntax checks and without changing state. +This list overrides any commands built into the Postfix SMTP server. +</p> + +%PARAM smtpd_proxy_ehlo $myhostname + +<p> +How the Postfix SMTP server announces itself to the proxy filter. +By default, the Postfix hostname is used. +</p> + +<p> +This feature is available in Postfix 2.1 and later. +</p> + +%PARAM smtpd_proxy_options + +<p> +List of options that control how the Postfix SMTP server +communicates with a before-queue content filter. Specify zero or +more of the following, separated by comma or whitespace. </p> + +<dl> + +<dt><b>speed_adjust</b></dt> + +<dd> <p> Do not connect to a before-queue content filter until an entire +message has been received. This reduces the number of simultaneous +before-queue content filter processes. </p> + +<p> NOTE 1: A filter must not <i>selectively</i> reject recipients +of a multi-recipient message. Rejecting all recipients is OK, as +is accepting all recipients. </p> + +<p> NOTE 2: This feature increases the minimum amount of free queue +space by $message_size_limit. The extra space is needed to save the +message to a temporary file. </p> </dd> + +</dl> + +<p> +This feature is available in Postfix 2.7 and later. +</p> + +%CLASS smtpd-proxy SMTP Proxy filter + +<p> +As of Postfix version 2.1, the SMTP server can forward all incoming +mail to a content filtering proxy server that inspects all mail +BEFORE it is stored in the Postfix mail queue. +</p> + +<p> +WARNING: the proxy filter must reply within a fixed deadline or +else the remote SMTP client times out and mail duplication happens. +This becomes a problem as mail load increases so that fewer and +fewer CPU cycles remain available to mead the fixed deadline. +</p> + +%PARAM smtpd_proxy_filter + +<p> The hostname and TCP port of the mail filtering proxy server. +The proxy receives all mail from the Postfix SMTP server, and is +supposed to give the result to another Postfix SMTP server process. +</p> + +<p> Specify "host:port" or "inet:host:port" for a TCP endpoint, or +"unix:pathname" for a UNIX-domain endpoint. The host can be specified +as an IP address or as a symbolic name; no MX lookups are done. +When no "host" or "host:" is specified, the local machine is +assumed. Pathname interpretation is relative to the Postfix queue +directory. </p> + +<p> This feature is available in Postfix 2.1 and later. </p> + +<p> The "inet:" and "unix:" prefixes are available in Postfix 2.3 +and later. </p> + +%PARAM smtpd_proxy_timeout 100s + +<p> +The time limit for connecting to a proxy filter and for sending or +receiving information. When a connection fails the client gets a +generic error message while more detailed information is logged to +the maillog file. +</p> + +<p> Specify a non-zero time value (an integral value plus an optional +one-letter suffix that specifies the time unit). Time units: s +(seconds), m (minutes), h (hours), d (days), w (weeks). +The default time unit is s (seconds). </p> + +<p> +This feature is available in Postfix 2.1 and later. +</p> + +%PARAM smtpd_recipient_limit 1000 + +<p> +The maximal number of recipients that the Postfix SMTP server +accepts per message delivery request. +</p> + +%PARAM smtpd_recipient_restrictions see "postconf -d" output + +<p> +Optional restrictions that the Postfix SMTP server applies in the +context of a client RCPT TO command, after smtpd_relay_restrictions. +See SMTPD_ACCESS_README, section "Delayed evaluation of SMTP access +restriction lists" for a discussion of evaluation context and time. +</p> + +<p> With Postfix versions before 2.10, the rules for relay permission +and spam blocking were combined under smtpd_recipient_restrictions, +resulting in error-prone configuration. As of Postfix 2.10, relay +permission rules are preferably implemented with smtpd_relay_restrictions, +so that a permissive spam blocking policy under +smtpd_recipient_restrictions will no longer result in a permissive +mail relay policy. </p> + +<p> For backwards compatibility, sites that migrate from Postfix +versions before 2.10 can set smtpd_relay_restrictions to the empty +value, and use smtpd_recipient_restrictions exactly as before. </p> + +<p> +IMPORTANT: Either the smtpd_relay_restrictions or the +smtpd_recipient_restrictions parameter must specify +at least one of the following restrictions. Otherwise Postfix will +refuse to receive mail: +</p> + +<blockquote> +<pre> +reject, reject_unauth_destination +</pre> +</blockquote> + +<blockquote> +<pre> +defer, defer_if_permit, defer_unauth_destination +</pre> +</blockquote> + +<p> +Specify a list of restrictions, separated by commas and/or whitespace. +Continue long lines by starting the next line with whitespace. +Restrictions are applied in the order as specified; the first +restriction that matches wins. +</p> + +<p> +The following restrictions are specific to the recipient address +that is received with the RCPT TO command. +</p> + +<dl> + +<dt><b><a name="check_recipient_access">check_recipient_access</a> <i><a href="DATABASE_README.html">type:table</a></i></b></dt> + +<dd>Search the specified access(5) database for the resolved RCPT +TO address, domain, parent domains, or localpart@, and execute the +corresponding action. </dd> + +<dt><b><a name="check_recipient_a_access">check_recipient_a_access</a> <i><a href="DATABASE_README.html">type:table</a></i></b></dt> + +<dd>Search the specified access(5) database for the IP addresses for +the RCPT TO domain, and execute the corresponding action. Note: +a result of "OK" is not allowed for safety reasons. Instead, use +DUNNO in order to exclude specific hosts from denylists. This +feature is available in Postfix 3.0 and later. </dd> + +<dt><b><a name="check_recipient_mx_access">check_recipient_mx_access</a> <i><a href="DATABASE_README.html">type:table</a></i></b></dt> + +<dd>Search the specified access(5) database for the MX hosts for +the RCPT TO domain, and execute the corresponding action. If no +MX record is found, look up A or AAAA records, just like the Postfix +SMTP client would. Note: +a result of "OK" is not allowed for safety reasons. Instead, use +DUNNO in order to exclude specific hosts from denylists. This +feature is available in Postfix 2.1 and later. </dd> + +<dt><b><a name="check_recipient_ns_access">check_recipient_ns_access</a> <i><a href="DATABASE_README.html">type:table</a></i></b></dt> + +<dd>Search the specified access(5) database for the DNS servers +for the RCPT TO domain, and execute the corresponding action. +Note: a result of "OK" is not allowed for safety reasons. Instead, +use DUNNO in order to exclude specific hosts from denylists. This +feature is available in Postfix 2.1 and later. </dd> + +<dt><b><a name="permit_auth_destination">permit_auth_destination</a></b></dt> + +<dd>Permit the request when one of the following is true: + +<ul> + +<li> Postfix is a mail forwarder: the resolved RCPT TO domain matches +$relay_domains or a subdomain thereof, and the address contains no +sender-specified routing (user@elsewhere@domain), + +<li> Postfix is the final destination: the resolved RCPT TO domain +matches $mydestination, $inet_interfaces, $proxy_interfaces, +$virtual_alias_domains, or $virtual_mailbox_domains, and the address +contains no sender-specified routing (user@elsewhere@domain). + +</ul></dd> + +<dt><b><a name="permit_mx_backup">permit_mx_backup</a></b></dt> + +<dd>Permit the request when the local mail system is a backup MX for +the RCPT TO domain, or when the domain is an authorized destination +(see permit_auth_destination for definition). + +<ul> + +<li> Safety: permit_mx_backup does not accept addresses that have +sender-specified routing information (example: user@elsewhere@domain). + +<li> Safety: permit_mx_backup can be vulnerable to mis-use when +access is not restricted with permit_mx_backup_networks. + +<li> Safety: as of Postfix version 2.3, permit_mx_backup no longer +accepts the address when the local mail system is a primary MX for +the recipient domain. Exception: permit_mx_backup accepts the address +when it specifies an authorized destination (see permit_auth_destination +for definition). + +<li> Limitation: mail may be rejected in case of a temporary DNS +lookup problem with Postfix prior to version 2.0. + +</ul></dd> + +<dt><b><a name="reject_non_fqdn_recipient">reject_non_fqdn_recipient</a></b></dt> + +<dd>Reject the request when the RCPT TO address specifies a +domain that is not in +fully-qualified domain form, as required by the RFC. <br> The +non_fqdn_reject_code parameter specifies the response code for +rejected requests (default: 504). </dd> + +<dt><b><a name="reject_rhsbl_recipient">reject_rhsbl_recipient <i>rbl_domain=d.d.d.d</i></a></b></dt> + +<dd>Reject the request when the RCPT TO domain is listed with the +A record "<i>d.d.d.d</i>" under <i>rbl_domain</i> (Postfix version +2.1 and later only). Each "<i>d</i>" is a number, or a pattern +inside "[]" that contains one or more ";"-separated numbers or +number..number ranges (Postfix version 2.8 and later). If no +"<i>=d.d.d.d</i>" is specified, reject +the request when the RCPT TO domain is listed with +any A record under <i>rbl_domain</i>. <br> The maps_rbl_reject_code +parameter specifies the response code for rejected requests (default: +554); the default_rbl_reply parameter specifies the default server +reply; and the rbl_reply_maps parameter specifies tables with server +replies indexed by <i>rbl_domain</i>. This feature is available +in Postfix version 2.0 and later.</dd> + +<dt><b><a name="reject_unauth_destination">reject_unauth_destination</a></b></dt> + +<dd>Reject the request unless one of the following is true: + +<ul> + +<li> Postfix is a mail forwarder: the resolved RCPT TO domain matches +$relay_domains or a subdomain thereof, and contains no sender-specified +routing (user@elsewhere@domain), + +<li> Postfix is the final destination: the resolved RCPT TO domain +matches $mydestination, $inet_interfaces, $proxy_interfaces, +$virtual_alias_domains, or $virtual_mailbox_domains, and contains +no sender-specified routing (user@elsewhere@domain). + +</ul>The relay_domains_reject_code parameter specifies the response +code for rejected requests (default: 554). </dd> + +<dt><b><a name="defer_unauth_destination">defer_unauth_destination</a></b></dt> + +<dd> Reject the same requests as reject_unauth_destination, with a +non-permanent error code. This feature is available in Postfix +2.10 and later.</dd> + +<dt><b><a name="reject_unknown_recipient_domain">reject_unknown_recipient_domain</a></b></dt> + +<dd>Reject the request when Postfix is not final destination for +the recipient domain, and the RCPT TO domain has 1) no DNS MX and +no DNS A +record or 2) a malformed MX record such as a record with +a zero-length MX hostname (Postfix version 2.3 and later). <br> The +reply is specified with the unknown_address_reject_code parameter +(default: 450), unknown_address_tempfail_action (default: +defer_if_permit), or 556 (nullmx, Postfix 3.0 and +later). See the respective parameter descriptions for details. +</dd> + +<dt><b><a name="reject_unlisted_recipient">reject_unlisted_recipient</a></b> (with Postfix version 2.0: check_recipient_maps)</dt> + +<dd> Reject the request when the RCPT TO address is not listed in +the list of valid recipients for its domain class. See the +smtpd_reject_unlisted_recipient parameter description for details. +This feature is available in Postfix 2.1 and later.</dd> + +<dt><b><a name="reject_unverified_recipient">reject_unverified_recipient</a></b></dt> + +<dd>Reject the request when mail to the RCPT TO address is known +to bounce, or when the recipient address destination is not reachable. +Address verification information is managed by the verify(8) server; +see the ADDRESS_VERIFICATION_README file for details. <br> The +unverified_recipient_reject_code parameter specifies the numerical +response code when an address is known to bounce (default: 450, +change it to 550 when you are confident that it is safe to do so). +<br>The unverified_recipient_defer_code parameter specifies the +numerical response code when an address probe failed due to a +temporary problem (default: 450). <br> The +unverified_recipient_tempfail_action parameter specifies the action +after address probe failure due to a temporary problem (default: +defer_if_permit). <br> This feature breaks for aliased addresses +with "enable_original_recipient = no" (Postfix ≤ 3.2). <br> +This feature is available in Postfix 2.1 and later. </dd> + +</dl> + +<p> +Other restrictions that are valid in this context: +</p> + +<ul> + +<li><a href="#generic">Generic</a> restrictions that can be used +in any SMTP command context, described under smtpd_client_restrictions. + +<li>SMTP command specific restrictions described under +smtpd_client_restrictions, smtpd_helo_restrictions and +smtpd_sender_restrictions. + +</ul> + +<p> +Example: +</p> + +<pre> +# The Postfix before 2.10 default mail relay policy. Later Postfix +# versions implement this preferably with smtpd_relay_restrictions. +smtpd_recipient_restrictions = permit_mynetworks, reject_unauth_destination +</pre> + +%PARAM smtpd_relay_restrictions permit_mynetworks, permit_sasl_authenticated, defer_unauth_destination + +<p> Access restrictions for mail relay control that the Postfix +SMTP server applies in the context of the RCPT TO command, before +smtpd_recipient_restrictions. +See SMTPD_ACCESS_README, section "Delayed evaluation of SMTP access +restriction lists" for a discussion of evaluation context and time. +</p> + +<p> With Postfix versions before 2.10, the rules for relay permission +and spam blocking were combined under smtpd_recipient_restrictions, +resulting in error-prone configuration. As of Postfix 2.10, relay +permission rules are preferably implemented with smtpd_relay_restrictions, +so that a permissive spam blocking policy under +smtpd_recipient_restrictions will no longer result in a permissive +mail relay policy. </p> + +<p> For backwards compatibility, sites that migrate from Postfix +versions before 2.10 can set smtpd_relay_restrictions to the empty +value, and use smtpd_recipient_restrictions exactly as before. </p> + +<p> +By default, the Postfix SMTP server accepts: +</p> + +<ul> + +<li> Mail from clients whose IP address matches $mynetworks, or: + +<li> Mail from clients who are SASL authenticated, or: + +<li> Mail to remote destinations that match $relay_domains, except +for addresses that contain sender-specified routing +(user@elsewhere@domain), or: + +<li> Mail to local destinations that match $inet_interfaces +or $proxy_interfaces, $mydestination, $virtual_alias_domains, or +$virtual_mailbox_domains. + +</ul> + +<p> +IMPORTANT: Either the smtpd_relay_restrictions or the +smtpd_recipient_restrictions parameter must specify +at least one of the following restrictions. Otherwise Postfix will +refuse to receive mail: +</p> + +<blockquote> +<pre> +reject, reject_unauth_destination +</pre> +</blockquote> + +<blockquote> +<pre> +defer, defer_if_permit, defer_unauth_destination +</pre> +</blockquote> + +<p> +Specify a list of restrictions, separated by commas and/or whitespace. +Continue long lines by starting the next line with whitespace. +The same restrictions are available as documented under +smtpd_recipient_restrictions. +</p> + +<p> This feature is available in Postix 2.10 and later. </p> + +%CLASS sasl-auth SASL Authentication + +<p> +Postfix SASL support (RFC 4954) can be used to authenticate remote +SMTP clients to the Postfix SMTP server, and to authenticate the +Postfix SMTP client to a remote SMTP server. +See the SASL_README document for details. +</p> + +%PARAM smtpd_sasl_auth_enable no + +<p> +Enable SASL authentication in the Postfix SMTP server. By default, +the Postfix SMTP server does not use authentication. +</p> + +<p> +If a remote SMTP client is authenticated, the permit_sasl_authenticated +access restriction can be used to permit relay access, like this: +</p> + +<blockquote> +<pre> +# With Postfix 2.10 and later, the mail relay policy is +# preferably specified under smtpd_relay_restrictions. +smtpd_relay_restrictions = + permit_mynetworks, permit_sasl_authenticated, ... +</pre> + +<pre> +# With Postfix before 2.10, the relay policy can be +# specified only under smtpd_recipient_restrictions. +smtpd_recipient_restrictions = + permit_mynetworks, permit_sasl_authenticated, ... +</pre> +</blockquote> + +<p> To reject all SMTP connections from unauthenticated clients, +specify "smtpd_delay_reject = yes" (which is the default) and use: +</p> + +<blockquote> +<pre> +smtpd_client_restrictions = permit_sasl_authenticated, reject +</pre> +</blockquote> + +<p> +See the SASL_README file for SASL configuration and operation details. +</p> + +%PARAM smtpd_sasl_authenticated_header no + +<p> Report the SASL authenticated user name in the smtpd(8) Received +message header. </p> + +<p> This feature is available in Postfix 2.3 and later. </p> + +%PARAM smtpd_sasl_exceptions_networks + +<p> +What remote SMTP clients the Postfix SMTP server will not offer +AUTH support to. +</p> + +<p> +Some clients (Netscape 4 at least) have a bug that causes them to +require a login and password whenever AUTH is offered, whether it's +necessary or not. To work around this, specify, for example, +$mynetworks to prevent Postfix from offering AUTH to local clients. +</p> + +<p> +Specify a list of network/netmask patterns, separated by commas +and/or whitespace. The mask specifies the number of bits in the +network part of a host address. You can also specify "/file/name" or +"type:table" patterns. A "/file/name" pattern is replaced by its +contents; a "type:table" lookup table is matched when a table entry +matches a lookup string (the lookup result is ignored). Continue +long lines by starting the next line with whitespace. Specify +"!pattern" to exclude an address or network block from the list. +The form "!/file/name" is supported only in Postfix version 2.4 and +later. </p> + +<p> Note: IP version 6 address information must be specified inside +<tt>[]</tt> in the smtpd_sasl_exceptions_networks value, and in +files specified with "/file/name". IP version 6 addresses contain +the ":" character, and would otherwise be confused with a "type:table" +pattern. </p> + +<p> +Example: +</p> + +<pre> +smtpd_sasl_exceptions_networks = $mynetworks +</pre> + +<p> +This feature is available in Postfix 2.1 and later. +</p> + +%PARAM smtpd_sasl_local_domain + +<p> +The name of the Postfix SMTP server's local SASL authentication +realm. +</p> + +<p> +By default, the local authentication realm name is the null string. +</p> + +<p> +Examples: +</p> + +<pre> +smtpd_sasl_local_domain = $mydomain +smtpd_sasl_local_domain = $myhostname +</pre> + +%PARAM smtpd_sasl_security_options noanonymous + +<p> Postfix SMTP server SASL security options; as of Postfix 2.3 +the list of available +features depends on the SASL server implementation that is selected +with <b>smtpd_sasl_type</b>. </p> + +<p> The following security features are defined for the <b>cyrus</b> +server SASL implementation: </p> + +<p> +Restrict what authentication mechanisms the Postfix SMTP server +will offer to the client. The list of available authentication +mechanisms is system dependent. +</p> + +<p> +Specify zero or more of the following: +</p> + +<dl> + +<dt><b>noplaintext</b></dt> + +<dd>Disallow methods that use plaintext passwords. </dd> + +<dt><b>noactive</b></dt> + +<dd>Disallow methods subject to active (non-dictionary) attack. </dd> + +<dt><b>nodictionary</b></dt> + +<dd>Disallow methods subject to passive (dictionary) attack. </dd> + +<dt><b>noanonymous</b></dt> + +<dd>Disallow methods that allow anonymous authentication. </dd> + +<dt><b>forward_secrecy</b></dt> + +<dd>Only allow methods that support forward secrecy (Dovecot only). +</dd> + +<dt><b>mutual_auth</b></dt> + +<dd>Only allow methods that provide mutual authentication (not available +with Cyrus SASL version 1). </dd> + +</dl> + +<p> +By default, the Postfix SMTP server accepts plaintext passwords but +not anonymous logins. +</p> + +<p> +Warning: it appears that clients try authentication methods in the +order as advertised by the server (e.g., PLAIN ANONYMOUS CRAM-MD5) +which means that if you disable plaintext passwords, clients will +log in anonymously, even when they should be able to use CRAM-MD5. +So, if you disable plaintext logins, disable anonymous logins too. +Postfix treats anonymous login as no authentication. +</p> + +<p> +Example: +</p> + +<pre> +smtpd_sasl_security_options = noanonymous, noplaintext +</pre> + +%PARAM smtpd_sender_login_maps + +<p> +Optional lookup table with the SASL login names that own the sender +(MAIL FROM) addresses. +</p> + +<p> +Specify zero or more "type:name" lookup tables, separated by +whitespace or comma. Tables will be searched in the specified order +until a match is found. With lookups from +indexed files such as DB or DBM, or from networked tables such as +NIS, LDAP or SQL, the following search operations are done with a +sender address of <i>user@domain</i>: </p> + +<dl> + +<dt> 1) <i>user@domain</i> </dt> + +<dd>This table lookup is always done and has the highest precedence. </dd> + +<dt> 2) <i>user</i> </dt> + +<dd>This table lookup is done only when the <i>domain</i> part of the +sender address matches $myorigin, $mydestination, $inet_interfaces +or $proxy_interfaces. </dd> + +<dt> 3) <i>@domain</i> </dt> + +<dd>This table lookup is done last and has the lowest precedence. </dd> + +</dl> + +<p> +In all cases the result of table lookup must be either "not found" +or a list of SASL login names separated by comma and/or whitespace. +</p> + +%PARAM smtpd_sender_restrictions + +<p> +Optional restrictions that the Postfix SMTP server applies in the +context of a client MAIL FROM command. +See SMTPD_ACCESS_README, section "Delayed evaluation of SMTP access +restriction lists" for a discussion of evaluation context and time. +</p> + +<p> +The default is to permit everything. +</p> + +<p> +Specify a list of restrictions, separated by commas and/or whitespace. +Continue long lines by starting the next line with whitespace. +Restrictions are applied in the order as specified; the first +restriction that matches wins. +</p> + +<p> +The following restrictions are specific to the sender address +received with the MAIL FROM command. +</p> + +<dl> + +<dt><b><a name="check_sender_access">check_sender_access</a> <i><a href="DATABASE_README.html">type:table</a></i></b></dt> + +<dd>Search the specified access(5) database for the MAIL FROM +address, domain, parent domains, or localpart@, and execute the +corresponding action. </dd> + +<dt><b><a name="check_sender_a_access">check_sender_a_access</a> <i><a href="DATABASE_README.html">type:table</a></i></b></dt> + +<dd>Search the specified access(5) database for the IP addresses for +the MAIL FROM domain, and execute the corresponding action. Note: +a result of "OK" is not allowed for safety reasons. Instead, use +DUNNO in order to exclude specific hosts from denylists. This +feature is available in Postfix 3.0 and later. </dd> + +<dt><b><a name="check_sender_mx_access">check_sender_mx_access</a> <i><a href="DATABASE_README.html">type:table</a></i></b></dt> + +<dd>Search the specified access(5) database for the MX hosts for +the MAIL FROM domain, and execute the corresponding action. If no +MX record is found, look up A or AAAA records, just like the Postfix +SMTP client would. Note: +a result of "OK" is not allowed for safety reasons. Instead, use +DUNNO in order to exclude specific hosts from denylists. This +feature is available in Postfix 2.1 and later. </dd> + +<dt><b><a name="check_sender_ns_access">check_sender_ns_access</a> <i><a href="DATABASE_README.html">type:table</a></i></b></dt> + +<dd>Search the specified access(5) database for the DNS servers +for the MAIL FROM domain, and execute the corresponding action. +Note: a result of "OK" is not allowed for safety reasons. Instead, +use DUNNO in order to exclude specific hosts from denylists. This +feature is available in Postfix 2.1 and later. </dd> + +<dt><b><a name="reject_authenticated_sender_login_mismatch">reject_authenticated_sender_login_mismatch</a></b></dt> + +<dd>Enforces the reject_sender_login_mismatch restriction for +authenticated clients only. This feature is available in +Postfix version 2.1 and later. </dd> + +<dt><b><a name="reject_known_sender_login_mismatch">reject_known_sender_login_mismatch</a></b></dt> + +<dd>Apply the reject_sender_login_mismatch restriction only to MAIL +FROM addresses that are known in $smtpd_sender_login_maps. This +feature is available in Postfix version 2.11 and later. </dd> + +<dt><b><a name="reject_non_fqdn_sender">reject_non_fqdn_sender</a></b></dt> + +<dd>Reject the request when the MAIL FROM address specifies a +domain that is not in +fully-qualified domain form as required by the RFC. <br> The +non_fqdn_reject_code parameter specifies the response code for +rejected requests (default: 504). </dd> + +<dt><b><a name="reject_rhsbl_sender">reject_rhsbl_sender <i>rbl_domain=d.d.d.d</i></a></b></dt> + +<dd>Reject the request when the MAIL FROM domain is listed with +the A record "<i>d.d.d.d</i>" under <i>rbl_domain</i> (Postfix +version 2.1 and later only). Each "<i>d</i>" is a number, or a +pattern inside "[]" that contains one or more ";"-separated numbers +or number..number ranges (Postfix version 2.8 and later). If no +"<i>=d.d.d.d</i>" is specified, +reject the request when the MAIL FROM domain is +listed with any A record under <i>rbl_domain</i>. <br> The +maps_rbl_reject_code parameter specifies the response code for +rejected requests (default: 554); the default_rbl_reply parameter +specifies the default server reply; and the rbl_reply_maps parameter +specifies tables with server replies indexed by <i>rbl_domain</i>. +This feature is available in Postfix 2.0 and later.</dd> + +<dt><b><a name="reject_sender_login_mismatch">reject_sender_login_mismatch</a></b></dt> + +<dd>Reject the request when $smtpd_sender_login_maps specifies an +owner for the MAIL FROM address, but the client is not (SASL) logged +in as that MAIL FROM address owner; or when the client is (SASL) +logged in, but the client login name doesn't own the MAIL FROM +address according to $smtpd_sender_login_maps.</dd> + +<dt><b><a name="reject_unauthenticated_sender_login_mismatch">reject_unauthenticated_sender_login_mismatch</a></b></dt> + +<dd>Enforces the reject_sender_login_mismatch restriction for +unauthenticated clients only. This feature is available in +Postfix version 2.1 and later. </dd> + +<dt><b><a name="reject_unknown_sender_domain">reject_unknown_sender_domain</a></b></dt> + +<dd>Reject the request when Postfix is not the final destination for +the sender address, and the MAIL FROM domain has 1) no DNS MX and +no DNS A +record, or 2) a malformed MX record such as a record with +a zero-length MX hostname (Postfix version 2.3 and later). <br> The +reply is specified with the unknown_address_reject_code parameter +(default: 450), unknown_address_tempfail_action (default: +defer_if_permit), or 550 (nullmx, Postfix 3.0 and +later). See the respective parameter descriptions for details. +</dd> + +<dt><b><a name="reject_unlisted_sender">reject_unlisted_sender</a></b></dt> + +<dd>Reject the request when the MAIL FROM address is not listed in +the list of valid recipients for its domain class. See the +smtpd_reject_unlisted_sender parameter description for details. +This feature is available in Postfix 2.1 and later.</dd> + +<dt><b><a name="reject_unverified_sender">reject_unverified_sender</a></b></dt> + +<dd>Reject the request when mail to the MAIL FROM address is known to +bounce, or when the sender address destination is not reachable. +Address verification information is managed by the verify(8) server; +see the ADDRESS_VERIFICATION_README file for details. <br> The +unverified_sender_reject_code parameter specifies the numerical +response code when an address is known to bounce (default: 450, +change into 550 when you are confident that it is safe to do so). +<br>The unverified_sender_defer_code specifies the numerical response +code when an address probe failed due to a temporary problem +(default: 450). <br> The unverified_sender_tempfail_action parameter +specifies the action after address probe failure due to a temporary +problem (default: defer_if_permit). <br> This feature breaks for +aliased addresses with "enable_original_recipient = no" (Postfix +≤ 3.2). <br> This feature is available in Postfix 2.1 and later. +</dd> + +</dl> + +<p> +Other restrictions that are valid in this context: +</p> + +<ul> + +<li> <a href="#generic">Generic</a> restrictions that can be used +in any SMTP command context, described under smtpd_client_restrictions. + +<li> SMTP command specific restrictions described under +smtpd_client_restrictions and smtpd_helo_restrictions. + +<li> SMTP command specific restrictions described under +smtpd_recipient_restrictions. When recipient restrictions are listed +under smtpd_sender_restrictions, they have effect only with +"smtpd_delay_reject = yes", so that $smtpd_sender_restrictions is +evaluated at the time of the RCPT TO command. + +</ul> + +<p> +Examples: +</p> + +<pre> +smtpd_sender_restrictions = reject_unknown_sender_domain +smtpd_sender_restrictions = reject_unknown_sender_domain, + check_sender_access hash:/etc/postfix/access +</pre> + +%PARAM smtpd_timeout normal: 300s, overload: 10s + +<p> When the Postfix SMTP server wants to send an SMTP server +response, how long the Postfix SMTP server will wait for an underlying +network write operation to complete; and when the Postfix SMTP +server Postfix wants to receive an SMTP client request, how long +the Postfix SMTP server will wait for an underlying network read +operation to complete. See the smtpd_per_request_deadline for how +this time limit may be enforced (with Postfix 2.9-3.6 see +smtpd_per_record_deadline). </p> + +<p> Normally the default limit +is 300s, but it changes under overload to just 10s. With Postfix +2.5 and earlier, the SMTP server always uses a time limit of 300s +by default. +</p> + +<p> +Note: if you set SMTP time limits to very large values you may have +to update the global ipc_timeout parameter. +</p> + +<p> Specify a non-zero time value (an integral value plus an optional +one-letter suffix that specifies the time unit). Time units: s +(seconds), m (minutes), h (hours), d (days), w (weeks). +The default time unit is s (seconds). </p> + +%PARAM soft_bounce no + +<p> +Safety net to keep mail queued that would otherwise be returned to +the sender. This parameter disables locally-generated bounces, +changes the handling of negative responses from remote servers, +content filters or plugins, +and prevents the Postfix SMTP server from rejecting mail permanently +by changing 5xx reply codes into 4xx. However, soft_bounce is no +cure for address rewriting mistakes or mail routing mistakes. +</p> + +<p> +Note: "soft_bounce = yes" is in some cases implemented by modifying +server responses. Therefore, the response that Postfix logs may +differ from the response that Postfix actually sends or receives. +</p> + +<p> +Example: +</p> + +<pre> +soft_bounce = yes +</pre> + +%PARAM stale_lock_time 500s + +<p> +The time after which a stale exclusive mailbox lockfile is removed. +This is used for delivery to file or mailbox. +</p> + +<p> Specify a non-zero time value (an integral value plus an optional +one-letter suffix that specifies the time unit). Time units: s +(seconds), m (minutes), h (hours), d (days), w (weeks). +The default time unit is s (seconds). </p> + +%PARAM strict_rfc821_envelopes no + +<p> +Require that addresses received in SMTP MAIL FROM and RCPT TO +commands are enclosed with <>, and that those addresses do +not contain RFC 822 style comments or phrases. This stops mail +from poorly written software. +</p> + +<p> +By default, the Postfix SMTP server accepts RFC 822 syntax in MAIL +FROM and RCPT TO addresses. +</p> + +%PARAM swap_bangpath yes + +<p> +Enable the rewriting of "site!user" into "user@site". This is +necessary if your machine is connected to UUCP networks. It is +enabled by default. +</p> + +<p> Note: with Postfix version 2.2, message header address rewriting +happens only when one of the following conditions is true: </p> + +<ul> + +<li> The message is received with the Postfix sendmail(1) command, + +<li> The message is received from a network client that matches +$local_header_rewrite_clients, + +<li> The message is received from the network, and the +remote_header_rewrite_domain parameter specifies a non-empty value. + +</ul> + +<p> To get the behavior before Postfix version 2.2, specify +"local_header_rewrite_clients = static:all". </p> + +<p> +Example: +</p> + +<pre> +swap_bangpath = no +</pre> + +%PARAM syslog_facility mail + +<p> +The syslog facility of Postfix logging. Specify a facility as +defined in syslog.conf(5). The default facility is "mail". +</p> + +<p> +Warning: a non-default syslog_facility setting takes effect only +after a Postfix process has completed initialization. Errors during +process initialization will be logged with the default facility. +Examples are errors while parsing the command line arguments, and +errors while accessing the Postfix main.cf configuration file. +</p> + +%PARAM syslog_name see "postconf -d" output + +<p> +A prefix that is prepended to the process name in syslog +records, so that, for example, "smtpd" becomes "prefix/smtpd". +</p> + +<p> +Warning: a non-default syslog_name setting takes effect only after +a Postfix process has completed initialization. Errors during +process initialization will be logged with the default name. Examples +are errors while parsing the command line arguments, and errors +while accessing the Postfix main.cf configuration file. +</p> + +%PARAM transport_maps + +<p> +Optional lookup tables with mappings from recipient address to +(message delivery transport, next-hop destination). See transport(5) +for details. +</p> + +<p> +Specify zero or more "type:table" lookup tables, separated by +whitespace or comma. Tables will be searched in the specified order +until a match is found. If you use this +feature with local files, run "<b>postmap /etc/postfix/transport</b>" +after making a change. </p> + +<p> Pattern matching of domain names is controlled by the presence +or absence of "transport_maps" in the parent_domain_matches_subdomains +parameter value. </p> + +<p> For safety reasons, as of Postfix 2.3 this feature does not +allow $number substitutions in regular expression maps. </p> + +<p> +Examples: +</p> + +<pre> +transport_maps = dbm:/etc/postfix/transport +transport_maps = hash:/etc/postfix/transport +</pre> + +%PARAM transport_retry_time 60s + +<p> +The time between attempts by the Postfix queue manager to contact +a malfunctioning message delivery transport. +</p> + +<p> Specify a non-zero time value (an integral value plus an optional +one-letter suffix that specifies the time unit). Time units: s +(seconds), m (minutes), h (hours), d (days), w (weeks). +The default time unit is s (seconds). </p> + +%PARAM trigger_timeout 10s + +<p> +The time limit for sending a trigger to a Postfix daemon (for +example, the pickup(8) or qmgr(8) daemon). This time limit prevents +programs from getting stuck when the mail system is under heavy +load. +</p> + +<p> Specify a non-zero time value (an integral value plus an optional +one-letter suffix that specifies the time unit). Time units: s +(seconds), m (minutes), h (hours), d (days), w (weeks). +The default time unit is s (seconds). </p> + +%PARAM unknown_address_reject_code 450 + +<p> +The numerical response code when the Postfix SMTP server rejects a +sender or recipient address because its domain is unknown. This +is one of the possible replies from the restrictions +reject_unknown_sender_domain and reject_unknown_recipient_domain. +</p> + +<p> +Do not change this unless you have a complete understanding of RFC 5321. +</p> + +%PARAM unknown_client_reject_code 450 + +<p> +The numerical Postfix SMTP server response code when a client +without valid address <=> name mapping is rejected by the +reject_unknown_client_hostname restriction. The SMTP server always replies +with 450 when the mapping failed due to a temporary error condition. +</p> + +<p> +Do not change this unless you have a complete understanding of RFC 5321. +</p> + +%PARAM unknown_hostname_reject_code 450 + +<p> +The numerical Postfix SMTP server response code when the hostname +specified with the HELO or EHLO command is rejected by the +reject_unknown_helo_hostname restriction. +</p> + +<p> +Do not change this unless you have a complete understanding of RFC 5321. +</p> + +%PARAM unknown_local_recipient_reject_code 550 + +<p> +The numerical Postfix SMTP server response code when a recipient +address is local, and $local_recipient_maps specifies a list of +lookup tables that does not match the recipient. A recipient +address is local when its domain matches $mydestination, +$proxy_interfaces or $inet_interfaces. +</p> + +<p> +The default setting is 550 (reject mail) but it is safer to initially +use 450 (try again later) so you have time to find out if your +local_recipient_maps settings are OK. +</p> + +<p> +Example: +</p> + +<pre> +unknown_local_recipient_reject_code = 450 +</pre> + +<p> +This feature is available in Postfix 2.0 and later. +</p> + +%PARAM unverified_recipient_reject_code 450 + +<p> +The numerical Postfix SMTP server response when a recipient address +is rejected by the reject_unverified_recipient restriction. +</p> + +<p> +Unlike elsewhere in Postfix, you can specify 250 in order to +accept the address anyway. +</p> + +<p> +Do not change this unless you have a complete understanding of RFC 5321. +</p> + +<p> +This feature is available in Postfix 2.1 and later. +</p> + +%PARAM unverified_recipient_defer_code 450 + +<p> +The numerical Postfix SMTP server response when a recipient address +probe fails due to a temporary error condition. +</p> + +<p> +Unlike elsewhere in Postfix, you can specify 250 in order to +accept the address anyway. +</p> + +<p> +Do not change this unless you have a complete understanding of RFC 5321. +</p> + +<p> +This feature is available in Postfix 2.6 and later. +</p> + +%PARAM unverified_sender_reject_code 450 + +<p> +The numerical Postfix SMTP server response code when a recipient +address is rejected by the reject_unverified_sender restriction. +</p> + +<p> +Unlike elsewhere in Postfix, you can specify 250 in order to +accept the address anyway. +</p> + +<p> +Do not change this unless you have a complete understanding of RFC 5321. +</p> + +<p> +This feature is available in Postfix 2.1 and later. +</p> + +%PARAM unverified_sender_defer_code 450 + +<p> +The numerical Postfix SMTP server response code when a sender address +probe fails due to a temporary error condition. +</p> + +<p> +Unlike elsewhere in Postfix, you can specify 250 in order to +accept the address anyway. +</p> + +<p> +Do not change this unless you have a complete understanding of RFC 5321. +</p> + +<p> +This feature is available in Postfix 2.6 and later. +</p> + +%PARAM virtual_alias_domains $virtual_alias_maps + +<p> Postfix is the final destination for the specified list of virtual +alias domains, that is, domains for which all addresses are aliased +to addresses in other local or remote domains. The SMTP server +validates recipient addresses with $virtual_alias_maps and rejects +non-existent recipients. See also the virtual alias domain class +in the ADDRESS_CLASS_README file </p> + +<p> +This feature is available in Postfix 2.0 and later. The default +value is backwards compatible with Postfix version 1.1. +</p> + +<p> +The default value is $virtual_alias_maps so that you can keep all +information about virtual alias domains in one place. If you have +many users, it is better to separate information that changes more +frequently (virtual address -> local or remote address mapping) +from information that changes less frequently (the list of virtual +domain names). +</p> + +<p> Specify a list of host or domain names, "/file/name" or +"type:table" patterns, separated by commas and/or whitespace. A +"/file/name" pattern is replaced by its contents; a "type:table" +lookup table is matched when a table entry matches a host or domain name +(the lookup result is ignored). Continue long lines by starting +the next line with whitespace. Specify "!pattern" to exclude a host +or domain name from the list. The form "!/file/name" is supported +only in Postfix version 2.4 and later. </p> + +<p> +See also the VIRTUAL_README and ADDRESS_CLASS_README documents +for further information. +</p> + +<p> +Example: +</p> + +<pre> +virtual_alias_domains = virtual1.tld virtual2.tld +</pre> + +%PARAM virtual_alias_expansion_limit 1000 + +<p> +The maximal number of addresses that virtual alias expansion produces +from each original recipient. +</p> + +<p> +This feature is available in Postfix 2.1 and later. +</p> + +%PARAM virtual_alias_maps $virtual_maps + +<p> +Optional lookup tables that alias specific mail addresses or domains +to other local or remote addresses. The table format and lookups +are documented in virtual(5). For an overview of Postfix address +manipulations see the ADDRESS_REWRITING_README document. +</p> + +<p> +This feature is available in Postfix 2.0 and later. The default +value is backwards compatible with Postfix version 1.1. +</p> + +<p> +Specify zero or more "type:name" lookup tables, separated by +whitespace or comma. Tables will be searched in the specified order +until a match is found. +Note: these lookups are recursive. +</p> + +<p> +If you use this feature with indexed files, run "<b>postmap +/etc/postfix/virtual</b>" after changing the file. +</p> + +<p> +Examples: +</p> + +<pre> +virtual_alias_maps = dbm:/etc/postfix/virtual +virtual_alias_maps = hash:/etc/postfix/virtual +</pre> + +%PARAM virtual_alias_recursion_limit 1000 + +<p> +The maximal nesting depth of virtual alias expansion. Currently +the recursion limit is applied only to the left branch of the +expansion graph, so the depth of the tree can in the worst case +reach the sum of the expansion and recursion limits. This may +change in the future. +</p> + +<p> +This feature is available in Postfix 2.1 and later. +</p> + +%CLASS trouble-shooting Trouble shooting + +<p> +The DEBUG_README document describes how to debug parts of the +Postfix mail system. The methods vary from making the software log +a lot of detail, to running some daemon processes under control of +a call tracer or debugger. +</p> + +%PARAM debugger_command + +<p> +The external command to execute when a Postfix daemon program is +invoked with the -D option. +</p> + +<p> +Use "command .. & sleep 5" so that the debugger can attach before +the process marches on. If you use an X-based debugger, be sure to +set up your XAUTHORITY environment variable before starting Postfix. +</p> + +<p> +Note: the command is subject to $name expansion, before it is +passed to the default command interpreter. Specify "$$" to +produce a single "$" character. +</p> + +<p> +Example: +</p> + +<pre> +debugger_command = + PATH=/usr/bin:/usr/X11R6/bin + ddd $daemon_directory/$process_name $process_id & sleep 5 +</pre> + +%PARAM 2bounce_notice_recipient postmaster + +<p> The recipient of undeliverable mail that cannot be returned to +the sender. This feature is enabled with the notify_classes +parameter. </p> + +%PARAM address_verify_service_name verify + +<p> +The name of the verify(8) address verification service. This service +maintains the status of sender and/or recipient address verification +probes, and generates probes on request by other Postfix processes. +</p> + +%PARAM alternate_config_directories + +<p> +A list of non-default Postfix configuration directories that may +be specified with "-c config_directory" on the command line (in the +case of sendmail(1), with the "-C" option), or via the MAIL_CONFIG +environment parameter. +</p> + +<p> +This list must be specified in the default Postfix main.cf file, +and will be used by set-gid Postfix commands such as postqueue(1) +and postdrop(1). +</p> + +<p> +Specify absolute pathnames, separated by comma or space. Note: $name +expansion is not supported. +</p> + +%PARAM append_at_myorigin yes + +<p> +With locally submitted mail, append the string "@$myorigin" to mail +addresses without domain information. With remotely submitted mail, +append the string "@$remote_header_rewrite_domain" instead. +</p> + +<p> +Note 1: this feature is enabled by default and must not be turned off. +Postfix does not support domain-less addresses. +</p> + +<p> Note 2: with Postfix version 2.2, message header address rewriting +happens only when one of the following conditions is true: </p> + +<ul> + +<li> The message is received with the Postfix sendmail(1) command, + +<li> The message is received from a network client that matches +$local_header_rewrite_clients, + +<li> The message is received from the network, and the +remote_header_rewrite_domain parameter specifies a non-empty value. + +</ul> + +<p> To get the behavior before Postfix version 2.2, specify +"local_header_rewrite_clients = static:all". </p> + +%PARAM append_dot_mydomain Postfix ≥ 3.0: no, Postfix < 3.0: yes + +<p> +With locally submitted mail, append the string ".$mydomain" to +addresses that have no ".domain" information. With remotely submitted +mail, append the string ".$remote_header_rewrite_domain" +instead. +</p> + +<p> +Note 1: this feature is enabled by default. If disabled, users will not be +able to send mail to "user@partialdomainname" but will have to +specify full domain names instead. +</p> + +<p> Note 2: with Postfix version 2.2, message header address rewriting +happens only when one of the following conditions is true: </p> + +<ul> + +<li> The message is received with the Postfix sendmail(1) command, + +<li> The message is received from a network client that matches +$local_header_rewrite_clients, + +<li> The message is received from the network, and the +remote_header_rewrite_domain parameter specifies a non-empty value. + +</ul> + +<p> To get the behavior before Postfix version 2.2, specify +"local_header_rewrite_clients = static:all". </p> + +%PARAM application_event_drain_time 100s + +<p> +How long the postkick(1) command waits for a request to enter the +Postfix daemon process input buffer before giving up. +</p> + +<p> Specify a non-zero time value (an integral value plus an optional +one-letter suffix that specifies the time unit). Time units: s +(seconds), m (minutes), h (hours), d (days), w (weeks). +The default time unit is s (seconds). </p> + +<p> +This feature is available in Postfix 2.1 and later. +</p> + +%PARAM authorized_flush_users static:anyone + +<p> +List of users who are authorized to flush the queue. +</p> + +<p> +By default, all users are allowed to flush the queue. Access is +always granted if the invoking user is the super-user or the +$mail_owner user. Otherwise, the real UID of the process is looked +up in the system password file, and access is granted only if the +corresponding login name is on the access list. The username +"unknown" is used for processes whose real UID is not found in the +password file. </p> + +<p> +Specify a list of user names, "/file/name" or "type:table" patterns, +separated by commas and/or whitespace. The list is matched left to +right, and the search stops on the first match. A "/file/name" +pattern is replaced +by its contents; a "type:table" lookup table is matched when a name +matches a lookup key (the lookup result is ignored). Continue long +lines by starting the next line with whitespace. Specify "!pattern" +to exclude a name from the list. The form "!/file/name" is supported +only in Postfix version 2.4 and later. </p> + +<p> +This feature is available in Postfix 2.2 and later. +</p> + +%PARAM authorized_mailq_users static:anyone + +<p> +List of users who are authorized to view the queue. +</p> + +<p> +By default, all users are allowed to view the queue. Access is +always granted if the invoking user is the super-user or the +$mail_owner user. Otherwise, the real UID of the process is looked +up in the system password file, and access is granted only if the +corresponding login name is on the access list. The username +"unknown" is used for processes whose real UID is not found in the +password file. </p> + +<p> +Specify a list of user names, "/file/name" or "type:table" patterns, +separated by commas and/or whitespace. The list is matched left to +right, and the search stops on the first match. A "/file/name" +pattern is replaced +by its contents; a "type:table" lookup table is matched when a name +matches a lookup key (the lookup result is ignored). Continue long +lines by starting the next line with whitespace. Specify "!pattern" +to exclude a user name from the list. The form "!/file/name" is +supported only in Postfix version 2.4 and later. </p> + +<p> +This feature is available in Postfix 2.2 and later. +</p> + +%PARAM authorized_submit_users static:anyone + +<p> +List of users who are authorized to submit mail with the sendmail(1) +command (and with the privileged postdrop(1) helper command). +</p> + +<p> +By default, all users are allowed to submit mail. Otherwise, the +real UID of the process is looked up in the system password file, +and access is granted only if the corresponding login name is on +the access list. The username "unknown" is used for processes +whose real UID is not found in the password file. To deny mail +submission access to all users specify an empty list. </p> + +<p> +Specify a list of user names, "/file/name" or "type:table" patterns, +separated by commas and/or whitespace. The list is matched left to right, +and the search stops on the first match. A "/file/name" pattern is +replaced by its contents; +a "type:table" lookup table is matched when a name matches a lookup key +(the lookup result is ignored). Continue long lines by starting the +next line with whitespace. Specify "!pattern" to exclude a user +name from the list. The form "!/file/name" is supported only in +Postfix version 2.4 and later. </p> + +<p> +Example: +</p> + +<pre> +authorized_submit_users = !www, static:all +</pre> + +<p> +This feature is available in Postfix 2.2 and later. +</p> + +%PARAM backwards_bounce_logfile_compatibility yes + +<p> +Produce additional bounce(8) logfile records that can be read by +Postfix versions before 2.0. The current and more extensible "name = +value" format is needed in order to implement more sophisticated +functionality. +</p> + +<p> +This feature is available in Postfix 2.1 and later. +</p> + +%PARAM bounce_notice_recipient postmaster + +<p> +The recipient of postmaster notifications with the message headers +of mail that Postfix did not deliver and of SMTP conversation +transcripts of mail that Postfix did not receive. This feature is +enabled with the notify_classes parameter. </p> + +%PARAM bounce_service_name bounce + +<p> +The name of the bounce(8) service. This service maintains a record +of failed delivery attempts and generates non-delivery notifications. +</p> + +<p> +This feature is available in Postfix 2.0 and later. +</p> + +%PARAM broken_sasl_auth_clients no + +<p> +Enable interoperability with remote SMTP clients that implement an obsolete +version of the AUTH command (RFC 4954). Examples of such clients +are MicroSoft Outlook Express version 4 and MicroSoft Exchange +version 5.0. +</p> + +<p> +Specify "broken_sasl_auth_clients = yes" to have Postfix advertise +AUTH support in a non-standard way. +</p> + +%PARAM cleanup_service_name cleanup + +<p> +The name of the cleanup(8) service. This service rewrites addresses +into the standard form, and performs canonical(5) address mapping +and virtual(5) aliasing. +</p> + +<p> +This feature is available in Postfix 2.0 and later. +</p> + +%PARAM anvil_status_update_time 600s + +<p> +How frequently the anvil(8) connection and rate limiting server +logs peak usage information. +</p> + +<p> Specify a non-zero time value (an integral value plus an optional +one-letter suffix that specifies the time unit). Time units: s +(seconds), m (minutes), h (hours), d (days), w (weeks). +The default time unit is s (seconds). </p> + +<p> +This feature is available in Postfix 2.2 and later. +</p> + +%PARAM enable_errors_to no + +<p> Report mail delivery errors to the address specified with the +non-standard Errors-To: message header, instead of the envelope +sender address (this feature is removed with Postfix version 2.2, is +turned off by default with Postfix version 2.1, and is always turned on +with older Postfix versions). </p> + +%PARAM extract_recipient_limit 10240 + +<p> +The maximal number of recipient addresses that Postfix will extract +from message headers when mail is submitted with "<b>sendmail -t</b>". +</p> + +<p> +This feature was removed in Postfix version 2.1. +</p> + +%PARAM anvil_rate_time_unit 60s + +<p> +The time unit over which client connection rates and other rates +are calculated. +</p> + +<p> +This feature is implemented by the anvil(8) service which is available +in Postfix version 2.2 and later. +</p> + +<p> +The default interval is relatively short. Because of the high +frequency of updates, the anvil(8) server uses volatile memory +only. Thus, information is lost whenever the process terminates. +</p> + +<p> Specify a non-zero time value (an integral value plus an optional +one-letter suffix that specifies the time unit). Time units: s +(seconds), m (minutes), h (hours), d (days), w (weeks). +The default time unit is s (seconds). </p> + +%PARAM command_expansion_filter see "postconf -d" output + +<p> +Restrict the characters that the local(8) delivery agent allows in +$name expansions of $mailbox_command and $command_execution_directory. +Characters outside the +allowed set are replaced by underscores. +</p> + +%PARAM content_filter + +<p> After the message is queued, send the entire message to the +specified <i>transport:destination</i>. The <i>transport</i> name +specifies the first field of a mail delivery agent definition in +master.cf; the syntax of the next-hop <i>destination</i> is described +in the manual page of the corresponding delivery agent. More +information about external content filters is in the Postfix +FILTER_README file. </p> + +<p> Notes: </p> + +<ul> + +<li> <p> This setting has lower precedence than a FILTER action +that is specified in an access(5), header_checks(5) or body_checks(5) +table. </p> + +<li> <p> The meaning of an empty next-hop filter <i>destination</i> +is version dependent. Postfix 2.7 and later will use the recipient +domain; earlier versions will use $myhostname. Specify +"default_filter_nexthop = $myhostname" for compatibility with Postfix +2.6 or earlier, or specify a content_filter value with an explicit +next-hop <i>destination</i>. </p> + +</ul> + +%PARAM default_delivery_slot_discount 50 + +<p> +The default value for transport-specific _delivery_slot_discount +settings. +</p> + +<p> +This parameter speeds up the moment when a message preemption can +happen. Instead of waiting until the full amount of delivery slots +required is available, the preemption can happen when +<i>transport</i>_delivery_slot_discount percent of the required amount +plus <i>transport</i>_delivery_slot_loan still remains to be accumulated. +Note that the full amount will still have to be accumulated before +another preemption can take place later. +</p> + +<p> Use <i>transport</i>_delivery_slot_discount to specify a +transport-specific override, where <i>transport</i> is the master.cf +name of the message delivery transport. +</p> + +%PARAM default_delivery_slot_loan 3 + +<p> +The default value for transport-specific _delivery_slot_loan +settings. +</p> + +<p> +This parameter speeds up the moment when a message preemption can +happen. Instead of waiting until the full amount of delivery slots +required is available, the preemption can happen when +transport_delivery_slot_discount percent of the required amount +plus transport_delivery_slot_loan still remains to be accumulated. +Note that the full amount will still have to be accumulated before +another preemption can take place later. +</p> + +<p> Use <i>transport</i>_delivery_slot_loan to specify a +transport-specific override, where <i>transport</i> is the master.cf +name of the message delivery transport. +</p> + +%CLASS verp VERP Support + +<p> +With VERP style delivery, each recipient of a message receives a +customized copy of the message with his/her own recipient address +encoded in the envelope sender address. The VERP_README file +describes configuration and operation details of Postfix support +for variable envelope return path addresses. VERP style delivery +is requested with the SMTP XVERP command or with the "<b>sendmail +-V</b>" command-line option and is available in Postfix +1.1 and later. +</p> + +%PARAM default_verp_delimiters += + +<p> The two default VERP delimiter characters. These are used when +no explicit delimiters are specified with the SMTP XVERP command +or with the "<b>sendmail -XV</b>" command-line option (Postfix 2.2 +and earlier: <b>-V</b>). Specify characters that are allowed by the +verp_delimiter_filter setting. +</p> + +<p> +This feature is available in Postfix 1.1 and later. +</p> + +%PARAM defer_service_name defer + +<p> +The name of the defer service. This service is implemented by the +bounce(8) daemon and maintains a record +of failed delivery attempts and generates non-delivery notifications. +</p> + +<p> +This feature is available in Postfix 2.0 and later. +</p> + +%PARAM delay_notice_recipient postmaster + +<p> +The recipient of postmaster notifications with the message headers +of mail that cannot be delivered within $delay_warning_time time +units. </p> + +<p> +See also: delay_warning_time, notify_classes. +</p> + +%PARAM delay_warning_time 0h + +<p> +The time after which the sender receives a copy of the message +headers of mail that is still queued. The confirm_delay_cleared +parameter controls sender notification when the delay clears up. +</p> + +<p> +To enable this feature, specify a non-zero time value (an integral +value plus an optional one-letter suffix that specifies the time +unit). +</p> + +<p> +Time units: s (seconds), m (minutes), h (hours), d (days), w (weeks). +The default time unit is h (hours). +</p> + +<p> +See also: delay_notice_recipient, notify_classes, confirm_delay_cleared. +</p> + +%PARAM confirm_delay_cleared no + +<p> After sending a "your message is delayed" notification, inform +the sender when the delay clears up. This can result in a sudden +burst of notifications at the end of a prolonged network outage, +and is therefore disabled by default. </p> + +<p> See also: delay_warning_time. </p> + +<p> This feature is available in Postfix 3.0 and later. </p> + +%PARAM disable_dns_lookups no + +<p> +Disable DNS lookups in the Postfix SMTP and LMTP clients. When +disabled, hosts are looked up with the getaddrinfo() system +library routine which normally also looks in /etc/hosts. As of +Postfix 2.11, this parameter is deprecated; use smtp_dns_support_level +instead. +</p> + +<p> +DNS lookups are enabled by default. +</p> + +%CLASS mime MIME Processing + +<p> +MIME processing is available in Postfix as of version 2.0. Older +Postfix versions do not recognize MIME headers inside the message +body. +</p> + +%PARAM disable_mime_input_processing no + +<p> +Turn off MIME processing while receiving mail. This means that no +special treatment is given to Content-Type: message headers, and +that all text after the initial message headers is considered to +be part of the message body. +</p> + +<p> +This feature is available in Postfix 2.0 and later. +</p> + +<p> +Mime input processing is enabled by default, and is needed in order +to recognize MIME headers in message content. +</p> + +%PARAM disable_mime_output_conversion no + +<p> +Disable the conversion of 8BITMIME format to 7BIT format. Mime +output conversion is needed when the destination does not advertise +8BITMIME support. +</p> + +<p> +This feature is available in Postfix 2.0 and later. +</p> + +%PARAM disable_verp_bounces no + +<p> +Disable sending one bounce report per recipient. +</p> + +<p> +The default, one per recipient, is what ezmlm needs. +</p> + +<p> +This feature is available in Postfix 1.1 and later. +</p> + +%PARAM dont_remove 0 + +<p> +Don't remove queue files and save them to the "saved" mail queue. +This is a debugging aid. To inspect the envelope information and +content of a Postfix queue file, use the postcat(1) command. +</p> + +%PARAM empty_address_recipient MAILER-DAEMON + +<p> +The recipient of mail addressed to the null address. Postfix does +not accept such addresses in SMTP commands, but they may still be +created locally as the result of configuration or software error. +</p> + +%PARAM error_notice_recipient postmaster + +<p> The recipient of postmaster notifications about mail delivery +problems that are caused by policy, resource, software or protocol +errors. These notifications are enabled with the notify_classes +parameter. </p> + +%PARAM error_service_name error + +<p> +The name of the error(8) pseudo delivery agent. This service always +returns mail as undeliverable. +</p> + +<p> +This feature is available in Postfix 2.0 and later. +</p> + +%PARAM expand_owner_alias no + +<p> +When delivering to an alias "<i>aliasname</i>" that has an +"owner-<i>aliasname</i>" companion alias, set the envelope sender +address to the expansion of the "owner-<i>aliasname</i>" alias. +Normally, Postfix sets the envelope sender address to the name of +the "owner-<i>aliasname</i>" alias. +</p> + +%PARAM fallback_transport + +<p> +Optional message delivery transport that the local(8) delivery +agent should use for names that are not found in the aliases(5) +or UNIX password database. +</p> + +<p> The precedence of local(8) delivery features from high to low +is: aliases, .forward files, mailbox_transport_maps, mailbox_transport, +mailbox_command_maps, mailbox_command, home_mailbox, mail_spool_directory, +fallback_transport_maps, fallback_transport and luser_relay. </p> + +%PARAM fault_injection_code 0 + +<p> +Force specific internal tests to fail, to test the handling of +errors that are difficult to reproduce otherwise. +</p> + +%PARAM flush_service_name flush + +<p> +The name of the flush(8) service. This service maintains per-destination +logfiles with the queue file names of mail that is queued for those +destinations. +</p> + +<p> +This feature is available in Postfix 2.0 and later. +</p> + +%PARAM forward_expansion_filter see "postconf -d" output + +<p> +Restrict the characters that the local(8) delivery agent allows in +$name expansions of $forward_path. Characters outside the +allowed set are replaced by underscores. +</p> + +%PARAM header_address_token_limit 10240 + +<p> +The maximal number of address tokens are allowed in an address +message header. Information that exceeds the limit is discarded. +The limit is enforced by the cleanup(8) server. +</p> + +%PARAM helpful_warnings yes + +<p> +Log warnings about problematic configuration settings, and provide +helpful suggestions. +</p> + +<p> +This feature is available in Postfix 2.0 and later. +</p> + +%PARAM lmtp_cache_connection yes + +<p> +Keep Postfix LMTP client connections open for up to $max_idle +seconds. When the LMTP client receives a request for the same +connection the connection is reused. +</p> + +<p> This parameter is available in Postfix version 2.2 and earlier. +With Postfix version 2.3 and later, see lmtp_connection_cache_on_demand, +lmtp_connection_cache_destinations, or lmtp_connection_reuse_time_limit. +</p> + +<p> +The effectiveness of cached connections will be determined by the +number of remote LMTP servers in use, and the concurrency limit specified +for the Postfix LMTP client. Cached connections are closed under any of +the following conditions: +</p> + +<ul> + +<li> The Postfix LMTP client idle time limit is reached. This limit is +specified with the Postfix max_idle configuration parameter. + +<li> A delivery request specifies a different destination than the +one currently cached. + +<li> The per-process limit on the number of delivery requests is +reached. This limit is specified with the Postfix max_use +configuration parameter. + +<li> Upon the onset of another delivery request, the remote LMTP server +associated with the current session does not respond to the RSET +command. + +</ul> + +<p> +Most of these limitations have been with the Postfix +connection cache that is shared among multiple LMTP client +programs. +</p> + +%PARAM lmtp_sasl_auth_enable no + +<p> +Enable SASL authentication in the Postfix LMTP client. +</p> + +%PARAM lmtp_sasl_password_maps + +<p> +Optional Postfix LMTP client lookup tables with one username:password entry +per host or domain. If a remote host or domain has no username:password +entry, then the Postfix LMTP client will not attempt to authenticate +to the remote host. +</p> + +%PARAM lmtp_sasl_security_options noplaintext, noanonymous + +<p> SASL security options; as of Postfix 2.3 the list of available +features depends on the SASL client implementation that is selected +with <b>lmtp_sasl_type</b>. </p> + +<p> The following security features are defined for the <b>cyrus</b> +client SASL implementation: </p> + +<dl> + +<dt><b>noplaintext</b></dt> + +<dd>Disallow authentication methods that use plaintext passwords. </dd> + +<dt><b>noactive</b></dt> + +<dd>Disallow authentication methods that are vulnerable to non-dictionary +active attacks. </dd> + +<dt><b>nodictionary</b></dt> + +<dd>Disallow authentication methods that are vulnerable to passive +dictionary attacks. </dd> + +<dt><b>noanonymous</b></dt> + +<dd>Disallow anonymous logins. </dd> + +</dl> + +<p> +Example: +</p> + +<pre> +lmtp_sasl_security_options = noplaintext +</pre> + +%PARAM lmtp_tcp_port 24 + +<p> +The default TCP port that the Postfix LMTP client connects to. +Specify a symbolic name (see services(5)) or a numeric port. +</p> + +%PARAM smtp_tcp_port smtp + +<p> +The default TCP port that the Postfix SMTP client connects to. +Specify a symbolic name (see services(5)) or a numeric port. +</p> + +%PARAM mail_release_date see "postconf -d" output + +<p> +The Postfix release date, in "YYYYMMDD" format. +</p> + +%PARAM mailbox_command_maps + +<p> +Optional lookup tables with per-recipient external commands to use +for local(8) mailbox delivery. Behavior is as with mailbox_command. +</p> + +<p> The precedence of local(8) delivery features from high to low +is: aliases, .forward files, mailbox_transport_maps, mailbox_transport, +mailbox_command_maps, mailbox_command, home_mailbox, mail_spool_directory, +fallback_transport_maps, fallback_transport and luser_relay. </p> + +<p> +Specify zero or more "type:name" lookup tables, separated by +whitespace or comma. Tables will be searched in the specified order +until a match is found. +</p> + +%PARAM mailbox_delivery_lock see "postconf -d" output + +<p> +How to lock a UNIX-style local(8) mailbox before attempting delivery. +For a list of available file locking methods, use the "<b>postconf +-l</b>" command. +</p> + +<p> +This setting is ignored with <b>maildir</b> style delivery, +because such deliveries are safe without explicit locks. +</p> + +<p> +Note: The <b>dotlock</b> method requires that the recipient UID or +GID has write access to the parent directory of the mailbox file. +</p> + +<p> +Note: the default setting of this parameter is system dependent. +</p> + +%PARAM mailbox_transport + +<p> +Optional message delivery transport that the local(8) delivery +agent should use for mailbox delivery to all local recipients, +whether or not they are found in the UNIX passwd database. +</p> + +<p> The precedence of local(8) delivery features from high to low +is: aliases, .forward files, mailbox_transport_maps, mailbox_transport, +mailbox_command_maps, mailbox_command, home_mailbox, mail_spool_directory, +fallback_transport_maps, fallback_transport and luser_relay. </p> + +%PARAM mailq_path see "postconf -d" output + +<p> +Sendmail compatibility feature that specifies where the Postfix +mailq(1) command is installed. This command can be used to +list the Postfix mail queue. +</p> + +%PARAM manpage_directory see "postconf -d" output + +<p> +Where the Postfix manual pages are installed. +</p> + +%PARAM maps_rbl_domains + +<p> +Obsolete feature: use the reject_rbl_client feature instead. +</p> + +%PARAM mime_boundary_length_limit 2048 + +<p> +The maximal length of MIME multipart boundary strings. The MIME +processor is unable to distinguish between boundary strings that +do not differ in the first $mime_boundary_length_limit characters. +</p> + +<p> +This feature is available in Postfix 2.0 and later. +</p> + +%PARAM mime_header_checks $header_checks + +<p> +Optional lookup tables for content inspection of MIME related +message headers, as described in the header_checks(5) manual page. +</p> + +<p> +This feature is available in Postfix 2.0 and later. +</p> + +%PARAM mime_nesting_limit 100 + +<p> +The maximal recursion level that the MIME processor will handle. +Postfix refuses mail that is nested deeper than the specified limit. +</p> + +<p> +This feature is available in Postfix 2.0 and later. +</p> + +%PARAM mynetworks_style Postfix ≥ 3.0: host, Postfix < 3.0: subnet + +<p> +The method to generate the default value for the mynetworks parameter. +This is the list of trusted networks for relay access control etc. +</p> + +<ul> + +<li><p>Specify "mynetworks_style = host" when Postfix should +"trust" only the local machine. </p> + +<li><p>Specify "mynetworks_style = subnet" when Postfix +should "trust" remote SMTP clients in the same IP subnetworks as the local +machine. On Linux, this works correctly only with interfaces +specified with the "ifconfig" or "ip" command. </p> + +<li><p>Specify "mynetworks_style = class" when Postfix should +"trust" remote SMTP clients in the same IP class A/B/C networks as the +local machine. Caution: this may cause +Postfix to "trust" your entire provider's network. Instead, specify +an explicit mynetworks list by hand, as described with the mynetworks +configuration parameter. </p> + +</ul> + +%PARAM nested_header_checks $header_checks + +<p> +Optional lookup tables for content inspection of non-MIME message +headers in attached messages, as described in the header_checks(5) +manual page. +</p> + +<p> +This feature is available in Postfix 2.0 and later. +</p> + +%PARAM newaliases_path see "postconf -d" output + +<p> +Sendmail compatibility feature that specifies the location of the +newaliases(1) command. This command can be used to rebuild the +local(8) aliases(5) database. +</p> + +%PARAM non_fqdn_reject_code 504 + +<p> +The numerical Postfix SMTP server reply code when a client request +is rejected by the reject_non_fqdn_helo_hostname, reject_non_fqdn_sender +or reject_non_fqdn_recipient restriction. +</p> + +%PARAM owner_request_special yes + +<p> +Enable special treatment for owner-<i>listname</i> entries in the +aliases(5) file, and don't split owner-<i>listname</i> and +<i>listname</i>-request address localparts when the recipient_delimiter +is set to "-". This feature is useful for mailing lists. +</p> + +%PARAM permit_mx_backup_networks + +<p> +Restrict the use of the permit_mx_backup SMTP access feature to +only domains whose primary MX hosts match the listed networks. +The parameter value syntax is the same as with the mynetworks +parameter; note, however, that the default value is empty. </p> + +<p> Pattern matching of domain names is controlled by the presence +or absence of "permit_mx_backup_networks" in the +parent_domain_matches_subdomains parameter value. </p> + +%PARAM pickup_service_name pickup + +<p> +The name of the pickup(8) service. This service picks up local mail +submissions from the Postfix maildrop queue. +</p> + +<p> +This feature is available in Postfix 2.0 and later. +</p> + +%PARAM prepend_delivered_header command, file, forward + +<p> The message delivery contexts where the Postfix local(8) delivery +agent prepends a Delivered-To: message header with the address +that the mail was delivered to. This information is used for mail +delivery loop detection. </p> + +<p> +By default, the Postfix local delivery agent prepends a Delivered-To: +header when forwarding mail and when delivering to file (mailbox) +and command. Turning off the Delivered-To: header when forwarding +mail is not recommended. +</p> + +<p> +Specify zero or more of <b>forward</b>, <b>file</b>, or <b>command</b>. +</p> + +<p> +Example: +</p> + +<pre> +prepend_delivered_header = forward +</pre> + +%PARAM process_name read-only + +<p> +The process name of a Postfix command or daemon process. +</p> + +%PARAM service_name read-only + +<p> The master.cf service name of a Postfix daemon process. This +can be used to distinguish the logging from different services that +use the same program name. </p> + +<p> Example master.cf entries: </p> + +<pre> +# Distinguish inbound MTA logging from submission and smtps logging. +smtp inet n - n - - smtpd +submission inet n - n - - smtpd + -o syslog_name=postfix/$service_name +smtps inet n - n - - smtpd + -o syslog_name=postfix/$service_name +</pre> + +<pre> +# Distinguish outbound MTA logging from inbound relay logging. +smtp unix - - n - - smtp +relay unix - - n - - smtp + -o syslog_name=postfix/$service_name +</pre> + +%PARAM process_id read-only + +<p> +The process ID of a Postfix command or daemon process. +</p> + +%PARAM process_id_directory pid + +<p> +The location of Postfix PID files relative to $queue_directory. +This is a read-only parameter. +</p> + +%PARAM proxy_read_maps see "postconf -d" output + +<p> +The lookup tables that the proxymap(8) server is allowed to +access for the read-only service. +</p> + +<p> +Specify zero or more "type:name" lookup tables, separated by +whitespace or comma. +Table references that don't begin with proxy: are ignored. +</p> + +<p> +This feature is available in Postfix 2.0 and later. +</p> + +%PARAM proxy_write_maps see "postconf -d" output + +<p> The lookup tables that the proxymap(8) server is allowed to +access for the read-write service. Postfix-owned local database +files should be stored under the Postfix-owned data_directory. +Table references that don't begin with proxy: are ignored. </p> + +<p> +This feature is available in Postfix 2.5 and later. +</p> + +%PARAM qmgr_clog_warn_time 300s + +<p> +The minimal delay between warnings that a specific destination is +clogging up the Postfix active queue. Specify 0 to disable. +</p> + +<p> Specify a non-negative time value (an integral value plus an optional +one-letter suffix that specifies the time unit). Time units: s +(seconds), m (minutes), h (hours), d (days), w (weeks). +The default time unit is s (seconds). </p> + +<p> +This feature is enabled with the helpful_warnings parameter. +</p> + +<p> +This feature is available in Postfix 2.0 and later. +</p> + +%PARAM qmgr_fudge_factor 100 + +<p> +Obsolete feature: the percentage of delivery resources that a busy +mail system will use up for delivery of a large mailing list +message. +</p> + +<p> +This feature exists only in the oqmgr(8) old queue manager. The +current queue manager solves the problem in a better way. +</p> + +%PARAM queue_directory see "postconf -d" output + +<p> +The location of the Postfix top-level queue directory. This is the +root directory of Postfix daemon processes that run chrooted. +</p> + +%PARAM queue_file_attribute_count_limit 100 + +<p> +The maximal number of (name=value) attributes that may be stored +in a Postfix queue file. The limit is enforced by the cleanup(8) +server. +</p> + +<p> +This feature is available in Postfix 2.0 and later. +</p> + +%PARAM queue_service_name qmgr + +<p> +The name of the qmgr(8) service. This service manages the Postfix +queue and schedules delivery requests. +</p> + +<p> +This feature is available in Postfix 2.0 and later. +</p> + +%PARAM html_directory see "postconf -d" output + +<p> +The location of Postfix HTML files that describe how to build, +configure or operate a specific Postfix subsystem or feature. +</p> + +%PARAM readme_directory see "postconf -d" output + +<p> +The location of Postfix README files that describe how to build, +configure or operate a specific Postfix subsystem or feature. +</p> + +%PARAM relay_transport relay + +<p> +The default mail delivery transport and next-hop destination for +remote delivery to domains listed with $relay_domains. In order of +decreasing precedence, the nexthop destination is taken from +$relay_transport, $sender_dependent_relayhost_maps, $relayhost, or +from the recipient domain. This information can be overruled with +the transport(5) table. +</p> + +<p> +Specify a string of the form <i>transport:nexthop</i>, where <i>transport</i> +is the name of a mail delivery transport defined in master.cf. +The <i>:nexthop</i> destination is optional; its syntax is documented +in the manual page of the corresponding delivery agent. +</p> + +<p> +See also the relay domains address class in the ADDRESS_CLASS_README +file. +</p> + +<p> +This feature is available in Postfix 2.0 and later. +</p> + +%PARAM rewrite_service_name rewrite + +<p> +The name of the address rewriting service. This service rewrites +addresses to standard form and resolves them to a (delivery method, +next-hop host, recipient) triple. +</p> + +<p> +This feature is available in Postfix 2.0 and later. +</p> + +%PARAM sample_directory /etc/postfix + +<p> +The name of the directory with example Postfix configuration files. +Starting with Postfix 2.1, these files have been replaced with the +postconf(5) manual page. +</p> + +%PARAM sender_based_routing no + +<p> +This parameter should not be used. It was replaced by sender_dependent_relayhost_maps +in Postfix version 2.3. +</p> + +%PARAM sendmail_path see "postconf -d" output + +<p> +A Sendmail compatibility feature that specifies the location of +the Postfix sendmail(1) command. This command can be used to +submit mail into the Postfix queue. +</p> + +%PARAM service_throttle_time 60s + +<p> +How long the Postfix master(8) waits before forking a server that +appears to be malfunctioning. +</p> + +<p> Specify a non-zero time value (an integral value plus an optional +one-letter suffix that specifies the time unit). Time units: s +(seconds), m (minutes), h (hours), d (days), w (weeks). +The default time unit is s (seconds). </p> + +%PARAM setgid_group postdrop + +<p> +The group ownership of set-gid Postfix commands and of group-writable +Postfix directories. When this parameter value is changed you need +to re-run "<b>postfix set-permissions</b>" (with Postfix version 2.0 and +earlier: "<b>/etc/postfix/post-install set-permissions</b>". +</p> + +%PARAM show_user_unknown_table_name yes + +<p> +Display the name of the recipient table in the "User unknown" +responses. The extra detail makes troubleshooting easier but also +reveals information that is nobody else's business. +</p> + +<p> +This feature is available in Postfix 2.0 and later. +</p> + +%PARAM showq_service_name showq + +<p> +The name of the showq(8) service. This service produces mail queue +status reports. +</p> + +<p> +This feature is available in Postfix 2.0 and later. +</p> + +%PARAM smtp_pix_workaround_delay_time 10s + +<p> +How long the Postfix SMTP client pauses before sending +".<CR><LF>" in order to work around the PIX firewall +"<CR><LF>.<CR><LF>" bug. +</p> + +<p> +Choosing too short a time makes this workaround ineffective when +sending large messages over slow network connections. +</p> + +<p> Specify a non-zero time value (an integral value plus an optional +one-letter suffix that specifies the time unit). Time units: s +(seconds), m (minutes), h (hours), d (days), w (weeks). +The default time unit is s (seconds). </p> + +%PARAM smtp_randomize_addresses yes + +<p> +Randomize the order of equal-preference MX host addresses. This +is a performance feature of the Postfix SMTP client. +</p> + +%PARAM smtp_rset_timeout 20s + +<p> The Postfix SMTP client time limit for sending the RSET command, +and for receiving the remote SMTP server response. The SMTP client +sends RSET in +order to finish a recipient address probe, or to verify that a +cached session is still usable. </p> + +<p> Specify a non-zero time value (an integral value plus an optional +one-letter suffix that specifies the time unit). Time units: s +(seconds), m (minutes), h (hours), d (days), w (weeks). +The default time unit is s (seconds). </p> + +<p> This feature is available in Postfix 2.1 and later. </p> + +%PARAM smtpd_data_restrictions + +<p> +Optional access restrictions that the Postfix SMTP server applies +in the context of the SMTP DATA command. +See SMTPD_ACCESS_README, section "Delayed evaluation of SMTP access +restriction lists" for a discussion of evaluation context and time. +</p> + +<p> +This feature is available in Postfix 2.0 and later. +</p> + +<p> +Specify a list of restrictions, separated by commas and/or whitespace. +Continue long lines by starting the next line with whitespace. +Restrictions are applied in the order as specified; the first +restriction that matches wins. +</p> + +<p> +The following restrictions are valid in this context: +</p> + +<ul> + +<li><a href="#generic">Generic</a> restrictions that can be used +in any SMTP command context, described under smtpd_client_restrictions. + +<li>SMTP command specific restrictions described under +smtpd_client_restrictions, smtpd_helo_restrictions, +smtpd_sender_restrictions or smtpd_recipient_restrictions. + +<li>However, no recipient information is available in the case of +multi-recipient mail. Acting on only one recipient would be misleading, +because any decision will affect all recipients equally. Acting on +all recipients would require a possibly very large amount of memory, +and would also be misleading for the reasons mentioned before. + +</ul> + +<p> +Examples: +</p> + +<pre> +smtpd_data_restrictions = reject_unauth_pipelining +smtpd_data_restrictions = reject_multi_recipient_bounce +</pre> + +%PARAM smtpd_end_of_data_restrictions + +<p> Optional access restrictions that the Postfix SMTP server +applies in the context of the SMTP END-OF-DATA command. +See SMTPD_ACCESS_README, section "Delayed evaluation of SMTP access +restriction lists" for a discussion of evaluation context and time. +</p> + +<p> This feature is available in Postfix 2.2 and later. </p> + +<p> See smtpd_data_restrictions for details and limitations. </p> + +%PARAM smtpd_delay_reject yes + +<p> +Wait until the RCPT TO command before evaluating +$smtpd_client_restrictions, $smtpd_helo_restrictions and +$smtpd_sender_restrictions, or wait until the ETRN command before +evaluating $smtpd_client_restrictions and $smtpd_helo_restrictions. +</p> + +<p> +This feature is turned on by default because some clients apparently +mis-behave when the Postfix SMTP server rejects commands before +RCPT TO. +</p> + +<p> +The default setting has one major benefit: it allows Postfix to log +recipient address information when rejecting a client name/address +or sender address, so that it is possible to find out whose mail +is being rejected. +</p> + +%PARAM smtpd_null_access_lookup_key <> + +<p> +The lookup key to be used in SMTP access(5) tables instead of the +null sender address. +</p> + +%CLASS smtpd-policy SMTP server policy delegation + +<p> +The Postfix SMTP server has a number of built-in mechanisms to +block or accept mail at specific SMTP protocol stages. As of version +2.1 Postfix can be configured to delegate policy decisions to an +external server that runs outside Postfix. See the file +SMTPD_POLICY_README for more information. +</p> + +%PARAM smtpd_policy_service_max_idle 300s + +<p> +The time after which an idle SMTPD policy service connection is +closed. +</p> + +<p> Specify a non-zero time value (an integral value plus an optional +one-letter suffix that specifies the time unit). Time units: s +(seconds), m (minutes), h (hours), d (days), w (weeks). +The default time unit is s (seconds). </p> + +<p> +This feature is available in Postfix 2.1 and later. +</p> + +%PARAM smtpd_policy_service_max_ttl 1000s + +<p> +The time after which an active SMTPD policy service connection is +closed. +</p> + +<p> Specify a non-zero time value (an integral value plus an optional +one-letter suffix that specifies the time unit). Time units: s +(seconds), m (minutes), h (hours), d (days), w (weeks). +The default time unit is s (seconds). </p> + +<p> +This feature is available in Postfix 2.1 and later. +</p> + +%PARAM smtpd_policy_service_timeout 100s + +<p> +The time limit for connecting to, writing to, or receiving from a +delegated SMTPD policy server. +</p> + +<p> Specify a non-zero time value (an integral value plus an optional +one-letter suffix that specifies the time unit). Time units: s +(seconds), m (minutes), h (hours), d (days), w (weeks). +The default time unit is s (seconds). </p> + +<p> +This feature is available in Postfix 2.1 and later. +</p> + +%PARAM smtpd_policy_service_request_limit 0 + +<p> +The maximal number of requests per SMTPD policy service connection, +or zero (no limit). Once a connection reaches this limit, the +connection is closed and the next request will be sent over a new +connection. This is a workaround to avoid error-recovery delays +with policy servers that cannot maintain a persistent connection. +</p> + +<p> +This feature is available in Postfix 3.0 and later. +</p> + +%PARAM smtpd_reject_unlisted_recipient yes + +<p> +Request that the Postfix SMTP server rejects mail for unknown +recipient addresses, even when no explicit reject_unlisted_recipient +access restriction is specified. This prevents the Postfix queue +from filling up with undeliverable MAILER-DAEMON messages. +</p> + +<p> An address is always considered "known" when it matches a +virtual(5) alias or a canonical(5) mapping. + +<ul> + +<li> The recipient domain matches $mydestination, $inet_interfaces +or $proxy_interfaces, but the recipient is not listed in +$local_recipient_maps, and $local_recipient_maps is not null. + +<li> The recipient domain matches $virtual_alias_domains but the +recipient is not listed in $virtual_alias_maps. + +<li> The recipient domain matches $virtual_mailbox_domains but the +recipient is not listed in $virtual_mailbox_maps, and $virtual_mailbox_maps +is not null. + +<li> The recipient domain matches $relay_domains but the recipient +is not listed in $relay_recipient_maps, and $relay_recipient_maps +is not null. + +</ul> + +<p> +This feature is available in Postfix 2.1 and later. +</p> + +%PARAM smtpd_reject_unlisted_sender no + +<p> Request that the Postfix SMTP server rejects mail from unknown +sender addresses, even when no explicit reject_unlisted_sender +access restriction is specified. This can slow down an explosion +of forged mail from worms or viruses. </p> + +<p> An address is always considered "known" when it matches a +virtual(5) alias or a canonical(5) mapping. + +<ul> + +<li> The sender domain matches $mydestination, $inet_interfaces or +$proxy_interfaces, but the sender is not listed in +$local_recipient_maps, and $local_recipient_maps is not null. + +<li> The sender domain matches $virtual_alias_domains but the sender +is not listed in $virtual_alias_maps. + +<li> The sender domain matches $virtual_mailbox_domains but the +sender is not listed in $virtual_mailbox_maps, and $virtual_mailbox_maps +is not null. + +<li> The sender domain matches $relay_domains but the sender is +not listed in $relay_recipient_maps, and $relay_recipient_maps is +not null. + +</ul> + +<p> +This feature is available in Postfix 2.1 and later. +</p> + +%PARAM smtpd_restriction_classes + +<p> +User-defined aliases for groups of access restrictions. The aliases +can be specified in smtpd_recipient_restrictions etc., and on the +right-hand side of a Postfix access(5) table. +</p> + +<p> +One major application is for implementing per-recipient UCE control. +See the RESTRICTION_CLASS_README document for other examples. +</p> + +%PARAM smtpd_sasl_application_name smtpd + +<p> +The application name that the Postfix SMTP server uses for SASL +server initialization. This +controls the name of the SASL configuration file. The default value +is <b>smtpd</b>, corresponding to a SASL configuration file named +<b>smtpd.conf</b>. +</p> + +<p> +This feature is available in Postfix 2.1 and 2.2. With Postfix 2.3 +it was renamed to smtpd_sasl_path. +</p> + +%PARAM strict_7bit_headers no + +<p> +Reject mail with 8-bit text in message headers. This blocks mail +from poorly written applications. +</p> + +<p> +This feature should not be enabled on a general purpose mail server, +because it is likely to reject legitimate email. +</p> + +<p> +This feature is available in Postfix 2.0 and later. +</p> + +%PARAM strict_8bitmime no + +<p> +Enable both strict_7bit_headers and strict_8bitmime_body. +</p> + +<p> +This feature should not be enabled on a general purpose mail server, +because it is likely to reject legitimate email. +</p> + +<p> +This feature is available in Postfix 2.0 and later. +</p> + +%PARAM strict_8bitmime_body no + +<p> +Reject 8-bit message body text without 8-bit MIME content encoding +information. This blocks mail from poorly written applications. +</p> + +<p> +Unfortunately, this also rejects majordomo approval requests when +the included request contains valid 8-bit MIME mail, and it rejects +bounces from mailers that do not MIME encapsulate 8-bit content +(for example, bounces from qmail or from old versions of Postfix). +</p> + +<p> +This feature should not be enabled on a general purpose mail server, +because it is likely to reject legitimate email. +</p> + +<p> +This feature is available in Postfix 2.0 and later. +</p> + +%PARAM strict_mime_encoding_domain no + +<p> +Reject mail with invalid Content-Transfer-Encoding: information +for the message/* or multipart/* MIME content types. This blocks +mail from poorly written software. +</p> + +<p> +This feature should not be enabled on a general purpose mail server, +because it will reject mail after a single violation. +</p> + +<p> +This feature is available in Postfix 2.0 and later. +</p> + +%PARAM sun_mailtool_compatibility no + +<p> +Obsolete SUN mailtool compatibility feature. Instead, use +"mailbox_delivery_lock = dotlock". +</p> + +%PARAM trace_service_name trace + +<p> +The name of the trace service. This service is implemented by the +bounce(8) daemon and maintains a record +of mail deliveries and produces a mail delivery report when verbose +delivery is requested with "<b>sendmail -v</b>". +</p> + +<p> +This feature is available in Postfix 2.1 and later. +</p> + +%PARAM undisclosed_recipients_header see "postconf -d" output + +<p> +Message header that the Postfix cleanup(8) server inserts when a +message contains no To: or Cc: message header. With Postfix 2.8 +and later, the default value is empty. With Postfix 2.4-2.7, +specify an empty value to disable this feature. </p> + +<p> Example: </p> + +<pre> +# Default value before Postfix 2.8. +# Note: the ":" and ";" are both required. +undisclosed_recipients_header = To: undisclosed-recipients:; +</pre> + +%PARAM unknown_relay_recipient_reject_code 550 + +<p> +The numerical Postfix SMTP server reply code when a recipient +address matches $relay_domains, and relay_recipient_maps specifies +a list of lookup tables that does not match the recipient address. +</p> + +<p> +This feature is available in Postfix 2.0 and later. +</p> + +%PARAM unknown_virtual_alias_reject_code 550 + +<p> +The Postfix SMTP server reply code when a recipient address matches +$virtual_alias_domains, and $virtual_alias_maps specifies a list +of lookup tables that does not match the recipient address. +</p> + +<p> +This feature is available in Postfix 2.0 and later. +</p> + +%PARAM unknown_virtual_mailbox_reject_code 550 + +<p> +The Postfix SMTP server reply code when a recipient address matches +$virtual_mailbox_domains, and $virtual_mailbox_maps specifies a list +of lookup tables that does not match the recipient address. +</p> + +<p> +This feature is available in Postfix 2.0 and later. +</p> + +%PARAM verp_delimiter_filter -=+ + +<p> +The characters Postfix accepts as VERP delimiter characters on the +Postfix sendmail(1) command line and in SMTP commands. +</p> + +<p> +This feature is available in Postfix 1.1 and later. +</p> + +%PARAM virtual_gid_maps + +<p> +Lookup tables with the per-recipient group ID for virtual(8) mailbox +delivery. +</p> + +<p> This parameter is specific to the virtual(8) delivery agent. +It does not apply when mail is delivered with a different mail +delivery program. </p> + +<p> +Specify zero or more "type:name" lookup tables, separated by +whitespace or comma. Tables will be searched in the specified order +until a match is found. +</p> + +<p> +In a lookup table, specify a left-hand side of "@domain.tld" to +match any user in the specified domain that does not have a specific +"user@domain.tld" entry. +</p> + +<p> +When a recipient address has an optional address extension +(user+foo@domain.tld), the virtual(8) delivery agent looks up +the full address first, and when the lookup fails, it looks up the +unextended address (user@domain.tld). +</p> + +<p> +Note 1: for security reasons, the virtual(8) delivery agent disallows +regular expression substitution of $1 etc. in regular expression +lookup tables, because that would open a security hole. +</p> + +<p> +Note 2: for security reasons, the virtual(8) delivery agent will +silently ignore requests to use the proxymap(8) server. Instead +it will open the table directly. Before Postfix version 2.2, the +virtual(8) delivery agent will terminate with a fatal error. +</p> + +%PARAM virtual_mailbox_base + +<p> +A prefix that the virtual(8) delivery agent prepends to all pathname +results from $virtual_mailbox_maps table lookups. This is a safety +measure to ensure that an out of control map doesn't litter the +file system with mailboxes. While virtual_mailbox_base could be +set to "/", this setting isn't recommended. +</p> + +<p> This parameter is specific to the virtual(8) delivery agent. +It does not apply when mail is delivered with a different mail +delivery program. </p> + +<p> +Example: +</p> + +<pre> +virtual_mailbox_base = /var/mail +</pre> + +%PARAM virtual_mailbox_domains $virtual_mailbox_maps + +<p> Postfix is the final destination for the specified list of domains; +mail is delivered via the $virtual_transport mail delivery transport. +By default this is the Postfix virtual(8) delivery agent. The SMTP +server validates recipient addresses with $virtual_mailbox_maps +and rejects mail for non-existent recipients. See also the virtual +mailbox domain class in the ADDRESS_CLASS_README file. </p> + +<p> This parameter expects the same syntax as the mydestination +configuration parameter. </p> + +<p> +This feature is available in Postfix 2.0 and later. The default +value is backwards compatible with Postfix version 1.1. +</p> + +%PARAM virtual_mailbox_limit 51200000 + +<p> +The maximal size in bytes of an individual virtual(8) mailbox or +maildir file, or zero (no limit). </p> + +<p> This parameter is specific to the virtual(8) delivery agent. +It does not apply when mail is delivered with a different mail +delivery program. </p> + +%PARAM virtual_mailbox_lock see "postconf -d" output + +<p> +How to lock a UNIX-style virtual(8) mailbox before attempting +delivery. For a list of available file locking methods, use the +"<b>postconf -l</b>" command. +</p> + +<p> This parameter is specific to the virtual(8) delivery agent. +It does not apply when mail is delivered with a different mail +delivery program. </p> + +<p> +This setting is ignored with <b>maildir</b> style delivery, because +such deliveries are safe without application-level locks. +</p> + +<p> +Note 1: the <b>dotlock</b> method requires that the recipient UID +or GID has write access to the parent directory of the recipient's +mailbox file. +</p> + +<p> +Note 2: the default setting of this parameter is system dependent. +</p> + +%PARAM virtual_mailbox_maps + +<p> +Optional lookup tables with all valid addresses in the domains that +match $virtual_mailbox_domains. +</p> + +<p> +Specify zero or more "type:name" lookup tables, separated by +whitespace or comma. Tables will be searched in the specified order +until a match is found. +</p> + +<p> +In a lookup table, specify a left-hand side of "@domain.tld" to +match any user in the specified domain that does not have a specific +"user@domain.tld" entry. +</p> + +<p> +With the default "virtual_mailbox_domains = $virtual_mailbox_maps", +lookup tables also need entries with a left-hand side of "domain.tld" +to satisfy virtual_mailbox_domain lookups (the right-hand side is +required but will not be used). +</p> + +<p> The remainder of this text is specific to the virtual(8) delivery +agent. It does not apply when mail is delivered with a different +mail delivery program. </p> + +<p> +The virtual(8) delivery agent uses this table to look up the +per-recipient mailbox or maildir pathname. If the lookup result +ends in a slash ("/"), maildir-style delivery is carried out, +otherwise the path is assumed to specify a UNIX-style mailbox file. +Note that $virtual_mailbox_base is unconditionally prepended to +this path. +</p> + +<p> +When a recipient address has an optional address extension +(user+foo@domain.tld), the virtual(8) delivery agent looks up +the full address first, and when the lookup fails, it looks up the +unextended address (user@domain.tld). +</p> + +<p> +Note 1: for security reasons, the virtual(8) delivery agent disallows +regular expression substitution of $1 etc. in regular expression +lookup tables, because that would open a security hole. +</p> + +<p> +Note 2: for security reasons, the virtual(8) delivery agent will +silently ignore requests to use the proxymap(8) server. Instead +it will open the table directly. Before Postfix version 2.2, the +virtual(8) delivery agent will terminate with a fatal error. +</p> + +%PARAM virtual_minimum_uid 100 + +<p> +The minimum user ID value that the virtual(8) delivery agent accepts +as a result from $virtual_uid_maps table lookup. Returned +values less than this will be rejected, and the message will be +deferred. +</p> + +<p> This parameter is specific to the virtual(8) delivery agent. +It does not apply when mail is delivered with a different mail +delivery program. </p> + +%PARAM virtual_transport virtual + +<p> +The default mail delivery transport and next-hop destination for +final delivery to domains listed with $virtual_mailbox_domains. +This information can be overruled with the transport(5) table. +</p> + +<p> +Specify a string of the form <i>transport:nexthop</i>, where <i>transport</i> +is the name of a mail delivery transport defined in master.cf. +The <i>:nexthop</i> destination is optional; its syntax is documented +in the manual page of the corresponding delivery agent. +</p> + +<p> +This feature is available in Postfix 2.0 and later. +</p> + +%PARAM virtual_uid_maps + +<p> +Lookup tables with the per-recipient user ID that the virtual(8) +delivery agent uses while writing to the recipient's mailbox. +</p> + +<p> This parameter is specific to the virtual(8) delivery agent. +It does not apply when mail is delivered with a different mail +delivery program. </p> + +<p> +Specify zero or more "type:name" lookup tables, separated by +whitespace or comma. Tables will be searched in the specified order +until a match is found. +</p> + +<p> +In a lookup table, specify a left-hand side of "@domain.tld" +to match any user in the specified domain that does not have a +specific "user@domain.tld" entry. +</p> + +<p> +When a recipient address has an optional address extension +(user+foo@domain.tld), the virtual(8) delivery agent looks up +the full address first, and when the lookup fails, it looks up the +unextended address (user@domain.tld). +</p> + +<p> +Note 1: for security reasons, the virtual(8) delivery agent disallows +regular expression substitution of $1 etc. in regular expression +lookup tables, because that would open a security hole. +</p> + +<p> +Note 2: for security reasons, the virtual(8) delivery agent will +silently ignore requests to use the proxymap(8) server. Instead +it will open the table directly. Before Postfix version 2.2, the +virtual(8) delivery agent will terminate with a fatal error. +</p> + +%PARAM config_directory see "postconf -d" output + +<p> The default location of the Postfix main.cf and master.cf +configuration files. This can be overruled via the following +mechanisms: </p> + +<ul> + +<li> <p> The MAIL_CONFIG environment variable (daemon processes +and commands). </p> + +<li> <p> The "-c" command-line option (commands only). </p> + +</ul> + +<p> With Postfix commands that run with set-gid privileges, a +config_directory override either requires root privileges, or it +requires that the directory is listed with the alternate_config_directories +parameter in the default main.cf file. </p> + +%PARAM virtual_maps + +<p> Optional lookup tables with a) names of domains for which all +addresses are aliased to addresses in other local or remote domains, +and b) addresses that are aliased to addresses in other local or +remote domains. Available before Postfix version 2.0. With Postfix +version 2.0 and later, this is replaced by separate controls: virtual_alias_domains +and virtual_alias_maps. </p> + +%PARAM smtp_discard_ehlo_keywords + +<p> A case insensitive list of EHLO keywords (pipelining, starttls, +auth, etc.) that the Postfix SMTP client will ignore in the EHLO +response from a remote SMTP server. </p> + +<p> This feature is available in Postfix 2.2 and later. </p> + +<p> Notes: </p> + +<ul> + +<li> <p> Specify the <b>silent-discard</b> pseudo keyword to prevent +this action from being logged. </p> + +<li> <p> Use the smtp_discard_ehlo_keyword_address_maps feature to +discard EHLO keywords selectively. </p> + +</ul> + +%PARAM smtpd_discard_ehlo_keywords + +<p> A case insensitive list of EHLO keywords (pipelining, starttls, +auth, etc.) that the Postfix SMTP server will not send in the EHLO +response +to a remote SMTP client. </p> + +<p> This feature is available in Postfix 2.2 and later. </p> + +<p> Notes: </p> + +<ul> + +<li> <p> Specify the <b>silent-discard</b> pseudo keyword to prevent +this action from being logged. </p> + +<li> <p> Use the smtpd_discard_ehlo_keyword_address_maps feature +to discard EHLO keywords selectively. </p> + +</ul> + +%PARAM smtp_discard_ehlo_keyword_address_maps + +<p> Lookup tables, indexed by the remote SMTP server address, with +case insensitive lists of EHLO keywords (pipelining, starttls, auth, +etc.) that the Postfix SMTP client will ignore in the EHLO response from a +remote SMTP server. See smtp_discard_ehlo_keywords for details. The +table is not indexed by hostname for consistency with +smtpd_discard_ehlo_keyword_address_maps. </p> + +<p> +Specify zero or more "type:name" lookup tables, separated by +whitespace or comma. Tables will be searched in the specified order +until a match is found. +</p> + +<p> This feature is available in Postfix 2.2 and later. </p> + +%PARAM smtpd_discard_ehlo_keyword_address_maps + +<p> Lookup tables, indexed by the remote SMTP client address, with +case insensitive lists of EHLO keywords (pipelining, starttls, auth, +etc.) that the Postfix SMTP server will not send in the EHLO response +to a +remote SMTP client. See smtpd_discard_ehlo_keywords for details. +The tables are not searched by hostname for robustness reasons. </p> + +<p> +Specify zero or more "type:name" lookup tables, separated by +whitespace or comma. Tables will be searched in the specified order +until a match is found. +</p> + +<p> This feature is available in Postfix 2.2 and later. </p> + +%PARAM connection_cache_service_name scache + +<p> The name of the scache(8) connection cache service. This service +maintains a limited pool of cached sessions. </p> + +<p> This feature is available in Postfix 2.2 and later. </p> + +%PARAM connection_cache_ttl_limit 2s + +<p> The maximal time-to-live value that the scache(8) connection +cache server +allows. Requests that specify a larger TTL will be stored with the +maximum allowed TTL. The purpose of this additional control is to +protect the infrastructure against careless people. The cache TTL +is already bounded by $max_idle. </p> + +%PARAM connection_cache_status_update_time 600s + +<p> How frequently the scache(8) server logs usage statistics with +connection cache hit and miss rates for logical destinations and for +physical endpoints. </p> + +%PARAM remote_header_rewrite_domain + +<p> Don't rewrite message headers from remote clients at all when +this parameter is empty; otherwise, rewrite message headers and +append the specified domain name to incomplete addresses. The +local_header_rewrite_clients parameter controls what clients Postfix +considers local. </p> + +<p> Examples: </p> + +<p> The safe setting: append "domain.invalid" to incomplete header +addresses from remote SMTP clients, so that those addresses cannot +be confused with local addresses. </p> + +<blockquote> +<pre> +remote_header_rewrite_domain = domain.invalid +</pre> +</blockquote> + +<p> The default, purist, setting: don't rewrite headers from remote +clients at all. </p> + +<blockquote> +<pre> +remote_header_rewrite_domain = +</pre> +</blockquote> + +%PARAM local_header_rewrite_clients permit_inet_interfaces + +<p> Rewrite message header addresses in mail from these clients and +update incomplete addresses with the domain name in $myorigin or +$mydomain; either don't rewrite message headers from other clients +at all, or rewrite message headers and update incomplete addresses +with the domain specified in the remote_header_rewrite_domain +parameter. </p> + +<p> See the append_at_myorigin and append_dot_mydomain parameters +for details of how domain names are appended to incomplete addresses. +</p> + +<p> Specify a list of zero or more of the following: </p> + +<dl> + +<dt><b>permit_inet_interfaces</b></dt> + +<dd> Append the domain name in $myorigin or $mydomain when the +client IP address matches $inet_interfaces. This is enabled by +default. </dd> + +<dt><b>permit_mynetworks</b></dt> + +<dd> Append the domain name in $myorigin or $mydomain when the +client IP address matches any network or network address listed in +$mynetworks. This setting will not prevent remote mail header +address rewriting when mail from a remote client is forwarded by +a neighboring system. </dd> + +<dt><b>permit_sasl_authenticated </b></dt> + +<dd> Append the domain name in $myorigin or $mydomain when the +client is successfully authenticated via the RFC 4954 (AUTH) +protocol. </dd> + +<dt><b>permit_tls_clientcerts </b></dt> + +<dd> Append the domain name in $myorigin or $mydomain when the +remote SMTP client TLS certificate fingerprint or public key fingerprint +(Postfix 2.9 and later) is listed in $relay_clientcerts. +The fingerprint digest algorithm is configurable via the +smtpd_tls_fingerprint_digest parameter (hard-coded as md5 prior to +Postfix version 2.5). </dd> + +<dd> The default algorithm is <b>sha256</b> with Postfix ≥ 3.6 +and the <b>compatibility_level</b> set to 3.6 or higher. With Postfix +≤ 3.5, the default algorithm is <b>md5</b>. The best-practice +algorithm is now <b>sha256</b>. Recent advances in hash function +cryptanalysis have led to md5 and sha1 being deprecated in favor of +sha256. However, as long as there are no known "second pre-image" +attacks against the older algorithms, their use in this context, though +not recommended, is still likely safe. </dd> + +<dt><b>permit_tls_all_clientcerts </b></dt> + +<dd> Append the domain name in $myorigin or $mydomain when the +remote SMTP client TLS certificate is successfully verified, regardless of +whether it is listed on the server, and regardless of the certifying +authority. </dd> + +<dt><b><a name="check_address_map">check_address_map</a> <i><a href="DATABASE_README.html">type:table</a></i> </b></dt> + +<dt><b><i><a href="DATABASE_README.html">type:table</a></i> </b></dt> + +<dd> Append the domain name in $myorigin or $mydomain when the +client IP address matches the specified lookup table. +The lookup result is ignored, and no subnet lookup is done. This +is suitable for, e.g., pop-before-smtp lookup tables. </dd> + +</dl> + +<p> Examples: </p> + +<p> The Postfix < 2.2 backwards compatible setting: always rewrite +message headers, and always append my own domain to incomplete +header addresses. </p> + +<blockquote> +<pre> +local_header_rewrite_clients = static:all +</pre> +</blockquote> + +<p> The purist (and default) setting: rewrite headers only in mail +from Postfix sendmail and in SMTP mail from this machine. </p> + +<blockquote> +<pre> +local_header_rewrite_clients = permit_inet_interfaces +</pre> +</blockquote> + +<p> The intermediate setting: rewrite header addresses and append +$myorigin or $mydomain information only with mail from Postfix +sendmail, from local clients, or from authorized SMTP clients. </p> + +<p> Note: this setting will not prevent remote mail header address +rewriting when mail from a remote client is forwarded by a neighboring +system. </p> + +<blockquote> +<pre> +local_header_rewrite_clients = permit_mynetworks, + permit_sasl_authenticated permit_tls_clientcerts + check_address_map hash:/etc/postfix/pop-before-smtp +</pre> +</blockquote> + +%PARAM smtpd_tls_cert_file + +<p> File with the Postfix SMTP server RSA certificate in PEM format. +This file may also contain the Postfix SMTP server private RSA key. +With Postfix ≥ 3.4 the preferred way to configure server keys and +certificates is via the "smtpd_tls_chain_files" parameter. </p> + +<p> Public Internet MX hosts without certificates signed by a "reputable" +CA must generate, and be prepared to present to most clients, a +self-signed or private-CA signed certificate. The client will not be +able to authenticate the server, but unless it is running Postfix 2.3 or +similar software, it will still insist on a server certificate. </p> + +<p> For servers that are <b>not</b> public Internet MX hosts, Postfix +supports configurations with no certificates. This entails the use of +just the anonymous TLS ciphers, which are not supported by typical SMTP +clients. Since some clients may not fall back to plain text after a TLS +handshake failure, a certificate-less Postfix SMTP server will be unable +to receive email from some TLS-enabled clients. To avoid accidental +configurations with no certificates, Postfix enables certificate-less +operation only when the administrator explicitly sets +"smtpd_tls_cert_file = none". This ensures that new Postfix SMTP server +configurations will not accidentally enable TLS without certificates. </p> + +<p> Note that server certificates are not optional in TLS 1.3. To run +without certificates you'd have to disable the TLS 1.3 protocol by +including '!TLSv1.3' in "smtpd_tls_protocols" and perhaps also +"smtpd_tls_mandatory_protocols". It is simpler instead to just +configure a certificate chain. Certificate-less operation is not +recommended. <p> + +<p> Both RSA and DSA certificates are supported. When both types +are present, the cipher used determines which certificate will be +presented to the client. For Netscape and OpenSSL clients without +special cipher choices the RSA certificate is preferred. </p> + +<p> To enable a remote SMTP client to verify the Postfix SMTP server +certificate, the issuing CA certificates must be made available to the +client. You should include the required certificates in the server +certificate file, the server certificate first, then the issuing +CA(s) (bottom-up order). </p> + +<p> Example: the certificate for "server.example.com" was issued by +"intermediate CA" which itself has a certificate of "root CA". +Create the server.pem file with "cat server_cert.pem intermediate_CA.pem +root_CA.pem > server.pem". </p> + +<p> If you also want to verify client certificates issued by these +CAs, you can add the CA certificates to the smtpd_tls_CAfile, in which +case it is not necessary to have them in the smtpd_tls_cert_file, +smtpd_tls_dcert_file (obsolete) or smtpd_tls_eccert_file. </p> + +<p> A certificate supplied here must be usable as an SSL server certificate +and hence pass the "openssl verify -purpose sslserver ..." test. </p> + +<p> Example: </p> + +<pre> +smtpd_tls_cert_file = /etc/postfix/server.pem +</pre> + +<p> This feature is available in Postfix 2.2 and later. </p> + +%PARAM smtpd_tls_key_file $smtpd_tls_cert_file + +<p> File with the Postfix SMTP server RSA private key in PEM format. +This file may be combined with the Postfix SMTP server RSA certificate +file specified with $smtpd_tls_cert_file. With Postfix ≥ 3.4 the +preferred way to configure server keys and certificates is via the +"smtpd_tls_chain_files" parameter. </p> + +<p> The private key must be accessible without a pass-phrase, i.e. it +must not be encrypted. File permissions should grant read-only +access to the system superuser account ("root"), and no access +to anyone else. </p> + +%PARAM smtpd_tls_dcert_file + +<p> File with the Postfix SMTP server DSA certificate in PEM format. +This file may also contain the Postfix SMTP server private DSA key. +The DSA algorithm is obsolete and should not be used. </p> + +<p> See the discussion under smtpd_tls_cert_file for more details. +</p> + +<p> Example: </p> + +<pre> +smtpd_tls_dcert_file = /etc/postfix/server-dsa.pem +</pre> + +<p> This feature is available in Postfix 2.2 and later. </p> + +%PARAM smtpd_tls_dkey_file $smtpd_tls_dcert_file + +<p> File with the Postfix SMTP server DSA private key in PEM format. +This file may be combined with the Postfix SMTP server DSA certificate +file specified with $smtpd_tls_dcert_file. The DSA algorithm is obsolete +and should not be used. </p> + +<p> The private key must be accessible without a pass-phrase, i.e. it +must not be encrypted. File permissions should grant read-only +access to the system superuser account ("root"), and no access +to anyone else. </p> + +<p> This feature is available in Postfix 2.2 and later. </p> + +%PARAM smtpd_tls_CAfile + +<p> A file containing (PEM format) CA certificates of root CAs trusted +to sign either remote SMTP client certificates or intermediate CA +certificates. These are loaded into memory before the smtpd(8) server +enters the chroot jail. If the number of trusted roots is large, consider +using smtpd_tls_CApath instead, but note that the latter directory must +be present in the chroot jail if the smtpd(8) server is chrooted. This +file may also be used to augment the server certificate trust chain, +but it is best to include all the required certificates directly in the +server certificate file. </p> + +<p> Specify "smtpd_tls_CAfile = /path/to/system_CA_file" to use ONLY +the system-supplied default Certification Authority certificates. +</p> + +<p> Specify "tls_append_default_CA = no" to prevent Postfix from +appending the system-supplied default CAs and trusting third-party +certificates. </p> + +<p> By default (see smtpd_tls_ask_ccert), client certificates are not +requested, and smtpd_tls_CAfile should remain empty. If you do make use +of client certificates, the distinguished names (DNs) of the Certification +Authorities listed in smtpd_tls_CAfile are sent to the remote SMTP client +in the client certificate request message. MUAs with multiple client +certificates may use the list of preferred Certification Authorities +to select the correct client certificate. You may want to put your +"preferred" CA or CAs in this file, and install other trusted CAs in +$smtpd_tls_CApath. </p> + +<p> Example: </p> + +<pre> +smtpd_tls_CAfile = /etc/postfix/CAcert.pem +</pre> + +<p> This feature is available in Postfix 2.2 and later. </p> + +%PARAM smtpd_tls_CApath + +<p> A directory containing (PEM format) CA certificates of root CAs +trusted to sign either remote SMTP client certificates or intermediate CA +certificates. Do not forget to create the necessary "hash" links with, +for example, "$OPENSSL_HOME/bin/c_rehash /etc/postfix/certs". To use +smtpd_tls_CApath in chroot mode, this directory (or a copy) must be +inside the chroot jail. </p> + +<p> Specify "smtpd_tls_CApath = /path/to/system_CA_directory" to +use ONLY the system-supplied default Certification Authority certificates. +</p> + +<p> Specify "tls_append_default_CA = no" to prevent Postfix from +appending the system-supplied default CAs and trusting third-party +certificates. </p> + +<p> By default (see smtpd_tls_ask_ccert), client certificates are +not requested, and smtpd_tls_CApath should remain empty. In contrast +to smtpd_tls_CAfile, DNs of Certification Authorities installed +in $smtpd_tls_CApath are not included in the client certificate +request message. MUAs with multiple client certificates may use the +list of preferred Certification Authorities to select the correct +client certificate. You may want to put your "preferred" CA or +CAs in $smtpd_tls_CAfile, and install the remaining trusted CAs in +$smtpd_tls_CApath. </p> + +<p> Example: </p> + +<pre> +smtpd_tls_CApath = /etc/postfix/certs +</pre> + +<p> This feature is available in Postfix 2.2 and later. </p> + +%PARAM smtpd_tls_loglevel 0 + +<p> Enable additional Postfix SMTP server logging of TLS activity. +Each logging level also includes the information that is logged at +a lower logging level. </p> + +<dl compact> + +<dt> </dt> <dd> 0 Disable logging of TLS activity. </dd> + +<dt> </dt> <dd> 1 Log only a summary message on TLS handshake completion +— no logging of client certificate trust-chain verification errors +if client certificate verification is not required. With Postfix 2.8 and +earlier, log the summary message, peer certificate summary information +and unconditionally log trust-chain verification errors. </dd> + +<dt> </dt> <dd> 2 Also log levels during TLS negotiation. </dd> + +<dt> </dt> <dd> 3 Also log hexadecimal and ASCII dump of TLS negotiation +process. </dd> + +<dt> </dt> <dd> 4 Also log hexadecimal and ASCII dump of complete +transmission after STARTTLS. </dd> + +</dl> + +<p> Do not use "smtpd_tls_loglevel = 2" or higher except in case +of problems. Use of loglevel 4 is strongly discouraged. </p> + +<p> This feature is available in Postfix 2.2 and later. </p> + +%PARAM smtpd_tls_received_header no + +<p> Request that the Postfix SMTP server produces Received: message +headers that include information about the protocol and cipher used, +as well as the remote SMTP client CommonName and client certificate issuer +CommonName. This is disabled by default, as the information may +be modified in transit through other mail servers. Only information +that was recorded by the final destination can be trusted. </p> + +<p> This feature is available in Postfix 2.2 and later. </p> + +%PARAM smtpd_use_tls no + +<p> Opportunistic TLS: announce STARTTLS support to remote SMTP clients, +but do not require that clients use TLS encryption. </p> + +<p> Note: when invoked via "<b>sendmail -bs</b>", Postfix will never offer +STARTTLS due to insufficient privileges to access the server private +key. This is intended behavior. </p> + +<p> This feature is available in Postfix 2.2 and later. With +Postfix 2.3 and later use smtpd_tls_security_level instead. </p> + +%PARAM smtpd_enforce_tls no + +<p> Mandatory TLS: announce STARTTLS support to remote SMTP clients, +and require that clients use TLS encryption. According to RFC 2487 +this MUST NOT be applied in case of a publicly-referenced SMTP +server. This option is therefore off by default. </p> + +<p> Note 1: "smtpd_enforce_tls = yes" implies "smtpd_tls_auth_only = yes". </p> + +<p> Note 2: when invoked via "<b>sendmail -bs</b>", Postfix will never offer +STARTTLS due to insufficient privileges to access the server private +key. This is intended behavior. </p> + +<p> This feature is available in Postfix 2.2 and later. With +Postfix 2.3 and later use smtpd_tls_security_level instead. </p> + +%PARAM smtpd_tls_wrappermode no + +<p> Run the Postfix SMTP server in TLS "wrapper" mode, +instead of using the STARTTLS command. </p> + +<p> If you want to support this service, enable a special port in +master.cf, and specify "-o smtpd_tls_wrappermode=yes" on the SMTP +server's command line. Port 465 (submissions/smtps) is reserved for +this purpose. </p> + +<p> This feature is available in Postfix 2.2 and later. </p> + +%PARAM smtpd_tls_ask_ccert no + +<p> Ask a remote SMTP client for a client certificate. This +information is needed for certificate based mail relaying with, +for example, the permit_tls_clientcerts feature. </p> + +<p> Some clients such as Netscape will either complain if no +certificate is available (for the list of CAs in $smtpd_tls_CAfile) +or will offer multiple client certificates to choose from. This +may be annoying, so this option is "off" by default. </p> + +<p> This feature is available in Postfix 2.2 and later. </p> + +%PARAM smtpd_tls_req_ccert no + +<p> With mandatory TLS encryption, require a trusted remote SMTP client +certificate in order to allow TLS connections to proceed. This +option implies "smtpd_tls_ask_ccert = yes". </p> + +<p> When TLS encryption is optional, this setting is ignored with +a warning written to the mail log. </p> + +<p> This feature is available in Postfix 2.2 and later. </p> + +%PARAM smtpd_tls_ccert_verifydepth 9 + +<p> The verification depth for remote SMTP client certificates. A +depth of 1 is sufficient if the issuing CA is listed in a local CA +file. </p> + +<p> The default verification depth is 9 (the OpenSSL default) for +compatibility with earlier Postfix behavior. Prior to Postfix 2.5, +the default value was 5, but the limit was not actually enforced. If +you have set this to a lower non-default value, certificates with longer +trust chains may now fail to verify. Certificate chains with 1 or 2 +CAs are common, deeper chains are more rare and any number between 5 +and 9 should suffice in practice. You can choose a lower number if, +for example, you trust certificates directly signed by an issuing CA +but not any CAs it delegates to. </p> + +<p> This feature is available in Postfix 2.2 and later. </p> + +%PARAM smtpd_tls_auth_only no + +<p> When TLS encryption is optional in the Postfix SMTP server, do +not announce or accept SASL authentication over unencrypted +connections. </p> + +<p> This feature is available in Postfix 2.2 and later. </p> + +%PARAM smtpd_tls_session_cache_database + +<p> Name of the file containing the optional Postfix SMTP server +TLS session cache. Specify a database type that supports enumeration, +such as <b>btree</b> or <b>sdbm</b>; there is no need to support +concurrent access. The file is created if it does not exist. The smtpd(8) +daemon does not use this parameter directly, rather the cache is +implemented indirectly in the tlsmgr(8) daemon. This means that +per-smtpd-instance master.cf overrides of this parameter are not +effective. Note that each of the cache databases supported by tlsmgr(8) +daemon: $smtpd_tls_session_cache_database, $smtp_tls_session_cache_database +(and with Postfix 2.3 and later $lmtp_tls_session_cache_database), needs to be +stored separately. It is not at this time possible to store multiple +caches in a single database. </p> + +<p> Note: <b>dbm</b> databases are not suitable. TLS +session objects are too large. </p> + +<p> As of version 2.5, Postfix no longer uses root privileges when +opening this file. The file should now be stored under the Postfix-owned +data_directory. As a migration aid, an attempt to open the file +under a non-Postfix directory is redirected to the Postfix-owned +data_directory, and a warning is logged. </p> + + +<p> As of Postfix 2.11 the preferred mechanism for session resumption +is RFC 5077 TLS session tickets, which don't require server-side +storage. Consequently, for Postfix ≥ 2.11 this parameter should +generally be left empty. TLS session tickets require an OpenSSL +library (at least version 0.9.8h) that provides full support for +this TLS extension. See also smtpd_tls_session_cache_timeout. </p> + +<p> Example: </p> + +<pre> +smtpd_tls_session_cache_database = btree:/var/lib/postfix/smtpd_scache +</pre> + +<p> This feature is available in Postfix 2.2 and later. </p> + +%PARAM smtpd_tls_session_cache_timeout 3600s + +<p> The expiration time of Postfix SMTP server TLS session cache +information. A cache cleanup is performed periodically +every $smtpd_tls_session_cache_timeout seconds. As with +$smtpd_tls_session_cache_database, this parameter is implemented in the +tlsmgr(8) daemon and therefore per-smtpd-instance master.cf overrides +are not possible. </p> + +<p> As of Postfix 2.11 this setting cannot exceed 100 days. If set +≤ 0, session caching is disabled, not just via the database, but +also via RFC 5077 TLS session tickets, which don't require server-side +storage. If set to a positive value less than 2 minutes, the minimum +value of 2 minutes is used instead. TLS session tickets require +an OpenSSL library (at least version 0.9.8h) that provides full +support for this TLS extension. </p> + +<p> Specify a non-negative time value (an integral value plus an optional +one-letter suffix that specifies the time unit). Time units: s +(seconds), m (minutes), h (hours), d (days), w (weeks). +The default time unit is s (seconds). </p> + +<p> This feature is available in Postfix 2.2 and later, and updated +for TLS session ticket support in Postfix 2.11. </p> + +%PARAM relay_clientcerts + +<p> List of tables with remote SMTP client-certificate fingerprints or +public key fingerprints (Postfix 2.9 and later) for which the Postfix +SMTP server will allow access with the permit_tls_clientcerts +feature. The fingerprint digest algorithm is configurable via the +smtpd_tls_fingerprint_digest parameter (hard-coded as md5 prior to +Postfix version 2.5). </p> + +<p> The default algorithm is <b>sha256</b> with Postfix ≥ 3.6 +and the <b>compatibility_level</b> set to 3.6 or higher. With Postfix +≤ 3.5, the default algorithm is <b>md5</b>. The best-practice +algorithm is now <b>sha256</b>. Recent advances in hash function +cryptanalysis have led to md5 and sha1 being deprecated in favor of +sha256. However, as long as there are no known "second pre-image" +attacks against the older algorithms, their use in this context, though +not recommended, is still likely safe. </p> + +<p> Postfix lookup tables are in the form of (key, value) pairs. +Since we only need the key, the value can be chosen freely, e.g. +the name of the user or host: +D7:04:2F:A7:0B:8C:A5:21:FA:31:77:E1:41:8A:EE:80 lutzpc.at.home </p> + +<p> Example: </p> + +<pre> +relay_clientcerts = hash:/etc/postfix/relay_clientcerts +</pre> + +<p>For more fine-grained control, use check_ccert_access to select +an appropriate access(5) policy for each client. +See RESTRICTION_CLASS_README.</p> + +<p>This feature is available with Postfix version 2.2.</p> + +%PARAM smtpd_tls_cipherlist + +<p> Obsolete Postfix < 2.3 control for the Postfix SMTP server TLS +cipher list. It is easy to create interoperability problems by choosing +a non-default cipher list. Do not use a non-default TLS cipherlist for +MX hosts on the public Internet. Clients that begin the TLS handshake, +but are unable to agree on a common cipher, may not be able to send any +email to the SMTP server. Using a restricted cipher list may be more +appropriate for a dedicated MSA or an internal mailhub, where one can +exert some control over the TLS software and settings of the connecting +clients. </p> + +<p> <b>Note:</b> do not use "" quotes around the parameter value. </p> + +<p>This feature is available with Postfix version 2.2. It is not used with +Postfix 2.3 and later; use smtpd_tls_mandatory_ciphers instead. </p> + +%PARAM smtpd_tls_dh1024_param_file + +<p> File with DH parameters that the Postfix SMTP server should +use with non-export EDH ciphers. </p> + +<p> With Postfix ≥ 3.7, built with OpenSSL version is 3.0.0 or later, if the +parameter value is either empty or "<b>auto</b>", then the DH parameter +selection is delegated to the OpenSSL library, which selects appropriate +parameters based on the TLS handshake. This choice is likely to be the most +interoperable with SMTP clients using various TLS libraries, and custom local +parameters are no longer recommended when using Postfix ≥ 3.7 built against +OpenSSL 3.0.0. </p> + +<p> The best-practice choice of parameters uses a 2048-bit prime. This is fine, +despite the historical "1024" in the parameter name. Do not be tempted to use +much larger values, performance degrades quickly, and you may also cease to +interoperate with some mainstream SMTP clients. As of Postfix 3.1, the +compiled-in default prime is 2048-bits, and it is not strictly necessary, +though perhaps somewhat beneficial to generate custom DH parameters. </p> + +<p> Instead of using the exact same parameter sets as distributed +with other TLS packages, it is more secure to generate your own +set of parameters with something like the following commands: </p> + +<blockquote> +<pre> +openssl dhparam -out /etc/postfix/dh2048.pem 2048 +openssl dhparam -out /etc/postfix/dh1024.pem 1024 +# As of Postfix 3.6, export-grade 512-bit DH parameters are no longer +# supported or needed. +openssl dhparam -out /etc/postfix/dh512.pem 512 +</pre> +</blockquote> + +<p> It is safe to share the same DH parameters between multiple +Postfix instances. If you prefer, you can generate separate +parameters for each instance. </p> + +<p> If you want to take maximal advantage of ciphers that offer <a +href="FORWARD_SECRECY_README.html#dfn_fs">forward secrecy</a> see +the <a href="FORWARD_SECRECY_README.html#quick-start">Getting +started</a> section of <a +href="FORWARD_SECRECY_README.html">FORWARD_SECRECY_README</a>. The +full document conveniently presents all information about Postfix +"perfect" forward secrecy support in one place: what forward secrecy +is, how to tweak settings, and what you can expect to see when +Postfix uses ciphers with forward secrecy. </p> + +<p> Example: </p> + +<pre> +smtpd_tls_dh1024_param_file = /etc/postfix/dh2048.pem +</pre> + +<p>This feature is available in Postfix 2.2 and later.</p> + +%PARAM smtpd_tls_dh512_param_file + +<p> File with DH parameters that the Postfix SMTP server should +use with export-grade EDH ciphers. The default SMTP server cipher +grade is "medium" with Postfix releases after the middle of 2015, +and as a result export-grade cipher suites are by default not used. +</p> + +<p> With Postfix ≥ 3.6 export-grade Diffie-Hellman key exchange +is no longer supported, and this parameter is silently ignored. </p> + +<p> See also the discussion under the smtpd_tls_dh1024_param_file +configuration parameter. </p> + +<p> Example: </p> + +<pre> +smtpd_tls_dh512_param_file = /etc/postfix/dh_512.pem +</pre> + +<p>This feature is available in Postfix 2.2 and later, +but is ignored in Postfix 3.6 and later.</p> + +%PARAM smtpd_starttls_timeout see "postconf -d" output + +<p> The time limit for Postfix SMTP server write and read operations +during TLS startup and shutdown handshake procedures. The current +default value is stress-dependent. Before Postfix version 2.8, it +was fixed at 300s. </p> + +<p> Specify a non-zero time value (an integral value plus an optional +one-letter suffix that specifies the time unit). Time units: s +(seconds), m (minutes), h (hours), d (days), w (weeks). +The default time unit is s (seconds). </p> + +<p> This feature is available in Postfix 2.2 and later. </p> + +%PARAM smtp_tls_cert_file + +<p> File with the Postfix SMTP client RSA certificate in PEM format. +This file may also contain the Postfix SMTP client private RSA key, and +these may be the same as the Postfix SMTP server RSA certificate and key +file. With Postfix ≥ 3.4 the preferred way to configure client keys +and certificates is via the "smtp_tls_chain_files" parameter. </p> + +<p> Do not configure client certificates unless you <b>must</b> present +client TLS certificates to one or more servers. Client certificates are +not usually needed, and can cause problems in configurations that work +well without them. The recommended setting is to let the defaults stand: </p> + +<blockquote> +<pre> +smtp_tls_cert_file = +smtp_tls_key_file = +smtp_tls_eccert_file = +smtp_tls_eckey_file = +# Obsolete DSA parameters +smtp_tls_dcert_file = +smtp_tls_dkey_file = +# Postfix ≥ 3.4 interface +smtp_tls_chain_files = +</pre> +</blockquote> + +<p> The best way to use the default settings is to comment out the above +parameters in main.cf if present. </p> + +<p> To enable remote SMTP servers to verify the Postfix SMTP client +certificate, the issuing CA certificates must be made available to the +server. You should include the required certificates in the client +certificate file, the client certificate first, then the issuing +CA(s) (bottom-up order). </p> + +<p> Example: the certificate for "client.example.com" was issued by +"intermediate CA" which itself has a certificate issued by "root CA". +As the "root" super-user create the client.pem file with: </p> + +<blockquote> +<pre> +# <b>umask 077</b> +# <b>cat client_key.pem client_cert.pem intermediate_CA.pem > chain.pem </b> +</pre> +</blockquote> + +<p> If you also want to verify remote SMTP server certificates issued by +these CAs, you can add the CA certificates to the smtp_tls_CAfile, in +which case it is not necessary to have them in the smtp_tls_cert_file, +smtp_tls_dcert_file (obsolete) or smtp_tls_eccert_file. </p> + +<p> A certificate supplied here must be usable as an SSL client certificate +and hence pass the "openssl verify -purpose sslclient ..." test. </p> + +<p> Example: </p> + +<pre> +smtp_tls_cert_file = /etc/postfix/chain.pem +</pre> + +<p> This feature is available in Postfix 2.2 and later. </p> + +%PARAM smtp_tls_key_file $smtp_tls_cert_file + +<p> File with the Postfix SMTP client RSA private key in PEM format. +This file may be combined with the Postfix SMTP client RSA certificate +file specified with $smtp_tls_cert_file. With Postfix ≥ 3.4 the +preferred way to configure client keys and certificates is via the +"smtp_tls_chain_files" parameter. </p> + +<p> The private key must be accessible without a pass-phrase, i.e. it +must not be encrypted. File permissions should grant read-only +access to the system superuser account ("root"), and no access +to anyone else. </p> + +<p> Example: </p> + +<pre> +smtp_tls_key_file = $smtp_tls_cert_file +</pre> + +<p> This feature is available in Postfix 2.2 and later. </p> + +%PARAM smtp_tls_CAfile + +<p> A file containing CA certificates of root CAs trusted to sign +either remote SMTP server certificates or intermediate CA certificates. +These are loaded into memory before the smtp(8) client enters the +chroot jail. If the number of trusted roots is large, consider using +smtp_tls_CApath instead, but note that the latter directory must be +present in the chroot jail if the smtp(8) client is chrooted. This +file may also be used to augment the client certificate trust chain, +but it is best to include all the required certificates directly in +$smtp_tls_cert_file (or, Postfix ≥ 3.4 $smtp_tls_chain_files). </p> + +<p> Specify "smtp_tls_CAfile = /path/to/system_CA_file" to use +ONLY the system-supplied default Certification Authority certificates. +</p> + +<p> Specify "tls_append_default_CA = no" to prevent Postfix from +appending the system-supplied default CAs and trusting third-party +certificates. </p> + +<p> Example: </p> + +<pre> +smtp_tls_CAfile = /etc/postfix/CAcert.pem +</pre> + +<p> This feature is available in Postfix 2.2 and later. </p> + +%PARAM smtp_tls_CApath + +<p> Directory with PEM format Certification Authority certificates +that the Postfix SMTP client uses to verify a remote SMTP server +certificate. Don't forget to create the necessary "hash" links +with, for example, "$OPENSSL_HOME/bin/c_rehash /etc/postfix/certs". +</p> + +<p> To use this option in chroot mode, this directory (or a copy) +must be inside the chroot jail. </p> + +<p> Specify "smtp_tls_CApath = /path/to/system_CA_directory" to +use ONLY the system-supplied default Certification Authority certificates. +</p> + +<p> Specify "tls_append_default_CA = no" to prevent Postfix from +appending the system-supplied default CAs and trusting third-party +certificates. </p> + +<p> Example: </p> + +<pre> +smtp_tls_CApath = /etc/postfix/certs +</pre> + +<p> This feature is available in Postfix 2.2 and later. </p> + +%PARAM smtp_tls_loglevel 0 + +<p> Enable additional Postfix SMTP client logging of TLS activity. +Each logging level also includes the information that is logged at +a lower logging level. </p> + +<dl compact> + +<dt> </dt> <dd> 0 Disable logging of TLS activity. </dd> + +<dt> </dt> <dd> 1 Log only a summary message on TLS handshake completion +— no logging of remote SMTP server certificate trust-chain +verification errors if server certificate verification is not required. +With Postfix 2.8 and earlier, log the summary message and unconditionally +log trust-chain verification errors. </dd> + +<dt> </dt> <dd> 2 Also log levels during TLS negotiation. </dd> + +<dt> </dt> <dd> 3 Also log the hexadecimal and ASCII dump of the +TLS negotiation process. </dd> + +<dt> </dt> <dd> 4 Also log the hexadecimal and ASCII dump of complete +transmission after STARTTLS. </dd> + +</dl> + +<p> Do not use "smtp_tls_loglevel = 2" or higher except in case of +problems. Use of loglevel 4 is strongly discouraged. </p> + +<p> This feature is available in Postfix 2.2 and later. </p> + +%PARAM smtp_tls_session_cache_database + +<p> Name of the file containing the optional Postfix SMTP client +TLS session cache. Specify a database type that supports enumeration, +such as <b>btree</b> or <b>sdbm</b>; there is no need to support +concurrent access. The file is created if it does not exist. The smtp(8) +daemon does not use this parameter directly, rather the cache is +implemented indirectly in the tlsmgr(8) daemon. This means that +per-smtp-instance master.cf overrides of this parameter are not effective. +Note that each of the cache databases supported by tlsmgr(8) daemon: +$smtpd_tls_session_cache_database, $smtp_tls_session_cache_database +(and with Postfix 2.3 and later $lmtp_tls_session_cache_database), needs to +be stored separately. It is not at this time possible to store multiple +caches in a single database. </p> + +<p> Note: <b>dbm</b> databases are not suitable. TLS +session objects are too large. </p> + +<p> As of version 2.5, Postfix no longer uses root privileges when +opening this file. The file should now be stored under the Postfix-owned +data_directory. As a migration aid, an attempt to open the file +under a non-Postfix directory is redirected to the Postfix-owned +data_directory, and a warning is logged. </p> + +<p> Example: </p> + +<pre> +smtp_tls_session_cache_database = btree:/var/lib/postfix/smtp_scache +</pre> + +<p> This feature is available in Postfix 2.2 and later. </p> + +%PARAM smtp_tls_session_cache_timeout 3600s + +<p> The expiration time of Postfix SMTP client TLS session cache +information. A cache cleanup is performed periodically +every $smtp_tls_session_cache_timeout seconds. As with +$smtp_tls_session_cache_database, this parameter is implemented in the +tlsmgr(8) daemon and therefore per-smtp-instance master.cf overrides +are not possible. </p> + +<p> As of Postfix 2.11 this setting cannot exceed 100 days. If set +≤ 0, session caching is disabled. If set to a positive value +less than 2 minutes, the minimum value of 2 minutes is used instead. </p> + +<p> Specify a non-zero time value (an integral value plus an optional +one-letter suffix that specifies the time unit). Time units: s +(seconds), m (minutes), h (hours), d (days), w (weeks). +The default time unit is s (seconds). </p> + +<p> This feature is available in Postfix 2.2 and later. </p> + +%PARAM smtp_use_tls no + +<p> Opportunistic mode: use TLS when a remote SMTP server announces +STARTTLS support, otherwise send the mail in the clear. Beware: +some SMTP servers offer STARTTLS even if it is not configured. With +Postfix < 2.3, if the TLS handshake fails, and no other server is +available, delivery is deferred and mail stays in the queue. If this +is a concern for you, use the smtp_tls_per_site feature instead. </p> + +<p> This feature is available in Postfix 2.2 and later. With +Postfix 2.3 and later use smtp_tls_security_level instead. </p> + +%PARAM smtp_enforce_tls no + +<p> Enforcement mode: require that remote SMTP servers use TLS +encryption, and never send mail in the clear. This also requires +that the remote SMTP server hostname matches the information in +the remote server certificate, and that the remote SMTP server +certificate was issued by a CA that is trusted by the Postfix SMTP +client. If the certificate doesn't verify or the hostname doesn't +match, delivery is deferred and mail stays in the queue. </p> + +<p> The server hostname is matched against all names provided as +dNSNames in the SubjectAlternativeName. If no dNSNames are specified, +the CommonName is checked. The behavior may be changed with the +smtp_tls_enforce_peername option. </p> + +<p> This option is useful only if you are definitely sure that you +will only connect to servers that support RFC 2487 _and_ that +provide valid server certificates. Typical use is for clients that +send all their email to a dedicated mailhub. </p> + +<p> This feature is available in Postfix 2.2 and later. With +Postfix 2.3 and later use smtp_tls_security_level instead. </p> + +%PARAM smtp_tls_enforce_peername yes + +<p> With mandatory TLS encryption, require that the remote SMTP +server hostname matches the information in the remote SMTP server +certificate. As of RFC 2487 the requirements for hostname checking +for MTA clients are not specified. </p> + +<p> This option can be set to "no" to disable strict peer name +checking. This setting has no effect on sessions that are controlled +via the smtp_tls_per_site table. </p> + +<p> Disabling the hostname verification can make sense in a closed +environment where special CAs are created. If not used carefully, +this option opens the danger of a "man-in-the-middle" attack (the +CommonName of this attacker will be logged). </p> + +<p> This feature is available in Postfix 2.2 and later. With +Postfix 2.3 and later use smtp_tls_security_level instead. </p> + +%PARAM smtp_tls_per_site + +<p> Optional lookup tables with the Postfix SMTP client TLS usage +policy by next-hop destination and by remote SMTP server hostname. +When both lookups succeed, the more specific per-site policy (NONE, +MUST, etc.) overrides the less specific one (MAY), and the more secure +per-site policy (MUST, etc.) overrides the less secure one (NONE). +With Postfix 2.3 and later smtp_tls_per_site is strongly discouraged: +use smtp_tls_policy_maps instead. </p> + +<p> Use of the bare hostname as the per-site table lookup key is +discouraged. Always use the full destination nexthop (enclosed in +[] with a possible ":port" suffix). A recipient domain or MX-enabled +transport next-hop with no port suffix may look like a bare hostname, +but is still a suitable <i>destination</i>. </p> + +<p> Specify a next-hop destination or server hostname on the left-hand +side; no wildcards are allowed. The next-hop destination is either +the recipient domain, or the destination specified with a transport(5) +table, the relayhost parameter, or the relay_transport parameter. +On the right hand side specify one of the following keywords: </p> + +<dl> + +<dt> NONE </dt> <dd> Don't use TLS at all. This overrides a less +specific <b>MAY</b> lookup result from the alternate host or next-hop +lookup key, and overrides the global smtp_use_tls, smtp_enforce_tls, +and smtp_tls_enforce_peername settings. </dd> + +<dt> MAY </dt> <dd> Try to use TLS if the server announces support, +otherwise use an unencrypted connection. This has less precedence +than a more specific result (including <b>NONE</b>) from the alternate +host or next-hop lookup key, and has less precedence than the more +specific global "smtp_enforce_tls = yes" or "smtp_tls_enforce_peername += yes". </dd> + +<dt> MUST_NOPEERMATCH </dt> <dd> Require TLS encryption, but do not +require that the remote SMTP server hostname matches the information +in the remote SMTP server certificate, or that the server certificate +was issued by a trusted CA. This overrides a less secure <b>NONE</b> +or a less specific <b>MAY</b> lookup result from the alternate host +or next-hop lookup key, and overrides the global smtp_use_tls, +smtp_enforce_tls and smtp_tls_enforce_peername settings. </dd> + +<dt> MUST </dt> <dd> Require TLS encryption, require that the remote +SMTP server hostname matches the information in the remote SMTP +server certificate, and require that the remote SMTP server certificate +was issued by a trusted CA. This overrides a less secure <b>NONE</b> +or <b>MUST_NOPEERMATCH</b> or a less specific <b>MAY</b> lookup +result from the alternate host or next-hop lookup key, and overrides +the global smtp_use_tls, smtp_enforce_tls and smtp_tls_enforce_peername +settings. </dd> + +</dl> + +<p> The above keywords correspond to the "none", "may", "encrypt" and +"verify" security levels for the new smtp_tls_security_level parameter +introduced in Postfix 2.3. Starting with Postfix 2.3, and independently +of how the policy is specified, the smtp_tls_mandatory_ciphers and +smtp_tls_mandatory_protocols parameters apply when TLS encryption +is mandatory. Connections for which encryption is optional typically +enable all "export" grade and better ciphers (see smtp_tls_ciphers +and smtp_tls_protocols). </p> + +<p> As long as no secure DNS lookup mechanism is available, false +hostnames in MX or CNAME responses can change the server hostname +that Postfix uses for TLS policy lookup and server certificate +verification. Even with a perfect match between the server hostname and +the server certificate, there is no guarantee that Postfix is connected +to the right server. See TLS_README (Closing a DNS loophole with obsolete +per-site TLS policies) for a possible work-around. </p> + +<p> This feature is available in Postfix 2.2 and later. With +Postfix 2.3 and later use smtp_tls_policy_maps instead. </p> + +%PARAM smtp_tls_scert_verifydepth 9 + +<p> The verification depth for remote SMTP server certificates. A depth +of 1 is sufficient if the issuing CA is listed in a local CA file. </p> + +<p> The default verification depth is 9 (the OpenSSL default) for +compatibility with earlier Postfix behavior. Prior to Postfix 2.5, +the default value was 5, but the limit was not actually enforced. If +you have set this to a lower non-default value, certificates with longer +trust chains may now fail to verify. Certificate chains with 1 or 2 +CAs are common, deeper chains are more rare and any number between 5 +and 9 should suffice in practice. You can choose a lower number if, +for example, you trust certificates directly signed by an issuing CA +but not any CAs it delegates to. </p> + +<p> This feature is available in Postfix 2.2 and later. </p> + +%PARAM smtp_tls_note_starttls_offer no + +<p> Log the hostname of a remote SMTP server that offers STARTTLS, +when TLS is not already enabled for that server. </p> + +<p> The logfile record looks like: </p> + +<pre> +postfix/smtp[pid]: Host offered STARTTLS: [name.of.host] +</pre> + +<p> This feature is available in Postfix 2.2 and later. </p> + +%PARAM smtp_tls_cipherlist + +<p> Obsolete Postfix < 2.3 control for the Postfix SMTP client TLS +cipher list. As this feature applies to all TLS security levels, it is easy +to create interoperability problems by choosing a non-default cipher +list. Do not use a non-default TLS cipher list on hosts that deliver email +to the public Internet: you will be unable to send email to servers that +only support the ciphers you exclude. Using a restricted cipher list +may be more appropriate for an internal MTA, where one can exert some +control over the TLS software and settings of the peer servers. </p> + +<p> <b>Note:</b> do not use "" quotes around the parameter value. </p> + +<p> This feature is available in Postfix version 2.2. It is not used with +Postfix 2.3 and later; use smtp_tls_mandatory_ciphers instead. </p> + +%PARAM smtp_starttls_timeout 300s + +<p> Time limit for Postfix SMTP client write and read operations +during TLS startup and shutdown handshake procedures. </p> + +<p> Specify a non-zero time value (an integral value plus an optional +one-letter suffix that specifies the time unit). Time units: s +(seconds), m (minutes), h (hours), d (days), w (weeks). +The default time unit is s (seconds). </p> + +<p> This feature is available in Postfix 2.2 and later. </p> + +%PARAM smtp_tls_dkey_file $smtp_tls_dcert_file + +<p> File with the Postfix SMTP client DSA private key in PEM format. +This file may be combined with the Postfix SMTP client DSA certificate +file specified with $smtp_tls_dcert_file. The DSA algorithm is obsolete +and should not be used. </p> + +<p> The private key must be accessible without a pass-phrase, i.e. it +must not be encrypted. File permissions should grant read-only +access to the system superuser account ("root"), and no access +to anyone else. </p> + +<p> This feature is available in Postfix 2.2 and later. </p> + +%PARAM smtp_tls_dcert_file + +<p> File with the Postfix SMTP client DSA certificate in PEM format. +This file may also contain the Postfix SMTP client private DSA key. +The DSA algorithm is obsolete and should not be used. </p> + +<p> See the discussion under smtp_tls_cert_file for more details. +</p> + +<p> Example: </p> + +<pre> +smtp_tls_dcert_file = /etc/postfix/client-dsa.pem +</pre> + +<p> This feature is available in Postfix 2.2 and later. </p> + +%PARAM tls_append_default_CA no + +<p> Append the system-supplied default Certification Authority +certificates to the ones specified with *_tls_CApath or *_tls_CAfile. +The default is "no"; this prevents Postfix from trusting third-party +certificates and giving them relay permission with +permit_tls_all_clientcerts. </p> + +<p> This feature is available in Postfix 2.4.15, 2.5.11, 2.6.8, +2.7.2 and later versions. Specify "tls_append_default_CA = yes" for +backwards compatibility, to avoid breaking certificate verification +with sites that don't use permit_tls_all_clientcerts. </p> + +%PARAM tls_random_exchange_name see "postconf -d" output + +<p> Name of the pseudo random number generator (PRNG) state file +that is maintained by tlsmgr(8). The file is created when it does +not exist, and its length is fixed at 1024 bytes. </p> + +<p> As of version 2.5, Postfix no longer uses root privileges when +opening this file, and the default file location was changed from +${config_directory}/prng_exch to ${data_directory}/prng_exch. As +a migration aid, an attempt to open the file under a non-Postfix +directory is redirected to the Postfix-owned data_directory, and a +warning is logged. </p> + +<p> This feature is available in Postfix 2.2 and later. </p> + +%PARAM tls_random_source see "postconf -d" output + +<p> The external entropy source for the in-memory tlsmgr(8) pseudo +random number generator (PRNG) pool. Be sure to specify a non-blocking +source. If this source is not a regular file, the entropy source +type must be prepended: egd:/path/to/egd_socket for a source with +EGD compatible socket interface, or dev:/path/to/device for a +device file. </p> + +<p> Note: on OpenBSD systems specify dev:/dev/arandom when dev:/dev/urandom +gives timeout errors. </p> + +<p> This feature is available in Postfix 2.2 and later. </p> + +%PARAM tls_random_bytes 32 + +<p> The number of bytes that tlsmgr(8) reads from $tls_random_source +when (re)seeding the in-memory pseudo random number generator (PRNG) +pool. The default of 32 bytes (256 bits) is good enough for 128bit +symmetric keys. If using EGD or a device file, a maximum of 255 +bytes is read. </p> + +<p> This feature is available in Postfix 2.2 and later. </p> + +%PARAM tls_random_reseed_period 3600s + +<p> The maximal time between attempts by tlsmgr(8) to re-seed the +in-memory pseudo random number generator (PRNG) pool from external +sources. The actual time between re-seeding attempts is calculated +using the PRNG, and is between 0 and the time specified. </p> + +<p> Specify a non-zero time value (an integral value plus an optional +one-letter suffix that specifies the time unit). Time units: s +(seconds), m (minutes), h (hours), d (days), w (weeks). +The default time unit is s (seconds). </p> + +<p> This feature is available in Postfix 2.2 and later. </p> + +%PARAM tls_random_prng_update_period 3600s + +<p> The time between attempts by tlsmgr(8) to save the state of +the pseudo random number generator (PRNG) to the file specified +with $tls_random_exchange_name. </p> + +<p> Specify a non-zero time value (an integral value plus an optional +one-letter suffix that specifies the time unit). Time units: s +(seconds), m (minutes), h (hours), d (days), w (weeks). +The default time unit is s (seconds). </p> + +<p> This feature is available in Postfix 2.2 and later. </p> + +%PARAM tls_daemon_random_bytes 32 + +<p> The number of pseudo-random bytes that an smtp(8) or smtpd(8) +process requests from the tlsmgr(8) server in order to seed its +internal pseudo random number generator (PRNG). The default of 32 +bytes (equivalent to 256 bits) is sufficient to generate a 128bit +(or 168bit) session key. </p> + +<p> This feature is available in Postfix 2.2 and later. </p> + +%PARAM smtp_sasl_tls_security_options $smtp_sasl_security_options + +<p> The SASL authentication security options that the Postfix SMTP +client uses for TLS encrypted SMTP sessions. </p> + +<p> This feature is available in Postfix 2.2 and later. </p> + +%PARAM smtpd_sasl_tls_security_options $smtpd_sasl_security_options + +<p> The SASL authentication security options that the Postfix SMTP +server uses for TLS encrypted SMTP sessions. </p> + +<p> This feature is available in Postfix 2.2 and later. </p> + +%PARAM smtp_generic_maps + +<p> Optional lookup tables that perform address rewriting in the +Postfix SMTP client, typically to transform a locally valid address into +a globally valid address when sending mail across the Internet. +This is needed when the local machine does not have its own Internet +domain name, but uses something like <i>localdomain.local</i> +instead. </p> + +<p> +Specify zero or more "type:name" lookup tables, separated by +whitespace or comma. Tables will be searched in the specified order +until a match is found. +</p> + +<p> The table format and lookups are documented in generic(5); +examples are shown in the ADDRESS_REWRITING_README and +STANDARD_CONFIGURATION_README documents. </p> + +<p> This feature is available in Postfix 2.2 and later. </p> + +%PARAM message_reject_characters + +<p> The set of characters that Postfix will reject in message +content. The usual C-like escape sequences are recognized: <tt>\a +\b \f \n \r \t \v \<i>ddd</i></tt> (up to three octal digits) and +<tt>\\</tt>. </p> + +<p> Note 1: this feature does not recognize text that requires MIME +decoding. It inspects raw message content, just like header_checks +and body_checks. </p> + +<p> Note 2: this feature is disabled with "receive_override_options += no_header_body_checks". </p> + +<p> Example: </p> + +<pre> +message_reject_characters = \0 +</pre> + +<p> This feature is available in Postfix 2.3 and later. </p> + +%PARAM message_strip_characters + +<p> The set of characters that Postfix will remove from message +content. The usual C-like escape sequences are recognized: <tt>\a +\b \f \n \r \t \v \<i>ddd</i></tt> (up to three octal digits) and +<tt>\\</tt>. </p> + +<p> Note 1: this feature does not recognize text that requires MIME +decoding. It inspects raw message content, just like header_checks +and body_checks. </p> + +<p> Note 2: this feature is disabled with "receive_override_options += no_header_body_checks". </p> + +<p> Example: </p> + +<pre> +message_strip_characters = \0 +</pre> + +<p> This feature is available in Postfix 2.3 and later. </p> + +%PARAM frozen_delivered_to yes + +<p> Update the local(8) delivery agent's idea of the Delivered-To: +address (see prepend_delivered_header) only once, at the start of +a delivery attempt; do not update the Delivered-To: address while +expanding aliases or .forward files. </p> + +<p> This feature is available in Postfix 2.3 and later. With older +Postfix releases, the behavior is as if this parameter is set to +"no". The old setting can be expensive with deeply nested aliases +or .forward files. When an alias or .forward file changes the +Delivered-To: address, it ties up one queue file and one cleanup +process instance while mail is being forwarded. </p> + +%PARAM smtpd_peername_lookup yes + +<p> Attempt to look up the remote SMTP client hostname, and verify that +the name matches the client IP address. A client name is set to +"unknown" when it cannot be looked up or verified, or when name +lookup is disabled. Turning off name lookup reduces delays due to +DNS lookup and increases the maximal inbound delivery rate. </p> + +<p> This feature is available in Postfix 2.3 and later. </p> + +%PARAM delay_logging_resolution_limit 2 + +<p> The maximal number of digits after the decimal point when logging +sub-second delay values. Specify a number in the range 0..6. </p> + +<p> Large delay values are rounded off to an integral number of seconds; +delay values below the delay_logging_resolution_limit are logged +as "0", and delay values under 100s are logged with at most two-digit +precision. </p> + +<p> The format of the "delays=a/b/c/d" logging is as follows: </p> + +<ul> + +<li> a = time from message arrival to last active queue entry + +<li> b = time from last active queue entry to connection setup + +<li> c = time in connection setup, including DNS, EHLO and STARTTLS + +<li> d = time in message transmission + +</ul> + +<p> This feature is available in Postfix 2.3 and later. </p> + +%PARAM bounce_template_file + +<p> Pathname of a configuration file with bounce message templates. +These override the built-in templates of delivery status notification +(DSN) messages for undeliverable mail, delayed mail, successful +delivery, or delivery verification. The bounce(5) manual page +describes how to edit and test template files. </p> + +<p> Template message body text may contain $name references to +Postfix configuration parameters. The result of $name expansion can +be previewed with "<b>postconf -b <i>file_name</i></b>" before the file +is placed into the Postfix configuration directory. </p> + +<p> This feature is available in Postfix 2.3 and later. </p> + +%PARAM sender_dependent_relayhost_maps + +<p> A sender-dependent override for the global relayhost parameter +setting. The tables are searched by the envelope sender address and +@domain. A lookup result of DUNNO terminates the search without +overriding the global relayhost parameter setting (Postfix 2.6 and +later). This information is overruled with relay_transport, +sender_dependent_default_transport_maps, default_transport and with +the transport(5) table. </p> + +<p> +Specify zero or more "type:name" lookup tables, separated by +whitespace or comma. Tables will be searched in the specified order +until a match is found. +</p> + +<p> For safety reasons, this feature does not allow $number +substitutions in regular expression maps. </p> + +<p> +This feature is available in Postfix 2.3 and later. +</p> + +%PARAM empty_address_relayhost_maps_lookup_key <> + +<p> The sender_dependent_relayhost_maps search string that will be +used instead of the null sender address. </p> + +<p> This feature is available in Postfix 2.5 and later. With +earlier versions, sender_dependent_relayhost_maps lookups were +skipped for the null sender address. </p> + +%PARAM address_verify_sender_dependent_relayhost_maps $sender_dependent_relayhost_maps + +<p> +Overrides the sender_dependent_relayhost_maps parameter setting for address +verification probes. +</p> + +<p> +This feature is available in Postfix 2.3 and later. +</p> + +%PARAM smtp_sender_dependent_authentication no + +<p> +Enable sender-dependent authentication in the Postfix SMTP client; this is +available only with SASL authentication, and disables SMTP connection +caching to ensure that mail from different senders will use the +appropriate credentials. </p> + +<p> +This feature is available in Postfix 2.3 and later. +</p> + +%PARAM lmtp_lhlo_name $myhostname + +<p> +The hostname to send in the LMTP LHLO command. +</p> + +<p> +The default value is the machine hostname. Specify a hostname or +[ip.add.re.ss] or [ip:v6:add:re::ss]. +</p> + +<p> +This information can be specified in the main.cf file for all LMTP +clients, or it can be specified in the master.cf file for a specific +client, for example: +</p> + +<blockquote> +<pre> +/etc/postfix/master.cf: + mylmtp ... lmtp -o lmtp_lhlo_name=foo.bar.com +</pre> +</blockquote> + +<p> +This feature is available in Postfix 2.3 and later. +</p> + +%PARAM lmtp_discard_lhlo_keyword_address_maps + +<p> Lookup tables, indexed by the remote LMTP server address, with +case insensitive lists of LHLO keywords (pipelining, starttls, +auth, etc.) that the Postfix LMTP client will ignore in the LHLO +response +from a remote LMTP server. See lmtp_discard_lhlo_keywords for +details. The table is not indexed by hostname for consistency with +smtpd_discard_ehlo_keyword_address_maps. </p> + +<p> This feature is available in Postfix 2.3 and later. </p> + +%PARAM lmtp_discard_lhlo_keywords + +<p> A case insensitive list of LHLO keywords (pipelining, starttls, +auth, etc.) that the Postfix LMTP client will ignore in the LHLO +response +from a remote LMTP server. </p> + +<p> This feature is available in Postfix 2.3 and later. </p> + +<p> Notes: </p> + +<ul> + +<li> <p> Specify the <b>silent-discard</b> pseudo keyword to prevent +this action from being logged. </p> + +<li> <p> Use the lmtp_discard_lhlo_keyword_address_maps feature to +discard LHLO keywords selectively. </p> + +</ul> + +%PARAM lmtp_lhlo_timeout 300s + +<p> The Postfix LMTP client time limit for sending the LHLO command, +and for receiving the initial remote LMTP server response. </p> + +<p> Time units: s (seconds), m (minutes), h (hours), d (days), w +(weeks). The default time unit is s (seconds). </p> + +%PARAM lmtp_sasl_tls_security_options $lmtp_sasl_security_options + +<p> The LMTP-specific version of the smtp_sasl_tls_security_options +configuration parameter. See there for details. </p> + +<p> This feature is available in Postfix 2.3 and later. </p> + +%PARAM lmtp_sasl_mechanism_filter + +<p> The LMTP-specific version of the smtp_sasl_mechanism_filter +configuration parameter. See there for details. </p> + +<p> This feature is available in Postfix 2.3 and later. </p> + +%PARAM lmtp_bind_address + +<p> The LMTP-specific version of the smtp_bind_address configuration +parameter. See there for details. </p> + +<p> This feature is available in Postfix 2.3 and later. </p> + +%PARAM lmtp_bind_address6 + +<p> The LMTP-specific version of the smtp_bind_address6 configuration +parameter. See there for details. </p> + +<p> This feature is available in Postfix 2.3 and later. </p> + +%PARAM lmtp_host_lookup dns + +<p> The LMTP-specific version of the smtp_host_lookup configuration +parameter. See there for details. </p> + +<p> This feature is available in Postfix 2.3 and later. </p> + +%PARAM lmtp_connection_cache_destinations + +<p> The LMTP-specific version of the smtp_connection_cache_destinations +configuration parameter. See there for details. </p> + +<p> This feature is available in Postfix 2.3 and later. </p> + +%PARAM lmtp_tls_per_site + +<p> The LMTP-specific version of the smtp_tls_per_site configuration +parameter. See there for details. </p> + +<p> This feature is available in Postfix 2.3 and later. </p> + +%PARAM lmtp_generic_maps + +<p> The LMTP-specific version of the smtp_generic_maps configuration +parameter. See there for details. </p> + +<p> This feature is available in Postfix 2.3 and later. </p> + +%PARAM lmtp_pix_workaround_threshold_time 500s + +<p> The LMTP-specific version of the smtp_pix_workaround_threshold_time +configuration parameter. See there for details. </p> + +<p> This feature is available in Postfix 2.3 and later. </p> + +%PARAM lmtp_pix_workaround_delay_time 10s + +<p> The LMTP-specific version of the smtp_pix_workaround_delay_time +configuration parameter. See there for details. </p> + +<p> This feature is available in Postfix 2.3 and later. </p> + +%PARAM lmtp_connection_reuse_time_limit 300s + +<p> The LMTP-specific version of the smtp_connection_reuse_time_limit +configuration parameter. See there for details. </p> + +<p> This feature is available in Postfix 2.3 and later. </p> + +%PARAM lmtp_starttls_timeout 300s + +<p> The LMTP-specific version of the smtp_starttls_timeout configuration +parameter. See there for details. </p> + +<p> This feature is available in Postfix 2.3 and later. </p> + +%PARAM lmtp_line_length_limit 990 + +<p> The LMTP-specific version of the smtp_line_length_limit +configuration parameter. See there for details. </p> + +<p> This feature is available in Postfix 2.3 and later. </p> + +%PARAM lmtp_mx_address_limit 5 + +<p> The LMTP-specific version of the smtp_mx_address_limit configuration +parameter. See there for details. </p> + +<p> This feature is available in Postfix 2.3 and later. </p> + +%PARAM lmtp_mx_session_limit 2 + +<p> The LMTP-specific version of the smtp_mx_session_limit configuration +parameter. See there for details. </p> + +<p> This feature is available in Postfix 2.3 and later. </p> + +%PARAM lmtp_tls_scert_verifydepth 9 + +<p> The LMTP-specific version of the smtp_tls_scert_verifydepth +configuration parameter. See there for details. </p> + +<p> This feature is available in Postfix 2.3 and later. </p> + +%PARAM lmtp_skip_5xx_greeting yes + +<p> The LMTP-specific version of the smtp_skip_5xx_greeting +configuration parameter. See there for details. </p> + +<p> This feature is available in Postfix 2.3 and later. </p> + +%PARAM lmtp_randomize_addresses yes + +<p> The LMTP-specific version of the smtp_randomize_addresses +configuration parameter. See there for details. </p> + +<p> This feature is available in Postfix 2.3 and later. </p> + +%PARAM lmtp_quote_rfc821_envelope yes + +<p> The LMTP-specific version of the smtp_quote_rfc821_envelope +configuration parameter. See there for details. </p> + +<p> This feature is available in Postfix 2.3 and later. </p> + +%PARAM lmtp_defer_if_no_mx_address_found no + +<p> The LMTP-specific version of the smtp_defer_if_no_mx_address_found +configuration parameter. See there for details. </p> + +<p> This feature is available in Postfix 2.3 and later. </p> + +%PARAM lmtp_connection_cache_on_demand yes + +<p> The LMTP-specific version of the smtp_connection_cache_on_demand +configuration parameter. See there for details. </p> + +<p> This feature is available in Postfix 2.3 and later. </p> + +%PARAM lmtp_use_tls no + +<p> The LMTP-specific version of the smtp_use_tls configuration +parameter. See there for details. </p> + +<p> This feature is available in Postfix 2.3 and later. </p> + +%PARAM lmtp_enforce_tls no + +<p> The LMTP-specific version of the smtp_enforce_tls configuration +parameter. See there for details. </p> + +<p> This feature is available in Postfix 2.3 and later. </p> + +%PARAM lmtp_tls_security_level + +<p> The LMTP-specific version of the smtp_tls_security_level configuration +parameter. See there for details. </p> + +<p> This feature is available in Postfix 2.3 and later. </p> + +%PARAM lmtp_tls_enforce_peername yes + +<p> The LMTP-specific version of the smtp_tls_enforce_peername +configuration parameter. See there for details. </p> + +<p> This feature is available in Postfix 2.3 and later. </p> + +%PARAM lmtp_tls_note_starttls_offer no + +<p> The LMTP-specific version of the smtp_tls_note_starttls_offer +configuration parameter. See there for details. </p> + +<p> This feature is available in Postfix 2.3 and later. </p> + +%PARAM lmtp_sender_dependent_authentication no + +<p> The LMTP-specific version of the smtp_sender_dependent_authentication +configuration parameter. See there for details. </p> + +<p> This feature is available in Postfix 2.3 and later. </p> + +%PARAM connection_cache_protocol_timeout 5s + +<p> Time limit for connection cache connect, send or receive +operations. The time limit is enforced in the client. </p> + +<p> This feature is available in Postfix 2.3 and later. </p> + +%PARAM smtpd_sasl_type cyrus + +<p> The SASL plug-in type that the Postfix SMTP server should use +for authentication. The available types are listed with the +"<b>postconf -a</b>" command. </p> + +<p> This feature is available in Postfix 2.3 and later. </p> + +%PARAM smtp_sasl_type cyrus + +<p> The SASL plug-in type that the Postfix SMTP client should use +for authentication. The available types are listed with the +"<b>postconf -A</b>" command. </p> + +<p> This feature is available in Postfix 2.3 and later. </p> + + +%PARAM lmtp_sasl_type cyrus + +<p> The SASL plug-in type that the Postfix LMTP client should use +for authentication. The available types are listed with the +"<b>postconf -A</b>" command. </p> + +<p> This feature is available in Postfix 2.3 and later. </p> + +%PARAM smtpd_sasl_path smtpd + +<p> Implementation-specific information that the Postfix SMTP server +passes through to +the SASL plug-in implementation that is selected with +<b>smtpd_sasl_type</b>. Typically this specifies the name of a +configuration file or rendezvous point. </p> + +<p> This feature is available in Postfix 2.3 and later. In earlier +releases it was called <b>smtpd_sasl_application_name</b>. </p> + +%PARAM smtpd_sasl_service smtp + +<p> The service name that is passed to the SASL plug-in that is +selected with <b>smtpd_sasl_type</b> and <b>smtpd_sasl_path</b>. +</p> + +<p> This feature is available in Postfix 2.11 and later. Prior +versions behave as if "<b>smtp</b>" is specified. </p> + +%PARAM smtpd_sasl_response_limit 12288 + +<p> The maximum length of a SASL client's response to a server challenge. +When the client's "initial response" is longer than the normal limit for +SMTP commands, the client must omit its initial response, and wait for an +empty server challenge; it can then send what would have been its "initial +response" as a response to the empty server challenge. RFC4954 requires the +server to accept client responses up to at least 12288 octets of +base64-encoded text. The default value is therefore also the minimum value +accepted for this parameter.</p> + +<p> This feature is available in Postfix 3.4 and later. Prior versions use +"line_length_limit", which may need to be raised to accommodate larger client +responses, as may be needed with GSSAPI authentication of Windows AD users +who are members of many groups. </p> + +%PARAM cyrus_sasl_config_path + +<p> Search path for Cyrus SASL application configuration files, +currently used only to locate the $smtpd_sasl_path.conf file. +Specify zero or more directories separated by a colon character, +or an empty value to use Cyrus SASL's built-in search path. </p> + +<p> This feature is available in Postfix 2.5 and later when compiled +with Cyrus SASL 2.1.22 or later. </p> + +%PARAM smtp_sasl_path + +<p> Implementation-specific information that the Postfix SMTP client +passes through to +the SASL plug-in implementation that is selected with +<b>smtp_sasl_type</b>. Typically this specifies the name of a +configuration file or rendezvous point. </p> + +<p> This feature is available in Postfix 2.3 and later. </p> + +%PARAM lmtp_sasl_path + +<p> Implementation-specific information that is passed through to +the SASL plug-in implementation that is selected with +<b>lmtp_sasl_type</b>. Typically this specifies the name of a +configuration file or rendezvous point. </p> + +<p> This feature is available in Postfix 2.3 and later. </p> + +%PARAM plaintext_reject_code 450 + +<p> +The numerical Postfix SMTP server response code when a request +is rejected by the <b>reject_plaintext_session</b> restriction. +</p> + +<p> This feature is available in Postfix 2.3 and later. </p> + +%PARAM resolve_numeric_domain no + +<p> Resolve "user@ipaddress" as "user@[ipaddress]", instead of +rejecting the address as invalid. </p> + +<p> This feature is available in Postfix 2.3 and later. + +%PARAM mailbox_transport_maps + +<p> Optional lookup tables with per-recipient message delivery +transports to use for local(8) mailbox delivery, whether or not the +recipients are found in the UNIX passwd database. </p> + +<p> The precedence of local(8) delivery features from high to low +is: aliases, .forward files, mailbox_transport_maps, mailbox_transport, +mailbox_command_maps, mailbox_command, home_mailbox, mail_spool_directory, +fallback_transport_maps, fallback_transport and luser_relay. </p> + +<p> +Specify zero or more "type:name" lookup tables, separated by +whitespace or comma. Tables will be searched in the specified order +until a match is found. +</p> + +<p> For safety reasons, this feature does not allow $number +substitutions in regular expression maps. </p> + +<p> This feature is available in Postfix 2.3 and later. </p> + +%PARAM fallback_transport_maps + +<p> Optional lookup tables with per-recipient message delivery +transports for recipients that the local(8) delivery agent could +not find in the aliases(5) or UNIX password database. </p> + +<p> The precedence of local(8) delivery features from high to low +is: aliases, .forward files, mailbox_transport_maps, mailbox_transport, +mailbox_command_maps, mailbox_command, home_mailbox, mail_spool_directory, +fallback_transport_maps, fallback_transport and luser_relay. </p> + +<p> For safety reasons, this feature does not allow $number +substitutions in regular expression maps. </p> + +<p> This feature is available in Postfix 2.3 and later. </p> + +%PARAM smtp_cname_overrides_servername version dependent + +<p> When the remote SMTP servername is a DNS CNAME, replace the +servername with the result from CNAME expansion for the purpose of +logging, SASL password lookup, TLS +policy decisions, or TLS certificate verification. The value "no" +hardens Postfix smtp_tls_per_site hostname-based policies against +false hostname information in DNS CNAME records, and makes SASL +password file lookups more predictable. This is the default setting +as of Postfix 2.3. </p> + +<p> When DNS CNAME records are validated with secure DNS lookups +(smtp_dns_support_level = dnssec), they are always allowed to +override the above servername (Postfix 2.11 and later). </p> + +<p> This feature is available in Postfix 2.2.9 and later. </p> + +%PARAM lmtp_cname_overrides_servername yes + +<p> The LMTP-specific version of the smtp_cname_overrides_servername +configuration parameter. See there for details. </p> + +<p> This feature is available in Postfix 2.3 and later. </p> + +%PARAM smtp_sasl_tls_verified_security_options $smtp_sasl_tls_security_options + +<p> The SASL authentication security options that the Postfix SMTP +client uses for TLS encrypted SMTP sessions with a verified server +certificate. </p> + +<p> When mail is sent to the public MX host for the recipient's +domain, server certificates are by default optional, and delivery +proceeds even if certificate verification fails. For delivery via +a submission service that requires SASL authentication, it may be +appropriate to send plaintext passwords only when the connection +to the server is strongly encrypted <b>and</b> the server identity +is verified. </p> + +<p> The smtp_sasl_tls_verified_security_options parameter makes it +possible to only enable plaintext mechanisms when a secure connection +to the server is available. Submission servers subject to this +policy must either have verifiable certificates or offer suitable +non-plaintext SASL mechanisms. </p> + +<p> This feature is available in Postfix 2.6 and later. </p> + +%PARAM lmtp_sasl_tls_verified_security_options $lmtp_sasl_tls_security_options + +<p> The LMTP-specific version of the +smtp_sasl_tls_verified_security_options configuration parameter. +See there for details. </p> + +<p> This feature is available in Postfix 2.3 and later. </p> + +%PARAM lmtp_connection_cache_time_limit 2s + +<p> The LMTP-specific version of the +smtp_connection_cache_time_limit configuration parameter. +See there for details. </p> + +<p> This feature is available in Postfix 2.3 and later. </p> + +%PARAM smtpd_delay_open_until_valid_rcpt yes + +<p> Postpone the start of an SMTP mail transaction until a valid +RCPT TO command is received. Specify "no" to create a mail transaction +as soon as the Postfix SMTP server receives a valid MAIL FROM +command. </p> + +<p> With sites that reject lots of mail, the default setting reduces +the use of +disk, CPU and memory resources. The downside is that rejected +recipients are logged with NOQUEUE instead of a mail transaction +ID. This complicates the logfile analysis of multi-recipient mail. +</p> + +<p> This feature is available in Postfix 2.3 and later. </p> + +%PARAM lmtp_tls_cert_file + +<p> The LMTP-specific version of the smtp_tls_cert_file +configuration parameter. See there for details. </p> + +<p> This feature is available in Postfix 2.3 and later. </p> + +%PARAM lmtp_tls_key_file $lmtp_tls_cert_file + +<p> The LMTP-specific version of the smtp_tls_key_file +configuration parameter. See there for details. </p> + +<p> This feature is available in Postfix 2.3 and later. </p> + +%PARAM lmtp_tls_dcert_file + +<p> The LMTP-specific version of the smtp_tls_dcert_file +configuration parameter. See there for details. </p> + +<p> This feature is available in Postfix 2.3 and later. </p> + +%PARAM lmtp_tls_dkey_file $lmtp_tls_dcert_file + +<p> The LMTP-specific version of the smtp_tls_dkey_file +configuration parameter. See there for details. </p> + +<p> This feature is available in Postfix 2.3 and later. </p> + +%PARAM lmtp_tls_CAfile + +<p> The LMTP-specific version of the smtp_tls_CAfile +configuration parameter. See there for details. </p> + +<p> This feature is available in Postfix 2.3 and later. </p> + +%PARAM lmtp_tls_CApath + +<p> The LMTP-specific version of the smtp_tls_CApath +configuration parameter. See there for details. </p> + +<p> This feature is available in Postfix 2.3 and later. </p> + +%PARAM lmtp_tls_loglevel 0 + +<p> The LMTP-specific version of the smtp_tls_loglevel +configuration parameter. See there for details. </p> + +<p> This feature is available in Postfix 2.3 and later. </p> + +%PARAM lmtp_tls_session_cache_database + +<p> The LMTP-specific version of the smtp_tls_session_cache_database +configuration parameter. See there for details. </p> + +<p> This feature is available in Postfix 2.3 and later. </p> + +%PARAM lmtp_tls_session_cache_timeout 3600s + +<p> The LMTP-specific version of the smtp_tls_session_cache_timeout +configuration parameter. See there for details. </p> + +<p> This feature is available in Postfix 2.3 and later. </p> + +%PARAM smtp_tls_policy_maps + +<p> Optional lookup tables with the Postfix SMTP client TLS security +policy by next-hop destination; when a non-empty value is specified, +this overrides the obsolete smtp_tls_per_site parameter. See +TLS_README for a more detailed discussion of TLS security levels. +</p> + +<p> +Specify zero or more "type:name" lookup tables, separated by +whitespace or comma. Tables will be searched in the specified order +until a match is found. +</p> + +<p> The TLS policy table is indexed by the full next-hop destination, +which is either the recipient domain, or the verbatim next-hop +specified in the transport table, $local_transport, $virtual_transport, +$relay_transport or $default_transport. This includes any enclosing +square brackets and any non-default destination server port suffix. The +LMTP socket type prefix (inet: or unix:) is not included in the lookup +key. </p> + +<p> Only the next-hop domain, or $myhostname with LMTP over UNIX-domain +sockets, is used as the nexthop name for certificate verification. The +port and any enclosing square brackets are used in the table lookup key, +but are not used for server name verification. </p> + +<p> When the lookup key is a domain name without enclosing square brackets +or any <i>:port</i> suffix (typically the recipient domain), and the full +domain is not found in the table, just as with the transport(5) table, +the parent domain starting with a leading "." is matched recursively. This +allows one to specify a security policy for a recipient domain and all +its sub-domains. </p> + +<p> The lookup result is a security level, followed by an optional list +of whitespace and/or comma separated name=value attributes that override +related main.cf settings. The TLS security levels in order of increasing +security are: </p> + +<dl> + +<dt><b><a href="TLS_README.html#client_tls_none">none</a></b></dt> +<dd>No TLS. No additional attributes are supported at this level. </dd> + +<dt><b><a href="TLS_README.html#client_tls_may">may</a></b></dt> +<dd>Opportunistic TLS. Since sending in the clear is acceptable, +demanding stronger than default TLS security merely reduces +interoperability. The optional "ciphers", "exclude", and "protocols" +attributes (available for opportunistic TLS with Postfix ≥ 2.6) +and "connection_reuse" attribute (Postfix ≥ 3.4) override the +"smtp_tls_ciphers", "smtp_tls_exclude_ciphers", "smtp_tls_protocols", +and +"smtp_tls_connection_reuse" configuration parameters. In the policy table, +multiple ciphers, protocols or excluded ciphers must be separated by colons, +as attribute values may not contain whitespace or commas. When opportunistic +TLS handshakes fail, Postfix retries the connection with TLS disabled. +This allows mail delivery to sites with non-interoperable TLS +implementations.</dd> + +<dt><b><a href="TLS_README.html#client_tls_encrypt">encrypt</a></b></dt> +<dd>Mandatory TLS encryption. At this level +and higher, the optional "protocols" attribute overrides the main.cf +smtp_tls_mandatory_protocols parameter, the optional "ciphers" attribute +overrides the main.cf smtp_tls_mandatory_ciphers parameter, the +optional "exclude" attribute (Postfix ≥ 2.6) overrides the main.cf +smtp_tls_mandatory_exclude_ciphers parameter, and the optional +"connection_reuse" attribute (Postfix ≥ 3.4) overrides the +main.cf smtp_tls_connection_reuse parameter. In the policy table, +multiple ciphers, protocols or excluded ciphers must be separated by colons, +as attribute values may not contain whitespace or commas. </dd> + +<dt><b><a href="TLS_README.html#client_tls_dane">dane</a></b></dt> +<dd>Opportunistic DANE TLS. The TLS policy for the destination is +obtained via TLSA records in DNSSEC. If no TLSA records are found, +the effective security level used is <a +href="TLS_README.html#client_tls_may">may</a>. If TLSA records are +found, but none are usable, the effective security level is <a +href="TLS_README.html#client_tls_encrypt">encrypt</a>. When usable +TLSA records are obtained for the remote SMTP server, the +server certificate must match the TLSA records. RFC 7672 (DANE) +TLS authentication and DNSSEC support is available with Postfix +2.11 and later. The optional "connection_reuse" attribute (Postfix +≥ 3.4) overrides the main.cf smtp_tls_connection_reuse parameter. +When the effective security level used is <a +href="TLS_README.html#client_tls_may">may</a>, the optional "ciphers", +"exclude", and "protocols" attributes (Postfix ≥ 2.6) override the +"smtp_tls_ciphers", "smtp_tls_exclude_ciphers", and "smtp_tls_protocols" +configuration parameters. +When the effective security level used is <a +href="TLS_README.html#client_tls_encrypt">encrypt</a>, the optional "ciphers", +"exclude", and "protocols" attributes (Postfix ≥ 2.6) override the +"smtp_tls_mandatory_ciphers", "smtp_tls_mandatory_exclude_ciphers", and +"smtp_tls_mandatory_protocols" configuration parameters. +</dd> + +<dt><b><a href="TLS_README.html#client_tls_dane">dane-only</a></b></dt> +<dd>Mandatory DANE TLS. The TLS policy for the destination is +obtained via TLSA records in DNSSEC. If no TLSA records are found, +or none are usable, no connection is made to the server. When +usable TLSA records are obtained for the remote SMTP server, the +server certificate must match the TLSA records. RFC 7672 (DANE) TLS +authentication and DNSSEC support is available with Postfix 2.11 +and later. The optional "ciphers", "exclude", and "protocols" attributes +(Postfix ≥ 2.6) override the "smtp_tls_mandatory_ciphers", +"smtp_tls_mandatory_exclude_ciphers", and "smtp_tls_mandatory_protocols" +configuration parameters. The optional "connection_reuse" attribute +(Postfix ≥ 3.4) overrides the main.cf smtp_tls_connection_reuse parameter. +</dd> + +<dt><b><a href="TLS_README.html#client_tls_fprint">fingerprint</a></b></dt> +<dd>Certificate fingerprint +verification. Available with Postfix 2.5 and later. At this security +level, there are no trusted Certification Authorities. The certificate +trust chain, expiration date, ... are not checked. Instead, +the optional "match" attribute, or else the main.cf +<b>smtp_tls_fingerprint_cert_match</b> parameter, lists the certificate +fingerprints or the public key fingerprint (Postfix 2.9 and later) +of the valid server certificate. The digest +algorithm used to calculate the fingerprint is selected by the +<b>smtp_tls_fingerprint_digest</b> parameter. Multiple fingerprints can +be combined with a "|" delimiter in a single match attribute, or multiple +match attributes can be employed. The ":" character is not used as a +delimiter as it occurs between each pair of fingerprint (hexadecimal) +digits. The optional "ciphers", "exclude", and "protocols" attributes +(Postfix ≥ 2.6) override the "smtp_tls_mandatory_ciphers", +"smtp_tls_mandatory_exclude_ciphers", and "smtp_tls_mandatory_protocols" +configuration parameters. The optional "connection_reuse" attribute +(Postfix ≥ 3.4) overrides the main.cf smtp_tls_connection_reuse +parameter. </dd> + +<dt><b><a href="TLS_README.html#client_tls_verify">verify</a></b></dt> +<dd>Mandatory TLS verification. At this security +level, DNS MX lookups are trusted to be secure enough, and the name +verified in the server certificate is usually obtained indirectly via +unauthenticated DNS MX lookups. The optional "match" attribute overrides +the main.cf smtp_tls_verify_cert_match parameter. In the policy table, +multiple match patterns and strategies must be separated by colons. +In practice explicit control over matching is more common with the +"secure" policy, described below. The optional "ciphers", "exclude", +and "protocols" attributes (Postfix ≥ 2.6) override the +"smtp_tls_mandatory_ciphers", "smtp_tls_mandatory_exclude_ciphers", and +"smtp_tls_mandatory_protocols" configuration parameters. The optional +"connection_reuse" attribute (Postfix ≥ 3.4) overrides the main.cf +smtp_tls_connection_reuse parameter. </dd> + +<dt><b><a href="TLS_README.html#client_tls_secure">secure</a></b></dt> +<dd>Secure-channel TLS. At this security level, DNS +MX lookups, though potentially used to determine the candidate next-hop +gateway IP addresses, are <b>not</b> trusted to be secure enough for TLS +peername verification. Instead, the default name verified in the server +certificate is obtained directly from the next-hop, or is explicitly +specified via the optional "match" attribute which overrides the +main.cf smtp_tls_secure_cert_match parameter. In the policy table, +multiple match patterns and strategies must be separated by colons. +The match attribute is most useful when multiple domains are supported by +a common server: the policy entries for additional domains specify matching +rules for the primary domain certificate. While transport table overrides +that route the secondary domains to the primary nexthop also allow secure +verification, they risk delivery to the wrong destination when domains +change hands or are re-assigned to new gateways. With the "match" +attribute approach, routing is not perturbed, and mail is deferred if +verification of a new MX host fails. The optional "ciphers", "exclude", +and "protocols" attributes (Postfix ≥ 2.6) override the +"smtp_tls_mandatory_ciphers", "smtp_tls_mandatory_exclude_ciphers", and +"smtp_tls_mandatory_protocols" configuration parameters. The optional +"connection_reuse" attribute (Postfix ≥ 3.4) overrides the main.cf +smtp_tls_connection_reuse parameter. </dd> + +</dl> + +<p> +Example: +</p> + +<pre> +/etc/postfix/main.cf: + smtp_tls_policy_maps = hash:/etc/postfix/tls_policy + # Postfix 2.5 and later. + # + # The default digest is sha256 with Postfix ≥ 3.6 and + # compatibility level ≥ 3. + # + smtp_tls_fingerprint_digest = sha256 +</pre> + +<pre> +/etc/postfix/tls_policy: + example.edu none + example.mil may + example.gov encrypt protocols=TLSv1 + example.com verify ciphers=high + example.net secure + .example.net secure match=.example.net:example.net + [mail.example.org]:587 secure match=nexthop + # Postfix 2.5 and later + [thumb.example.org] fingerprint + match=b6:b4:72:34:e2:59:cd:...:c2:ca:63:0d:4d:cc:2c:7d:84:de:e6:2f + match=51:e9:af:2e:1e:40:1f:...:64:0a:30:35:2d:09:16:31:5a:eb:82:76 +</pre> + +<p> <b>Note:</b> The "hostname" strategy if listed in a non-default +setting of smtp_tls_secure_cert_match or in the "match" attribute +in the policy table can render the "secure" level vulnerable to +DNS forgery. Do not use the "hostname" strategy for secure-channel +configurations in environments where DNS security is not assured. </p> + +<p> This feature is available in Postfix 2.3 and later. </p> + +%PARAM smtp_tls_mandatory_protocols see "postconf -d" output + +<p> TLS protocols that the Postfix SMTP client will use with mandatory +TLS encryption. In main.cf the values are separated by whitespace, +commas or colons. In the policy table "protocols" attribute (see +smtp_tls_policy_maps) the only valid separator is colon. An empty value +means allow all protocols. </p> + +<p> The valid protocol names (see SSL_get_version(3)) are "SSLv2", +"SSLv3", "TLSv1", "TLSv1.1", "TLSv1.2" and "TLSv1.3". Starting with +Postfix 3.6, the default value is ">=TLSv1", which sets TLS 1.0 as +the lowest supported TLS protocol version (see below). Older releases +use the "!" exclusion syntax, also described below. </p> + +<p> As of Postfix 3.6, the preferred way to limit the range of +acceptable protocols is to set a lowest acceptable TLS protocol version +and/or a highest acceptable TLS protocol version. To set the lower +bound include an element of the form: ">=<i>version</i>" where +<i>version</i> is a either one of the TLS protocol names listed above, +or a hexadecimal number corresponding to the desired TLS protocol +version (0301 for TLS 1.0, 0302 for TLS 1.1, etc.). For the upper +bound, use "<=<i>version</i>". There must be no whitespace between +the ">=" or "<=" symbols and the protocol name or number. </p> + +<p> Hexadecimal protocol numbers make it possible to specify protocol +bounds for TLS versions that are known to OpenSSL, but might not be +known to Postfix. They cannot be used with the legacy exclusion syntax. +Leading "0" or "0x" prefixes are supported, but not required. +Therefore, "301", "0301", "0x301" and "0x0301" are all equivalent to +"TLSv1". Hexadecimal versions unknown to OpenSSL will fail to set the +upper or lower bound, and a warning will be logged. Hexadecimal +versions should only be used when Postfix is linked with some future +version of OpenSSL that supports TLS 1.4 or later, but Postfix does not +yet support a symbolic name for that protocol version. </p> + +<p>Hexadecimal example (Postfix ≥ 3.6):</p> +<blockquote> +<pre> +# Allow only TLS 1.2 through (hypothetical) TLS 1.4, once supported +# in some future version of OpenSSL (presently a warning is logged). +smtp_tls_mandatory_protocols = >=TLSv1.2, <=0305 +# Allow only TLS 1.2 and up: +smtp_tls_mandatory_protocols = >=0x0303 +</pre> +</blockquote> + +<p> With Postfix < 3.6 there is no support for a minimum or maximum +version, and the protocol range is configured via protocol exclusions. +To require at least TLS 1.0, set "smtp_tls_mandatory_protocols = !SSLv2, +!SSLv3". Listing the protocols to include, rather than the protocols to +exclude, is supported, but not recommended. The exclusion syntax more +accurately matches the underlying OpenSSL interface. </p> + +<p> When using the exclusion syntax, take care to ensure that the range +of protocols supported by the Postfix SMTP client is contiguous. When +a protocol version is enabled, disabling any higher version implicitly +disables all versions above that higher version. Thus, for example: </p> + +<blockquote> +<pre> +smtp_tls_mandatory_protocols = !SSLv2, !SSLv3, !TLSv1.1 +</pre> +</blockquote> + +<p> also disables any protocol versions higher than TLSv1.1 leaving +only "TLSv1" enabled. </p> + +<p> Support for "TLSv1.3" was introduced in OpenSSL 1.1.1. Disabling +this protocol via "!TLSv1.3" is supported since Postfix 3.4 (or patch +releases ≥ 3.0.14, 3.1.10, 3.2.7 and 3.3.2). </p> + +<p> While the vast majority of SMTP servers with DANE TLSA records now +support at least TLS 1.2, a few still only support TLS 1.0. If you use +"dane" or "dane-only" it is best not to disable TLSv1, except perhaps +via the policy table for destinations which you are sure will support +"TLSv1.2". </p> + +<p> See the documentation of the smtp_tls_policy_maps parameter and +TLS_README for more information about security levels. </p> + +<p> Example: </p> +<pre> +# Preferred syntax with Postfix ≥ 3.6: +smtp_tls_mandatory_protocols = >=TLSv1.2, <=TLSv1.3 +# Legacy syntax: +smtp_tls_mandatory_protocols = !SSLv2, !SSLv3, !TLSv1, !TLSv1.1 +</pre> + +<p> This feature is available in Postfix 2.3 and later. </p> + +%PARAM smtp_tls_verify_cert_match hostname + +<p> How the Postfix SMTP client verifies the server certificate +peername for the +"verify" TLS security level. In a "verify" TLS policy table +($smtp_tls_policy_maps) entry the optional "match" attribute +overrides this main.cf setting. </p> + +<p> This parameter specifies one or more patterns or strategies separated +by commas, whitespace or colons. In the policy table the only valid +separator is the colon character. </p> + +<p> Patterns specify domain names, or domain name suffixes: </p> + +<dl> + +<dt><i>example.com</i></dt> <dd> Match the <i>example.com</i> domain, +i.e. one of the names in the server certificate must be <i>example.com</i>. +Upper and lower case distinctions are ignored. </dd> + +<dt><i>.example.com</i></dt> +<dd> Match subdomains of the <i>example.com</i> domain, i.e. match +a name in the server certificate that consists of a non-zero number of +labels followed by a <i>.example.com</i> suffix. Case distinctions are +ignored.</dd> + +</dl> + +<p> Strategies specify a transformation from the next-hop domain +to the expected name in the server certificate: </p> + +<dl> + +<dt>nexthop</dt> +<dd> Match against the next-hop domain, which is either the recipient +domain, or the transport next-hop configured for the domain stripped of +any optional socket type prefix, enclosing square brackets and trailing +port. When MX lookups are not suppressed, this is the original nexthop +domain prior to the MX lookup, not the result of the MX lookup. For +LMTP delivery via UNIX-domain sockets, the verified next-hop name is +$myhostname. This strategy is suitable for use with the "secure" +policy. Case is ignored.</dd> + +<dt>dot-nexthop</dt> +<dd> As above, but match server certificate names that are subdomains +of the next-hop domain. Case is ignored.</dd> + +<dt>hostname</dt> <dd> Match against the hostname of the server, often +obtained via an unauthenticated DNS MX lookup. For LMTP delivery via +UNIX-domain sockets, the verified name is $myhostname. This matches +the verification strategy of the "MUST" keyword in the obsolete +smtp_tls_per_site table, and is suitable for use with the "verify" +security level. When the next-hop name is enclosed in square brackets +to suppress MX lookups, the "hostname" strategy is the same as the +"nexthop" strategy. Case is ignored.</dd> + +</dl> + +<p> +Sample main.cf setting: +</p> + +<pre> +smtp_tls_verify_cert_match = hostname, nexthop, dot-nexthop +</pre> + +<p> +Sample policy table override: +</p> + +<pre> +example.com verify match=hostname:nexthop +.example.com verify match=example.com:.example.com:hostname +</pre> + +<p> This feature is available in Postfix 2.3 and later. </p> + +%PARAM smtp_tls_secure_cert_match nexthop, dot-nexthop + +<p> How the Postfix SMTP client verifies the server certificate +peername for the "secure" TLS security level. In a "secure" TLS policy table +($smtp_tls_policy_maps) entry the optional "match" attribute +overrides this main.cf setting. </p> + +<p> This parameter specifies one or more patterns or strategies separated +by commas, whitespace or colons. In the policy table the only valid +separator is the colon character. </p> + +<p> For a description of the pattern and strategy syntax see the +smtp_tls_verify_cert_match parameter. The "hostname" strategy should +be avoided in this context, as in the absence of a secure global DNS, using +the results of MX lookups in certificate verification is not immune to active +(man-in-the-middle) attacks on DNS. </p> + +<p> +Sample main.cf setting: +</p> + +<blockquote> +<pre> +smtp_tls_secure_cert_match = nexthop +</pre> +</blockquote> + +<p> +Sample policy table override: +</p> + +<blockquote> +<pre> +example.net secure match=example.com:.example.com +.example.net secure match=example.com:.example.com +</pre> +</blockquote> + +<p> This feature is available in Postfix 2.3 and later. </p> + +%PARAM lmtp_tls_policy_maps + +<p> The LMTP-specific version of the smtp_tls_policy_maps +configuration parameter. See there for details. </p> + +<p> This feature is available in Postfix 2.3 and later. </p> + +%PARAM lmtp_tls_mandatory_protocols see postconf -d output + +<p> The LMTP-specific version of the smtp_tls_mandatory_protocols +configuration parameter. See there for details. </p> + +<p> This feature is available in Postfix 2.3 and later. </p> + +%PARAM lmtp_tls_verify_cert_match hostname + +<p> The LMTP-specific version of the smtp_tls_verify_cert_match +configuration parameter. See there for details. </p> + +<p> This feature is available in Postfix 2.3 and later. </p> + +%PARAM lmtp_tls_secure_cert_match nexthop + +<p> The LMTP-specific version of the smtp_tls_secure_cert_match +configuration parameter. See there for details. </p> + +<p> This feature is available in Postfix 2.3 and later. </p> + +%PARAM smtpd_tls_mandatory_protocols see "postconf -d" output + +<p> TLS protocols accepted by the Postfix SMTP server with mandatory TLS +encryption. If the list is empty, the server supports all available TLS +protocol versions. A non-empty value is a list of protocol names to +include or exclude, separated by whitespace, commas or colons. </p> + +<p> The valid protocol names (see SSL_get_version(3)) are "SSLv2", +"SSLv3", "TLSv1", "TLSv1.1", "TLSv1.2" and "TLSv1.3". Starting with +Postfix 3.6, the default value is ">=TLSv1", which sets TLS 1.0 as +the lowest supported TLS protocol version (see below). Older releases +use the "!" exclusion syntax, also described below. </p> + +<p> As of Postfix 3.6, the preferred way to limit the range of +acceptable protocols is to set the lowest acceptable TLS protocol +version and/or the highest acceptable TLS protocol version. To set the +lower bound include an element of the form: ">=<i>version</i>" where +<i>version</i> is a either one of the TLS protocol names listed above, +or a hexadecimal number corresponding to the desired TLS protocol +version (0301 for TLS 1.0, 0302 for TLS 1.1, etc.). For the upper +bound, use "<=<i>version</i>". There must be no whitespace between +the ">=" or "<=" symbols and the protocol name or number. </p> + +<p> Hexadecimal protocol numbers make it possible to specify protocol +bounds for TLS versions that are known to OpenSSL, but might not be +known to Postfix. They cannot be used with the legacy exclusion syntax. +Leading "0" or "0x" prefixes are supported, but not required. +Therefore, "301", "0301", "0x301" and "0x0301" are all equivalent to +"TLSv1". Hexadecimal versions unknown to OpenSSL will fail to set the +upper or lower bound, and a warning will be logged. Hexadecimal +versions should only be used when Postfix is linked with some future +version of OpenSSL that supports TLS 1.4 or later, but Postfix does not +yet support a symbolic name for that protocol version. </p> + +<p>Hexadecimal example (Postfix ≥ 3.6):</p> +<blockquote> +<pre> +# Allow only TLS 1.2 through (hypothetical) TLS 1.4, once supported +# in some future version of OpenSSL (presently a warning is logged). +smtpd_tls_mandatory_protocols = >=TLSv1.2, <=0305 +# Allow only TLS 1.2 and up: +smtpd_tls_mandatory_protocols = >=0x0303 +</pre> +</blockquote> + +<p> With Postfix < 3.6 there is no support for a minimum or maximum +version, and the protocol range is configured via protocol exclusions. +To require at least TLS 1.0, set "smtpd_tls_mandatory_protocols = +!SSLv2, !SSLv3". Listing the protocols to include, rather than +protocols to exclude, is supported, but not recommended. The exclusion +form more accurately matches the underlying OpenSSL interface. </p> + +<p> Support for "TLSv1.3" was introduced in OpenSSL 1.1.1. Disabling +this protocol via "!TLSv1.3" is supported since Postfix 3.4 (or patch +releases ≥ 3.0.14, 3.1.10, 3.2.7 and 3.3.2). </p> + +<p> Example: </p> + +<pre> +# Preferred syntax with Postfix ≥ 3.6: +smtpd_tls_mandatory_protocols = >=TLSv1.2, <=TLSv1.3 +# Legacy syntax: +smtpd_tls_mandatory_protocols = !SSLv2, !SSLv3, !TLSv1, !TLSv1.1 +</pre> + +<p> This feature is available in Postfix 2.3 and later. </p> + +%PARAM smtp_tls_security_level + +<p> The default SMTP TLS security level for the Postfix SMTP client. +When a non-empty value is specified, this overrides the obsolete +parameters smtp_use_tls, smtp_enforce_tls, and smtp_tls_enforce_peername; +when no value is specified for smtp_tls_enforce_peername or the obsolete +parameters, the default SMTP TLS security level is +<a href="TLS_README.html#client_tls_none">none</a>. </p> + +<p> Specify one of the following security levels: </p> + +<dl> + +<dt><b><a href="TLS_README.html#client_tls_none">none</a></b></dt> +<dd> No TLS. TLS will not be used unless enabled for specific +destinations via smtp_tls_policy_maps. </dd> + +<dt><b><a href="TLS_README.html#client_tls_may">may</a></b></dt> +<dd> Opportunistic TLS. Use TLS if this is supported by the remote +SMTP server, otherwise use plaintext. Since +sending in the clear is acceptable, demanding stronger than default TLS +security merely reduces interoperability. +The "smtp_tls_ciphers" and "smtp_tls_protocols" (Postfix ≥ 2.6) +configuration parameters provide control over the protocols and +cipher grade used with opportunistic TLS. With earlier releases the +opportunistic TLS cipher grade is always "export" and no protocols +are disabled. +When TLS handshakes fail, the connection is retried with TLS disabled. +This allows mail delivery to sites with non-interoperable TLS +implementations. </dd> + +<dt><b><a href="TLS_README.html#client_tls_encrypt">encrypt</a></b></dt> +<dd>Mandatory TLS encryption. Since a minimum +level of security is intended, it is reasonable to be specific about +sufficiently secure protocol versions and ciphers. At this security level +and higher, the main.cf parameters smtp_tls_mandatory_protocols and +smtp_tls_mandatory_ciphers specify the TLS protocols and minimum +cipher grade which the administrator considers secure enough for +mandatory encrypted sessions. This security level is not an appropriate +default for systems delivering mail to the Internet. </dd> + +<dt><b><a href="TLS_README.html#client_tls_dane">dane</a></b></dt> +<dd>Opportunistic DANE TLS. At this security level, the TLS policy +for the destination is obtained via DNSSEC. For TLSA policy to be +in effect, the destination domain's containing DNS zone must be +signed and the Postfix SMTP client's operating system must be +configured to send its DNS queries to a recursive DNS nameserver +that is able to validate the signed records. Each MX host's DNS +zone should also be signed, and should publish DANE TLSA (RFC 7672) +records that specify how that MX host's TLS certificate is to be +verified. TLSA records do not preempt the normal SMTP MX host +selection algorithm, if some MX hosts support TLSA and others do +not, TLS security will vary from delivery to delivery. It is up +to the domain owner to configure their MX hosts and their DNS +sensibly. To configure the Postfix SMTP client for DNSSEC lookups +see the documentation for the smtp_dns_support_level main.cf +parameter. When DNSSEC-validated TLSA records are not found the +effective tls security level is "may". When TLSA records are found, +but are all unusable the effective security level is "encrypt". For +purposes of protocol and cipher selection, the "dane" security level +is treated like a "mandatory" TLS security level, and weak ciphers +and protocols are disabled. Since DANE authenticates server +certificates the "aNULL" cipher-suites are transparently excluded +at this level, no need to configure this manually. RFC 7672 (DANE) +TLS authentication is available with Postfix 2.11 and later. </dd> + +<dt><b><a href="TLS_README.html#client_tls_dane">dane-only</a></b></dt> +<dd>Mandatory DANE TLS. This is just like "dane" above, but DANE +TLSA authentication is required. There is no fallback to "may" or +"encrypt" when TLSA records are missing or unusable. RFC 7672 +(DANE) TLS authentication is available with Postfix 2.11 and later. +</dd> + +<dt><b><a href="TLS_README.html#client_tls_fprint">fingerprint</a></b></dt> +<dd>Certificate fingerprint verification. +At this security level, there are no trusted Certification Authorities. +The certificate trust chain, expiration date, etc., are +not checked. Instead, the <b>smtp_tls_fingerprint_cert_match</b> +parameter lists the certificate fingerprint or public key fingerprint +(Postfix 2.9 and later) of the valid server certificate. The digest +algorithm used to calculate the fingerprint is selected by the +<b>smtp_tls_fingerprint_digest</b> parameter. Available with Postfix +2.5 and later. </dd> + +<dt><b><a href="TLS_README.html#client_tls_verify">verify</a></b></dt> +<dd>Mandatory TLS verification. At this security +level, DNS MX lookups are trusted to be secure enough, and the name +verified in the server certificate is usually obtained indirectly +via unauthenticated DNS MX lookups. The smtp_tls_verify_cert_match +parameter controls how the server name is verified. In practice explicit +control over matching is more common at the "secure" level, described +below. This security level is not an appropriate default for systems +delivering mail to the Internet. </dd> + +<dt><b><a href="TLS_README.html#client_tls_secure">secure</a></b></dt> +<dd>Secure-channel TLS. At this security level, +DNS MX lookups, though potentially used to determine the candidate +next-hop gateway IP addresses, are <b>not</b> trusted to be secure enough +for TLS peername verification. Instead, the default name verified in +the server certificate is obtained from the next-hop domain as specified +in the smtp_tls_secure_cert_match configuration parameter. The default +matching rule is that a server certificate matches when its name is equal +to or is a sub-domain of the nexthop domain. This security level is not +an appropriate default for systems delivering mail to the Internet. </dd> + +</dl> + +<p> +Examples: +</p> + +<pre> +# No TLS. Formerly: smtp_use_tls=no and smtp_enforce_tls=no. +smtp_tls_security_level = none +</pre> + +<pre> +# Opportunistic TLS. +smtp_tls_security_level = may +# Do not tweak opportunistic ciphers or protocols unless it is essential +# to do so (if a security vulnerability is found in the SSL library that +# can be mitigated by disabling a particular protocol or raising the +# cipher grade). +smtp_tls_ciphers = medium +smtp_tls_protocols = >=TLSv1 +# Legacy (Postfix < 3.6) syntax: +smtp_tls_protocols = !SSLv2, !SSLv3 +</pre> + +<pre> +# Mandatory (high-grade) TLS encryption. +smtp_tls_security_level = encrypt +smtp_tls_mandatory_ciphers = high +</pre> + +<pre> +# Authenticated TLS 1.2 or better matching the nexthop domain or a +# subdomain. +smtp_tls_security_level = secure +smtp_tls_mandatory_ciphers = high +smtp_tls_mandatory_protocols = >=TLSv1.2 +smtp_tls_secure_cert_match = nexthop, dot-nexthop +</pre> + +<pre> +# Certificate fingerprint verification (Postfix ≥ 2.5). +# The CA-less "fingerprint" security level only scales to a limited +# number of destinations. As a global default rather than a per-site +# setting, this is practical only when mail for all recipients is sent +# to a central mail hub. +relayhost = [mailhub.example.com] +smtp_tls_security_level = fingerprint +smtp_tls_mandatory_protocols = >=TLSv1.2 +smtp_tls_mandatory_ciphers = high +smtp_tls_fingerprint_cert_match = + 3D:95:34:51:...:40:99:C0:C1 + EC:3B:2D:B0:...:A3:9D:72:F6 +</pre> + +<p> This feature is available in Postfix 2.3 and later. </p> + +%PARAM smtpd_milters + +<p> A list of Milter (mail filter) applications for new mail that +arrives via the Postfix smtpd(8) server. Specify space or comma as +separator. See the MILTER_README document for details. </p> + +<p> This feature is available in Postfix 2.3 and later. </p> + +%PARAM non_smtpd_milters + +<p> A list of Milter (mail filter) applications for new mail that +does not arrive via the Postfix smtpd(8) server. This includes local +submission via the sendmail(1) command line, new mail that arrives +via the Postfix qmqpd(8) server, and old mail that is re-injected +into the queue with "postsuper -r". Specify space or comma as a +separator. See the MILTER_README document for details. </p> + +<p> This feature is available in Postfix 2.3 and later. </p> + +%PARAM milter_protocol 6 + +<p> The mail filter protocol version and optional protocol extensions +for communication with a Milter application; prior to Postfix 2.6 +the default protocol is 2. Postfix +sends this version number during the initial protocol handshake. +It should match the version number that is expected by the mail +filter application (or by its Milter library). </p> + +<p>Protocol versions: </p> + +<dl compact> + +<dt>2</dt> <dd>Use Sendmail 8 mail filter protocol version 2 (default +with Sendmail version 8.11 .. 8.13 and Postfix version 2.3 .. +2.5).</dd> + +<dt>3</dt> <dd>Use Sendmail 8 mail filter protocol version 3.</dd> + +<dt>4</dt> <dd>Use Sendmail 8 mail filter protocol version 4.</dd> + +<dt>6</dt> <dd>Use Sendmail 8 mail filter protocol version 6 (default +with Sendmail version 8.14 and Postfix version 2.6).</dd> + +</dl> + +<p>Protocol extensions: </p> + +<dl compact> + +<dt>no_header_reply</dt> <dd> Specify this when the Milter application +will not reply for each individual message header.</dd> + +</dl> + +<p> This feature is available in Postfix 2.3 and later. </p> + +%PARAM milter_default_action tempfail + +<p> The default action when a Milter (mail filter) response is +unavailable (for example, bad Postfix configuration or Milter +failure). Specify one of the following: </p> + +<dl compact> + +<dt>accept</dt> <dd>Proceed as if the mail filter was not present. +</dd> + +<dt>reject</dt> <dd>Reject all further commands in this session +with a permanent status code.</dd> + +<dt>tempfail</dt> <dd>Reject all further commands in this session +with a temporary status code. </dd> + +<dt>quarantine</dt> <dd>Like "accept", but freeze the message in +the "hold" queue. Available with Postfix 2.6 and later. </dd> + +</dl> + +<p> This feature is available in Postfix 2.3 and later. </p> + +%PARAM milter_connect_timeout 30s + +<p> The time limit for connecting to a Milter (mail filter) +application, and for negotiating protocol options. </p> + +<p> Specify a non-zero time value (an integral value plus an optional +one-letter suffix that specifies the time unit). Time units: s +(seconds), m (minutes), h (hours), d (days), w (weeks). +The default time unit is s (seconds). </p> + +<p> This feature is available in Postfix 2.3 and later. </p> + +%PARAM milter_command_timeout 30s + +<p> The time limit for sending an SMTP command to a Milter (mail +filter) application, and for receiving the response. </p> + +<p> Specify a non-zero time value (an integral value plus an optional +one-letter suffix that specifies the time unit). Time units: s +(seconds), m (minutes), h (hours), d (days), w (weeks). +The default time unit is s (seconds). </p> + +<p> This feature is available in Postfix 2.3 and later. </p> + +%PARAM milter_content_timeout 300s + +<p> The time limit for sending message content to a Milter (mail +filter) application, and for receiving the response. </p> + +<p> Specify a non-zero time value (an integral value plus an optional +one-letter suffix that specifies the time unit). Time units: s +(seconds), m (minutes), h (hours), d (days), w (weeks). +The default time unit is s (seconds). </p> + +<p> This feature is available in Postfix 2.3 and later. </p> + +%PARAM milter_connect_macros see "postconf -d" output + +<p> The macros that are sent to Milter (mail filter) applications +after completion of an SMTP connection. See MILTER_README +for a list of available macro names and their meanings. </p> + +<p> This feature is available in Postfix 2.3 and later. </p> + +%PARAM milter_helo_macros see "postconf -d" output + +<p> The macros that are sent to Milter (mail filter) applications +after the SMTP HELO or EHLO command. See +MILTER_README for a list of available macro names and their meanings. +</p> + +<p> This feature is available in Postfix 2.3 and later. </p> + +%PARAM milter_mail_macros see "postconf -d" output + +<p> The macros that are sent to Milter (mail filter) applications +after the SMTP MAIL FROM command. See MILTER_README +for a list of available macro names and their meanings. </p> + +<p> This feature is available in Postfix 2.3 and later. </p> + +%PARAM milter_rcpt_macros see "postconf -d" output + +<p> The macros that are sent to Milter (mail filter) applications +after the SMTP RCPT TO command. See MILTER_README +for a list of available macro names and their meanings. </p> + +<p> This feature is available in Postfix 2.3 and later. </p> + +%PARAM milter_data_macros see "postconf -d" output + +<p> The macros that are sent to version 4 or higher Milter (mail +filter) applications after the SMTP DATA command. See MILTER_README +for a list of available macro names and their meanings. </p> + +<p> This feature is available in Postfix 2.3 and later. </p> + +%PARAM milter_end_of_header_macros see "postconf -d" output + +<p> The macros that are sent to Milter (mail filter) applications +after the end of the message header. See MILTER_README for a list +of available macro names and their meanings. </p> + +<p> This feature is available in Postfix 2.5 and later. </p> + +%PARAM milter_end_of_data_macros see "postconf -d" output + +<p> The macros that are sent to Milter (mail filter) applications +after the message end-of-data. See MILTER_README for a list of +available macro names and their meanings. </p> + +<p> This feature is available in Postfix 2.3 and later. </p> + +%PARAM milter_unknown_command_macros see "postconf -d" output + +<p> The macros that are sent to version 3 or higher Milter (mail +filter) applications after an unknown SMTP command. See MILTER_README +for a list of available macro names and their meanings. </p> + +<p> This feature is available in Postfix 2.3 and later. </p> + +%PARAM milter_macro_daemon_name $myhostname + +<p> The {daemon_name} macro value for Milter (mail filter) applications. +See MILTER_README for a list of available macro names and their +meanings. </p> + +<p> This feature is available in Postfix 2.3 and later. </p> + +%PARAM milter_macro_defaults + +<p> Optional list of <i>name=value</i> pairs that specify default +values for arbitrary macros that Postfix may send to Milter +applications. These defaults are used when there is no corresponding +information from the message delivery context. </p> + +<p> Specify <i>name=value</i> or <i>{name=value}</i> pairs separated +by comma or whitespace. Enclose a pair in "{}" when a value contains +comma or whitespace (this form ignores whitespace after the enclosing +"{", around the "=", and before the enclosing "}"). </p> + +<p> This feature is available in Postfix 3.1 and later. </p> + +%PARAM milter_macro_v $mail_name $mail_version + +<p> The {v} macro value for Milter (mail filter) applications. +See MILTER_README for a list of available macro names and their +meanings. </p> + +<p> This feature is available in Postfix 2.3 and later. </p> + +%PARAM smtpd_tls_mandatory_ciphers medium + +<p> The minimum TLS cipher grade that the Postfix SMTP server will +use with mandatory TLS encryption. The default grade ("medium") is +sufficiently strong that any benefit from globally restricting TLS +sessions to a more stringent grade is likely negligible, especially +given the fact that many implementations still do not offer any stronger +("high" grade) ciphers, while those that do, will always use "high" +grade ciphers. So insisting on "high" grade ciphers is generally +counter-productive. Allowing "export" or "low" ciphers is typically +not a good idea, as systems limited to just these are limited to +obsolete browsers. No known SMTP clients fail to support at least +one "medium" or "high" grade cipher. </p> + +<p> The following cipher grades are supported: </p> + +<dl> +<dt><b>export</b></dt> +<dd> Enable "EXPORT" grade or stronger OpenSSL ciphers. The +underlying cipherlist is specified via the tls_export_cipherlist +configuration parameter, which you are strongly encouraged not to +change. This choice is insecure and SHOULD NOT be used. </dd> + +<dt><b>low</b></dt> +<dd> Enable "LOW" grade or stronger OpenSSL ciphers. The underlying +cipherlist is specified via the tls_low_cipherlist configuration +parameter, which you are strongly encouraged not to change. This +choice is insecure and SHOULD NOT be used. </dd> + +<dt><b>medium</b></dt> +<dd> Enable "MEDIUM" grade or stronger OpenSSL ciphers. These use 128-bit +or longer symmetric bulk-encryption keys. This is the default minimum +strength for mandatory TLS encryption. The underlying cipherlist is +specified via the tls_medium_cipherlist configuration parameter, which +you are strongly encouraged not to change. </dd> + +<dt><b>high</b></dt> +<dd> Enable only "HIGH" grade OpenSSL ciphers. The +underlying cipherlist is specified via the tls_high_cipherlist +configuration parameter, which you are strongly encouraged to +not change. </dd> + +<dt><b>null</b></dt> +<dd> Enable only the "NULL" OpenSSL ciphers, these provide authentication +without encryption. This setting is only appropriate in the rare +case that all clients are prepared to use NULL ciphers (not normally +enabled in TLS clients). The underlying cipherlist is specified via the +tls_null_cipherlist configuration parameter, which you are strongly +encouraged not to change. </dd> + +</dl> + +<p> Cipher types listed in +smtpd_tls_mandatory_exclude_ciphers or smtpd_tls_exclude_ciphers are +excluded from the base definition of the selected cipher grade. See +smtpd_tls_ciphers for cipher controls that apply to opportunistic +TLS. </p> + +<p> The underlying cipherlists for grades other than "null" include +anonymous ciphers, but these are automatically filtered out if the +server is configured to ask for remote SMTP client certificates. You are very +unlikely to need to take any steps to exclude anonymous ciphers, they +are excluded automatically as required. If you must exclude anonymous +ciphers even when Postfix does not need or use peer certificates, set +"smtpd_tls_exclude_ciphers = aNULL". To exclude anonymous ciphers only +when TLS is enforced, set "smtpd_tls_mandatory_exclude_ciphers = aNULL". </p> + +<p> This feature is available in Postfix 2.3 and later. </p> + +%PARAM smtpd_tls_exclude_ciphers + +<p> List of ciphers or cipher types to exclude from the SMTP server +cipher list at all TLS security levels. Excluding valid ciphers +can create interoperability problems. DO NOT exclude ciphers unless it +is essential to do so. This is not an OpenSSL cipherlist; it is a simple +list separated by whitespace and/or commas. The elements are a single +cipher, or one or more "+" separated cipher properties, in which case +only ciphers matching <b>all</b> the properties are excluded. </p> + +<p> Examples (some of these will cause problems): </p> + +<blockquote> +<pre> +smtpd_tls_exclude_ciphers = aNULL +smtpd_tls_exclude_ciphers = MD5, DES +smtpd_tls_exclude_ciphers = DES+MD5 +smtpd_tls_exclude_ciphers = AES256-SHA, DES-CBC3-MD5 +smtpd_tls_exclude_ciphers = kEDH+aRSA +</pre> +</blockquote> + +<p> The first setting disables anonymous ciphers. The next setting +disables ciphers that use the MD5 digest algorithm or the (single) DES +encryption algorithm. The next setting disables ciphers that use MD5 and +DES together. The next setting disables the two ciphers "AES256-SHA" +and "DES-CBC3-MD5". The last setting disables ciphers that use "EDH" +key exchange with RSA authentication. </p> + +<p> This feature is available in Postfix 2.3 and later. </p> + +%PARAM smtpd_tls_mandatory_exclude_ciphers + +<p> Additional list of ciphers or cipher types to exclude from the +Postfix SMTP server cipher list at mandatory TLS security levels. +This list +works in addition to the exclusions listed with smtpd_tls_exclude_ciphers +(see there for syntax details). </p> + +<p> This feature is available in Postfix 2.3 and later. </p> + +%PARAM smtp_tls_mandatory_ciphers medium + +<p> The minimum TLS cipher grade that the Postfix SMTP client will +use with +mandatory TLS encryption. The default value "medium" is suitable +for most destinations with which you may want to enforce TLS, and +is beyond the reach of today's cryptanalytic methods. See +smtp_tls_policy_maps for information on how to configure ciphers +on a per-destination basis. </p> + +<p> The following cipher grades are supported: </p> + +<dl> +<dt><b>export</b></dt> +<dd> Enable "EXPORT" grade or better OpenSSL ciphers. The underlying +cipherlist is specified via the tls_export_cipherlist configuration +parameter, which you are strongly encouraged not to change. This +choice is insecure and SHOULD NOT be used. </dd> + +<dt><b>low</b></dt> +<dd> Enable "LOW" grade or better OpenSSL ciphers. The underlying +cipherlist is specified via the tls_low_cipherlist configuration +parameter, which you are strongly encouraged not to change. This +choice is insecure and SHOULD NOT be used. </dd> + +<dt><b>medium</b></dt> +<dd> Enable "MEDIUM" grade or better OpenSSL ciphers. +The underlying cipherlist is specified via the tls_medium_cipherlist +configuration parameter, which you are strongly encouraged not to change. +</dd> + +<dt><b>high</b></dt> +<dd> Enable only "HIGH" grade OpenSSL ciphers. This setting may +be appropriate when all mandatory TLS destinations (e.g. when all +mail is routed to a suitably capable relayhost) support at least one +"HIGH" grade cipher. The underlying cipherlist is specified via the +tls_high_cipherlist configuration parameter, which you are strongly +encouraged not to change. </dd> + +<dt><b>null</b></dt> +<dd> Enable only the "NULL" OpenSSL ciphers, these provide authentication +without encryption. This setting is only appropriate in the rare case +that all servers are prepared to use NULL ciphers (not normally enabled +in TLS servers). A plausible use-case is an LMTP server listening on a +UNIX-domain socket that is configured to support "NULL" ciphers. The +underlying cipherlist is specified via the tls_null_cipherlist +configuration parameter, which you are strongly encouraged not to +change. </dd> + +</dl> + +<p> The underlying cipherlists for grades other than "null" include +anonymous ciphers, but these are automatically filtered out if the +Postfix SMTP client is configured to verify server certificates. +You are very unlikely to need to take any steps to exclude anonymous +ciphers, they are excluded automatically as necessary. If you must +exclude anonymous ciphers at the "may" or "encrypt" security levels, +when the Postfix SMTP client does not need or use peer certificates, set +"smtp_tls_exclude_ciphers = aNULL". To exclude anonymous ciphers only when +TLS is enforced, set "smtp_tls_mandatory_exclude_ciphers = aNULL". </p> + +<p> This feature is available in Postfix 2.3 and later. </p> + +%PARAM smtp_tls_exclude_ciphers + +<p> List of ciphers or cipher types to exclude from the Postfix +SMTP client cipher +list at all TLS security levels. This is not an OpenSSL cipherlist, it is +a simple list separated by whitespace and/or commas. The elements are a +single cipher, or one or more "+" separated cipher properties, in which +case only ciphers matching <b>all</b> the properties are excluded. </p> + +<p> Examples (some of these will cause problems): </p> + +<blockquote> +<pre> +smtp_tls_exclude_ciphers = aNULL +smtp_tls_exclude_ciphers = MD5, DES +smtp_tls_exclude_ciphers = DES+MD5 +smtp_tls_exclude_ciphers = AES256-SHA, DES-CBC3-MD5 +smtp_tls_exclude_ciphers = kEDH+aRSA +</pre> +</blockquote> + +<p> The first setting disables anonymous ciphers. The next setting +disables ciphers that use the MD5 digest algorithm or the (single) DES +encryption algorithm. The next setting disables ciphers that use MD5 and +DES together. The next setting disables the two ciphers "AES256-SHA" +and "DES-CBC3-MD5". The last setting disables ciphers that use "EDH" +key exchange with RSA authentication. </p> + +<p> This feature is available in Postfix 2.3 and later. </p> + +%PARAM smtp_tls_mandatory_exclude_ciphers + +<p> Additional list of ciphers or cipher types to exclude from the +Postfix SMTP client cipher list at mandatory TLS security levels. This list +works in addition to the exclusions listed with smtp_tls_exclude_ciphers +(see there for syntax details). </p> + +<p> Starting with Postfix 2.6, the mandatory cipher exclusions can be +specified on a per-destination basis via the TLS policy "exclude" +attribute. See smtp_tls_policy_maps for notes and examples. </p> + +<p> This feature is available in Postfix 2.3 and later. </p> + +%PARAM tls_high_cipherlist see "postconf -d" output + +<p> The OpenSSL cipherlist for "high" grade ciphers. This defines +the meaning of the "high" setting in smtpd_tls_ciphers, +smtpd_tls_mandatory_ciphers, smtp_tls_ciphers, smtp_tls_mandatory_ciphers, +lmtp_tls_ciphers, and lmtp_tls_mandatory_ciphers. You are strongly +encouraged not to change this setting. </p> + +<p> This feature is available in Postfix 2.3 and later. </p> + +%PARAM tls_medium_cipherlist see "postconf -d" output + +<p> The OpenSSL cipherlist for "medium" or higher grade ciphers. This +defines the meaning of the "medium" setting in smtpd_tls_ciphers, +smtpd_tls_mandatory_ciphers, smtp_tls_ciphers, smtp_tls_mandatory_ciphers, +lmtp_tls_ciphers, and lmtp_tls_mandatory_ciphers. This is the +default cipherlist for mandatory TLS encryption in the TLS client +(with anonymous ciphers disabled when verifying server certificates). +This is the default cipherlist for opportunistic TLS with Postfix +releases after the middle of 2015. You are strongly encouraged not +to change this setting. </p> + +<p> This feature is available in Postfix 2.3 and later. </p> + +%PARAM tls_low_cipherlist see "postconf -d" output + +<p> The OpenSSL cipherlist for "low" or higher grade ciphers. This defines +the meaning of the "low" setting in smtpd_tls_ciphers, +smtpd_tls_mandatory_ciphers, smtp_tls_ciphers, smtp_tls_mandatory_ciphers, +lmtp_tls_ciphers, and lmtp_tls_mandatory_ciphers. You are strongly +encouraged not to change this setting. </p> + +<p> This feature is available in Postfix 2.3 and later. </p> + +%PARAM tls_export_cipherlist see "postconf -d" output + +<p> The OpenSSL cipherlist for "export" or higher grade ciphers. This +defines the meaning of the "export" setting in smtpd_tls_ciphers, +smtpd_tls_mandatory_ciphers, smtp_tls_ciphers, smtp_tls_mandatory_ciphers, +lmtp_tls_ciphers, and lmtp_tls_mandatory_ciphers. With Postfix +releases before the middle of 2015 this is the default cipherlist +for the opportunistic ("may") TLS client security level and also +the default cipherlist for the SMTP server. You are strongly +encouraged not to change this setting. </p> + +<p> This feature is available in Postfix 2.3 and later. </p> + +%PARAM tls_null_cipherlist eNULL:!aNULL + +<p> The OpenSSL cipherlist for "NULL" grade ciphers that provide +authentication without encryption. This defines the meaning of the "null" +setting in smtpd_tls_mandatory_ciphers, smtp_tls_mandatory_ciphers and +lmtp_tls_mandatory_ciphers. You are strongly encouraged not to +change this setting. </p> + +<p> This feature is available in Postfix 2.3 and later. </p> + +%PARAM lmtp_tls_mandatory_ciphers medium + +<p> The LMTP-specific version of the smtp_tls_mandatory_ciphers +configuration parameter. See there for details. </p> + +<p> This feature is available in Postfix 2.3 and later. </p> + +%PARAM lmtp_tls_exclude_ciphers + +<p> The LMTP-specific version of the smtp_tls_exclude_ciphers +configuration parameter. See there for details. </p> + +<p> This feature is available in Postfix 2.3 and later. </p> + +%PARAM lmtp_tls_mandatory_exclude_ciphers + +<p> The LMTP-specific version of the smtp_tls_mandatory_exclude_ciphers +configuration parameter. See there for details. </p> + +<p> This feature is available in Postfix 2.3 and later. </p> + +%PARAM smtpd_tls_security_level + +<p> The SMTP TLS security level for the Postfix SMTP server; when +a non-empty value is specified, this overrides the obsolete parameters +smtpd_use_tls and smtpd_enforce_tls. This parameter is ignored with +"smtpd_tls_wrappermode = yes". </p> + +<p> Specify one of the following security levels: </p> + +<dl> + +<dt><b>none</b></dt> <dd> TLS will not be used. </dd> + +<dt><b>may</b></dt> <dd> Opportunistic TLS: announce STARTTLS support +to remote SMTP clients, but do not require that clients use TLS encryption. +</dd> + +<dt><b>encrypt</b></dt> <dd>Mandatory TLS encryption: announce +STARTTLS support to remote SMTP clients, and require that clients use TLS +encryption. According to RFC 2487 this MUST NOT be applied in case +of a publicly-referenced SMTP server. Instead, this option should +be used only on dedicated servers. </dd> + +</dl> + +<p> Note 1: the "fingerprint", "verify" and "secure" levels are not +supported here. +The Postfix SMTP server logs a warning and uses "encrypt" instead. +To verify remote SMTP client certificates, see TLS_README for a discussion +of the smtpd_tls_ask_ccert, smtpd_tls_req_ccert, and permit_tls_clientcerts +features. </p> + +<p> Note 2: The parameter setting "smtpd_tls_security_level = +encrypt" implies "smtpd_tls_auth_only = yes".</p> + +<p> Note 3: when invoked via "sendmail -bs", Postfix will never +offer STARTTLS due to insufficient privileges to access the server +private key. This is intended behavior.</p> + +<p> This feature is available in Postfix 2.3 and later. </p> + +%PARAM internal_mail_filter_classes + +<p> What categories of Postfix-generated mail are subject to +before-queue content inspection by non_smtpd_milters, header_checks +and body_checks. Specify zero or more of the following, separated +by whitespace or comma. </p> + +<dl> + +<dt><b>bounce</b></dt> <dd> Inspect the content of delivery +status notifications. </dd> + +<dt><b>notify</b></dt> <dd> Inspect the content of postmaster +notifications by the smtp(8) and smtpd(8) processes. </dd> + +</dl> + +<p> NOTE: It's generally not safe to enable content inspection of +Postfix-generated email messages. The user is warned. </p> + +<p> This feature is available in Postfix 2.3 and later. </p> + +%PARAM smtpd_tls_always_issue_session_ids yes + +<p> Force the Postfix SMTP server to issue a TLS session id, even +when TLS session caching is turned off (smtpd_tls_session_cache_database +is empty). This behavior is compatible with Postfix < 2.3. </p> + +<p> With Postfix 2.3 and later the Postfix SMTP server can disable +session id generation when TLS session caching is turned off. This +keeps remote SMTP clients from caching sessions that almost certainly cannot +be re-used. </p> + +<p> By default, the Postfix SMTP server always generates TLS session +ids. This works around a known defect in mail client applications +such as MS Outlook, and may also prevent interoperability issues +with other MTAs. </p> + +<p> Example: </p> + +<pre> +smtpd_tls_always_issue_session_ids = no +</pre> + +<p> This feature is available in Postfix 2.3 and later. </p> + +%PARAM smtp_pix_workarounds disable_esmtp, delay_dotcrlf + +<p> A list that specifies zero or more workarounds for CISCO PIX +firewall bugs. These workarounds are implemented by the Postfix +SMTP client. Workaround names are separated by comma or space, and +are case insensitive. This parameter setting can be overruled with +per-destination smtp_pix_workaround_maps settings. </p> + +<dl> + +<dt><b>delay_dotcrlf</b><dd> Insert a delay before sending +".<CR><LF>" after the end of the message content. The +delay is subject to the smtp_pix_workaround_delay_time and +smtp_pix_workaround_threshold_time parameter settings. </dd> + +<dt><b>disable_esmtp</b><dd> Disable all extended SMTP commands: +send HELO instead of EHLO. </dd> + +</dl> + +<p> This feature is available in Postfix 2.4 and later. The default +settings are backwards compatible with earlier Postfix versions. +</p> + +%PARAM smtp_pix_workaround_maps + +<p> Lookup tables, indexed by the remote SMTP server address, with +per-destination workarounds for CISCO PIX firewall bugs. The table +is not indexed by hostname for consistency with +smtp_discard_ehlo_keyword_address_maps. </p> + +<p> +Specify zero or more "type:name" lookup tables, separated by +whitespace or comma. Tables will be searched in the specified order +until a match is found. +</p> + +<p> This feature is available in Postfix 2.4 and later. </p> + +%PARAM lmtp_pix_workarounds + +<p> The LMTP-specific version of the smtp_pix_workaround +configuration parameter. See there for details. </p> + +<p> This feature is available in Postfix 2.4 and later. </p> + +%PARAM smtp_tls_fingerprint_digest see "postconf -d" output + +<p> The message digest algorithm used to construct remote SMTP server +certificate fingerprints. At the "fingerprint" TLS security level +(<b>smtp_tls_security_level</b> = fingerprint), the server certificate is +verified by directly matching its certificate fingerprint or its public +key fingerprint (Postfix 2.9 and later). The fingerprint is the +message digest of the server certificate (or its public key) +using the selected +algorithm. With a digest algorithm resistant to "second pre-image" +attacks, it is not feasible to create a new public key and a matching +certificate (or public/private key-pair) that has the same fingerprint. </p> + +<p> The default algorithm is <b>sha256</b> with Postfix ≥ 3.6 +and the <b>compatibility_level</b> set to 3.6 or higher. With Postfix +≤ 3.5, the default algorithm is <b>md5</b>. </p> + +<p> The best-practice algorithm is now <b>sha256</b>. Recent advances in hash +function cryptanalysis have led to md5 and sha1 being deprecated in favor of +sha256. However, as long as there are no known "second pre-image" attacks +against the older algorithms, their use in this context, though not +recommended, is still likely safe. </p> + +<p> While additional digest algorithms are often available with OpenSSL's +libcrypto, only those used by libssl in SSL cipher suites are available to +Postfix. You'll likely find support for md5, sha1, sha256 and sha512. </p> + +<p> To find the fingerprint of a specific certificate file, with a +specific digest algorithm, run: +</p> + +<blockquote> +<pre> +$ openssl x509 -noout -fingerprint -<i>digest</i> -in <i>certfile</i>.pem +</pre> +</blockquote> + +<p> The text to the right of the "=" sign is the desired fingerprint. +For example: </p> + +<blockquote> +<pre> +$ openssl x509 -noout -fingerprint -sha256 -in cert.pem +SHA256 Fingerprint=D4:6A:AB:19:24:...:BB:A6:CB:66:82:C0:8E:9B:EE:29:A8:1A +</pre> +</blockquote> + +<p> To extract the public key fingerprint from an X.509 certificate, +you need to extract the public key from the certificate and compute +the appropriate digest of its DER (ASN.1) encoding. With OpenSSL +the "-pubkey" option of the "x509" command extracts the public +key always in "PEM" format. We pipe the result to another OpenSSL +command that converts the key to DER and then to the "dgst" command +to compute the fingerprint. </p> + +<p> The actual command to transform the key to DER format depends on the +version of OpenSSL used. As of OpenSSL 1.0.0, the "pkey" command supports +all key types. </p> +<blockquote> +<pre> +# OpenSSL ≥ 1.0 with SHA-256 fingerprints. +$ openssl x509 -in cert.pem -noout -pubkey | + openssl pkey -pubin -outform DER | + openssl dgst -sha256 -c +(stdin)= 64:3f:1f:f6:e5:1e:d4:2a:56:...:fc:09:1a:61:98:b5:bc:7c:60:58 +</pre> +</blockquote> + +<p> The Postfix SMTP server and client log the peer (leaf) certificate +fingerprint and the public key fingerprint when the TLS loglevel is 2 or +higher. </p> + +<p> This feature is available in Postfix 2.5 and later. </p> + +%PARAM smtp_tls_fingerprint_cert_match + +<p> List of acceptable remote SMTP server certificate fingerprints for +the "fingerprint" TLS security level (<b>smtp_tls_security_level</b> = +fingerprint). At this security level, Certification Authorities are not +used, and certificate expiration times are ignored. Instead, server +certificates are verified directly via their certificate fingerprint +or public key fingerprint (Postfix 2.9 and later). The fingerprint +is a message digest of the server certificate (or public key). The +digest algorithm is selected via the <b>smtp_tls_fingerprint_digest</b> +parameter. </p> + +<p> The colons between each pair of nibbles in the fingerprint value +are optional (Postfix ≥ 3.6). These were required in earlier +Postfix releases. </p> + +<p> When an <b>smtp_tls_policy_maps</b> table entry specifies the +"fingerprint" security level, any "match" attributes in that entry specify +the list of valid fingerprints for the corresponding destination. Multiple +fingerprints can be combined with a "|" delimiter in a single match +attribute, or multiple match attributes can be employed. </p> + +<p> Example: Certificate fingerprint verification with internal mailhub. +Two matching fingerprints are listed. The relayhost may be multiple +physical hosts behind a load-balancer, each with its own private/public +key and self-signed certificate. Alternatively, a single relayhost may +be in the process of switching from one set of private/public keys to +another, and both keys are trusted just prior to the transition. </p> + +<blockquote> +<pre> +relayhost = [mailhub.example.com] +smtp_tls_security_level = fingerprint +smtp_tls_fingerprint_digest = sha256 +smtp_tls_fingerprint_cert_match = + cd:fc:d8:db:f8:c4:82:96:6c:...:28:71:e8:f5:8d:a5:0d:9b:d4:a6 + dd:5c:ef:f5:c3:bc:64:25:36:...:99:36:06:ce:40:ef:de:2e:ad:a4 +</pre> +</blockquote> + +<p> Example: Certificate fingerprint verification with selected destinations. +As in the example above, we show two matching fingerprints: </p> + +<blockquote> +<pre> +/etc/postfix/main.cf: + smtp_tls_policy_maps = hash:/etc/postfix/tls_policy + smtp_tls_fingerprint_digest = sha256 +</pre> +</blockquote> + +<blockquote> +<pre> +/etc/postfix/tls_policy: + example.com fingerprint + match=51:e9:af:2e:1e:40:1f:...:64:0a:30:35:2d:09:16:31:5a:eb:82:76 + match=b6:b4:72:34:e2:59:cd:...:c2:ca:63:0d:4d:cc:2c:7d:84:de:e6:2f +</pre> +</blockquote> + +<p> This feature is available in Postfix 2.5 and later. </p> + +%PARAM lmtp_tls_fingerprint_cert_match + +<p> The LMTP-specific version of the smtp_tls_fingerprint_cert_match +configuration parameter. See there for details. </p> + +<p> This feature is available in Postfix 2.5 and later. </p> + +%PARAM lmtp_tls_fingerprint_digest see "postconf -d" output + +<p> The LMTP-specific version of the smtp_tls_fingerprint_digest +configuration parameter. See there for details. </p> + +<p> This feature is available in Postfix 2.5 and later. </p> + +%PARAM smtpd_tls_fingerprint_digest see "postconf -d" output + +<p> The message digest algorithm to construct remote SMTP client-certificate +fingerprints or public key fingerprints (Postfix 2.9 and later) for +<b>check_ccert_access</b> and <b>permit_tls_clientcerts</b>. </p> + +<p> The default algorithm is <b>sha256</b> with Postfix ≥ 3.6 +and the <b>compatibility_level</b> set to 3.6 or higher. With Postfix +≤ 3.5, the default algorithm is <b>md5</b>. </p> + +<p> The best-practice algorithm is now <b>sha256</b>. Recent advances in hash +function cryptanalysis have led to md5 and sha1 being deprecated in favor of +sha256. However, as long as there are no known "second pre-image" attacks +against the older algorithms, their use in this context, though not +recommended, is still likely safe. </p> + +<p> While additional digest algorithms are often available with OpenSSL's +libcrypto, only those used by libssl in SSL cipher suites are available to +Postfix. You'll likely find support for md5, sha1, sha256 and sha512. </p> + +<p> To find the fingerprint of a specific certificate file, with a +specific digest algorithm, run: </p> + +<blockquote> +<pre> +$ openssl x509 -noout -fingerprint -<i>digest</i> -in <i>certfile</i>.pem +</pre> +</blockquote> + +<p> The text to the right of "=" sign is the desired fingerprint. +For example: </p> + +<blockquote> +<pre> +$ openssl x509 -noout -fingerprint -sha256 -in cert.pem +SHA256 Fingerprint=D4:6A:AB:19:24:...:A6:CB:66:82:C0:8E:9B:EE:29:A8:1A +</pre> +</blockquote> + +<p> To extract the public key fingerprint from an X.509 certificate, +you need to extract the public key from the certificate and compute +the appropriate digest of its DER (ASN.1) encoding. With OpenSSL +the "-pubkey" option of the "x509" command extracts the public +key always in "PEM" format. We pipe the result to another OpenSSL +command that converts the key to DER and then to the "dgst" command +to compute the fingerprint. </p> + +<p> Example: </p> +<blockquote> +<pre> +$ openssl x509 -in cert.pem -noout -pubkey | + openssl pkey -pubin -outform DER | + openssl dgst -sha256 -c +(stdin)= 64:3f:1f:f6:e5:1e:d4:2a:56:8b:fc:09:1a:61:98:b5:bc:7c:60:58 +</pre> +</blockquote> + +<p> The Postfix SMTP server and client log the peer (leaf) certificate +fingerprint and public key fingerprint when the TLS loglevel is 2 or +higher. </p> + +<p> Example: client-certificate access table, with sha256 fingerprints: </p> + +<blockquote> +<pre> +/etc/postfix/main.cf: + smtpd_tls_fingerprint_digest = sha256 + smtpd_client_restrictions = + check_ccert_access hash:/etc/postfix/access, + reject +</pre> +<pre> +/etc/postfix/access: + # Action folded to next line... + AF:88:7C:AD:51:95:6F:36:96:...:01:FB:2E:48:CD:AB:49:25:A2:3B + OK + 85:16:78:FD:73:6E:CE:70:E0:...:5F:0D:3C:C8:6D:C4:2C:24:59:E1 + permit_auth_destination +</pre> +</blockquote> + +<p> This feature is available in Postfix 2.5 and later. </p> + +%PARAM lmtp_pix_workaround_maps + +<p> The LMTP-specific version of the smtp_pix_workaround_maps +configuration parameter. See there for details. </p> + +<p> This feature is available in Postfix 2.4 and later. </p> + +%PARAM detect_8bit_encoding_header yes + +<p> Automatically detect 8BITMIME body content by looking at +Content-Transfer-Encoding: message headers; historically, this +behavior was hard-coded to be "always on". </p> + +<p> This feature is available in Postfix 2.5 and later. </p> + +%PARAM send_cyrus_sasl_authzid no + +<p> When authenticating to a remote SMTP or LMTP server with the +default setting "no", send no SASL authoriZation ID (authzid); send +only the SASL authentiCation ID (authcid) plus the authcid's password. +</p> + +<p> The non-default setting "yes" enables the behavior of older +Postfix versions. These always send a SASL authzid that is equal +to the SASL authcid, but this causes interoperability problems +with some SMTP servers. </p> + +<p> This feature is available in Postfix 2.4.4 and later. </p> + +%PARAM smtpd_client_port_logging no + +<p> Enable logging of the remote SMTP client port in addition to +the hostname and IP address. The logging format is "host[address]:port". +</p> + +<p> This feature is available in Postfix 2.5 and later. </p> + +%PARAM qmqpd_client_port_logging no + +<p> Enable logging of the remote QMQP client port in addition to +the hostname and IP address. The logging format is "host[address]:port". +</p> + +<p> This feature is available in Postfix 2.5 and later. </p> + +%PARAM smtp_tls_protocols see postconf -d output + +<p> TLS protocols that the Postfix SMTP client will use with +opportunistic TLS encryption. In main.cf the values are separated by +whitespace, commas or colons. In the policy table "protocols" attribute +(see smtp_tls_policy_maps) the only valid separator is colon. An empty +value means allow all protocols. </p> + +<p> The valid protocol names (see SSL_get_version(3)) are "SSLv2", +"SSLv3", "TLSv1", "TLSv1.1", "TLSv1.2" and "TLSv1.3". Starting with +Postfix 3.6, the default value is ">=TLSv1", which sets TLS 1.0 as +the lowest supported TLS protocol version (see below). Older releases +use the "!" exclusion syntax, also described below. </p> + +<p> As of Postfix 3.6, the preferred way to limit the range of +acceptable protocols is to set the lowest acceptable TLS protocol +version and/or the highest acceptable TLS protocol version. To set the +lower bound include an element of the form: ">=<i>version</i>" where +<i>version</i> is either one of the TLS protocol names listed above, +or a hexadecimal number corresponding to the desired TLS protocol +version (0301 for TLS 1.0, 0302 for TLS 1.1, etc.). For the upper +bound, use "<=<i>version</i>". There must be no whitespace between +the ">=" or "<=" symbols and the protocol name or number. </p> + +<p> Hexadecimal protocol numbers make it possible to specify protocol +bounds for TLS versions that are known to OpenSSL, but might not be +known to Postfix. They cannot be used with the legacy exclusion syntax. +Leading "0" or "0x" prefixes are supported, but not required. +Therefore, "301", "0301", "0x301" and "0x0301" are all equivalent to +"TLSv1". Hexadecimal versions unknown to OpenSSL will fail to set the +upper or lower bound, and a warning will be logged. Hexadecimal +versions should only be used when Postfix is linked with some future +version of OpenSSL that supports TLS 1.4 or later, but Postfix does not +yet support a symbolic name for that protocol version. </p> + +<p>Hexadecimal example (Postfix ≥ 3.6):</p> +<blockquote> +<pre> +# Allow only TLS 1.0 through (hypothetical) TLS 1.4, once supported +# in some future version of OpenSSL (presently a warning is logged). +smtp_tls_protocols = >=TLSv1, <=0305 +# Allow only TLS 1.0 and up: +smtp_tls_protocols = >=0x0301 +</pre> +</blockquote> + +<p> With Postfix < 3.6 there is no support for a minimum or maximum +version, and the protocol range is configured via protocol exclusions. +To require at least TLS 1.0, set "smtp_tls_protocols = !SSLv2, !SSLv3". +Listing the protocols to include, rather than protocols to exclude, is +supported, but not recommended. The exclusion form more accurately +matches the underlying OpenSSL interface. </p> + +<p> When using the exclusion syntax, take care to ensure that the range of +protocols advertised by an SSL/TLS client is contiguous. When a protocol +version is enabled, disabling any higher version implicitly disables all +versions above that higher version. Thus, for example: +</p> +<blockquote> +<pre> +smtp_tls_protocols = !SSLv2, !SSLv3, !TLSv1.1 +</pre> +</blockquote> +<p> also disables any protocols version higher than TLSv1.1 leaving +only "TLSv1" enabled. </p> + +<p> Support for "TLSv1.3" was introduced in OpenSSL 1.1.1. Disabling +this protocol via "!TLSv1.3" is supported since Postfix 3.4 (or patch +releases ≥ 3.0.14, 3.1.10, 3.2.7 and 3.3.2). </p> + +<p> Example: </p> +<pre> +# Preferred syntax with Postfix ≥ 3.6: +smtp_tls_protocols = >=TLSv1, <=TLSv1.3 +# Legacy syntax: +smtp_tls_protocols = !SSLv2, !SSLv3 +</pre> + +<p> This feature is available in Postfix 2.6 and later. </p> + +%PARAM smtpd_tls_protocols see postconf -d output + +<p> TLS protocols accepted by the Postfix SMTP server with opportunistic +TLS encryption. If the list is empty, the server supports all available +TLS protocol versions. A non-empty value is a list of protocol names to +include or exclude, separated by whitespace, commas or colons. </p> + +<p> The valid protocol names (see SSL_get_version(3)) are "SSLv2", +"SSLv3", "TLSv1", "TLSv1.1", "TLSv1.2" and "TLSv1.3". Starting with +Postfix 3.6, the default value is ">=TLSv1", which sets TLS 1.0 as +the lowest supported TLS protocol version (see below). Older releases +use the "!" exclusion syntax, also described below. </p> + +<p> As of Postfix 3.6, the preferred way to limit the range of +acceptable protocols is to set the lowest acceptable TLS protocol +version and/or the highest acceptable TLS protocol version. To set the +lower bound include an element of the form: ">=<i>version</i>" where +<i>version</i> is a either one of the TLS protocol names listed above, +or a hexadecimal number corresponding to the desired TLS protocol +version (0301 for TLS 1.0, 0302 for TLS 1.1, etc.). For the upper +bound, use "<=<i>version</i>". There must be no whitespace between +the ">=" or "<=" symbols and the protocol name or number. </p> + +<p> Hexadecimal protocol numbers make it possible to specify protocol +bounds for TLS versions that are known to OpenSSL, but might not be +known to Postfix. They cannot be used with the legacy exclusion syntax. +Leading "0" or "0x" prefixes are supported, but not required. +Therefore, "301", "0301", "0x301" and "0x0301" are all equivalent to +"TLSv1". Hexadecimal versions unknown to OpenSSL will fail to set the +upper or lower bound, and a warning will be logged. Hexadecimal +versions should only be used when Postfix is linked with some future +version of OpenSSL that supports TLS 1.4 or later, but Postfix does not +yet support a symbolic name for that protocol version. </p> + +<p>Hexadecimal example (Postfix ≥ 3.6):</p> +<blockquote> +<pre> +# Allow only TLS 1.0 through (hypothetical) TLS 1.4, once supported +# in some future version of OpenSSL (presently a warning is logged). +smtpd_tls_protocols = >=TLSv1, <=0305 +# Allow only TLS 1.0 and up: +smtpd_tls_protocols = >=0x0301 +</pre> +</blockquote> + +<p> With Postfix < 3.6 there is no support for a minimum or maximum +version, and the protocol range is configured via protocol exclusions. +To require at least TLS 1.0, set "smtpd_tls_protocols = !SSLv2, !SSLv3". +Listing the protocols to include, rather than protocols to exclude, is +supported, but not recommended. The exclusion form more accurately +matches the underlying OpenSSL interface. </p> + +<p> Support for "TLSv1.3" was introduced in OpenSSL 1.1.1. Disabling +this protocol via "!TLSv1.3" is supported since Postfix 3.4 (or patch +releases ≥ 3.0.14, 3.1.10, 3.2.7 and 3.3.2). </p> + +<p> Example: </p> +<pre> +# Preferred syntax with Postfix ≥ 3.6: +smtpd_tls_protocols = >=TLSv1, <=TLSv1.3 +# Legacy syntax: +smtpd_tls_protocols = !SSLv2, !SSLv3 +</pre> + +<p> This feature is available in Postfix 2.6 and later. </p> + +%PARAM lmtp_tls_protocols see postconf -d output + +<p> The LMTP-specific version of the smtp_tls_protocols configuration +parameter. See there for details. </p> + +<p> This feature is available in Postfix 2.6 and later. </p> + +%PARAM smtp_tls_ciphers medium + +<p> The minimum TLS cipher grade that the Postfix SMTP client +will use with opportunistic TLS encryption. Cipher types listed in +smtp_tls_exclude_ciphers are excluded from the base definition of +the selected cipher grade. The default value is "medium" for +Postfix releases after the middle of 2015, "export" for older +releases. </p> + +<p> When TLS is mandatory the cipher grade is chosen via the +smtp_tls_mandatory_ciphers configuration parameter, see there for syntax +details. See smtp_tls_policy_maps for information on how to configure +ciphers on a per-destination basis. </p> + +<p> This feature is available in Postfix 2.6 and later. With earlier Postfix +releases only the smtp_tls_mandatory_ciphers parameter is implemented, +and opportunistic TLS always uses "export" or better (i.e. all) ciphers. </p> + +%PARAM smtpd_tls_ciphers medium + +<p> The minimum TLS cipher grade that the Postfix SMTP server +will use with opportunistic TLS encryption. Cipher types listed in +smtpd_tls_exclude_ciphers are excluded from the base definition of +the selected cipher grade. The default value is "medium" for Postfix +releases after the middle of 2015, "export" for older releases. +</p> + +<p> When TLS is mandatory the cipher grade is chosen via the +smtpd_tls_mandatory_ciphers configuration parameter, see there for syntax +details. </p> + +<p> This feature is available in Postfix 2.6 and later. With earlier Postfix +releases only the smtpd_tls_mandatory_ciphers parameter is implemented, +and opportunistic TLS always uses "export" or better (i.e. all) ciphers. </p> + +%PARAM lmtp_tls_ciphers medium + +<p> The LMTP-specific version of the smtp_tls_ciphers configuration +parameter. See there for details. </p> + +<p> This feature is available in Postfix 2.6 and later. </p> + +%PARAM tls_eecdh_auto_curves see "postconf -d" output + +<p> The prioritized list of elliptic curves supported by the Postfix +SMTP client and server. These curves are used by the Postfix SMTP +server when "smtpd_tls_eecdh_grade = auto". The selected curves +must be implemented by OpenSSL and be standardized for use in TLS +(RFC 8422). It is unwise to list only +"bleeding-edge" curves supported by a small subset of clients. The +default list is suitable for most users. </p> + +<p> Postfix skips curve names that are unknown to OpenSSL, or that +are known but not yet implemented. This makes it possible to +"anticipate" support for curves that should be used once they become +available. In particular, in some OpenSSL versions, the new RFC +8031 curves "X25519" and "X448" may be known by name, but ECDH +support for either or both may be missing. These curves may appear +in the default value of this parameter, even though they'll only +be usable with later versions of OpenSSL. </p> + +<p> This feature is available in Postfix 3.2 and later, when it is +compiled and linked with OpenSSL 1.0.2 or later on platforms where +EC algorithms have not been disabled by the vendor. </p> + +%PARAM tls_eecdh_strong_curve prime256v1 + +<p> The elliptic curve used by the Postfix SMTP server for sensibly +strong +ephemeral ECDH key exchange. This curve is used by the Postfix SMTP +server when "smtpd_tls_eecdh_grade = strong". The phrase "sensibly +strong" means approximately 128-bit security based on best known +attacks. The selected curve must be implemented by OpenSSL (as +reported by ecparam(1) with the "-list_curves" option) and be one +of the curves listed in Section 5.1.1 of RFC 8422. You should not +generally change this setting. Remote SMTP client implementations +must support this curve for EECDH key exchange to take place. It +is unwise to choose only "bleeding-edge" curves supported by only a +small subset of clients. </p> + +<p> The default "strong" curve is rated in NSA <a +href="https://web.archive.org/web/20160330034144/https://www.nsa.gov/ia/programs/suiteb_cryptography/">Suite +B</a> for information classified up to SECRET. </p> + +<p> Note: elliptic curve names are poorly standardized; different +standards groups are assigning different names to the same underlying +curves. The curve with the X9.62 name "prime256v1" is also known +under the SECG name "secp256r1", but OpenSSL does not recognize the +latter name. </p> + +<p> If you want to take maximal advantage of ciphers that offer <a +href="FORWARD_SECRECY_README.html#dfn_fs">forward secrecy</a> see +the <a href="FORWARD_SECRECY_README.html#quick-start">Getting +started</a> section of <a +href="FORWARD_SECRECY_README.html">FORWARD_SECRECY_README</a>. The +full document conveniently presents all information about Postfix +"perfect" forward secrecy support in one place: what forward secrecy +is, how to tweak settings, and what you can expect to see when +Postfix uses ciphers with forward secrecy. </p> + +<p> This feature is available in Postfix 2.6 and later, when it is +compiled and linked with OpenSSL 1.0.0 or later on platforms where +EC algorithms have not been disabled by the vendor. </p> + +%PARAM tls_eecdh_ultra_curve secp384r1 + +<p> The elliptic curve used by the Postfix SMTP server for maximally +strong +ephemeral ECDH key exchange. This curve is used by the Postfix SMTP +server when "smtpd_tls_eecdh_grade = ultra". The phrase "maximally +strong" means approximately 192-bit security based on best known attacks. +This additional strength comes at a significant computational cost, most +users should instead set "smtpd_tls_eecdh_grade = strong". The selected +curve must be implemented by OpenSSL (as reported by ecparam(1) with the +"-list_curves" option) and be one of the curves listed in Section 5.1.1 +of RFC 8422. You should not generally change this setting. Remote SMTP +client implementations must support this curve for EECDH key exchange +to take place. It is unwise to choose only "bleeding-edge" curves +supported by only a small subset of clients. </p> + +<p> This default "ultra" curve is rated in NSA <a +href="https://web.archive.org/web/20160330034144/https://www.nsa.gov/ia/programs/suiteb_cryptography/">Suite +B</a> for information classified up to TOP SECRET. </p> + +<p> If you want to take maximal advantage of ciphers that offer <a +href="FORWARD_SECRECY_README.html#dfn_fs">forward secrecy</a> see +the <a href="FORWARD_SECRECY_README.html#quick-start">Getting +started</a> section of <a +href="FORWARD_SECRECY_README.html">FORWARD_SECRECY_README</a>. The +full document conveniently presents all information about Postfix +"perfect" forward secrecy support in one place: what forward secrecy +is, how to tweak settings, and what you can expect to see when +Postfix uses ciphers with forward secrecy. </p> + +<p> This feature is available in Postfix 2.6 and later, when it is +compiled and linked with OpenSSL 1.0.0 or later on platforms where +EC algorithms have not been disabled by the vendor. </p> + +%PARAM smtpd_tls_eecdh_grade see "postconf -d" output + +<p> The Postfix SMTP server security grade for ephemeral elliptic-curve +Diffie-Hellman (EECDH) key exchange. As of Postfix 3.6, the value of +this parameter is always ignored, and Postfix behaves as though the +<b>auto</b> value (described below) was chosen. +</p> + +<p> The available choices are: </p> + +<dl> + +<dt><b>auto</b></dt> <dd> Use the most preferred curve that is +supported by both the client and the server. This setting requires +Postfix ≥ 3.2 compiled and linked with OpenSSL ≥ 1.0.2. This +is the default setting under the above conditions (and the only +setting used with Postfix ≥ 3.6). </dd> + +<dt><b>none</b></dt> <dd> Don't use EECDH. Ciphers based on EECDH key +exchange will be disabled. This is the default in Postfix versions +2.6 and 2.7. </dd> + +<dt><b>strong</b></dt> <dd> Use EECDH with approximately 128 bits of +security at a reasonable computational cost. This is the default in +Postfix versions 2.8–3.5. </dd> + +<dt><b>ultra</b></dt> <dd> Use EECDH with approximately 192 bits of +security at computational cost that is approximately twice as high +as 128 bit strength ECC. </dd> + +</dl> + +<p> If you want to take maximal advantage of ciphers that offer <a +href="FORWARD_SECRECY_README.html#dfn_fs">forward secrecy</a> see +the <a href="FORWARD_SECRECY_README.html#quick-start">Getting +started</a> section of <a +href="FORWARD_SECRECY_README.html">FORWARD_SECRECY_README</a>. The +full document conveniently presents all information about Postfix +"perfect" forward secrecy support in one place: what forward secrecy +is, how to tweak settings, and what you can expect to see when +Postfix uses ciphers with forward secrecy. </p> + +<p> This feature is available in Postfix 2.6 and later, when it is +compiled and linked with OpenSSL 1.0.0 or later on platforms +where EC algorithms have not been disabled by the vendor. </p> + +%PARAM smtpd_tls_eccert_file + +<p> File with the Postfix SMTP server ECDSA certificate in PEM format. +This file may also contain the Postfix SMTP server private ECDSA key. +With Postfix ≥ 3.4 the preferred way to configure server keys and +certificates is via the "smtpd_tls_chain_files" parameter. </p> + +<p> See the discussion under smtpd_tls_cert_file for more details. </p> + +<p> Example: </p> + +<pre> +smtpd_tls_eccert_file = /etc/postfix/ecdsa-scert.pem +</pre> + +<p> This feature is available in Postfix 2.6 and later, when Postfix is +compiled and linked with OpenSSL 1.0.0 or later. </p> + +%PARAM smtpd_tls_eckey_file $smtpd_tls_eccert_file + +<p> File with the Postfix SMTP server ECDSA private key in PEM format. +This file may be combined with the Postfix SMTP server ECDSA certificate +file specified with $smtpd_tls_eccert_file. With Postfix ≥ 3.4 the +preferred way to configure server keys and certificates is via the +"smtpd_tls_chain_files" parameter. </p> + +<p> The private key must be accessible without a pass-phrase, i.e. it +must not be encrypted. File permissions should grant read-only +access to the system superuser account ("root"), and no access +to anyone else. </p> + +<p> This feature is available in Postfix 2.6 and later, when Postfix is +compiled and linked with OpenSSL 1.0.0 or later. </p> + +%PARAM smtp_tls_eccert_file + +<p> File with the Postfix SMTP client ECDSA certificate in PEM format. +This file may also contain the Postfix SMTP client ECDSA private key. +With Postfix ≥ 3.4 the preferred way to configure client keys and +certificates is via the "smtp_tls_chain_files" parameter. </p> + +<p> See the discussion under smtp_tls_cert_file for more details. +</p> + +<p> Example: </p> + +<pre> +smtp_tls_eccert_file = /etc/postfix/ecdsa-ccert.pem +</pre> + +<p> This feature is available in Postfix 2.6 and later, when Postfix is +compiled and linked with OpenSSL 1.0.0 or later. </p> + +%PARAM smtp_tls_eckey_file $smtp_tls_eccert_file + +<p> File with the Postfix SMTP client ECDSA private key in PEM format. +This file may be combined with the Postfix SMTP client ECDSA certificate +file specified with $smtp_tls_eccert_file. With Postfix ≥ 3.4 the +preferred way to configure client keys and certificates is via the +"smtp_tls_chain_files" parameter. </p> + +<p> The private key must be accessible without a pass-phrase, i.e. it +must not be encrypted. File permissions should grant read-only +access to the system superuser account ("root"), and no access +to anyone else. </p> + +<p> This feature is available in Postfix 2.6 and later, when Postfix is +compiled and linked with OpenSSL 1.0.0 or later. </p> + +%PARAM lmtp_tls_eccert_file + +<p> The LMTP-specific version of the smtp_tls_eccert_file configuration +parameter. See there for details. </p> + +<p> This feature is available in Postfix 2.6 and later, when Postfix is +compiled and linked with OpenSSL 1.0.0 or later. </p> + +%PARAM lmtp_tls_eckey_file + +<p> The LMTP-specific version of the smtp_tls_eckey_file configuration +parameter. See there for details. </p> + +<p> This feature is available in Postfix 2.6 and later, when Postfix is +compiled and linked with OpenSSL 1.0.0 or later. </p> + +%PARAM smtp_header_checks + +<p> Restricted header_checks(5) tables for the Postfix SMTP client. +These tables are searched while mail is being delivered. Actions +that change the delivery time or destination are not available. +</p> + +<p> This feature is available in Postfix 2.5 and later. </p> + +%PARAM smtp_mime_header_checks + +<p> Restricted mime_header_checks(5) tables for the Postfix SMTP +client. These tables are searched while mail is being delivered. +Actions that change the delivery time or destination are not +available. </p> + +<p> This feature is available in Postfix 2.5 and later. </p> + +%PARAM smtp_nested_header_checks + +<p> Restricted nested_header_checks(5) tables for the Postfix SMTP +client. These tables are searched while mail is being delivered. +Actions that change the delivery time or destination are not +available. </p> + +<p> This feature is available in Postfix 2.5 and later. </p> + +%PARAM smtp_body_checks + +<p> Restricted body_checks(5) tables for the Postfix SMTP client. +These tables are searched while mail is being delivered. Actions +that change the delivery time or destination are not available. +</p> + +<p> This feature is available in Postfix 2.5 and later. </p> + +%PARAM destination_concurrency_feedback_debug no + +<p> Make the queue manager's feedback algorithm verbose for performance +analysis purposes. </p> + +<p> This feature is available in Postfix 2.5 and later. </p> + +%PARAM default_destination_concurrency_failed_cohort_limit 1 + +<p> How many pseudo-cohorts must suffer connection or handshake +failure before a specific destination is considered unavailable +(and further delivery is suspended). Specify zero to disable this +feature. A destination's pseudo-cohort failure count is reset each +time a delivery completes without connection or handshake failure +for that specific destination. </p> + +<p> A pseudo-cohort is the number of deliveries equal to a destination's +delivery concurrency. </p> + +<p> Use <i>transport</i>_destination_concurrency_failed_cohort_limit to specify +a transport-specific override, where <i>transport</i> is the master.cf +name of the message delivery transport. </p> + +<p> This feature is available in Postfix 2.5. The default setting +is compatible with earlier Postfix versions. </p> + +%PARAM default_destination_concurrency_negative_feedback 1 + +<p> The per-destination amount of delivery concurrency negative +feedback, after a delivery completes with a connection or handshake +failure. Feedback values are in the range 0..1 inclusive. With +negative feedback, concurrency is decremented at the beginning of +a sequence of length 1/feedback. This is unlike positive feedback, +where concurrency is incremented at the end of a sequence of length +1/feedback. </p> + +<p> As of Postfix version 2.5, negative feedback cannot reduce +delivery concurrency to zero. Instead, a destination is marked +dead (further delivery suspended) after the failed pseudo-cohort +count reaches $default_destination_concurrency_failed_cohort_limit +(or $<i>transport</i>_destination_concurrency_failed_cohort_limit). +To make the scheduler completely immune to connection or handshake +failures, specify a zero feedback value and a zero failed pseudo-cohort +limit. </p> + +<p> Specify one of the following forms: </p> + +<dl> + +<dt> <b><i>number</i> </b> </dt> + +<dt> <b><i>number</i> / <i>number</i> </b> </dt> + +<dd> Constant feedback. The value must be in the range 0..1 inclusive. +The default setting of "1" is compatible with Postfix versions +before 2.5, where a destination's delivery concurrency is throttled +down to zero (and further delivery suspended) after a single failed +pseudo-cohort. </dd> + +<dt> <b><i>number</i> / concurrency </b> </dt> + +<dd> Variable feedback of "<i>number</i> / (delivery concurrency)". +The <i>number</i> must be in the range 0..1 inclusive. With +<i>number</i> equal to "1", a destination's delivery concurrency +is decremented by 1 after each failed pseudo-cohort. </dd> + +<!-- + +<dt> <b><i>number</i> / sqrt_concurrency </b> </dt> + +<dd> Variable feedback of "<i>number</i> / sqrt(delivery concurrency)". +The <i>number</i> must be in the range 0..1 inclusive. This setting +may be removed in a future version. </dd> + +--> + +</dl> + +<p> A pseudo-cohort is the number of deliveries equal to a destination's +delivery concurrency. </p> + +<p> Use <i>transport</i>_destination_concurrency_negative_feedback +to specify a transport-specific override, where <i>transport</i> +is the master.cf +name of the message delivery transport. </p> + +<p> This feature is available in Postfix 2.5. The default setting +is compatible with earlier Postfix versions. </p> + +%PARAM default_destination_concurrency_positive_feedback 1 + +<p> The per-destination amount of delivery concurrency positive +feedback, after a delivery completes without connection or handshake +failure. Feedback values are in the range 0..1 inclusive. The +concurrency increases until it reaches the per-destination maximal +concurrency limit. With positive feedback, concurrency is incremented +at the end of a sequence with length 1/feedback. This is unlike +negative feedback, where concurrency is decremented at the start +of a sequence of length 1/feedback. </p> + +<p> Specify one of the following forms: </p> + +<dl> + +<dt> <b><i>number</i> </b> </dt> + +<dt> <b><i>number</i> / <i>number</i> </b> </dt> + +<dd> Constant feedback. The value must be in the range 0..1 +inclusive. The default setting of "1" is compatible with Postfix +versions before 2.5, where a destination's delivery concurrency +doubles after each successful pseudo-cohort. </dd> + +<dt> <b><i>number</i> / concurrency </b> </dt> + +<dd> Variable feedback of "<i>number</i> / (delivery concurrency)". +The <i>number</i> must be in the range 0..1 inclusive. With +<i>number</i> equal to "1", a destination's delivery concurrency +is incremented by 1 after each successful pseudo-cohort. </dd> + +<!-- + +<dt> <b><i>number</i> / sqrt_concurrency </b> </dt> + +<dd> Variable feedback of "<i>number</i> / sqrt(delivery concurrency)". +The <i>number</i> must be in the range 0..1 inclusive. This setting +may be removed in a future version. </dd> + +--> + +</dl> + +<p> A pseudo-cohort is the number of deliveries equal to a destination's +delivery concurrency. </p> + +<p> Use <i>transport</i>_destination_concurrency_positive_feedback +to specify a transport-specific override, where <i>transport</i> +is the master.cf name of the message delivery transport. </p> + +<p> This feature is available in Postfix 2.5 and later. </p> + +%PARAM transport_destination_concurrency_failed_cohort_limit $default_destination_concurrency_failed_cohort_limit + +<p> A transport-specific override for the +default_destination_concurrency_failed_cohort_limit parameter value, +where <i>transport</i> is the master.cf name of the message delivery +transport. </p> + +<p> Note: some <i>transport</i>_destination_concurrency_failed_cohort_limit +parameters will not show up in "postconf" command output before +Postfix version 2.9. This limitation applies to many parameters +whose name is a combination of a master.cf service name and a +built-in suffix (in this case: +"_destination_concurrency_failed_cohort_limit"). </p> + +<p> This feature is available in Postfix 2.5 and later. </p> + +%PARAM transport_destination_concurrency_positive_feedback $default_destination_concurrency_positive_feedback + +<p> A transport-specific override for the +default_destination_concurrency_positive_feedback parameter value, +where <i>transport</i> is the master.cf name of the message delivery +transport. </p> + +<p> Note: some <i>transport</i>_destination_concurrency_positive_feedback +parameters will not show up in "postconf" command output before +Postfix version 2.9. This limitation applies to many parameters +whose name is a combination of a master.cf service name and a +built-in suffix (in this case: +"_destination_concurrency_positive_feedback"). </p> + +<p> This feature is available in Postfix 2.5 and later. </p> + +%PARAM transport_destination_concurrency_negative_feedback $default_destination_concurrency_negative_feedback + +<p> A transport-specific override for the +default_destination_concurrency_negative_feedback parameter value, +where <i>transport</i> is the master.cf name of the message delivery +transport. </p> + +<p> Note: some <i>transport</i>_destination_concurrency_negative_feedback +parameters will not show up in "postconf" command output before +Postfix version 2.9. This limitation applies to many parameters +whose name is a combination of a master.cf service name and a +built-in suffix (in this case: +"_destination_concurrency_negative_feedback"). </p> + +<p> This feature is available in Postfix 2.5 and later. </p> + +%PARAM transport_initial_destination_concurrency $initial_destination_concurrency + +<p> A transport-specific override for the initial_destination_concurrency +parameter value, where <i>transport</i> is the master.cf name of +the message delivery transport. </p> + +<p> Note: some <i>transport</i>_initial_destination_concurrency +parameters will not show up in "postconf" command output before +Postfix version 2.9. This limitation applies to many parameters +whose name is a combination of a master.cf service name and a +built-in suffix (in this case: "_initial_destination_concurrency"). +</p> + +<p> This feature is available in Postfix 2.5 and later. </p> + +%PARAM transport_destination_concurrency_limit $default_destination_concurrency_limit + +<p> A transport-specific override for the +default_destination_concurrency_limit parameter value, where +<i>transport</i> is the master.cf name of the message delivery +transport. </p> + +<p> Note: some <i>transport</i>_destination_concurrency_limit +parameters will not show up in "postconf" command output before +Postfix version 2.9. This limitation applies to many parameters +whose name is a combination of a master.cf service name and a +built-in suffix (in this case: "_destination_concurrency_limit"). +</p> + +%PARAM transport_destination_recipient_limit $default_destination_recipient_limit + +<p> A transport-specific override for the +default_destination_recipient_limit parameter value, where +<i>transport</i> is the master.cf name of the message delivery +transport. </p> + +<p> Note: some <i>transport</i>_destination_recipient_limit parameters +will not show up in "postconf" command output before Postfix version +2.9. This limitation applies to many parameters whose name is a +combination of a master.cf service name and a built-in suffix (in +this case: "_destination_recipient_limit"). </p> + +%PARAM transport_time_limit $command_time_limit + +<p> A transport-specific override for the command_time_limit parameter +value, where <i>transport</i> is the master.cf name of the message +delivery transport. </p> + +<p> Specify a non-zero time value (an integral value plus an optional +one-letter suffix that specifies the time unit). Time units: s +(seconds), m (minutes), h (hours), d (days), w (weeks). +The default time unit is s (seconds). </p> + +<p> Note: <i>transport</i>_time_limit parameters will not show up +in "postconf" command output before Postfix version 2.9. This +limitation applies to many parameters whose name is a combination +of a master.cf service name and a built-in suffix (in this case: +"_time_limit"). </p> + +%PARAM transport_delivery_slot_cost $default_delivery_slot_cost + +<p> A transport-specific override for the default_delivery_slot_cost +parameter value, where <i>transport</i> is the master.cf name of +the message delivery transport. </p> + +<p> Note: <i>transport</i>_delivery_slot_cost parameters will not +show up in "postconf" command output before Postfix version 2.9. +This limitation applies to many parameters whose name is a combination +of a master.cf service name and a built-in suffix (in this case: +"_delivery_slot_cost"). </p> + +%PARAM transport_delivery_slot_loan $default_delivery_slot_loan + +<p> A transport-specific override for the default_delivery_slot_loan +parameter value, where <i>transport</i> is the master.cf name of +the message delivery transport. </p> + +<p> Note: <i>transport</i>_delivery_slot_loan parameters will not +show up in "postconf" command output before Postfix version 2.9. +This limitation applies to many parameters whose name is a combination +of a master.cf service name and a built-in suffix (in this case: +"_delivery_slot_loan"). </p> + +%PARAM transport_delivery_slot_discount $default_delivery_slot_discount + +<p> A transport-specific override for the default_delivery_slot_discount +parameter value, where <i>transport</i> is the master.cf name of +the message delivery transport. </p> + +<p> Note: <i>transport</i>_delivery_slot_discount parameters will +not show up in "postconf" command output before Postfix version +2.9. This limitation applies to many parameters whose name is a +combination of a master.cf service name and a built-in suffix (in +this case: "_delivery_slot_discount"). </p> + +%PARAM transport_minimum_delivery_slots $default_minimum_delivery_slots + +<p> A transport-specific override for the default_minimum_delivery_slots +parameter value, where <i>transport</i> is the master.cf name of +the message delivery transport. </p> + +<p> Note: <i>transport</i>_minimum_delivery_slots parameters will +not show up in "postconf" command output before Postfix version +2.9. This limitation applies to many parameters whose name is a +combination of a master.cf service name and a built-in suffix (in +this case: "_minimum_delivery_slots"). </p> + +%PARAM transport_recipient_limit $default_recipient_limit + +<p> A transport-specific override for the default_recipient_limit +parameter value, where <i>transport</i> is the master.cf name of +the message delivery transport. </p> + +<p> Note: some <i>transport</i>_recipient_limit parameters will not +show up in "postconf" command output before Postfix version 2.9. +This limitation applies to many parameters whose name is a combination +of a master.cf service name and a built-in suffix (in this case: +"_recipient_limit"). </p> + +%PARAM transport_extra_recipient_limit $default_extra_recipient_limit + +<p> A transport-specific override for the default_extra_recipient_limit +parameter value, where <i>transport</i> is the master.cf name of +the message delivery transport. </p> + +<p> Note: <i>transport</i>_extra_recipient_limit parameters will +not show up in "postconf" command output before Postfix version +2.9. This limitation applies to many parameters whose name is a +combination of a master.cf service name and a built-in suffix (in +this case: "_extra_recipient_limit"). </p> + +%PARAM transport_recipient_refill_limit $default_recipient_refill_limit + +<p> A transport-specific override for the default_recipient_refill_limit +parameter value, where <i>transport</i> is the master.cf name of +the message delivery transport. </p> + +<p> Note: <i>transport</i>_recipient_refill_limit parameters will +not show up in "postconf" command output before Postfix version +2.9. This limitation applies to many parameters whose name is a +combination of a master.cf service name and a built-in suffix (in +this case: "_recipient_refill_limit"). </p> + +<p> This feature is available in Postfix 2.4 and later. </p> + +%PARAM transport_recipient_refill_delay $default_recipient_refill_delay + +<p> A transport-specific override for the default_recipient_refill_delay +parameter value, where <i>transport</i> is the master.cf name of +the message delivery transport. </p> + +<p> Note: <i>transport</i>_recipient_refill_delay parameters will +not show up in "postconf" command output before Postfix version +2.9. This limitation applies to many parameters whose name is a +combination of a master.cf service name and a built-in suffix (in +this case: "_recipient_refill_delay"). </p> + +<p> This feature is available in Postfix 2.4 and later. </p> + +%PARAM default_transport_rate_delay 0s + +<p> The default amount of delay that is inserted between individual +message deliveries over the same message delivery transport, +regardless of destination. Specify a non-zero value to rate-limit +those message deliveries to at most one per $default_transport_rate_delay. +</p> + +<p>Use <i>transport</i>_transport_rate_delay to specify a +transport-specific override, where the initial <i>transport</i> is +the master.cf name of the message delivery transport. </p> + +<p> Example: throttle outbound SMTP mail to at most 3 deliveries +per minute. </p> + +<pre> +/etc/postfix/main.cf: + smtp_transport_rate_delay = 20s +</pre> + +<p> To enable the delay, specify a non-zero time value (an integral +value plus an optional one-letter suffix that specifies the time +unit). </p> + +<p> Time units: s (seconds), m (minutes), h (hours), d (days), w +(weeks). The default time unit is s (seconds). </p> + +<p> NOTE: the delay is enforced by the queue manager. </p> + +<p> This feature is available in Postfix 3.1 and later. </p> + +%PARAM transport_transport_rate_delay $default_transport_rate_delay + +<p> A transport-specific override for the default_transport_rate_delay +parameter value, where the initial <i>transport</i> in the parameter +name is the master.cf name of the message delivery transport. </p> + +<p> Specify a non-negative time value (an integral value plus an optional +one-letter suffix that specifies the time unit). Time units: s +(seconds), m (minutes), h (hours), d (days), w (weeks). +The default time unit is s (seconds). </p> + +<p> Note: <i>transport</i>_transport_rate_delay parameters will +not show up in "postconf" command output before Postfix version +2.9. This limitation applies to many parameters whose name is a +combination of a master.cf service name and a built-in suffix (in +this case: "_transport_rate_delay"). </p> + +%PARAM default_destination_rate_delay 0s + +<p> The default amount of delay that is inserted between individual +message deliveries to the same destination and over the same message +delivery transport. Specify a non-zero value to rate-limit those +message deliveries to at most one per $default_destination_rate_delay. +</p> + +<p> The resulting behavior depends on the value of the corresponding +per-destination recipient limit. + +</p> + +<ul> + +<li> <p> With a corresponding per-destination recipient limit > +1, the rate delay specifies the time between deliveries to the +<i>same domain</i>. Different domains are delivered in parallel, +subject to the process limits specified in master.cf. </p> + +<li> <p> With a corresponding per-destination recipient limit equal +to 1, the rate delay specifies the time between deliveries to the +<i>same recipient</i>. Different recipients are delivered in +parallel, subject to the process limits specified in master.cf. +</p> + +</ul> + +<p> To enable the delay, specify a non-zero time value (an integral +value plus an optional one-letter suffix that specifies the time +unit). </p> + +<p> Time units: s (seconds), m (minutes), h (hours), d (days), w +(weeks). The default time unit is s (seconds). </p> + +<p> NOTE: the delay is enforced by the queue manager. The delay +timer state does not survive "<b>postfix reload</b>" or "<b>postfix +stop</b>". +</p> + +<p> Use <i>transport</i>_destination_rate_delay to specify a +transport-specific override, where <i>transport</i> is the master.cf +name of the message delivery transport. +</p> + +<p> NOTE: with a non-zero _destination_rate_delay, specify a +<i>transport</i>_destination_concurrency_failed_cohort_limit of 10 +or more to prevent Postfix from deferring all mail for the same +destination after only one connection or handshake error. </p> + +<p> This feature is available in Postfix 2.5 and later. </p> + +%PARAM transport_destination_rate_delay $default_destination_rate_delay + +<p> A transport-specific override for the default_destination_rate_delay +parameter value, where <i>transport</i> is the master.cf name of +the message delivery transport. </p> + +<p> Note: some <i>transport</i>_destination_rate_delay parameters +will not show up in "postconf" command output before Postfix version +2.9. This limitation applies to many parameters whose name is a +combination of a master.cf service name and a built-in suffix (in +this case: "_destination_rate_delay"). </p> + +<p> This feature is available in Postfix 2.5 and later. </p> + +%PARAM data_directory see "postconf -d" output + +<p> The directory with Postfix-writable data files (for example: +caches, pseudo-random numbers). This directory must be owned by +the mail_owner account, and must not be shared with non-Postfix +software. </p> + +<p> This feature is available in Postfix 2.5 and later. </p> + +%PARAM stress + +<p> This feature is documented in the STRESS_README document. </p> + +<p> This feature is available in Postfix 2.5 and later. </p> + +%PARAM smtp_sasl_auth_soft_bounce yes + +<p> When a remote SMTP server rejects a SASL authentication request +with a 535 reply code, defer mail delivery instead of returning +mail as undeliverable. The latter behavior was hard-coded prior to +Postfix version 2.5. </p> + +<p> Note: the setting "yes" overrides the global soft_bounce +parameter, but the setting "no" does not. </p> + +<p> Example: </p> + +<pre> +# Default as of Postfix 2.5 +smtp_sasl_auth_soft_bounce = yes +# The old hard-coded default +smtp_sasl_auth_soft_bounce = no +</pre> + +<p> This feature is available in Postfix 2.5 and later. </p> + +%PARAM smtp_sasl_auth_cache_name + +<p> An optional table to prevent repeated SASL authentication +failures with the same remote SMTP server hostname, username and +password. Each table (key, value) pair contains a server name, a +username and password, and the full server response. This information +is stored when a remote SMTP server rejects an authentication attempt +with a 535 reply code. As long as the smtp_sasl_password_maps +information does not change, and as long as the smtp_sasl_auth_cache_name +information does not expire (see smtp_sasl_auth_cache_time) the +Postfix SMTP client avoids SASL authentication attempts with the +same server, username and password, and instead bounces or defers +mail as controlled with the smtp_sasl_auth_soft_bounce configuration +parameter. </p> + +<p> Use a per-destination delivery concurrency of 1 (for example, +"smtp_destination_concurrency_limit = 1", +"relay_destination_concurrency_limit = 1", etc.), otherwise multiple +delivery agents may experience a login failure at the same time. +</p> + +<p> The table must be accessed via the proxywrite service, i.e. the +map name must start with "proxy:". The table should be stored under +the directory specified with the data_directory parameter. </p> + +<p> This feature uses cryptographic hashing to protect plain-text +passwords, and requires that Postfix is compiled with TLS support. +</p> + +<p> Example: </p> + +<pre> +smtp_sasl_auth_cache_name = proxy:btree:/var/lib/postfix/sasl_auth_cache +</pre> + +<p> This feature is available in Postfix 2.5 and later. </p> + +%PARAM smtp_sasl_auth_cache_time 90d + +<p> The maximal age of an smtp_sasl_auth_cache_name entry before it +is removed. </p> + +<p> Specify a non-negative time value (an integral value plus an optional +one-letter suffix that specifies the time unit). Time units: s +(seconds), m (minutes), h (hours), d (days), w (weeks). +The default time unit is d (days). </p> + +<p> This feature is available in Postfix 2.5 and later. </p> + +%PARAM lmtp_sasl_auth_soft_bounce yes + +<p> The LMTP-specific version of the smtp_sasl_auth_soft_bounce +configuration parameter. See there for details. </p> + +<p> This feature is available in Postfix 2.5 and later. </p> + +%PARAM lmtp_sasl_auth_cache_name + +<p> The LMTP-specific version of the smtp_sasl_auth_cache_name +configuration parameter. See there for details. </p> + +<p> This feature is available in Postfix 2.5 and later. </p> + +%PARAM lmtp_sasl_auth_cache_time 90d + +<p> The LMTP-specific version of the smtp_sasl_auth_cache_time +configuration parameter. See there for details. </p> + +<p> This feature is available in Postfix 2.5 and later. </p> + +%PARAM unverified_sender_reject_reason + +<p> The Postfix SMTP server's reply when rejecting mail with +reject_unverified_sender. Do not include the numeric SMTP reply +code or the enhanced status code. By default, the response includes +actual address verification details. + +<p> Example: </p> + +<pre> +unverified_sender_reject_reason = Sender address lookup failed +</pre> + +<p> This feature is available in Postfix 2.6 and later. </p> + +%PARAM unverified_recipient_reject_reason + +<p> The Postfix SMTP server's reply when rejecting mail with +reject_unverified_recipient. Do not include the numeric SMTP reply +code or the enhanced status code. By default, the response includes +actual address verification details. + +<p> Example: </p> + +<pre> +unverified_recipient_reject_reason = Recipient address lookup failed +</pre> + +<p> This feature is available in Postfix 2.6 and later. </p> + +%PARAM strict_mailbox_ownership yes + +<p> Defer delivery when a mailbox file is not owned by its recipient. +The default setting is not backwards compatible. </p> + +<p> This feature is available in Postfix 2.5.3 and later. </p> + +%PARAM proxymap_service_name proxymap + +<p> The name of the proxymap read-only table lookup service. This +service is normally implemented by the proxymap(8) daemon. </p> + +<p> This feature is available in Postfix 2.6 and later. </p> + +%PARAM proxywrite_service_name proxywrite + +<p> The name of the proxywrite read-write table lookup service. +This service is normally implemented by the proxymap(8) daemon. +</p> + +<p> This feature is available in Postfix 2.6 and later. </p> + +%PARAM master_service_disable + +<p> Selectively disable master(8) listener ports by service type +or by service name and type. Specify a list of service types +("inet", "unix", "fifo", or "pass") or "name/type" tuples, where +"name" is the first field of a master.cf entry and "type" is a +service type. As with other Postfix matchlists, a search stops at +the first match. Specify "!pattern" to exclude a service from the +list. By default, all master(8) listener ports are enabled. </p> + +<p> Note: this feature does not support "/file/name" or "type:table" +patterns, nor does it support wildcards such as "*" or "all". This +is intentional. </p> + +<p> Examples: </p> + +<pre> +# With Postfix 2.6..2.10 use '.' instead of '/'. +# Turn on all master(8) listener ports (the default). +master_service_disable = +# Turn off only the main SMTP listener port. +master_service_disable = smtp/inet +# Turn off all TCP/IP listener ports. +master_service_disable = inet +# Turn off all TCP/IP listener ports except "foo". +master_service_disable = !foo/inet, inet +</pre> + +<p> This feature is available in Postfix 2.6 and later. </p> + +%PARAM tcp_windowsize 0 + +<p> An optional workaround for routers that break TCP window scaling. +Specify a value > 0 and < 65536 to enable this feature. With +Postfix TCP servers (smtpd(8), qmqpd(8)), this feature is implemented +by the Postfix master(8) daemon. </p> + +<p> To change this parameter without stopping Postfix, you need to +first terminate all Postfix TCP servers: </p> + +<blockquote> +<pre> +# postconf -e master_service_disable=inet +# postfix reload +</pre> +</blockquote> + +<p> This immediately terminates all processes that accept network +connections. Next, you enable Postfix TCP servers with the updated +tcp_windowsize setting: </p> + +<blockquote> +<pre> +# postconf -e tcp_windowsize=65535 master_service_disable= +# postfix reload +</pre> +</blockquote> + +<p> If you skip these steps with a running Postfix system, then the +tcp_windowsize change will work only for Postfix TCP clients (smtp(8), +lmtp(8)). </p> + +<p> This feature is available in Postfix 2.6 and later. </p> + +%PARAM multi_instance_directories + +<p> An optional list of non-default Postfix configuration directories; +these directories belong to additional Postfix instances that share +the Postfix executable files and documentation with the default +Postfix instance, and that are started, stopped, etc., together +with the default Postfix instance. Specify a list of pathnames +separated by comma or whitespace. </p> + +<p> When $multi_instance_directories is empty, the postfix(1) command +runs in single-instance mode and operates on a single Postfix +instance only. Otherwise, the postfix(1) command runs in multi-instance +mode and invokes the multi-instance manager specified with the +multi_instance_wrapper parameter. The multi-instance manager in +turn executes postfix(1) commands for the default instance and for +all Postfix instances in $multi_instance_directories. </p> + +<p> Currently, this parameter setting is ignored except for the +default main.cf file. </p> + +<p> This feature is available in Postfix 2.6 and later. </p> + +%PARAM multi_instance_wrapper + +<p> The pathname of a multi-instance manager command that the +postfix(1) command invokes when the multi_instance_directories +parameter value is non-empty. The pathname may be followed by +initial command arguments separated by whitespace; shell +metacharacters such as quotes are not supported in this context. +</p> + +<p> The postfix(1) command invokes the manager command with the +postfix(1) non-option command arguments on the manager command line, +and with all installation configuration parameters exported into +the manager command process environment. The manager command in +turn invokes the postfix(1) command for individual Postfix instances +as "postfix -c <i>config_directory</i> <i>command</i>". </p> + +<p> This feature is available in Postfix 2.6 and later. </p> + +%PARAM multi_instance_group + +<p> The optional instance group name of this Postfix instance. A +group identifies closely-related Postfix instances that the +multi-instance manager can start, stop, etc., as a unit. This +parameter is reserved for the multi-instance manager. </p> + +<p> This feature is available in Postfix 2.6 and later. </p> + +%PARAM multi_instance_name + +<p> The optional instance name of this Postfix instance. This name +becomes also the default value for the syslog_name parameter. </p> + +<p> This feature is available in Postfix 2.6 and later. </p> + +%PARAM multi_instance_enable no + +<p> Allow this Postfix instance to be started, stopped, etc., by a +multi-instance manager. By default, new instances are created in +a safe state that prevents them from being started inadvertently. +This parameter is reserved for the multi-instance manager. </p> + +<p> This feature is available in Postfix 2.6 and later. </p> + +%PARAM reject_tempfail_action defer_if_permit + +<p> The Postfix SMTP server's action when a reject-type restriction +fails due to a temporary error condition. Specify "defer" to defer +the remote SMTP client request immediately. With the default +"defer_if_permit" action, the Postfix SMTP server continues to look +for opportunities to reject mail, and defers the client request +only if it would otherwise be accepted. </p> + +<p> For finer control, see: unverified_recipient_tempfail_action, +unverified_sender_tempfail_action, unknown_address_tempfail_action, +and unknown_helo_hostname_tempfail_action. </p> + +<p> This feature is available in Postfix 2.6 and later. </p> + +%PARAM unverified_recipient_tempfail_action $reject_tempfail_action + +<p> The Postfix SMTP server's action when reject_unverified_recipient +fails due to a temporary error condition. Specify "defer" to defer +the remote SMTP client request immediately. With the default +"defer_if_permit" action, the Postfix SMTP server continues to look +for opportunities to reject mail, and defers the client request +only if it would otherwise be accepted. </p> + +<p> This feature is available in Postfix 2.6 and later. </p> + +%PARAM unverified_sender_tempfail_action $reject_tempfail_action + +<p> The Postfix SMTP server's action when reject_unverified_sender +fails due to a temporary error condition. Specify "defer" to defer +the remote SMTP client request immediately. With the default +"defer_if_permit" action, the Postfix SMTP server continues to look +for opportunities to reject mail, and defers the client request +only if it would otherwise be accepted. </p> + +<p> This feature is available in Postfix 2.6 and later. </p> + +%PARAM unknown_address_tempfail_action $reject_tempfail_action + +<p> The Postfix SMTP server's action when reject_unknown_sender_domain +or reject_unknown_recipient_domain fail due to a temporary error +condition. Specify "defer" to defer the remote SMTP client request +immediately. With the default "defer_if_permit" action, the Postfix +SMTP server continues to look for opportunities to reject mail, and +defers the client request only if it would otherwise be accepted. +</p> + +<p> This feature is available in Postfix 2.6 and later. </p> + +%PARAM unknown_helo_hostname_tempfail_action $reject_tempfail_action + +<p> The Postfix SMTP server's action when reject_unknown_helo_hostname +fails due to a temporary error condition. Specify "defer" to defer +the remote SMTP client request immediately. With the default +"defer_if_permit" action, the Postfix SMTP server continues to look +for opportunities to reject mail, and defers the client request +only if it would otherwise be accepted. </p> + +<p> This feature is available in Postfix 2.6 and later. </p> + +%PARAM postmulti_start_commands start + +<p> The postfix(1) commands that the postmulti(1) instance manager treats +as "start" commands. For these commands, disabled instances are "checked" +rather than "started", and failure to "start" a member instance of an +instance group will abort the start-up of later instances. </p> + +<p> This feature is available in Postfix 2.6 and later. </p> + +%PARAM postmulti_stop_commands see "postconf -d" output + +<p> The postfix(1) commands that the postmulti(1) instance manager treats +as "stop" commands. For these commands, disabled instances are skipped, +and enabled instances are processed in reverse order. </p> + +<p> This feature is available in Postfix 2.6 and later. </p> + +%PARAM postmulti_control_commands reload flush + +<p> The postfix(1) commands that the postmulti(1) instance manager +treats as "control" commands, that operate on running instances. For +these commands, disabled instances are skipped. </p> + +<p> This feature is available in Postfix 2.6 and later. </p> + +%PARAM lmtp_assume_final no + +<p> When a remote LMTP server announces no DSN support, assume that +the +server performs final delivery, and send "delivered" delivery status +notifications instead of "relayed". The default setting is backwards +compatible to avoid the infinitesimal possibility of breaking +existing LMTP-based content filters. </p> + +%PARAM always_add_missing_headers no + +<p> Always add (Resent-) From:, To:, Date: or Message-ID: headers +when not present. Postfix 2.6 and later add these headers only +when clients match the local_header_rewrite_clients parameter +setting. Earlier Postfix versions always add these headers; this +may break DKIM signatures that cover non-existent headers. +The undisclosed_recipients_header parameter setting determines +whether a To: header will be added. </p> + +%PARAM lmtp_header_checks + +<p> The LMTP-specific version of the smtp_header_checks configuration +parameter. See there for details. </p> + +<p> This feature is available in Postfix 2.5 and later. </p> + +%PARAM lmtp_mime_header_checks + +<p> The LMTP-specific version of the smtp_mime_header_checks +configuration parameter. See there for details. </p> + +<p> This feature is available in Postfix 2.5 and later. </p> + +%PARAM lmtp_nested_header_checks + +<p> The LMTP-specific version of the smtp_nested_header_checks +configuration parameter. See there for details. </p> + +<p> This feature is available in Postfix 2.5 and later. </p> + +%PARAM lmtp_body_checks + +<p> The LMTP-specific version of the smtp_body_checks configuration +parameter. See there for details. </p> + +<p> This feature is available in Postfix 2.5 and later. </p> + +%PARAM milter_header_checks + +<p> Optional lookup tables for content inspection of message headers +that are produced by Milter applications. See the header_checks(5) +manual page available actions. Currently, PREPEND is not implemented. +</p> + +<p> The following example sends all mail that is marked as SPAM to +a spam handling machine. Note that matches are case-insensitive +by default. </p> + +<pre> +/etc/postfix/main.cf: + milter_header_checks = pcre:/etc/postfix/milter_header_checks +</pre> + +<pre> +/etc/postfix/milter_header_checks: + /^X-SPAM-FLAG:\s+YES/ FILTER mysmtp:sanitizer.example.com:25 +</pre> + +<p> The milter_header_checks mechanism could also be used for +allowlisting. For example it could be used to skip heavy content +inspection for DKIM-signed mail from known friendly domains. </p> + +<p> This feature is available in Postfix 2.7, and as an optional +patch for Postfix 2.6. </p> + +%PARAM postscreen_cache_map btree:$data_directory/postscreen_cache + +<p> Persistent storage for the postscreen(8) server decisions. </p> + +<p> To share a postscreen(8) cache between multiple postscreen(8) +instances, use "postscreen_cache_map = proxy:btree:/path/to/file". +This requires Postfix version 2.9 or later; earlier proxymap(8) +implementations don't support cache cleanup. For an alternative +approach see the memcache_table(5) manpage. </p> + +<p> This feature is available in Postfix 2.8. </p> + +%PARAM smtpd_service_name smtpd + +<p> The internal service that postscreen(8) hands off allowed +connections to. In a future version there may be different +classes of SMTP service. </p> + +<p> This feature is available in Postfix 2.8. </p> + +%PARAM postscreen_post_queue_limit $default_process_limit + +<p> The number of clients that can be waiting for service from a +real Postfix SMTP server process. When this queue is full, all +clients will +receive a 421 response. </p> + +<p> This feature is available in Postfix 2.8. </p> + +%PARAM postscreen_pre_queue_limit $default_process_limit + +<p> The number of non-allowlisted clients that can be waiting for +a decision whether they will receive service from a real Postfix +SMTP server +process. When this queue is full, all non-allowlisted clients will +receive a 421 response. </p> + +<p> This feature is available in Postfix 2.8. </p> + +%PARAM postscreen_greet_ttl 1d + +<p> The amount of time that postscreen(8) will use the result from +a successful PREGREET test. During this time, the client IP address +is excluded from this test. The default is relatively short, because +a good client can immediately talk to a real Postfix SMTP server. </p> + +<p> Specify a non-zero time value (an integral value plus an optional +one-letter suffix that specifies the time unit). Time units: s +(seconds), m (minutes), h (hours), d (days), w (weeks). +The default time unit is d (days). </p> + +<p> This feature is available in Postfix 2.8. </p> + +%PARAM postscreen_cache_retention_time 7d + +<p> The amount of time that postscreen(8) will cache an expired +temporary allowlist entry before it is removed. This prevents clients +from being logged as "NEW" just because their cache entry expired +an hour ago. It also prevents the cache from filling up with clients +that passed some deep protocol test once and never came back. </p> + +<p> Specify a non-zero time value (an integral value plus an optional +one-letter suffix that specifies the time unit). Time units: s +(seconds), m (minutes), h (hours), d (days), w (weeks). +The default time unit is d (days). </p> + +<p> This feature is available in Postfix 2.8. </p> + +%PARAM postscreen_cache_cleanup_interval 12h + +<p> The amount of time between postscreen(8) cache cleanup runs. +Cache cleanup increases the load on the cache database and should +therefore not be run frequently. This feature requires that the +cache database supports the "delete" and "sequence" operators. +Specify a zero interval to disable cache cleanup. </p> + +<p> After each cache cleanup run, the postscreen(8) daemon logs the +number of entries that were retained and dropped. A cleanup run is +logged as "partial" when the daemon terminates early after "<b>postfix +reload</b>", "<b>postfix stop</b>", or no requests for $max_idle +seconds. </p> + +<p> Specify a non-negative time value (an integral value plus an optional +one-letter suffix that specifies the time unit). Time units: s +(seconds), m (minutes), h (hours), d (days), w (weeks). +The default time unit is h (hours). </p> + +<p> This feature is available in Postfix 2.8. </p> + +%PARAM postscreen_greet_wait normal: 6s, overload: 2s + +<p> The amount of time that postscreen(8) will wait for an SMTP +client to send a command before its turn, and for DNS blocklist +lookup results to arrive (default: up to 2 seconds under stress, +up to 6 seconds otherwise). <p> + +<p> Specify a non-zero time value (an integral value plus an optional +one-letter suffix that specifies the time unit). Time units: s +(seconds), m (minutes), h (hours), d (days), w (weeks). +The default time unit is s (seconds). </p> + +<p> This feature is available in Postfix 2.8. </p> + +%PARAM postscreen_dnsbl_sites + +<p>Optional list of DNS allow/denylist domains, filters and weight +factors. When the list is non-empty, the dnsblog(8) daemon will +query these domains with the IP addresses of remote SMTP clients, +and postscreen(8) will update an SMTP client's DNSBL score with +each non-error reply. </p> + +<p> Caution: when postscreen rejects mail, it replies with the DNSBL +domain name. Use the postscreen_dnsbl_reply_map feature to hide +"password" information in DNSBL domain names. </p> + +<p> When a client's score is equal to or greater than the threshold +specified with postscreen_dnsbl_threshold, postscreen(8) can drop +the connection with the remote SMTP client. </p> + +<p> Specify a list of domain=filter*weight entries, separated by +comma or whitespace. </p> + +<ul> + +<li> <p> When no "=filter" is specified, postscreen(8) will use any +non-error DNSBL reply. Otherwise, postscreen(8) uses only DNSBL +replies that match the filter. The filter has the form d.d.d.d, +where each d is a number, or a pattern inside [] that contains one +or more ";"-separated numbers or number..number ranges. </p> + +<li> <p> When no "*weight" is specified, postscreen(8) increments +the remote SMTP client's DNSBL score by 1. Otherwise, the weight must be +an integral number, and postscreen(8) adds the specified weight to +the remote SMTP client's DNSBL score. Specify a negative number for +allowlisting. </p> + +<li> <p> When one postscreen_dnsbl_sites entry produces multiple +DNSBL responses, postscreen(8) applies the weight at most once. +</p> + +</ul> + +<p> Examples: </p> + +<p> To use example.com as a high-confidence blocklist, and to +block mail with example.net and example.org only when both agree: +</p> + +<pre> +postscreen_dnsbl_threshold = 2 +postscreen_dnsbl_sites = example.com*2, example.net, example.org +</pre> + +<p> To filter only DNSBL replies containing 127.0.0.4: </p> + +<pre> +postscreen_dnsbl_sites = example.com=127.0.0.4 +</pre> + +<p> This feature is available in Postfix 2.8. </p> + +%PARAM postscreen_dnsbl_action ignore + +<p>The action that postscreen(8) takes when a remote SMTP client's combined +DNSBL score is equal to or greater than a threshold (as defined +with the postscreen_dnsbl_sites and postscreen_dnsbl_threshold +parameters). Specify one of the following: </p> + +<dl> + +<dt> <b>ignore</b> (default) </dt> + +<dd> Ignore the failure of this test. Allow other tests to complete. +Repeat this test the next time the client connects. +This option is useful for testing and collecting statistics +without blocking mail. </dd> + +<dt> <b>enforce</b> </dt> + +<dd> Allow other tests to complete. Reject attempts to deliver mail +with a 550 SMTP reply, and log the helo/sender/recipient information. +Repeat this test the next time the client connects. </dd> + +<dt> <b>drop</b> </dt> + +<dd> Drop the connection immediately with a 521 SMTP reply. Repeat +this test the next time the client connects. </dd> + +</dl> + +<p> This feature is available in Postfix 2.8. </p> + +%PARAM postscreen_greet_action ignore + +<p>The action that postscreen(8) takes when a remote SMTP client speaks +before its turn within the time specified with the postscreen_greet_wait +parameter. Specify one of the following: </p> + +<dl> + +<dt> <b>ignore</b> (default) </dt> + +<dd> Ignore the failure of this test. Allow other tests to complete. +Repeat this test the next time the client connects. +This option is useful for testing and collecting statistics +without blocking mail. </dd> + +<dt> <b>enforce</b> </dt> + +<dd> Allow other tests to complete. Reject attempts to deliver mail +with a 550 SMTP reply, and log the helo/sender/recipient information. +Repeat this test the next time the client connects. </dd> + +<dt> <b>drop</b> </dt> + +<dd> Drop the connection immediately with a 521 SMTP reply. Repeat +this test the next time the client connects. </dd> + +</dl> + +<p> In either case, postscreen(8) will not allowlist the remote SMTP client +IP address. </p> + +<p> This feature is available in Postfix 2.8. </p> + +%PARAM postscreen_access_list permit_mynetworks + +<p> Permanent allow/denylist for remote SMTP client IP addresses. +postscreen(8) searches this list immediately after a remote SMTP +client connects. Specify a comma- or whitespace-separated list of +commands (in upper or lower case) or lookup tables. The search stops +upon the first command that fires for the client IP address. </p> + +<dl> + +<dt> <b> permit_mynetworks </b> </dt> <dd> Allowlist the client and +terminate the search if the client IP address matches $mynetworks. +Do not subject the client to any before/after 220 greeting tests. +Pass the connection immediately to a Postfix SMTP server process. +<br> Pattern matching of domain names is controlled by the presence +or absence of "postscreen_access_list" in the +parent_domain_matches_subdomains parameter value. </dd> + +<dt> <b> type:table </b> </dt> <dd> Query the specified lookup +table. Each table lookup result is an access list, except that +access lists inside a table cannot specify type:table entries. <br> +To discourage the use of hash, btree, etc. tables, there is no +support for substring matching like smtpd(8). Use CIDR tables +instead. </dd> + +<dt> <b> permit </b> </dt> <dd> Allowlist the client and terminate +the search. Do not subject the client to any before/after 220 +greeting tests. Pass the connection immediately to a Postfix SMTP +server process. </dd> + +<dt> <b> reject </b> </dt> <dd> Denylist the client and terminate +the search. Subject the client to the action configured with the +postscreen_denylist_action configuration parameter. </dd> + +<dt> <b> dunno </b> </dt> <dd> All postscreen(8) access lists +implicitly have this command at the end. <br> When <b> dunno </b> +is executed inside a lookup table, return from the lookup table and +evaluate the next command. <br> When <b> dunno </b> is executed +outside a lookup table, terminate the search, and subject the client +to the configured before/after 220 greeting tests. </dd> + +</dl> + +<p> Example: </p> + +<pre> +/etc/postfix/main.cf: + postscreen_access_list = permit_mynetworks, + cidr:/etc/postfix/postscreen_access.cidr + # Postfix < 3.6 use postscreen_blacklist_action. + postscreen_denylist_action = enforce +</pre> + +<pre> +/etc/postfix/postscreen_access.cidr: + # Rules are evaluated in the order as specified. + # Denylist 192.168.* except 192.168.0.1. + 192.168.0.1 dunno + 192.168.0.0/16 reject +</pre> + +<p> This feature is available in Postfix 2.8. </p> + +%PARAM postscreen_greet_banner $smtpd_banner + +<p> The <i>text</i> in the optional "220-<i>text</i>..." server +response that +postscreen(8) sends ahead of the real Postfix SMTP server's "220 +text..." response, in an attempt to confuse bad SMTP clients so +that they speak before their turn (pre-greet). Specify an empty +value to disable this feature. </p> + +<p> This feature is available in Postfix 2.8. </p> + +%PARAM postscreen_blacklist_action ignore + +<p> Renamed to postscreen_denylist_action in Postfix 3.6. </p> + +<p> This feature is available in Postfix 2.8 - 3.5. </p> + +%PARAM postscreen_denylist_action ignore + +<p> The action that postscreen(8) takes when a remote SMTP client is +permanently denylisted with the postscreen_access_list parameter. +Specify one of the following: </p> + +<dl> + +<dt> <b>ignore</b> (default) </dt> + +<dd> Ignore this result. Allow other tests to complete. Repeat +this test the next time the client connects. +This option is useful for testing and collecting statistics +without blocking mail. </dd> + +<dt> <b>enforce</b> </dt> + +<dd> Allow other tests to complete. Reject attempts to deliver mail +with a 550 SMTP reply, and log the helo/sender/recipient information. +Repeat this test the next time the client connects. </dd> + +<dt> <b>drop</b> </dt> + +<dd> Drop the connection immediately with a 521 SMTP reply. Repeat +this test the next time the client connects. </dd> + +</dl> + +<p> This feature is available in Postfix 3.6 and later. </p> + +<p> Available as postscreen_blacklist_action in Postfix 2.8 - 3.5. </p> + +%PARAM smtpd_command_filter + +<p> A mechanism to transform commands from remote SMTP clients. +This is a last-resort tool to work around client commands that break +interoperability with the Postfix SMTP server. Other uses involve +fault injection to test Postfix's handling of invalid commands. +</p> + +<p> Specify the name of a "type:table" lookup table. The search +string is the SMTP command as received from the remote SMTP client, +except that initial whitespace and the trailing <CR><LF> +are removed. The result value is executed by the Postfix SMTP +server. </p> + +<p> There is no need to use smtpd_command_filter for the following +cases: </p> + +<ul> + +<li> <p> Use "resolve_numeric_domain = yes" to accept +"<i>user@ipaddress</i>". </p> + +<li> <p> Postfix already accepts the correct form +"<i>user@[ipaddress]</i>". Use virtual_alias_maps or canonical_maps +to translate these into domain names if necessary. </p> + +<li> <p> Use "strict_rfc821_envelopes = no" to accept "RCPT TO:<<i>User +Name <user@example.com>></i>". Postfix will ignore the "<i>User +Name</i>" part and deliver to the <i><user@example.com></i> address. +</p> + +</ul> + +<p> Examples of problems that can be solved with the smtpd_command_filter +feature: </p> + +<pre> +/etc/postfix/main.cf: + smtpd_command_filter = pcre:/etc/postfix/command_filter +</pre> + +<pre> +/etc/postfix/command_filter: + # Work around clients that send malformed HELO commands. + /^HELO\s*$/ HELO domain.invalid +</pre> + +<pre> + # Work around clients that send empty lines. + /^\s*$/ NOOP +</pre> + +<pre> + # Work around clients that send RCPT TO:<'user@domain'>. + # WARNING: do not lose the parameters that follow the address. + /^(RCPT\s+TO:\s*<)'([^[:space:]]+)'(>.*)/ $1$2$3 +</pre> + +<pre> + # Append XVERP to MAIL FROM commands to request VERP-style delivery. + # See VERP_README for more information on how to use Postfix VERP. + /^(MAIL\s+FROM:\s*<listname@example\.com>.*)/ $1 XVERP +</pre> + +<pre> + # Bounce-never mail sink. Use notify_classes=bounce,resource,software + # to send bounced mail to the postmaster (with message body removed). + /^(RCPT\s+TO:\s*<.*>.*)\s+NOTIFY=\S+(.*)/ $1 NOTIFY=NEVER$2 + /^(RCPT\s+TO:.*)/ $1 NOTIFY=NEVER +</pre> + +<p> This feature is available in Postfix 2.7. </p> + +%PARAM smtp_reply_filter + +<p> A mechanism to transform replies from remote SMTP servers one +line at a time. This is a last-resort tool to work around server +replies that break interoperability with the Postfix SMTP client. +Other uses involve fault injection to test Postfix's handling of +invalid responses. </p> + +<p> Notes: </p> + +<ul> + +<li> <p> In the case of a multi-line reply, the Postfix SMTP client +uses the final reply line's numerical SMTP reply code and enhanced +status code. </p> + +<li> <p> The numerical SMTP reply code (XYZ) takes precedence over +the enhanced status code (X.Y.Z). When the enhanced status code +initial digit differs from the SMTP reply code initial digit, or +when no enhanced status code is present, the Postfix SMTP client +uses a generic enhanced status code (X.0.0) instead. </p> + +</ul> + +<p> Specify the name of a "type:table" lookup table. The search +string is a single SMTP reply line as received from the remote SMTP +server, except that the trailing <CR><LF> are removed. +When the lookup succeeds, the result replaces the single SMTP reply +line. </p> + +<p> Examples: </p> + +<pre> +/etc/postfix/main.cf: + smtp_reply_filter = pcre:/etc/postfix/reply_filter +</pre> + +<pre> +/etc/postfix/reply_filter: + # Transform garbage into "250-filler..." so that it looks like + # one line from a multi-line reply. It does not matter what we + # substitute here as long it has the right syntax. The Postfix + # SMTP client will use the final line's numerical SMTP reply + # code and enhanced status code. + !/^([2-5][0-9][0-9]($|[- ]))/ 250-filler for garbage +</pre> + +<p> This feature is available in Postfix 2.7. </p> + +%PARAM lmtp_reply_filter + +<p> The LMTP-specific version of the smtp_reply_filter +configuration parameter. See there for details. </p> + +<p> This feature is available in Postfix 2.7 and later. </p> + +%PARAM smtp_tls_block_early_mail_reply no + +<p> Try to detect a mail hijacking attack based on a TLS protocol +vulnerability (CVE-2009-3555), where an attacker prepends malicious +HELO, MAIL, RCPT, DATA commands to a Postfix SMTP client TLS session. +The attack would succeed with non-Postfix SMTP servers that reply +to the malicious HELO, MAIL, RCPT, DATA commands after negotiating +the Postfix SMTP client TLS session. </p> + +<p> This feature is available in Postfix 2.7. </p> + +%PARAM lmtp_tls_block_early_mail_reply + +<p> The LMTP-specific version of the smtp_tls_block_early_mail_reply +configuration parameter. See there for details. </p> + +<p> This feature is available in Postfix 2.7 and later. </p> + +%PARAM empty_address_default_transport_maps_lookup_key <> + +<p> The sender_dependent_default_transport_maps search string that +will be used instead of the null sender address. </p> + +<p> This feature is available in Postfix 2.7 and later. </p> + +%PARAM sender_dependent_default_transport_maps + +<p> A sender-dependent override for the global default_transport +parameter setting. The tables are searched by the envelope sender +address and @domain. A lookup result of DUNNO terminates the search +without overriding the global default_transport parameter setting. +This information is overruled with the transport(5) table. </p> + +<p> +Specify zero or more "type:name" lookup tables, separated by +whitespace or comma. Tables will be searched in the specified order +until a match is found. +</p> + +<p> Note: this overrides default_transport, not transport_maps, and +therefore the expected syntax is that of default_transport, not the +syntax of transport_maps. Specifically, this does not support the +transport_maps syntax for null transport, null nexthop, or null +email addresses. </p> + +<p> For safety reasons, this feature does not allow $number +substitutions in regular expression maps. </p> + +<p> This feature is available in Postfix 2.7 and later. </p> + +%PARAM address_verify_sender_dependent_default_transport_maps $sender_dependent_default_transport_maps + +<p> Overrides the sender_dependent_default_transport_maps parameter +setting for address verification probes. </p> + +<p> This feature is available in Postfix 2.7 and later. </p> + +%PARAM default_filter_nexthop + +<p> When a content_filter or FILTER request specifies no explicit +next-hop destination, use $default_filter_nexthop instead; when +that value is empty, use the domain in the recipient address. +Specify "default_filter_nexthop = $myhostname" for compatibility +with Postfix version 2.6 and earlier, or specify an explicit next-hop +destination with each content_filter value or FILTER action. </p> + +<p> This feature is available in Postfix 2.7 and later. </p> + +%PARAM smtp_address_preference any + +<p> The address type ("ipv6", "ipv4" or "any") that the Postfix +SMTP client will try first, when a destination has IPv6 and IPv4 +addresses with equal MX preference. This feature has no effect +unless the inet_protocols setting enables both IPv4 and IPv6. </p> + +<p> Postfix SMTP client address preference has evolved. With Postfix +2.8 the default is "ipv6"; earlier implementations are hard-coded +to prefer IPv6 over IPv4. </p> + +<p> Notes for mail delivery between sites that have both IPv4 and +IPv6 connectivity: </p> + +<ul> + +<li> <p> The setting "smtp_address_preference = ipv6" is unsafe. +It can fail to deliver mail when there is an outage that affects +IPv6, while the destination is still reachable over IPv4. </p> + +<li> <p> The setting "smtp_address_preference = any" is safe. With +this, mail will eventually be delivered even if there is an outage +that affects IPv6 or IPv4, as long as it does not affect both. </p> + +</ul> + +<p> This feature is available in Postfix 2.8 and later. </p> + +%PARAM lmtp_address_preference ipv6 + +<p> The LMTP-specific version of the smtp_address_preference +configuration parameter. See there for details. </p> + +<p> This feature is available in Postfix 2.8 and later. </p> + +%PARAM smtp_dns_resolver_options + +<p> DNS Resolver options for the Postfix SMTP client. Specify zero +or more of the following options, separated by comma or whitespace. +Option names are case-sensitive. Some options refer to domain names +that are specified in the file /etc/resolv.conf or equivalent. </p> + +<dl> + +<dt><b>res_defnames</b></dt> + +<dd> Append the current domain name to single-component names (those +that do not contain a "." character). This can produce incorrect +results, and is the hard-coded behavior prior to Postfix 2.8. </dd> + +<dt><b>res_dnsrch</b></dt> + +<dd> Search for host names in the current domain and in parent +domains. This can produce incorrect results and is therefore not +recommended. </dd> + +</dl> + +<p> This feature is available in Postfix 2.8 and later. </p> + +%PARAM lmtp_dns_resolver_options + +<p> The LMTP-specific version of the smtp_dns_resolver_options +configuration parameter. See there for details. </p> + +<p> This feature is available in Postfix 2.8 and later. </p> + +%PARAM postscreen_dnsbl_threshold 1 + +<p> The inclusive lower bound for blocking a remote SMTP client, based on +its combined DNSBL score as defined with the postscreen_dnsbl_sites +parameter. </p> + +<p> This feature is available in Postfix 2.8. </p> + +%PARAM postscreen_dnsbl_whitelist_threshold 0 + +<p> Renamed to postscreen_dnsbl_allowlist_threshold in Postfix 3.6. </p> + +<p> This feature is available in Postfix 2.11 - 3.5. </p> + +%PARAM postscreen_dnsbl_allowlist_threshold 0 + +<p> Allow a remote SMTP client to skip "before" and "after 220 +greeting" protocol tests, based on its combined DNSBL score as +defined with the postscreen_dnsbl_sites parameter. </p> + +<p> Specify a negative value to enable this feature. When a client +passes the postscreen_dnsbl_allowlist_threshold without having +failed other tests, all pending or disabled tests are flagged as +completed with a time-to-live value equal to postscreen_dnsbl_ttl. +When a test was already completed, its time-to-live value is updated +if it was less than postscreen_dnsbl_ttl. </p> + +<p> This feature is available in Postfix 3.6 and later. </p> + +<p> Available as postscreen_dnsbl_whitelist_threshold in Postfix 2.11 +- 3.5. </p> + +%PARAM postscreen_command_count_limit 20 + +<p> The limit on the total number of commands per SMTP session for +postscreen(8)'s built-in SMTP protocol engine. This SMTP engine +defers or rejects all attempts to deliver mail, therefore there is +no need to enforce separate limits on the number of junk commands +and error commands. </p> + +<p> This feature is available in Postfix 2.8. </p> + +%PARAM postscreen_command_time_limit normal: 300s, overload: 10s + +<p> The time limit to read an entire command line with postscreen(8)'s +built-in SMTP protocol engine. </p> + +<p> This feature is available in Postfix 2.8. </p> + +%PARAM postscreen_dnsbl_ttl 1h + +<p> The amount of time that postscreen(8) will use the result from +a successful DNS-based reputation test before a client +IP address is required to pass that test again. </p> + +<p> Specify a non-zero time value (an integral value plus an optional +one-letter suffix that specifies the time unit). Time units: s +(seconds), m (minutes), h (hours), d (days), w (weeks). +The default time unit is h (hours). </p> + +<p> This feature is available in Postfix 2.8-3.0. It was +replaced by postscreen_dnsbl_max_ttl in Postfix 3.1. </p> + +%PARAM postscreen_dnsbl_min_ttl 60s + +<p> The minimum amount of time that postscreen(8) will use the +result from a successful DNS-based reputation test before a +client IP address is required to pass that test again. If the DNS +reply specifies a larger TTL value, that value will be used unless +it would be larger than postscreen_dnsbl_max_ttl. </p> + +<p> Specify a non-zero time value (an integral value plus an optional +one-letter suffix that specifies the time unit). Time units: s +(seconds), m (minutes), h (hours), d (days), w (weeks). +The default time unit is s (seconds). </p> + +<p> This feature is available in Postfix 3.1. </p> + +%PARAM postscreen_dnsbl_max_ttl ${postscreen_dnsbl_ttl?{$postscreen_dnsbl_ttl}:{1}}h + +<p> The maximum amount of time that postscreen(8) will use the +result from a successful DNS-based reputation test before a +client IP address is required to pass that test again. If the DNS +reply specifies a shorter TTL value, that value will be used unless +it would be smaller than postscreen_dnsbl_min_ttl. </p> + +<p> Specify a non-zero time value (an integral value plus an optional +one-letter suffix that specifies the time unit). Time units: s +(seconds), m (minutes), h (hours), d (days), w (weeks). +The default time unit is h (hours). </p> + +<p> This feature is available in Postfix 3.1. The default setting +is backwards-compatible with older Postfix versions. </p> + +%PARAM postscreen_pipelining_action enforce + +<p> The action that postscreen(8) takes when a remote SMTP client +sends +multiple commands instead of sending one command and waiting for +the server to respond. Specify one of the following: </p> + +<dl> + +<dt> <b>ignore</b> </dt> + +<dd> Ignore the failure of this test. Allow other tests to complete. +Do <i>not</i> repeat this test before the result from some +other test expires. +This option is useful for testing and collecting statistics +without blocking mail permanently. </dd> + +<dt> <b>enforce</b> </dt> + +<dd> Allow other tests to complete. Reject attempts to deliver mail +with a 550 SMTP reply, and log the helo/sender/recipient information. +Repeat this test the next time the client connects. </dd> + +<dt> <b>drop</b> </dt> + +<dd> Drop the connection immediately with a 521 SMTP reply. Repeat +this test the next time the client connects. </dd> + +</dl> + +<p> This feature is available in Postfix 2.8. </p> + +%PARAM postscreen_pipelining_ttl 30d + +<p> The amount of time that postscreen(8) will use the result from +a successful "pipelining" SMTP protocol test. During this time, the +client IP address is excluded from this test. The default is +long because a good client must disconnect after it passes the test, +before it can talk to a real Postfix SMTP server. </p> + +<p> Specify a non-zero time value (an integral value plus an optional +one-letter suffix that specifies the time unit). Time units: s +(seconds), m (minutes), h (hours), d (days), w (weeks). +The default time unit is d (days). </p> + +<p> This feature is available in Postfix 2.8. </p> + +%PARAM postscreen_pipelining_enable no + +<p> Enable "pipelining" SMTP protocol tests in the postscreen(8) +server. These tests are expensive: a good client must disconnect +after it passes the test, before it can talk to a real Postfix SMTP +server. </p> + +<p> This feature is available in Postfix 2.8. </p> + +%PARAM postscreen_watchdog_timeout 10s + +<p> How much time a postscreen(8) process may take to respond to +a remote SMTP client command or to perform a cache operation before it +is terminated by a built-in watchdog timer. This is a safety +mechanism that prevents postscreen(8) from becoming non-responsive +due to a bug in Postfix itself or in system software. To avoid +false alarms and unnecessary cache corruption this limit cannot be +set under 10s. </p> + +<p> Specify a non-zero time value (an integral value plus an optional +one-letter suffix that specifies the time unit). Time units: s +(seconds), m (minutes), h (hours), d (days), w (weeks). +The default time unit is s (seconds). </p> + +<p> This feature is available in Postfix 2.8. </p> + +%PARAM postscreen_helo_required $smtpd_helo_required + +<p> Require that a remote SMTP client sends HELO or EHLO before +commencing a MAIL transaction. </p> + +<p> This feature is available in Postfix 2.8. </p> + +%PARAM postscreen_forbidden_commands $smtpd_forbidden_commands + +<p> List of commands that the postscreen(8) server considers in +violation of the SMTP protocol. See smtpd_forbidden_commands for +syntax, and postscreen_non_smtp_command_action for possible actions. +</p> + +<p> This feature is available in Postfix 2.8. </p> + +%PARAM postscreen_disable_vrfy_command $disable_vrfy_command + +<p> Disable the SMTP VRFY command in the postscreen(8) daemon. See +disable_vrfy_command for details. </p> + +<p> This feature is available in Postfix 2.8. </p> + +%PARAM postscreen_non_smtp_command_action drop + +<p> The action that postscreen(8) takes when a remote SMTP client sends +non-SMTP commands as specified with the postscreen_forbidden_commands +parameter. Specify one of the following: </p> + +<dl> + +<dt> <b>ignore</b> </dt> + +<dd> Ignore the failure of this test. Allow other tests to complete. +Do <i>not</i> repeat this test before the result from some +other test expires. +This option is useful for testing and collecting statistics +without blocking mail permanently. </dd> + +<dt> <b>enforce</b> </dt> + +<dd> Allow other tests to complete. Reject attempts to deliver mail +with a 550 SMTP reply, and log the helo/sender/recipient information. +Repeat this test the next time the client connects. </dd> + +<dt> <b>drop</b> </dt> + +<dd> Drop the connection immediately with a 521 SMTP reply. Repeat +this test the next time the client connects. This action is the +same as with the Postfix SMTP server's smtpd_forbidden_commands +feature. </dd> + +</dl> + +<p> This feature is available in Postfix 2.8. </p> + +%PARAM postscreen_non_smtp_command_ttl 30d + +<p> The amount of time that postscreen(8) will use the result from +a successful "non_smtp_command" SMTP protocol test. During this +time, the client IP address is excluded from this test. The default +is long because a client must disconnect after it passes the test, +before it can talk to a real Postfix SMTP server. </p> + +<p> Specify a non-zero time value (an integral value plus an optional +one-letter suffix that specifies the time unit). Time units: s +(seconds), m (minutes), h (hours), d (days), w (weeks). +The default time unit is d (days). </p> + +<p> This feature is available in Postfix 2.8. </p> + +%PARAM postscreen_non_smtp_command_enable no + +<p> Enable "non-SMTP command" tests in the postscreen(8) server. These +tests are expensive: a client must disconnect after it passes the +test, before it can talk to a real Postfix SMTP server. </p> + +<p> This feature is available in Postfix 2.8. </p> + +%PARAM postscreen_dnsbl_reply_map + +<p> A mapping from an actual DNSBL domain name which includes a secret +password, to the DNSBL domain name that postscreen will reply with +when it rejects mail. When no mapping is found, the actual DNSBL +domain will be used. </p> + +<p> For maximal stability it is best to use a file that is read +into memory such as pcre:, regexp: or texthash: (texthash: is similar +to hash:, except a) there is no need to run postmap(1) before the +file can be used, and b) texthash: does not detect changes after +the file is read). </p> + +<p> Example: </p> + +<pre> +/etc/postfix/main.cf: + postscreen_dnsbl_reply_map = texthash:/etc/postfix/dnsbl_reply +</pre> + +<pre> +/etc/postfix/dnsbl_reply: + secret.zen.spamhaus.org zen.spamhaus.org +</pre> + +<p> This feature is available in Postfix 2.8. </p> + +%PARAM postscreen_dnsbl_timeout 10s + +<p> The time limit for DNSBL or DNSWL lookups. This is separate from +the timeouts in the dnsblog(8) daemon which are defined by system +resolver(3) routines. </p> + +<p> Specify a non-zero time value (an integral value plus an optional +one-letter suffix that specifies the time unit). Time units: s +(seconds), m (minutes), h (hours), d (days), w (weeks). +The default time unit is s (seconds). </p> + +<p> This feature is available in Postfix 3.0. </p> +%PARAM postscreen_bare_newline_action ignore + +<p> The action that postscreen(8) takes when a remote SMTP client sends +a bare newline character, that is, a newline not preceded by carriage +return. Specify one of the following: </p> + +<dl> + +<dt> <b>ignore</b> </dt> + +<dd> Ignore the failure of this test. Allow other tests to complete. +Do <i>not</i> repeat this test before the result from some +other test expires. +This option is useful for testing and collecting statistics +without blocking mail permanently. </dd> + +<dt> <b>enforce</b> </dt> + +<dd> Allow other tests to complete. Reject attempts to deliver mail +with a 550 SMTP reply, and log the helo/sender/recipient information. +Repeat this test the next time the client connects. </dd> + +<dt> <b>drop</b> </dt> + +<dd> Drop the connection immediately with a 521 SMTP reply. Repeat +this test the next time the client connects. </dd> + +</dl> + +<p> This feature is available in Postfix 2.8. </p> + +%PARAM postscreen_bare_newline_ttl 30d + +<p> The amount of time that postscreen(8) will use the result from +a successful "bare newline" SMTP protocol test. During this +time, the client IP address is excluded from this test. The default +is long because a remote SMTP client must disconnect after it passes +the test, +before it can talk to a real Postfix SMTP server. </p> + +<p> Specify a non-zero time value (an integral value plus an optional +one-letter suffix that specifies the time unit). Time units: s +(seconds), m (minutes), h (hours), d (days), w (weeks). +The default time unit is d (days). </p> + +<p> This feature is available in Postfix 2.8. </p> + +%PARAM postscreen_bare_newline_enable no + +<p> Enable "bare newline" SMTP protocol tests in the postscreen(8) +server. These tests are expensive: a remote SMTP client must +disconnect after +it passes the test, before it can talk to a real Postfix SMTP server. +</p> + +<p> This feature is available in Postfix 2.8. </p> + +%PARAM postscreen_client_connection_count_limit $smtpd_client_connection_count_limit + +<p> How many simultaneous connections any remote SMTP client is +allowed to have +with the postscreen(8) daemon. By default, this limit is the same +as with the Postfix SMTP server. Note that the triage process can +take several seconds, with the time spent in postscreen_greet_wait +delay, and with the time spent talking to the postscreen(8) built-in +dummy SMTP protocol engine. </p> + +<p> This feature is available in Postfix 2.8. </p> + +%PARAM dnsblog_reply_delay 0s + +<p> A debugging aid to artificially delay DNS responses. </p> + +<p> This feature is available in Postfix 2.8. </p> + +%PARAM reset_owner_alias no + +<p> Reset the local(8) delivery agent's idea of the owner-alias +attribute, when delivering mail to a child alias that does not have +its own owner alias. </p> + +<p> This feature is available in Postfix 2.8 and later. With older +Postfix releases, the behavior is as if this parameter is set to +"yes". </p> + +<p> As documented in aliases(5), when an alias <i>name</i> has a +companion alias named owner-<i>name</i>, this will replace the +envelope sender address, so that delivery errors will be +reported to the owner alias instead of the sender. This configuration +is recommended for mailing lists. <p> + +<p> A less known property of the owner alias is that it also forces +the local(8) delivery agent to write local and remote addresses +from alias expansion to a new queue file, instead of attempting to +deliver mail to local addresses as soon as they come out of alias +expansion. </p> + +<p> Writing local addresses from alias expansion to a new queue +file allows for robust handling of temporary delivery errors: errors +with one local member have no effect on deliveries to other members +of the list. On the other hand, delivery to local addresses as +soon as they come out of alias expansion is fragile: a temporary +error with one local address from alias expansion will cause the +entire alias to be expanded repeatedly until the error goes away, +or until the message expires in the queue. In that case, a problem +with one list member results in multiple message deliveries to other +list members. </p> + +<p> The default behavior of Postfix 2.8 and later is to keep the +owner-alias attribute of the parent alias, when delivering mail to +a child alias that does not have its own owner alias. Then, local +addresses from that child alias will be written to a new queue file, +and a temporary error with one local address will not affect delivery +to other mailing list members. </p> + +<p> Unfortunately, older Postfix releases reset the owner-alias +attribute when delivering mail to a child alias that does not have +its own owner alias. To be precise, this resets only the decision +to create a new queue file, not the decision to override the envelope +sender address. The local(8) delivery agent then attempts to +deliver local addresses as soon as they come out of child alias +expansion. If delivery to any address from child alias expansion +fails with a temporary error condition, the entire mailing list may +be expanded repeatedly until the mail expires in the queue, resulting +in multiple deliveries of the same message to mailing list members. +</p> + +%PARAM qmgr_ipc_timeout 60s + +<p> The time limit for the queue manager to send or receive information +over an internal communication channel. The purpose is to break +out of deadlock situations. If the time limit is exceeded the +software either retries or aborts the operation. </p> + +<p> Specify a non-zero time value (an integral value plus an optional +one-letter suffix that specifies the time unit). Time units: s +(seconds), m (minutes), h (hours), d (days), w (weeks). +The default time unit is s (seconds). </p> + +<p> This feature is available in Postfix 2.8 and later. </p> + +%PARAM qmgr_daemon_timeout 1000s + +<p> How much time a Postfix queue manager process may take to handle +a request before it is terminated by a built-in watchdog timer. +</p> + +<p> Specify a non-zero time value (an integral value plus an optional +one-letter suffix that specifies the time unit). Time units: s +(seconds), m (minutes), h (hours), d (days), w (weeks). +The default time unit is s (seconds). </p> + +<p> This feature is available in Postfix 2.8 and later. </p> + +%PARAM tls_preempt_cipherlist no + +<p> With SSLv3 and later, use the Postfix SMTP server's cipher +preference order instead of the remote client's cipher preference +order. </p> + +<p> By default, the OpenSSL server selects the client's most preferred +cipher that the server supports. With SSLv3 and later, the server may +choose its own most preferred cipher that is supported (offered) by +the client. Setting "tls_preempt_cipherlist = yes" enables server cipher +preferences. </p> + +<p> While server cipher selection may in some cases lead to a more secure +or performant cipher choice, there is some risk of interoperability +issues. In the past, some SSL clients have listed lower priority ciphers +that they did not implement correctly. If the server chooses a cipher +that the client prefers less, it may select a cipher whose client +implementation is flawed. Most notably Windows 2003 Microsoft +Exchange servers have flawed implementations of DES-CBC3-SHA, which +OpenSSL considers stronger than RC4-SHA. Enabling server cipher-suite +selection may create interoperability issues with Windows 2003 +Microsoft Exchange clients. </p> + +<p> This feature is available in Postfix 2.8 and later, in combination +with OpenSSL 0.9.7 and later. </p> + +%PARAM tls_disable_workarounds see "postconf -d" output + +<p> List or bit-mask of OpenSSL bug work-arounds to disable. </p> + +<p> The OpenSSL toolkit includes a set of work-arounds for buggy SSL/TLS +implementations. Applications, such as Postfix, that want to maximize +interoperability ask the OpenSSL library to enable the full set of +recommended work-arounds. </p> + +<p> From time to time, it is discovered that a work-around creates a +security issue, and should no longer be used. If upgrading OpenSSL +to a fixed version is not an option or an upgrade is not available +in a timely manner, or in closed environments where no buggy clients +or servers exist, it may be appropriate to disable some or all of the +OpenSSL interoperability work-arounds. This parameter specifies which +bug work-arounds to disable. </p> + +<p> If the value of the parameter is a hexadecimal long integer starting +with "0x", the bug work-arounds corresponding to the bits specified in +its value are removed from the <b>SSL_OP_ALL</b> work-around bit-mask +(see openssl/ssl.h and SSL_CTX_set_options(3)). You can specify more +bits than are present in SSL_OP_ALL, excess bits are ignored. Specifying +0xFFFFFFFF disables all bug-workarounds on a 32-bit system. This should +also be sufficient on 64-bit systems, until OpenSSL abandons support +for 32-bit systems and starts using the high 32 bits of a 64-bit +bug-workaround mask. </p> + +<p> Otherwise, the parameter is a white-space or comma separated list +of specific named bug work-arounds chosen from the list below. It +is possible that your OpenSSL version includes new bug work-arounds +added after your Postfix source code was last updated, in that case +you can only disable one of these via the hexadecimal syntax above. </p> + +<dl> + +<dt><b>CRYPTOPRO_TLSEXT_BUG</b></dt> <dd>New with GOST support in +OpenSSL 1.0.0.</dd> + +<dt><b>DONT_INSERT_EMPTY_FRAGMENTS</b></dt> <dd>See +SSL_CTX_set_options(3)</dd> + +<dt><b>LEGACY_SERVER_CONNECT</b></dt> <dd>See SSL_CTX_set_options(3)</dd> + +<dt><b>MICROSOFT_BIG_SSLV3_BUFFER</b></dt> <dd>See +SSL_CTX_set_options(3)</dd> + +<dt><b>MICROSOFT_SESS_ID_BUG</b></dt> <dd>See SSL_CTX_set_options(3)</dd> + +<dt><b>MSIE_SSLV2_RSA_PADDING</b></dt> <dd> also aliased as +<b>CVE-2005-2969</b>. Postfix 2.8 disables this work-around by +default with OpenSSL versions that may predate the fix. Fixed in +OpenSSL 0.9.7h and OpenSSL 0.9.8a.</dd> + +<dt><b>NETSCAPE_CHALLENGE_BUG</b></dt> <dd>See SSL_CTX_set_options(3)</dd> + +<dt><b>NETSCAPE_REUSE_CIPHER_CHANGE_BUG</b></dt> <dd> also aliased +as <b>CVE-2010-4180</b>. Postfix 2.8 disables this work-around by +default with OpenSSL versions that may predate the fix. Fixed in +OpenSSL 0.9.8q and OpenSSL 1.0.0c.</dd> + +<dt><b>SSLEAY_080_CLIENT_DH_BUG</b></dt> <dd>See +SSL_CTX_set_options(3)</dd> + +<dt><b>SSLREF2_REUSE_CERT_TYPE_BUG</b></dt> <dd>See +SSL_CTX_set_options(3)</dd> + +<dt><b>TLS_BLOCK_PADDING_BUG</b></dt> <dd>See SSL_CTX_set_options(3)</dd> + +<dt><b>TLS_D5_BUG</b></dt> <dd>See SSL_CTX_set_options(3)</dd> + +<dt><b>TLS_ROLLBACK_BUG</b></dt> <dd>See SSL_CTX_set_options(3). +This is disabled in OpenSSL 0.9.7 and later. Nobody should still +be using 0.9.6! </dd> + +<dt><b>TLSEXT_PADDING</b></dt><dd>Postfix ≥ 3.4. See SSL_CTX_set_options(3).</dd> + +</dl> + +<p> This feature is available in Postfix 2.8 and later. </p> + +%PARAM tls_legacy_public_key_fingerprints no + +<p> A temporary migration aid for sites that use certificate +<i>public-key</i> fingerprints with Postfix 2.9.0..2.9.5, which use +an incorrect algorithm. This parameter has no effect on the certificate +fingerprint support that is available since Postfix 2.2. </p> + +<p> Specify "tls_legacy_public_key_fingerprints = yes" temporarily, +pending a migration from configuration files with incorrect Postfix +2.9.0..2.9.5 certificate public-key finger prints, to the correct +fingerprints used by Postfix 2.9.6 and later. To compute the correct +certificate public-key fingerprints, see TLS_README. </p> + +<p> This feature is available in Postfix 2.9.6 and later. </p> + +%PARAM tlsproxy_watchdog_timeout 10s + +<p> How much time a tlsproxy(8) process may take to process local +or remote I/O before it is terminated by a built-in watchdog timer. +This is a safety mechanism that prevents tlsproxy(8) from becoming +non-responsive due to a bug in Postfix itself or in system software. +To avoid false alarms and unnecessary cache corruption this limit +cannot be set under 10s. </p> + +<p> Specify a non-zero time value (an integral value plus an optional +one-letter suffix that specifies the time unit). Time units: s +(seconds), m (minutes), h (hours), d (days), w (weeks). +The default time unit is s (seconds). </p> + +<p> This feature is available in Postfix 2.8 and later </p> + +%PARAM postscreen_discard_ehlo_keywords $smtpd_discard_ehlo_keywords + +<p> A case insensitive list of EHLO keywords (pipelining, starttls, +auth, etc.) that the postscreen(8) server will not send in the EHLO +response to a remote SMTP client. See smtpd_discard_ehlo_keywords +for details. </p> + +<p> This feature is available in Postfix 2.8 and later. </p> + +%PARAM postscreen_discard_ehlo_keyword_address_maps $smtpd_discard_ehlo_keyword_address_maps + +<p> Lookup tables, indexed by the remote SMTP client address, with +case insensitive lists of EHLO keywords (pipelining, starttls, auth, +etc.) that the postscreen(8) server will not send in the EHLO response +to a remote SMTP client. See smtpd_discard_ehlo_keywords for details. +The table is not searched by hostname for robustness reasons. </p> + +<p> This feature is available in Postfix 2.8 and later. </p> + +%PARAM postscreen_use_tls $smtpd_use_tls + +<p> Opportunistic TLS: announce STARTTLS support to remote SMTP clients, +but do not require that clients use TLS encryption. </p> + +<p> This feature is available in Postfix 2.8 and later. +Preferably, use postscreen_tls_security_level instead. </p> + +%PARAM postscreen_enforce_tls $smtpd_enforce_tls + +<p> Mandatory TLS: announce STARTTLS support to remote SMTP clients, and +require that clients use TLS encryption. See smtpd_postscreen_enforce_tls +for details. </p> + +<p> This feature is available in Postfix 2.8 and later. +Preferably, use postscreen_tls_security_level instead. </p> + +%PARAM postscreen_tls_security_level $smtpd_tls_security_level + +<p> The SMTP TLS security level for the postscreen(8) server; when +a non-empty value is specified, this overrides the obsolete parameters +postscreen_use_tls and postscreen_enforce_tls. See smtpd_tls_security_level +for details. </p> + +<p> This feature is available in Postfix 2.8 and later. </p> + +%PARAM tlsproxy_enforce_tls $smtpd_enforce_tls + +<p> Mandatory TLS: announce STARTTLS support to remote SMTP clients, and +require that clients use TLS encryption. See smtpd_enforce_tls for +further details. Use tlsproxy_tls_security_level instead. </p> + +<p> This feature is available in Postfix 2.8 and later. </p> + +%PARAM tlsproxy_tls_CAfile $smtpd_tls_CAfile + +<p> A file containing (PEM format) CA certificates of root CAs +trusted to sign either remote SMTP client certificates or intermediate +CA certificates. See smtpd_tls_CAfile for further details. </p> + +<p> This feature is available in Postfix 2.8 and later. </p> + +%PARAM tlsproxy_tls_CApath $smtpd_tls_CApath + +<p> A directory containing (PEM format) CA certificates of root CAs +trusted to sign either remote SMTP client certificates or intermediate +CA certificates. See smtpd_tls_CApath for further details. </p> + +<p> This feature is available in Postfix 2.8 and later. </p> + +%PARAM tlsproxy_tls_always_issue_session_ids $smtpd_tls_always_issue_session_ids + +<p> Force the Postfix tlsproxy(8) server to issue a TLS session id, +even when TLS session caching is turned off. See +smtpd_tls_always_issue_session_ids for further details. </p> + +<p> This feature is available in Postfix 2.8 and later. </p> + +%PARAM tlsproxy_tls_ask_ccert $smtpd_tls_ask_ccert + +<p> Ask a remote SMTP client for a client certificate. See +smtpd_tls_ask_ccert for further details. </p> + +<p> This feature is available in Postfix 2.8 and later. </p> + +%PARAM tlsproxy_tls_ccert_verifydepth $smtpd_tls_ccert_verifydepth + +<p> The verification depth for remote SMTP client certificates. A +depth of 1 is sufficient if the issuing CA is listed in a local CA +file. See smtpd_tls_ccert_verifydepth for further details. </p> + +<p> This feature is available in Postfix 2.8 and later. </p> + +%PARAM tlsproxy_tls_cert_file $smtpd_tls_cert_file + +<p> File with the Postfix tlsproxy(8) server RSA certificate in PEM +format. This file may also contain the Postfix tlsproxy(8) server +private RSA key. See smtpd_tls_cert_file for further details. With +Postfix ≥ 3.4 the preferred way to configure tlsproxy server keys and +certificates is via the "tlsproxy_tls_chain_files" parameter. </p> + +<p> This feature is available in Postfix 2.8 and later. </p> + +%PARAM tlsproxy_tls_ciphers $smtpd_tls_ciphers + +<p> The minimum TLS cipher grade that the Postfix tlsproxy(8) server +will use with opportunistic TLS encryption. See smtpd_tls_ciphers +for further details. </p> + +<p> This feature is available in Postfix 2.8 and later. </p> + +%PARAM tlsproxy_tls_dcert_file $smtpd_tls_dcert_file + +<p> File with the Postfix tlsproxy(8) server DSA certificate in PEM +format. This file may also contain the Postfix tlsproxy(8) server +private DSA key. DSA is obsolete and should not be used. See +smtpd_tls_dcert_file for further details. </p> + +<p> This feature is available in Postfix 2.8 and later. </p> + +%PARAM tlsproxy_tls_dh1024_param_file $smtpd_tls_dh1024_param_file + +<p> File with DH parameters that the Postfix tlsproxy(8) server +should use with non-export EDH ciphers. See smtpd_tls_dh1024_param_file +for further details. </p> + +<p> This feature is available in Postfix 2.8 and later. </p> + +%PARAM tlsproxy_tls_dh512_param_file $smtpd_tls_dh512_param_file + +<p> File with DH parameters that the Postfix tlsproxy(8) server +should use with export-grade EDH ciphers. See smtpd_tls_dh512_param_file +for further details. The default SMTP server cipher grade is +"medium" with Postfix releases after the middle of 2015, and as a +result export-grade cipher suites are by default not used. </p> + +<p> With Postfix ≥ 3.6 export-grade Diffie-Hellman key exchange +is no longer supported, and this parameter is silently ignored. </p> + +<p> This feature is available in Postfix 2.8 and later. </p> + +%PARAM tlsproxy_tls_dkey_file $smtpd_tls_dkey_file + +<p> File with the Postfix tlsproxy(8) server DSA private key in PEM +format. This file may be combined with the Postfix tlsproxy(8) server +DSA certificate file specified with $smtpd_tls_dcert_file. DSA is +obsolete and should not be used. See smtpd_tls_dkey_file for further +details. </p> + +<p> This feature is available in Postfix 2.8 and later. </p> + +%PARAM tlsproxy_tls_eccert_file $smtpd_tls_eccert_file + +<p> File with the Postfix tlsproxy(8) server ECDSA certificate in PEM +format. This file may also contain the Postfix tlsproxy(8) server +private ECDSA key. See smtpd_tls_eccert_file for further details. With +Postfix ≥ 3.4 the preferred way to configure tlsproxy server keys and +certificates is via the "tlsproxy_tls_chain_files" parameter. </p> + +<p> This feature is available in Postfix 2.8 and later. </p> + +%PARAM tlsproxy_tls_eckey_file $smtpd_tls_eckey_file + +<p> File with the Postfix tlsproxy(8) server ECDSA private key in PEM +format. This file may be combined with the Postfix tlsproxy(8) server +ECDSA certificate file specified with $smtpd_tls_eccert_file. See +smtpd_tls_eckey_file for further details. With Postfix ≥ 3.4 the +preferred way to configure tlsproxy server keys and certificates is via +the "tlsproxy_tls_chain_files" parameter. </p> + +<p> This feature is available in Postfix 2.8 and later. </p> + +%PARAM tlsproxy_tls_eecdh_grade $smtpd_tls_eecdh_grade + +<p> The Postfix tlsproxy(8) server security grade for ephemeral +elliptic-curve Diffie-Hellman (EECDH) key exchange. See +smtpd_tls_eecdh_grade for further details. </p> + +<p> This feature is available in Postfix 2.8 and later. </p> + +%PARAM tlsproxy_tls_exclude_ciphers $smtpd_tls_exclude_ciphers + +<p> List of ciphers or cipher types to exclude from the tlsproxy(8) +server cipher list at all TLS security levels. See +smtpd_tls_exclude_ciphers for further details. </p> + +<p> This feature is available in Postfix 2.8 and later. </p> + +%PARAM tlsproxy_tls_fingerprint_digest $smtpd_tls_fingerprint_digest + +<p> The message digest algorithm to construct remote SMTP +client-certificate +fingerprints. See smtpd_tls_fingerprint_digest for further details. +</p> + +<p> This feature is available in Postfix 2.8 and later. </p> + +%PARAM tlsproxy_tls_key_file $smtpd_tls_key_file + +<p> File with the Postfix tlsproxy(8) server RSA private key in PEM +format. This file may be combined with the Postfix tlsproxy(8) server +RSA certificate file specified with $smtpd_tls_cert_file. See +smtpd_tls_key_file for further details. With Postfix ≥ 3.4 the +preferred way to configure tlsproxy server keys and certificates is via +the "tlsproxy_tls_chain_files" parameter. </p> + +<p> This feature is available in Postfix 2.8 and later. </p> + +%PARAM tlsproxy_tls_loglevel $smtpd_tls_loglevel + +<p> Enable additional Postfix tlsproxy(8) server logging of TLS +activity. Each logging level also includes the information that +is logged at a lower logging level. See smtpd_tls_loglevel for +further details. </p> + +<p> This feature is available in Postfix 2.8 and later. </p> + +%PARAM tlsproxy_tls_mandatory_ciphers $smtpd_tls_mandatory_ciphers + +<p> The minimum TLS cipher grade that the Postfix tlsproxy(8) server +will use with mandatory TLS encryption. See smtpd_tls_mandatory_ciphers +for further details. </p> + +<p> This feature is available in Postfix 2.8 and later. </p> + +%PARAM tlsproxy_tls_mandatory_exclude_ciphers $smtpd_tls_mandatory_exclude_ciphers + +<p> Additional list of ciphers or cipher types to exclude from the +tlsproxy(8) server cipher list at mandatory TLS security levels. +See smtpd_tls_mandatory_exclude_ciphers for further details. </p> + +<p> This feature is available in Postfix 2.8 and later. </p> + +%PARAM tlsproxy_tls_mandatory_protocols $smtpd_tls_mandatory_protocols + +<p> The SSL/TLS protocols accepted by the Postfix tlsproxy(8) server +with mandatory TLS encryption. If the list is empty, the server +supports all available SSL/TLS protocol versions. See +smtpd_tls_mandatory_protocols for further details. </p> + +<p> This feature is available in Postfix 2.8 and later. </p> + +%PARAM tlsproxy_tls_protocols $smtpd_tls_protocols + +<p> List of TLS protocols that the Postfix tlsproxy(8) server will +exclude or include with opportunistic TLS encryption. See +smtpd_tls_protocols for further details. </p> + +<p> This feature is available in Postfix 2.8 and later. </p> + +%PARAM tlsproxy_tls_req_ccert $smtpd_tls_req_ccert + +<p> With mandatory TLS encryption, require a trusted remote SMTP +client certificate in order to allow TLS connections to proceed. +See smtpd_tls_req_ccert for further details. </p> + +<p> This feature is available in Postfix 2.8 and later. </p> + +%PARAM tlsproxy_tls_security_level $smtpd_tls_security_level + +<p> The SMTP TLS security level for the Postfix tlsproxy(8) server; +when a non-empty value is specified, this overrides the obsolete +parameters smtpd_use_tls and smtpd_enforce_tls. See +smtpd_tls_security_level for further details. </p> + +<p> This feature is available in Postfix 2.8 and later. </p> + +%PARAM tlsproxy_tls_session_cache_timeout $smtpd_tls_session_cache_timeout + +<p> Obsolete expiration time of Postfix tlsproxy(8) server TLS session +cache information. Since the cache is shared with smtpd(8) and managed +by tlsmgr(8), there is only one expiration time for the SMTP server cache +shared by all three services, namely smtpd_tls_session_cache_timeout. </p> + +<p> This feature is available in Postfix 2.8 and later. </p> + +%PARAM tlsproxy_use_tls $smtpd_use_tls + +<p> Opportunistic TLS: announce STARTTLS support to remote SMTP clients, +but do not require that clients use TLS encryption. See smtpd_use_tls +for further details. Use tlsproxy_tls_security_level instead. </p> + +<p> This feature is available in Postfix 2.8 and later. </p> + +%PARAM smtpd_reject_footer + +<p> Optional information that is appended after each Postfix SMTP +server +4XX or 5XX response. </p> + +<p> The following example uses "\c" at the start of the template +(supported in Postfix 2.10 and later) to suppress the line break +between the reply text and the footer text. With earlier Postfix +versions, the footer text always begins on a new line, and the "\c" +is output literally. </p> + +<pre> +/etc/postfix/main.cf: + smtpd_reject_footer = \c. For assistance, call 800-555-0101. + Please provide the following information in your problem report: + time ($localtime), client ($client_address) and server + ($server_name). +</pre> + +<p> Server response: </p> + +<pre> + 550-5.5.1 <user@example> Recipient address rejected: User + unknown. For assistance, call 800-555-0101. Please provide the + following information in your problem report: time (Jan 4 15:42:00), + client (192.168.1.248) and server (mail1.example.com). +</pre> + +<p> Note: the above text is meant to make it easier to find the +Postfix logfile records for a failed SMTP session. The text itself +is not logged to the Postfix SMTP server's maillog file. </p> + +<p> Be sure to keep the text as short as possible. Long text may +be truncated before it is logged to the remote SMTP client's maillog +file, or before it is returned to the sender in a delivery status +notification. </p> + +<p> The template text is not subject to Postfix configuration +parameter $name expansion. Instead, this feature supports a limited +number of $name attributes in the footer text. These attributes are +replaced with their current value for the SMTP session. </p> + +<p> Note: specify $$name in footer text that is looked up from +regexp: or pcre:-based smtpd_reject_footer_maps, otherwise the +Postfix server will not use the footer text and will log a warning +instead. </p> + +<dl> + +<dt> <b>client_address</b> </dt> <dd> The Client IP address that +is logged in the maillog file. </dd> + +<dt> <b>client_port</b> </dt> <dd> The client TCP port that is +logged in the maillog file. </dd> + +<dt> <b>localtime</b> </dt> <dd> The server local time (Mmm dd +hh:mm:ss) that is logged in the maillog file. </dd> + +<dt> <b>server_name</b> </dt> <dd> The server's myhostname value. +This attribute is made available for sites with multiple MTAs +(perhaps behind a load-balancer), where the server name can help +the server support team to quickly find the right log files. </dd> + +</dl> + +<p> Notes: </p> + +<ul> + +<li> <p> NOT SUPPORTED are other attributes such as sender, recipient, +or main.cf parameters. </p> + +<li> <p> For safety reasons, text that does not match +$smtpd_expansion_filter is censored. </p> + +</ul> + +<p> This feature supports the two-character sequence \n as a request +for a line break in the footer text. Postfix automatically inserts +after each line break the three-digit SMTP reply code (and optional +enhanced status code) from the original Postfix reject message. +</p> + +<p> To work around mail software that mis-handles multi-line replies, +specify the two-character sequence \c at the start of the template. +This suppresses the line break between the reply text and the footer +text (Postfix 2.10 and later). </p> + +<p> This feature is available in Postfix 2.8 and later. </p> + +%PARAM smtpd_reject_footer_maps + +<p> Lookup tables, indexed by the complete Postfix SMTP server 4xx or +5xx response, with reject footer templates. See smtpd_reject_footer +for details. </p> + +<p> +Specify zero or more "type:name" lookup tables, separated by +whitespace or comma. Tables will be searched in the specified order +until a match is found. +</p> + +<p> This feature is available in Postfix 3.4 and later. </p> + +%PARAM postscreen_expansion_filter see "postconf -d" output + +<p> List of characters that are permitted in postscreen_reject_footer +attribute expansions. See smtpd_expansion_filter for further +details. </p> + +<p> This feature is available in Postfix 2.8 and later. </p> + +%PARAM postscreen_reject_footer $smtpd_reject_footer + +<p> Optional information that is appended after a 4XX or 5XX +postscreen(8) server +response. See smtpd_reject_footer for further details. </p> + +<p> This feature is available in Postfix 2.8 and later. </p> + +%PARAM postscreen_reject_footer_maps $smtpd_reject_footer_maps + +<p> Optional lookup table for information that is appended after a 4XX +or 5XX postscreen(8) server response. See smtpd_reject_footer_maps for +further details. </p> + +<p> This feature is available in Postfix 3.4 and later. </p> + +%PARAM postscreen_command_filter $smtpd_command_filter + +<p> A mechanism to transform commands from remote SMTP clients. +See smtpd_command_filter for further details. </p> + +<p> This feature is available in Postfix 2.8 and later. </p> + +%PARAM dnsblog_service_name dnsblog + +<p> The name of the dnsblog(8) service entry in master.cf. This +service performs DNS allow/denylist lookups. </p> + +<p> This feature is available in Postfix 2.8 and later. </p> + +%PARAM tlsproxy_service_name tlsproxy + +<p> The name of the tlsproxy(8) service entry in master.cf. This +service performs plaintext <=> TLS ciphertext conversion. <p> + +<p> This feature is available in Postfix 2.8 and later. </p> + +%PARAM smtpd_per_record_deadline normal: no, overload: yes + +<p> Change the behavior of the smtpd_timeout and smtpd_starttls_timeout +time limits, from a +time limit per read or write system call, to a time limit to send +or receive a complete record (an SMTP command line, SMTP response +line, SMTP message content line, or TLS protocol message). This +limits the impact from hostile peers that trickle data one byte at +a time. </p> + +<p> Note: when per-record deadlines are enabled, a short timeout +may cause problems with TLS over very slow network connections. +The reasons are that a TLS protocol message can be up to 16 kbytes +long (with TLSv1), and that an entire TLS protocol message must be +sent or received within the per-record deadline. </p> + +<p> This feature is available in Postfix 2.9-3.6. With older +Postfix releases, the behavior is as if this parameter is set to +"no". Postfix 3.7 and later use smtpd_per_request_deadline. </p> + +%PARAM smtp_per_record_deadline no + +<p> Change the behavior of the smtp_*_timeout time limits, from a +time limit per read or write system call, to a time limit to send +or receive a complete record (an SMTP command line, SMTP response +line, SMTP message content line, or TLS protocol message). This +limits the impact from hostile peers that trickle data one byte at +a time. </p> + +<p> Note: when per-record deadlines are enabled, a short timeout +may cause problems with TLS over very slow network connections. +The reasons are that a TLS protocol message can be up to 16 kbytes +long (with TLSv1), and that an entire TLS protocol message must be +sent or received within the per-record deadline. </p> + +<p> This feature is available in Postfix 2.9-3.6. With older +Postfix releases, the behavior is as if this parameter is set to +"no". Postfix 3.7 and later use smtp_per_request_deadline. </p> + +%PARAM lmtp_per_record_deadline no + +<p> The LMTP-specific version of the smtp_per_record_deadline +configuration parameter. See there for details. </p> + +<p> This feature is available in Postfix 2.9 and later. </p> + +%PARAM postscreen_whitelist_interfaces static:all + +<p> Renamed to postscreen_allowlist_interfaces in Postfix 3.6. </p> + +<p> This feature is available in Postfix 2.9 - 3.5. </p> + +%PARAM postscreen_allowlist_interfaces static:all + +<p> A list of local postscreen(8) server IP addresses where a +non-allowlisted remote SMTP client can obtain postscreen(8)'s temporary +allowlist status. This status is required before the client can +talk to a Postfix SMTP server process. By default, a client can +obtain postscreen(8)'s allowlist status on any local postscreen(8) +server IP address. </p> + +<p> When postscreen(8) listens on both primary and backup MX +addresses, the postscreen_allowlist_interfaces parameter can be +configured to give the temporary allowlist status only when a client +connects to a primary MX address. Once a client is allowlisted it +can talk to a Postfix SMTP server on any address. Thus, clients +that connect only to backup MX addresses will never become allowlisted, +and will never be allowed to talk to a Postfix SMTP server process. +</p> + +<p> Specify a list of network addresses or network/netmask patterns, +separated by commas and/or whitespace. The netmask specifies the +number of bits in the network part of a host address. Continue long +lines by starting the next line with whitespace. </p> + +<p> You can also specify "/file/name" or "type:table" patterns. A +"/file/name" pattern is replaced by its contents; a "type:table" +lookup table is matched when a table entry matches a lookup string +(the lookup result is ignored). </p> + +<p> The list is matched left to right, and the search stops on the +first match. Specify "!pattern" to exclude an address or network +block from the list. </p> + +<p> Note: IP version 6 address information must be specified inside +[] in the postscreen_allowlist_interfaces value, and in files +specified with "/file/name". IP version 6 addresses contain the +":" character, and would otherwise be confused with a "type:table" +pattern. </p> + +<p> Example: </p> + +<pre> +/etc/postfix/main.cf: + # Don't allowlist connections to the backup IP address. + # Postfix < 3.6 use postscreen_whitelist_interfaces. + postscreen_allowlist_interfaces = !168.100.189.8, static:all +</pre> + +<p> This feature is available in Postfix 3.6 and later. </p> + +<p> Available as postscreen_whitelist_interfaces in Postfix 2.9 - 3.5. </p> + +%PARAM postscreen_upstream_proxy_protocol + +<p> The name of the proxy protocol used by an optional before-postscreen +proxy agent. When a proxy agent is used, this protocol conveys local +and remote address and port information. Specify +"postscreen_upstream_proxy_protocol = haproxy" to enable the haproxy +protocol; version 2 is supported with Postfix 3.5 and later. <p> + +<p> This feature is available in Postfix 2.10 and later. </p> + +%PARAM postscreen_upstream_proxy_timeout 5s + +<p> The time limit for the proxy protocol specified with the +postscreen_upstream_proxy_protocol parameter. </p> + +<p> This feature is available in Postfix 2.10 and later. </p> + +%PARAM smtpd_upstream_proxy_protocol + +<p> The name of the proxy protocol used by an optional before-smtpd +proxy agent. When a proxy agent is used, this protocol conveys local +and remote address and port information. Specify +"smtpd_upstream_proxy_protocol = haproxy" to enable the haproxy +protocol; version 2 is supported with Postfix 3.5 and later. </p> + +<p> NOTE: To use the nginx proxy with smtpd(8), enable the XCLIENT +protocol with smtpd_authorized_xclient_hosts. This supports SASL +authentication in the proxy agent (Postfix 2.9 and later). <p> + +<p> This feature is available in Postfix 2.10 and later. </p> + +%PARAM smtpd_upstream_proxy_timeout 5s + +<p> The time limit for the proxy protocol specified with the +smtpd_upstream_proxy_protocol parameter. </p> + +<p> Specify a non-zero time value (an integral value plus an optional +one-letter suffix that specifies the time unit). Time units: s +(seconds), m (minutes), h (hours), d (days), w (weeks). +The default time unit is s (seconds). </p> + +<p> This feature is available in Postfix 2.10 and later. </p> + +%PARAM enable_long_queue_ids no + +<p> Enable long, non-repeating, queue IDs (queue file names). The +benefit of non-repeating names is simpler logfile analysis and +easier queue migration (there is no need to run "postsuper" to +change queue file names that don't match their message file inode +number). </p> + +<p> Note: see below for how to convert long queue file names to +Postfix ≤ 2.8. </p> + +<p> Changing the parameter value to "yes" has the following effects: +</p> + +<ul> + +<li> <p> Existing queue file names are not affected. </p> + +<li> <p> New queue files are created with names such as 3Pt2mN2VXxznjll. +These are encoded in a 52-character alphabet that contains digits +(0-9), upper-case letters (B-Z) and lower-case letters (b-z). For +safety reasons the vowels (AEIOUaeiou) are excluded from the alphabet. +The name format is: 6 or more characters for the time in seconds, +4 characters for the time in microseconds, the 'z'; the remainder +is the file inode number encoded in the first 51 characters of the +52-character alphabet. </p> + +<li> <p> New messages have a Message-ID header with +<i>queueID</i>@<i>myhostname</i>. </p> + +<li> <p> The mailq (postqueue -p) output has a wider Queue ID column. +The number of whitespace-separated fields is not changed. <p> + +<li> <p> The hash_queue_depth algorithm uses the first characters +of the queue file creation time in microseconds, after conversion +into hexadecimal representation. This produces the same queue hashing +behavior as if the queue file name was created with "enable_long_queue_ids += no". </p> + +</ul> + +<p> Changing the parameter value to "no" has the following effects: +</p> + +<ul> + +<li> <p> Existing long queue file names are renamed to the short +form (while running "postfix reload" or "postsuper"). </p> + +<li> <p> New queue files are created with names such as C3CD21F3E90 +from a hexadecimal alphabet that contains digits (0-9) and upper-case +letters (A-F). The name format is: 5 characters for the time in +microseconds; the remainder is the file inode number. </p> + +<li> <p> New messages have a Message-ID header with +<i>YYYYMMDDHHMMSS.queueid</i>@<i>myhostname</i>, where +<i>YYYYMMDDHHMMSS</i> are the year, month, day, hour, minute and +second. + +<li> <p> The mailq (postqueue -p) output has the same format as +with Postfix ≤ 2.8. <p> + +<li> <p> The hash_queue_depth algorithm uses the first characters +of the queue file name, with the hexadecimal representation of the +file creation time in microseconds. </p> + +</ul> + +<p> Before migration to Postfix ≤ 2.8, the following commands +are required to convert long queue file names into short names: </p> + +<pre> +# postfix stop +# postconf enable_long_queue_ids=no +# postsuper +</pre> + +<p> Repeat the postsuper command until it reports no more queue file +name changes. </p> + +<p> This feature is available in Postfix 2.9 and later. </p> + +%PARAM sendmail_fix_line_endings always + +<p> Controls how the Postfix sendmail command converts email message +line endings from <CR><LF> into UNIX format (<LF>). +</p> + +<dl> + +<dt> <b>always</b> </dt> <dd> Always convert message lines ending +in <CR><LF>. This setting is the default with Postfix +2.9 and later. </dd> + +<dt> <b>strict</b> </dt> <dd> Convert message lines ending in +<CR><LF> only if the first input line ends in +<CR><LF>. This setting is backwards-compatible with +Postfix 2.8 and earlier. </dd> + +<dt> <b>never</b> </dt> <dd> Never convert message lines ending in +<CR><LF>. This setting exists for completeness only. +</dd> + +</dl> + +<p> This feature is available in Postfix 2.9 and later. </p> + +%PARAM smtp_send_dummy_mail_auth no + +<p> Whether or not to append the "AUTH=<>" option to the MAIL +FROM command in SASL-authenticated SMTP sessions. The default is +not to send this, to avoid problems with broken remote SMTP servers. +Before Postfix 2.9 the behavior is as if "smtp_send_dummy_mail_auth += yes". + +<p> This feature is available in Postfix 2.9 and later. </p> + +%PARAM lmtp_send_dummy_mail_auth no + +<p> The LMTP-specific version of the smtp_send_dummy_mail_auth +configuration parameter. See there for details. </p> + +<p> This feature is available in Postfix 2.9 and later. </p> + +%PARAM address_verify_sender_ttl 0s + +<p> The time between changes in the time-dependent portion of address +verification probe sender addresses. The time-dependent portion is +appended to the localpart of the address specified with the +address_verify_sender parameter. This feature is ignored when the +probe sender addresses is the null sender, i.e. the address_verify_sender +value is empty or <>. </p> + +<p> Historically, the probe sender address was fixed. This has +caused such addresses to end up on spammer mailing lists, and has +resulted in wasted network and processing resources. </p> + +<p> To enable time-dependent probe sender addresses, specify a +non-zero time value. Specify a value of at least several hours, +to avoid problems with senders that use greylisting. Avoid nice +TTL values, to make the result less predictable. </p> + +<p> Specify a non-negative time value (an integral value plus an optional +one-letter suffix that specifies the time unit). Time units: s +(seconds), m (minutes), h (hours), d (days), w (weeks). +The default time unit is s (seconds). </p> + +<p> This feature is available in Postfix 2.9 and later. </p> + +%PARAM smtp_address_verify_target rcpt + +<p> In the context of email address verification, the SMTP protocol +stage that determines whether an email address is deliverable. +Specify one of "rcpt" or "data". The latter is needed with remote +SMTP servers that reject recipients after the DATA command. Use +transport_maps to apply this feature selectively: </p> + +<blockquote> +<pre> +/etc/postfix/main.cf: + transport_maps = hash:/etc/postfix/transport +</pre> +</blockquote> + +<blockquote> +<pre> +/etc/postfix/transport: + smtp-domain-that-verifies-after-data smtp-data-target: + lmtp-domain-that-verifies-after-data lmtp-data-target: +</pre> +</blockquote> + +<blockquote> +<pre> +/etc/postfix/master.cf: + smtp-data-target unix - - n - - smtp + -o smtp_address_verify_target=data + lmtp-data-target unix - - n - - lmtp + -o lmtp_address_verify_target=data +</pre> +</blockquote> + +<p> Unselective use of the "data" target does no harm, but will +result in unnecessary "lost connection after DATA" events at remote +SMTP/LMTP servers. </p> + +<p> This feature is available in Postfix 3.0 and later. </p> + +%PARAM lmtp_address_verify_target rcpt + +<p> The LMTP-specific version of the smtp_address_verify_target +configuration parameter. See there for details. </p> + +<p> This feature is available in Postfix 3.0 and later. </p> + +%PARAM daemon_table_open_error_is_fatal no + +<p> How a Postfix daemon process handles errors while opening lookup +tables: gradual degradation or immediate termination. </p> + +<dl> + +<dt> <b> no </b> (default) </dt> <dd> <p> Gradual degradation: a +daemon process logs a message of type "error" and continues execution +with reduced functionality. Features that do not depend on the +unavailable table will work normally, while features that depend +on the table will result in a type "warning" message. <br> When +the notify_classes parameter value contains the "data" class, the +Postfix SMTP server and client will report transcripts of sessions +with an error because a table is unavailable. </p> </dd> + +<dt> <b> yes </b> (historical behavior) </dt> <dd> <p> Immediate +termination: a daemon process logs a type "fatal" message and +terminates immediately. This option reduces the number of possible +code paths through Postfix, and may therefore be slightly more +secure than the default. </p> </dd> + +</dl> + +<p> For the sake of sanity, the number of type "error" messages is +limited to 13 over the lifetime of a daemon process. </p> + +<p> This feature is available in Postfix 2.9 and later. </p> + +%PARAM smtpd_log_access_permit_actions + +<p> Enable logging of the named "permit" actions in SMTP server +access lists (by default, the SMTP server logs "reject" actions but +not "permit" actions). This feature does not affect conditional +actions such as "defer_if_permit". </p> + +<p> Specify a list of "permit" action names, "/file/name" or +"type:table" patterns, separated by commas and/or whitespace. The +list is matched left to right, and the search stops on the first +match. A "/file/name" pattern is replaced by its contents; a +"type:table" lookup table is matched when a name matches a lookup +key (the lookup result is ignored). Continue long lines by starting +the next line with whitespace. Specify "!pattern" to exclude a name +from the list. </p> + +<p> Examples: </p> + +<pre> +/etc/postfix/main.cf: + # Log all "permit" actions. + smtpd_log_access_permit_actions = static:all +</pre> + +<pre> +/etc/postfix/main.cf: + # Log "permit_dnswl_client" only. + smtpd_log_access_permit_actions = permit_dnswl_client +</pre> + +<p> This feature is available in Postfix 2.10 and later. </p> + +%PARAM smtp_dns_support_level + +<p> Level of DNS support in the Postfix SMTP client. With +"smtp_dns_support_level" left at its empty default value, the legacy +"disable_dns_lookups" parameter controls whether DNS is enabled in +the Postfix SMTP client, otherwise the legacy parameter is ignored. +</p> + +<p> Specify one of the following: </p> + +<dl> + +<dt><b>disabled</b></dt> + +<dd>Disable DNS lookups. No MX lookups are performed and hostname +to address lookups are unconditionally "native". This setting is +not appropriate for hosts that deliver mail to the public Internet. +Some obsolete how-to documents recommend disabling DNS lookups in +some configurations with content_filters. This is no longer required +and strongly discouraged. </dd> + +<dt><b>enabled</b></dt> + +<dd>Enable DNS lookups. Nexthop destination domains not enclosed +in "[]" will be subject to MX lookups. If "dns" and "native" are +included in the "smtp_host_lookup" parameter value, DNS will be +queried first to resolve MX-host A records, followed by "native" +lookups if no answer is found in DNS. </dd> + +<dt><b>dnssec</b></dt> + +<dd>Enable <a href="https://tools.ietf.org/html/rfc4033">DNSSEC</a> +lookups. The "dnssec" setting differs from the "enabled" setting +above in the following ways: <ul> <li>Any MX lookups will set +RES_USE_DNSSEC and RES_USE_EDNS0 to request DNSSEC-validated +responses. If the MX response is DNSSEC-validated the corresponding +hostnames are considered validated. <li> The address lookups of +validated hostnames are also validated, (provided of course +"smtp_host_lookup" includes "dns", see below). <li>Temporary +failures in DNSSEC-enabled hostname-to-address resolution block any +"native" lookups. Additional "native" lookups only happen when +DNSSEC lookups hard-fail (NODATA or NXDOMAIN). </ul> </dd> + +</dl> + +<p> The Postfix SMTP client considers non-MX "[nexthop]" and +"[nexthop]:port" destinations equivalent to statically-validated +MX records of the form "nexthop. IN MX 0 nexthop." Therefore, +with "dnssec" support turned on, validated hostname-to-address +lookups apply to the nexthop domain of any "[nexthop]" or +"[nexthop]:port" destination. This is also true for LMTP "inet:host" +and "inet:host:port" destinations, as LMTP hostnames are never +subject to MX lookups. </p> + +<p>The "dnssec" setting is recommended only if you plan to use the +<a href="TLS_README.html#client_tls_dane">dane</a> or <a +href="TLS_README.html#client_tls_dane">dane-only</a> TLS security +level, otherwise enabling DNSSEC support in Postfix offers no +additional security. Postfix DNSSEC support relies on an upstream +recursive nameserver that validates DNSSEC signatures. Such a DNS +server will always filter out forged DNS responses, even when Postfix +itself is not configured to use DNSSEC. </p> + +<p> When using Postfix DANE support the "smtp_host_lookup" parameter +should include "dns", as <a +href="https://tools.ietf.org/html/rfc7672">DANE</a> is not applicable +to hosts resolved via "native" lookups. </p> + +<p> As mentioned above, Postfix is not a validating <a +href="https://tools.ietf.org/html/rfc4035#section-4.9">stub +resolver</a>; it relies on the system's configured DNSSEC-validating +<a href="https://tools.ietf.org/html/rfc4035#section-3.2">recursive +nameserver</a> to perform all DNSSEC validation. Since this +nameserver's DNSSEC-validated responses will be fully trusted, it +is strongly recommended that the MTA host have a local DNSSEC-validating +recursive caching nameserver listening on a loopback address, and +be configured to use only this nameserver for all lookups. Otherwise, +Postfix may remain subject to man-in-the-middle attacks that forge +responses from the recursive nameserver</p> + +<p>DNSSEC support requires a version of Postfix compiled against a +reasonably-modern DNS resolver(3) library that implements the +RES_USE_DNSSEC and RES_USE_EDNS0 resolver options. </p> + +<p> This feature is available in Postfix 2.11 and later. </p> + +%PARAM lmtp_dns_support_level + +<p> The LMTP-specific version of the smtp_dns_support_level +configuration parameter. See there for details. </p> + +<p> This feature is available in Postfix 2.11 and later. </p> + +%PARAM smtp_tls_trust_anchor_file + +<p> Zero or more PEM-format files with trust-anchor certificates +and/or public keys. If the parameter is not empty the root CAs in +CAfile and CApath are no longer trusted. Rather, the Postfix SMTP +client will only trust certificate-chains signed by one of the +trust-anchors contained in the chosen files. The specified +trust-anchor certificates and public keys are not subject to +expiration, and need not be (self-signed) root CAs. They may, if +desired, be intermediate certificates. Therefore, these certificates +also may be found "in the middle" of the trust chain presented by +the remote SMTP server, and any untrusted issuing parent certificates +will be ignored. Specify a list of pathnames separated by comma +or whitespace. </p> + +<p> Whether specified in main.cf, or on a per-destination basis, +the trust-anchor PEM file must be accessible to the Postfix SMTP +client in the chroot jail if applicable. The trust-anchor file +should contain only certificates and public keys, no private key +material, and must be readable by the non-privileged $mail_owner +user. This allows destinations to be bound to a set of specific +CAs or public keys without trusting the same CAs for all destinations. +</p> + +<p> The main.cf parameter supports single-purpose Postfix installations +that send mail to a fixed set of SMTP peers. At most sites, if +trust-anchor files are used at all, they will be specified on a +per-destination basis via the "tafile" attribute of the "verify" +and "secure" levels in smtp_tls_policy_maps. </p> + +<p> The underlying mechanism is in support of RFC 7672 (DANE TLSA), +which defines mechanisms for an SMTP client MTA to securely determine +server TLS certificates via DNS. </p> + +<p> If you want your trust anchors to be public keys, with OpenSSL +you can extract a single PEM public key from a PEM X.509 file +containing a single certificate, as follows: </p> + +<blockquote> +<pre> +$ openssl x509 -in cert.pem -out ta-key.pem -noout -pubkey +</pre> +</blockquote> + +<p> This feature is available in Postfix 2.11 and later. </p> + +%PARAM lmtp_tls_trust_anchor_file + +<p> The LMTP-specific version of the smtp_tls_trust_anchor_file +configuration parameter. See there for details. </p> + +<p> This feature is available in Postfix 2.11 and later. </p> + +%PARAM tls_dane_trust_anchor_digest_enable yes + +<p> Enable support for RFC 6698 (DANE TLSA) DNS records that contain +digests of trust-anchors with certificate usage "2". Do not change +this setting from its default value. </p> + +<p> This feature is available in Postfix 2.11 through 3.1. It has +been withdrawn in Postfix 3.2, as trust-anchor TLSA records are now +widely used and have proved sufficiently reliable. Postfix 3.2 and +later ignore this configuration parameter and behaves as though it +were set to "yes". </p> + +%PARAM tls_wildcard_matches_multiple_labels yes + +<p> Match multiple DNS labels with "*" in wildcard certificates. +</p> + +<p> Some mail service providers prepend the customer domain name +to a base domain for which they have a wildcard TLS certificate. +For example, the MX records for example.com hosted by example.net +may be: </p> + +<blockquote> +<pre> +example.com. IN MX 0 example.com.mx1.example.net. +example.com. IN MX 0 example.com.mx2.example.net. +</pre> +</blockquote> + +<p> and the TLS certificate may be for "*.example.net". The "*" +then corresponds with multiple labels in the mail server domain +name. While multi-label wildcards are not widely supported, and +are not blessed by any standard, there is little to be gained by +disallowing their use in this context. </p> + +<p> Notes: <p> + +<ul> + +<li> <p> In a certificate name, the "*" is special only when it is +used as the first label. </p> + +<li> <p> While Postfix (2.11 or later) can match "*" with multiple +domain name labels, other implementations likely will not. </p> + +<li> <p> Earlier Postfix implementations behave as if +"tls_wildcard_matches_multiple_labels = no". </p> + +</ul> + +<p> This feature is available in Postfix 2.11 and later. </p> + +%PARAM tls_ssl_options + +<p> List or bit-mask of OpenSSL options to enable. </p> + +<p> The OpenSSL toolkit provides a set of options that applications +can enable to tune the OpenSSL behavior. Some of these work around +bugs in other implementations and are on by default. You can use +the tls_disable_workarounds parameter to selectively disable some +or all of the bug work-arounds, making OpenSSL more strict at the +cost of non-interoperability with SSL clients or servers that exhibit +the bugs. </p> + +<p> Other options are off by default, and typically enable or disable +features rather than bug work-arounds. These may be turned on (with +care) via the tls_ssl_options parameter. The value is a white-space +or comma separated list of named options chosen from the list below. +The names are not case-sensitive, you can use lower-case if you +prefer. The upper case values below match the corresponding macro +name in the ssl.h header file with the SSL_OP_ prefix removed. It +is possible that your OpenSSL version includes new options added +after your Postfix source code was last updated, in that case you +can only enable one of these via the hexadecimal syntax below. </p> + +<p> You should only enable features via the hexadecimal mask when +the need to control the feature is critical (to deal with a new +vulnerability or a serious interoperability problem). Postfix DOES +NOT promise backwards compatible behavior with respect to the mask +bits. A feature enabled via the mask in one release may be enabled +by other means in a later release, and the mask bit will then be +ignored. Therefore, use of the hexadecimal mask is only a temporary +measure until a new Postfix or OpenSSL release provides a better +solution. </p> + +<p> If the value of the parameter is a hexadecimal long integer +starting with "0x", the options corresponding to the bits specified +in its value are enabled (see openssl/ssl.h and SSL_CTX_set_options(3)). +You can only enable options not already controlled by other Postfix +settings. For example, you cannot disable protocols or enable +server cipher preference. Do not attempt to enable all features by +specifying 0xFFFFFFFF, this is unlikely to be a good idea. Some +bug work-arounds are also valid here, allowing them to be re-enabled +if/when they're no longer enabled by default. The supported values +include: </p> + +<dl> + +<dt><b>ENABLE_MIDDLEBOX_COMPAT</b></dt> <dd>Postfix ≥ 3.4. See +SSL_CTX_set_options(3).</dd> + +<dt><b>LEGACY_SERVER_CONNECT</b></dt> <dd>See SSL_CTX_set_options(3).</dd> + +<dt><b>NO_TICKET</b></dt> <dd>Enabled by default when needed in +fully-patched Postfix ≥ 2.7. Not needed at all for Postfix ≥ +2.11, unless for some reason you do not want to support TLS session +resumption. Best not set explicitly. See SSL_CTX_set_options(3).</dd> + +<dt><b>NO_COMPRESSION</b></dt> <dd>Disable SSL compression even if +supported by the OpenSSL library. Compression is CPU-intensive, +and compression before encryption does not always improve security. </dd> + +<dt><b>NO_RENEGOTIATION</b></dt> <dd>Postfix ≥ 3.4. This can +reduce opportunities for a potential CPU exhaustion attack. See +SSL_CTX_set_options(3).</dd> + +<dt><b>NO_SESSION_RESUMPTION_ON_RENEGOTIATION</b></dt> <dd>Postfix +≥ 3.4. See SSL_CTX_set_options(3).</dd> + +<dt><b>PRIORITIZE_CHACHA</b></dt> <dd>Postfix ≥ 3.4. See SSL_CTX_set_options(3).</dd> + +</dl> + +<p> This feature is available in Postfix 2.11 and later. </p> + +%PARAM tlsmgr_service_name tlsmgr + +<p> The name of the tlsmgr(8) service entry in master.cf. This +service maintains TLS session caches and other information in support +of TLS. </p> + +<p> This feature is available in Postfix 2.11 and later. </p> + +%PARAM lmtp_connection_reuse_count_limit 0 + +<p> The LMTP-specific version of the smtp_connection_reuse_count_limit +configuration parameter. See there for details. </p> + +<p> This feature is available in Postfix 2.11 and later. </p> + +%PARAM smtp_connection_reuse_count_limit 0 + +<p> When SMTP connection caching is enabled, the number of times +that an SMTP session may be reused before it is closed, or zero (no +limit). With a reuse count limit of N, a connection is used up to +N+1 times. </p> + +<p> NOTE: This feature is unsafe. When a high-volume destination +has multiple inbound MTAs, then the slowest inbound MTA will attract +the most connections to that destination. This limitation does not +exist with the smtp_connection_reuse_time_limit feature. </p> + +<p> This feature is available in Postfix 2.11. </p> + +%PARAM lmtp_tls_force_insecure_host_tlsa_lookup no + +<p> The LMTP-specific version of the smtp_tls_force_insecure_host_tlsa_lookup +configuration parameter. See there for details. </p> + +<p> This feature is available in Postfix 2.11 and later. </p> + +%PARAM smtp_tls_force_insecure_host_tlsa_lookup no + +<p> Lookup the associated DANE TLSA RRset even when a hostname is +not an alias and its address records lie in an unsigned zone. This +is unlikely to ever yield DNSSEC validated results, since child +zones of unsigned zones are also unsigned in the absence of DLV or +locally configured non-root trust-anchors. We anticipate that such +mechanisms will not be used for just the "_tcp" subdomain of a host. +Suppressing the TLSA RRset lookup reduces latency and avoids potential +interoperability problems with nameservers for unsigned zones that +are not prepared to handle the new TLSA RRset. </p> + +<p> This feature is available in Postfix 2.11. </p> + +%PARAM tls_dane_digest_agility on + +<p> Configure RFC7671 DANE TLSA digest algorithm agility. +Do not change this setting from its default value. </p> + +<p> See Section 8 of RFC7671 for correct key rotation procedures. </p> + +<p> This feature is available in Postfix 2.11 through 3.1. Postfix +3.2 and later ignore this configuration parameter and behave as +though it were set to "on". </p> + +%PARAM tls_dane_digests sha512 sha256 + +<p> DANE TLSA (RFC 6698, RFC 7671, RFC 7672) resource-record "matching +type" digest algorithms in descending preference order. All the +specified algorithms must be supported by the underlying OpenSSL +library, otherwise the Postfix SMTP client will not support DANE +TLSA security. </p> + +<p> Specify a list of digest names separated by commas and/or +whitespace. Each digest name may be followed by an optional +"=<number>" suffix. For example, "sha512" may instead be specified +as "sha512=2" and "sha256" may instead be specified as "sha256=1". +The optional number must match the <a +href="https://www.iana.org/assignments/dane-parameters/dane-parameters.xhtml#matching-types" +>IANA</a> assigned TLSA matching type number the algorithm in question. +Postfix will check this constraint for the algorithms it knows about. +Additional matching type algorithms registered with IANA can be added +with explicit numbers provided they are supported by OpenSSL. </p> + +<p> Invalid list elements are logged with a warning and disable DANE +support. TLSA RRs that specify digests not included in the list are +ignored with a warning. </p> + +<p> Note: It is unwise to omit sha256 from the digest list. This +digest algorithm is the only mandatory to implement digest algorithm +in RFC 6698, and many servers are expected to publish TLSA records +with just sha256 digests. Unless one of the standard digests is +seriously compromised and servers have had ample time to update their +TLSA records you should not omit any standard digests, just arrange +them in order from strongest to weakest. </p> + +<p> This feature is available in Postfix 2.11 and later. </p> + +%PARAM tls_session_ticket_cipher Postfix ≥ 3.0: aes-256-cbc, Postfix < 3.0: aes-128-cbc + +<p> Algorithm used to encrypt RFC5077 TLS session tickets. This +algorithm must use CBC mode, have a 128-bit block size, and must +have a key length between 128 and 256 bits. The default is +aes-256-cbc. Overriding the default to choose a different algorithm +is discouraged. </p> + +<p> Setting this parameter empty disables session ticket support +in the Postfix SMTP server. Another way to disable session ticket +support is via the tls_ssl_options parameter. </p> + +<p> This feature is available in Postfix 3.0 and later. </p> + +%PARAM tls_fast_shutdown_enable yes + +<p> A workaround for implementations that hang Postfix while shutting +down a TLS session, until Postfix times out. With this enabled, +Postfix will not wait for the remote TLS peer to respond to a TLS +'close' notification. This behavior is recommended for TLSv1.0 and +later. </p> + +%PARAM default_delivery_status_filter + +<p> Optional filter to replace the delivery status code or explanatory +text of successful or unsuccessful deliveries. This does not allow +the replacement of a successful status code (2.X.X) with an +unsuccessful status code (4.X.X or 5.X.X) or vice versa. </p> + +<p> Note: the (smtp|lmtp)_delivery_status_filter is applied only +once per recipient: when delivery is successful, when delivery is +rejected with 5XX, or when there are no more alternate MX or A +destinations. Use smtp_reply_filter or lmtp_reply_filter to inspect +responses for all delivery attempts. </p> + +<p> The following parameters can be used to implement a filter for +specific delivery agents: lmtp_delivery_status_filter, +local_delivery_status_filter, pipe_delivery_status_filter, +smtp_delivery_status_filter or virtual_delivery_status_filter. These +parameters support the same filter syntax as described here. </p> + +<p> Specify zero or more "type:table" lookup table names, separated +by comma or whitespace. For each successful or unsuccessful delivery +to a recipient, the tables are queried in the specified order with +one line of text that is structured as follows: </p> + +<blockquote> +enhanced-status-code SPACE explanatory-text +</blockquote> + +<p> The first table match wins. The lookup result must have the +same structure as the query, a successful status code (2.X.X) must +be replaced with a successful status code, an unsuccessful status +code (4.X.X or 5.X.X) must be replaced with an unsuccessful status +code, and the explanatory text field must be non-empty. Other results +will result in a warning. </p> + +<p> Example 1: convert specific soft TLS errors into hard errors, +by overriding the first number in the enhanced status code. </p> + +<blockquote> +<pre> +/etc/postfix/main.cf: + smtp_delivery_status_filter = pcre:/etc/postfix/smtp_dsn_filter +</pre> +</blockquote> + +<blockquote> +<pre> +/etc/postfix/smtp_dsn_filter: + /^4(\.\d+\.\d+ TLS is required, but host \S+ refused to start TLS: .+)/ + 5$1 + /^4(\.\d+\.\d+ TLS is required, but was not offered by host .+)/ + 5$1 + # Do not change the following into hard bounces. They may + # result from a local configuration problem. + # 4.\d+.\d+ TLS is required, but our TLS engine is unavailable + # 4.\d+.\d+ TLS is required, but unavailable + # 4.\d+.\d+ Cannot start TLS: handshake failure +</pre> +</blockquote> + +<p> Example 2: censor the per-recipient delivery status text so +that it does not reveal the destination command or filename +when a remote sender requests confirmation of successful delivery. +</p> + +<blockquote> +<pre> +/etc/postfix/main.cf: + local_delivery_status_filter = pcre:/etc/postfix/local_dsn_filter +</pre> +</blockquote> + +<blockquote> +<pre> +/etc/postfix/local_dsn_filter: + /^(2\S+ delivered to file).+/ $1 + /^(2\S+ delivered to command).+/ $1 +</pre> +</blockquote> + +<p> Notes: </p> + +<ul> + +<li> <p> This feature will NOT override the soft_bounce safety net. </p> + +<li> <p> This feature will change the enhanced status code and text +that is logged to the maillog file, and that is reported to the +sender in delivery confirmation or non-delivery notifications. +</p> + +</ul> + +<p> This feature is available in Postfix 3.0 and later. </p> + +%PARAM smtp_delivery_status_filter $default_delivery_status_filter + +<p> Optional filter for the smtp(8) delivery agent to change the +delivery status code or explanatory text of successful or unsuccessful +deliveries. See default_delivery_status_filter for details. </p> + +<p> NOTE: This feature modifies Postfix SMTP client error or non-error +messages that may or may not be derived from remote SMTP server +responses. In contrast, the smtp_reply_filter feature modifies +remote SMTP server responses only. </p> + +%PARAM lmtp_delivery_status_filter + +<p> The LMTP-specific version of the smtp_delivery_status_filter +configuration parameter. See there for details. </p> + +<p> This feature is available in Postfix 3.0 and later. </p> + +%PARAM pipe_delivery_status_filter $default_delivery_status_filter + +<p> Optional filter for the pipe(8) delivery agent to change the +delivery status code or explanatory text of successful or unsuccessful +deliveries. See default_delivery_status_filter for details. </p> + +<p> This feature is available in Postfix 3.0 and later. </p> + +%PARAM virtual_delivery_status_filter $default_delivery_status_filter + +<p> Optional filter for the virtual(8) delivery agent to change the +delivery status code or explanatory text of successful or unsuccessful +deliveries. See default_delivery_status_filter for details. </p> + +<p> This feature is available in Postfix 3.0 and later. </p> + +%PARAM local_delivery_status_filter $default_delivery_status_filter + +<p> Optional filter for the local(8) delivery agent to change the +status code or explanatory text of successful or unsuccessful +deliveries. See default_delivery_status_filter for details. </p> + +<p> This feature is available in Postfix 3.0 and later. </p> + +%PARAM shlib_directory see 'postconf -d' output + +<p> The location of Postfix dynamically-linked libraries +(libpostfix-*.so), and the default location of Postfix database +plugins (postfix-*.so) that have a relative pathname in the +dynamicmaps.cf file. The shlib_directory parameter defaults to +"no" when Postfix dynamically-linked libraries and database plugins +are disabled at compile time, otherwise it typically defaults to +/usr/lib/postfix or /usr/local/lib/postfix. </p> + +<p> Notes: </p> + +<ul> + +<li> <p> The directory specified with shlib_directory should contain +only Postfix-related files. Postfix dynamically-linked libraries +and database plugins should not be installed in a "public" system +directory such as /usr/lib or /usr/local/lib. Linking Postfix +dynamically-linked library files or database plugins into non-Postfix +programs is not supported. Postfix dynamically-linked libraries +and database plugins implement a Postfix-internal API that changes +without maintaining compatibility. </p> + +<li> <p> You can change the shlib_directory value after Postfix is +built. However, you may have to run ldconfig or equivalent to prevent +Postfix programs from failing because the libpostfix-*.so files are +not found. No ldconfig command is needed if you keep the libpostfix-*.so +files in the compiled-in default $shlib_directory location. </p> + +</ul> + +<p> This feature is available in Postfix 3.0 and later. </p> + +%PARAM meta_directory see 'postconf -d' output + +<p> The location of non-executable files that are shared among +multiple Postfix instances, such as postfix-files, dynamicmaps.cf, +and the multi-instance template files main.cf.proto and master.cf.proto. +This directory should contain only Postfix-related files. Typically, +the meta_directory parameter has the same default as the config_directory +parameter (/etc/postfix or /usr/local/etc/postfix). </p> + +<p> For backwards compatibility with Postfix versions 2.6..2.11, +specify "meta_directory = $daemon_directory" in main.cf before +installing or upgrading Postfix, or specify "meta_directory = +/path/name" on the "make makefiles", "make install" or "make upgrade" +command line. </p> + +<p> This feature is available in Postfix 3.0 and later. </p> + +%PARAM smtpd_policy_service_default_action 451 4.3.5 Server configuration problem + +<p> The default action when an SMTPD policy service request fails. +Specify "DUNNO" to behave as if the failed SMTPD policy service +request was not sent, and to continue processing other access +restrictions, if any. </p> + +<p> Limitations: </p> + +<ul> + +<li> <p> This parameter may specify any value that would be a valid +SMTPD policy server response (or access(5) map lookup result). An +access(5) map or policy server in this parameter value may need to +be declared in advance with a restriction_class setting. </p> + +<li> <p> If the specified action invokes another check_policy_service +request, that request will have the built-in default action. </p> + +</ul> + +<p> This feature is available in Postfix 3.0 and later. </p> + +%PARAM smtpd_policy_service_try_limit 2 + +<p> The maximal number of attempts to send an SMTPD policy service +request before giving up. Specify a value greater than zero. </p> + +<p> This feature is available in Postfix 3.0 and later. </p> + +%PARAM smtpd_policy_service_retry_delay 1s + +<p> The delay between attempts to resend a failed SMTPD policy +service request. Specify a value greater than zero. </p> + +<p> Specify a non-zero time value (an integral value plus an optional +one-letter suffix that specifies the time unit). Time units: s +(seconds), m (minutes), h (hours), d (days), w (weeks). +The default time unit is s (seconds). </p> + +<p> This feature is available in Postfix 3.0 and later. </p> + +%PARAM smtputf8_enable yes + +<p> Enable preliminary SMTPUTF8 support for the protocols described +in RFC 6531, RFC 6532, and RFC 6533. This requires that Postfix is +built to support these protocols. </p> + +<p> This feature is available in Postfix 3.0 and later. </p> + +%PARAM strict_smtputf8 no + +<p> Enable stricter enforcement of the SMTPUTF8 protocol. The Postfix +SMTP server accepts UTF8 sender or recipient addresses only when +the client requests an SMTPUTF8 mail transaction. </p> + +<p> This feature is available in Postfix 3.0 and later. </p> + +%PARAM smtputf8_autodetect_classes sendmail, verify + +<p> Detect that a message requires SMTPUTF8 support for the specified +mail origin classes. This is a workaround to avoid chicken-and-egg +problems during the initial SMTPUTF8 roll-out in environments with +pre-existing mail flows that contain UTF8. Those mail flows should +not break because Postfix suddenly refuses to deliver such mail +to down-stream MTAs that don't announce SMTPUTF8 support. </p> + +<p> The problem is that Postfix cannot rely solely on the sender's +declaration that a message requires SMTPUTF8 support, because UTF8 +may be introduced during local processing (for example, the client +hostname in Postfix's Received: header, adding @$myorigin or +.$mydomain to an incomplete address, address rewriting, alias +expansion, automatic BCC recipients, local forwarding, and changes +made by header checks or Milter applications). </p> + +<p> For now, the default is to enable "SMTPUTF8 required" autodetection +only for Postfix sendmail command-line submissions and address +verification probes. This may change once SMTPUTF8 support achieves +world domination. However, sites that add UTF8 content via local +processing (see above) should autodetect the need for SMTPUTF8 +support for all email.</p> + +<p> Specify one or more of the following: </p> + +<dl compact> + +<dt> <b> sendmail </b> </dt> <dd> Submission with the Postfix +sendmail(1) command. </dd> + +<dt> <b> smtpd </b> </dt> <dd> Mail received with the smtpd(8) +daemon. </dd> + +<dt> <b> qmqpd </b> </dt> <dd> Mail received with the qmqpd(8) +daemon. </dd> + +<dt> <b> forward </b> </dt> <dd> Local forwarding or aliasing. When +a message is received with "SMTPUTF8 required", then the forwarded +(aliased) message always has "SMTPUTF8 required". </dd> + +<dt> <b> bounce </b> </dt> <dd> Submission by the bounce(8) daemon. +When a message is received with "SMTPUTF8 required", then the +delivery status notification always has "SMTPUTF8 required". </dd> + +<dt> <b> notify </b> </dt> <dd> Postmaster notification from the +smtp(8) or smtpd(8) daemon. </dd> + +<dt> <b> verify </b> </dt> <dd> Address verification probe from the +verify(8) daemon. </dd> + +<dt> <b> all </b> </dt> <dd> Enable SMTPUTF8 autodetection for all +mail. </dd> + +</dl> + +<p> This feature is available in Postfix 3.0 and later. </p> + +%PARAM compatibility_level 0 + +<p> A safety net that causes Postfix to run with backwards-compatible +default settings after an upgrade to a newer Postfix version. </p> + +<p> With backwards compatibility turned on (the main.cf compatibility_level +value is less than the Postfix built-in value), Postfix looks for +settings that are left at their implicit default value, and logs a +message when a backwards-compatible default setting is required. +</p> + +<blockquote> +<pre> +using backwards-compatible default setting <i>name=value</i> + to [accept a specific client request] +<nroffescape .sp> +using backwards-compatible default setting <i>name=value</i> + to [enable specific Postfix behavior] +</pre> +</blockquote> + +<p> See COMPATIBILITY_README for specific message details. If such +a message is logged in the context of a legitimate request, the +system administrator should make the backwards-compatible setting +permanent in main.cf or master.cf, for example: </p> + +<blockquote> +<pre> +# <b>postconf</b> <i>name=value</i> +# <b>postfix reload</b> +</pre> +</blockquote> + +<p> When no more backwards-compatible settings need to be made +permanent, the administrator should turn off backwards compatibility +by updating the compatibility_level setting in main.cf:</p> + +<blockquote> +<pre> +# <b>postconf compatibility_level=<i>N</i></b> +# <b>postfix reload</b> +</pre> +</blockquote> + +<p> For <i>N</i> specify the number that is logged in your postfix(1) +warning message: </p> + +<blockquote> +<pre> +warning: To disable backwards compatibility use "postconf + compatibility_level=<i>N</i>" and "postfix reload" +</pre> +</blockquote> + +<p> Starting with Postfix version 3.6, the compatibility level in +the above warning message is the Postfix version that introduced +the last incompatible change. The level is formatted as +<i>major.minor.patch</i>, where <i>patch</i> is usually omitted and +defaults to zero. Earlier compatibility levels are 0, 1 and 2. </p> + +<p> NOTE: this also introduces support for the "<level", +"<=level", and other operators to compare compatibility levels. +With the standard operators "<", "<=", etc., compatibility +level "3.10" would be smaller than "3.9" which is undesirable. </p> + +<p> This feature is available in Postfix 3.0 and later. </p> + +%PARAM message_drop_headers bcc, content-length, resent-bcc, return-path + +<p> Names of message headers that the cleanup(8) daemon will remove +after applying header_checks(5) and before invoking Milter applications. +The default setting is compatible with Postfix < 3.0. </p> + +<p> Specify a list of header names, separated by comma or space. +Names are matched in a case-insensitive manner. The list of supported +header names is limited only by available memory. </p> + +<p> This feature is available in Postfix 3.0 and later. </p> + +%PARAM smtpd_dns_reply_filter + +<p> Optional filter for Postfix SMTP server DNS lookup results. +See smtp_dns_reply_filter for details including an example. +</p> + +<p> This feature is available in Postfix 3.0 and later. </p> + +%PARAM lmtp_dns_reply_filter + +<p> Optional filter for Postfix LMTP client DNS lookup results. +See smtp_dns_reply_filter for details including an example. </p> + +<p> This feature is available in Postfix 3.0 and later. </p> + +#%PARAM postscreen_dns_reply_filter +# +#<p> Optional filter for postscreen(8) DNS lookup results. +#See smtp_dns_reply_filter for details including an example. +#</p> +# +#<p> This feature is available in Postfix 3.0 and later. </p> + +%PARAM smtp_dns_reply_filter + +<p> Optional filter for Postfix SMTP client DNS lookup results. +Specify zero or more lookup tables. The lookup tables are searched +in the given order for a match with the DNS lookup result, converted +to the following form: </p> + +<pre> + <i>name ttl class type preference value</i> +</pre> + +<p> The <i>class</i> field is always "IN", the <i>preference</i> +field exists only for MX records, the names of hosts, domains, etc. +end in ".", and those names are in ASCII form (xn--mumble form in +the case of UTF8 names). </p> + +<p> When a match is found, the table lookup result specifies an +action. By default, the table query and the action name are +case-insensitive. Currently, only the <b>IGNORE</b> action is +implemented. </p> + +<p> Notes: </p> + +<ul> + +<li> <p> Postfix DNS reply filters have no effect on implicit DNS +lookups through nsswitch.conf or equivalent mechanisms. </p> + +<li> <p> The Postfix SMTP/LMTP client uses smtp_dns_reply_filter +and lmtp_dns_reply_filter only to discover a remote SMTP or LMTP +service (record types MX, A, AAAA, and TLSA). These lookups are +also made to implement the features reject_unverified_sender and +reject_unverified_recipient. </p> + +<li> <p> The Postfix SMTP/LMTP client defers mail delivery when +a filter removes all lookup results from a successful query. </p> + +<li> <p> Postfix SMTP server uses smtpd_dns_reply_filter only to +look up MX, A, AAAA, and TXT records to implement the features +reject_unknown_helo_hostname, reject_unknown_sender_domain, +reject_unknown_recipient_domain, reject_rbl_*, and reject_rhsbl_*. +</p> + +<li> <p> The Postfix SMTP server logs a warning or defers mail +delivery when a filter removes all lookup results from a successful +query. </p> + +</ul> + +<p> Example: ignore Google AAAA records in Postfix SMTP client DNS +lookups, because Google sometimes hard-rejects mail from IPv6 clients +with valid PTR etc. records. </p> + +<pre> +/etc/postfix/main.cf: + smtp_dns_reply_filter = pcre:/etc/postfix/smtp_dns_reply_filter +</pre> + +<pre> +/etc/postfix/smtp_dns_reply_filter: + # /domain ttl IN AAAA address/ action, all case-insensitive. + # Note: the domain name ends in ".". + /^\S+\.google\.com\.\s+\S+\s+\S+\s+AAAA\s+/ IGNORE +</pre> + +<p> This feature is available in Postfix 3.0 and later. </p> + +%PARAM smtp_tls_wrappermode no + +<p> Request that the Postfix SMTP client connects using the +SUBMISSIONS/SMTPS protocol instead of using the STARTTLS command. </p> + +<p> This mode requires "smtp_tls_security_level = encrypt" or +stronger. </p> + +<p> Example: deliver all remote mail via a provider's server +"mail.example.com". </p> + +<pre> +/etc/postfix/main.cf: + # Client-side SMTPS requires "encrypt" or stronger. + smtp_tls_security_level = encrypt + smtp_tls_wrappermode = yes + # The [] suppress MX lookups. + relayhost = [mail.example.com]:465 +</pre> + +<p> More examples are in TLS_README, including examples for older +Postfix versions. </p> + +<p> This feature is available in Postfix 3.0 and later. </p> + +%PARAM lmtp_tls_wrappermode no + +<p> The LMTP-specific version of the smtp_tls_wrappermode configuration +parameter. See there for details. </p> + +<p> This feature is available in Postfix 3.0 and later. </p> + +%PARAM smtp_tls_connection_reuse no + +<p> Try to make multiple deliveries per TLS-encrypted connection. +This uses the tlsproxy(8) service to encrypt an SMTP connection, +uses the scache(8) service to save that connection, and relies on +hints from the qmgr(8) daemon. </p> + +<p> See "<a href="TLS_README.html#client_tls_reuse">Client-side +TLS connection reuse</a>" for background details. </p> + +<p> This feature is available in Postfix 3.4 and later. </p> + +%PARAM lmtp_tls_connection_reuse no + +<p> The LMTP-specific version of the smtp_tls_connection_reuse configuration +parameter. See there for details. </p> + +<p> This feature is available in Postfix 3.4 and later. </p> + +%PARAM virtual_alias_address_length_limit 1000 + +<p> +The maximal length of an email address after virtual alias expansion. +This stops virtual aliasing loops that increase the address length +exponentially. +</p> + +<p> +This feature is available in Postfix 3.0 and later. +</p> + +%PARAM dns_ncache_ttl_fix_enable no + +<p> Enable a workaround for future libc incompatibility. The Postfix +implementation of RFC 2308 negative reply caching relies on the +promise that res_query() and res_search() invoke res_send(), which +returns the server response in an application buffer even if the +requested record does not exist. If this promise is broken, specify +"yes" to enable a workaround for DNS reputation lookups. </p> + +<p> +This feature is available in Postfix 3.1 and later. +</p> + +%PARAM smtpd_policy_service_policy_context + +<p> Optional information that the Postfix SMTP server specifies in +the "policy_context" attribute of a policy service request (originally, +to share the same service endpoint among multiple check_policy_service +clients). </p> + +<p> +This feature is available in Postfix 3.1 and later. +</p> + +%PARAM smtp_tls_dane_insecure_mx_policy see "postconf -d" output + +<p> The TLS policy for MX hosts with "secure" TLSA records when the +nexthop destination security level is <b>dane</b>, but the MX +record was found via an "insecure" MX lookup. The choices are: +</p> + +<dl> +<dt><b>may</b></dt> +<dd> The TLSA records will be ignored and TLS will be optional. If +the MX host does not appear to support STARTTLS, or the STARTTLS +handshake fails, mail may be sent in the clear. </dd> +<dt><b>encrypt</b></dt> +<dd> The TLSA records will signal a requirement to use TLS. While +TLS encryption will be required, authentication will not be performed. +</dd> +<dt><b>dane</b></dt> +<dd>The TLSA records will be used just as with "secure" MX records. +TLS encryption will be required, and, if at least one of the TLSA +records is "usable", authentication will be required. When +authentication succeeds, it will be logged only as "Trusted", not +"Verified", because the MX host name could have been forged. </dd> +</dl> + +<p> The default setting for Postfix ≥ 3.6 is "dane" with +"smtp_tls_security_level = dane", otherwise "may". This behavior +was backported to Postfix versions 3.5.9, 3.4.19, 3.3.16. 3.2.21. +With earlier Postfix versions the default setting was always "dane". +</p> + +<p> Though with "insecure" MX records an active attacker can +compromise SMTP transport security by returning forged MX records, +such attacks are "tamper-evident" since any forged MX hostnames +will be recorded in the mail logs. Attackers who place a high value +on staying hidden may be deterred from forging MX records. </p> + +<p> +This feature is available in Postfix 3.1 and later. The <b>may</b> +policy is backwards-compatible with earlier Postfix versions. +</p> + +%PARAM openssl_path openssl + +<p> +The location of the OpenSSL command line program openssl(1). This +is used by the "<b>postfix tls</b>" command to create private keys, +certificate signing requests, self-signed certificates, and to +compute public key digests for DANE TLSA records. In multi-instance +environments, this parameter is always determined from the configuration +of the default Postfix instance. +</p> + +<p> Example: </p> + +<blockquote> +<pre> +/etc/postfix/main.cf: + # NetBSD pkgsrc: + openssl_path = /usr/pkg/bin/openssl + # Local build: + openssl_path = /usr/local/bin/openssl +</pre> +</blockquote> + +<p> +This feature is available in Postfix 3.1 and later. +</p> + +%PARAM address_verify_pending_request_limit see "postconf -d" output + +<p> A safety limit that prevents address verification requests from +overwhelming the Postfix queue. By default, the number of pending +requests is limited to 1/4 of the active queue maximum size +(qmgr_message_active_limit). The queue manager enforces the limit +by tempfailing requests that exceed the limit. This affects only +unknown addresses and inactive addresses that have expired, because +the verify(8) daemon automatically refreshes an active address +before it expires. </p> + +<p> This feature is available in Postfix 3.1 and later. </p> + +%PARAM smtpd_milter_maps + +<p> Lookup tables with Milter settings per remote SMTP client IP +address. The lookup result overrides the smtpd_milters setting, +and has the same syntax. </p> + +<p> Note: lookup tables cannot return empty responses. Specify a +lookup result of DISABLE (case does not matter) to indicate that +Milter support should be disabled. </p> + +<p> Example to disable Milters for local clients: </p> + +<pre> +/etc/postfix/main.cf: + smtpd_milter_maps = cidr:/etc/postfix/smtpd_milter_map + smtpd_milters = inet:host:port, { inet:host:port, ... }, ... +</pre> + +<pre> +/etc/postfix/smtpd_milter_map: + # Disable Milters for local clients. + 127.0.0.0/8 DISABLE + 192.168.0.0/16 DISABLE + ::/64 DISABLE + 2001:db8::/32 DISABLE +</pre> + +<p> This feature is available in Postfix 3.2 and later. </p> + +%PARAM enable_idna2003_compatibility no + +<p> Enable 'transitional' compatibility between IDNA2003 and IDNA2008, +when converting UTF-8 domain names to/from the ASCII form that is +used for DNS lookups. Specify "yes" for compatibility with Postfix +≤ 3.1 (not recommended). This affects the conversion of domain +names that contain for example the German sz and the Greek zeta. +See http://unicode.org/cldr/utility/idna.jsp for more examples. +</p> + +<p> This feature is available in Postfix 3.2 and later. </p> + +%PARAM smtp_balance_inet_protocols yes + +<p> When a remote destination resolves to a combination of IPv4 and +IPv6 addresses, ensure that the Postfix SMTP client can try both +address types before it runs into the smtp_mx_address_limit. </p> + +<p> This avoids an interoperability problem when a destination resolves +to primarily IPv6 addresses, the smtp_address_limit feature eliminates +most or all IPv4 addresses, and the destination is not reachable over +IPv6. </p> + +<p> This feature is available in Postfix 3.3 and later. </p> + +%PARAM lmtp_balance_inet_protocols yes + +<p> The LMTP-specific version of the smtp_balance_inet_protocols +configuration parameter. See there for details. </p> + +<p> This feature is available in Postfix 3.3 and later. </p> + +%PARAM header_from_format standard + +<p> The format of the Postfix-generated <b>From:</b> header. This +setting affects the appearance of 'full name' information when a +local program such as /bin/mail submits a message without a From: +header through the Postfix sendmail(1) command. </p> + +<p> Specify one of the following: </p> + +<dl> + +<dt><b>standard</b> (default)</dt> <dd> Produce a header formatted +as "<b>From:</b> <i>name</i><b> <</b><i>address</i><b>></b>". +This is the default as of Postfix 3.3.</dd> + +<dt><b>obsolete</b></dt> <dd>Produce a header formatted as "<b>From:</b> +<i>address</i> <b>(</b><i>name</i><b>)</b>". This is the behavior +prior to Postfix 3.3. </dd> + +</dl> + +<p> Notes: </p> + +<ul> + +<li> <p> Postfix generates the format "<b>From:</b> <i>address</i>" +when <i>name</i> information is unavailable or the envelope sender +address is empty. This is the same behavior as prior to Postfix +3.3. </p> + +<li> <p> In the <b>standard</b> form, the <i>name</i> will be quoted +if it contains <b>specials</b> as defined in RFC 5322, or the "!%" +address operators. </p> + +<li> <p> The Postfix sendmail(1) command gets <i>name</i> information +from the <b>-F</b> command-line option, from the <b>NAME</b> +environment variable, or from the UNIX password file. </p> + +</ul> + +<p> This feature is available in Postfix 3.3 and later. </p> + +%PARAM tlsproxy_client_CAfile $smtp_tls_CAfile + +<p> A file containing CA certificates of root CAs trusted to sign +either remote TLS server certificates or intermediate CA certificates. +See smtp_tls_CAfile for further details. </p> + +<p> This feature is available in Postfix 3.4 and later. </p> + +%PARAM tlsproxy_client_CApath $smtp_tls_CApath + +<p> Directory with PEM format Certification Authority certificates +that the Postfix tlsproxy(8) client uses to verify a remote TLS +server certificate. See smtp_tls_CApath for further details. </p> + +<p> This feature is available in Postfix 3.4 and later. </p> + +%PARAM tlsproxy_client_cert_file $smtp_tls_cert_file + +<p> File with the Postfix tlsproxy(8) client RSA certificate in PEM +format. See smtp_tls_cert_file for further details. The preferred way +to configure tlsproxy client keys and certificates is via the +"tlsproxy_client_chain_files" parameter. </p> + +<p> This feature is available in Postfix 3.4 and later. </p> + +%PARAM tlsproxy_client_key_file $smtp_tls_key_file + +<p> File with the Postfix tlsproxy(8) client RSA private key in PEM +format. See smtp_tls_key_file for further details. The preferred way to +configure tlsproxy client keys and certificates is via the +"tlsproxy_client_chain_files" parameter. </p> + +<p> This feature is available in Postfix 3.4 and later. </p> + +%PARAM tlsproxy_client_dcert_file $smtp_tls_dcert_file + +<p> File with the Postfix tlsproxy(8) client DSA certificate in PEM +format. See smtp_tls_dcert_file for further details. DSA is obsolete and +should not be used. </p> + +<p> This feature is available in Postfix 3.4 and later. </p> + +%PARAM tlsproxy_client_dkey_file $smtp_tls_dkey_file + +<p> File with the Postfix tlsproxy(8) client DSA private key in PEM +format. See smtp_tls_dkey_file for further details. DSA is obsolete and +should not be used. </p> + +<p> This feature is available in Postfix 3.4 and later. </p> + +%PARAM tlsproxy_client_eccert_file $smtp_tls_eccert_file + +<p> File with the Postfix tlsproxy(8) client ECDSA certificate in PEM +format. See smtp_tls_eccert_file for further details. The preferred way +to configure tlsproxy client keys and certificates is via the +"tlsproxy_client_chain_files" parameter. </p> + +<p> This feature is available in Postfix 3.4 and later. </p> + +%PARAM tlsproxy_client_eckey_file $smtp_tls_eckey_file + +<p> File with the Postfix tlsproxy(8) client ECDSA private key in PEM +format. See smtp_tls_eckey_file for further details. The preferred way +to configure tlsproxy client keys and certificates is via the +"tlsproxy_client_chain_files" parameter. </p> + +<p> This feature is available in Postfix 3.4 and later. </p> + +%PARAM tlsproxy_client_fingerprint_digest $smtp_tls_fingerprint_digest + +<p> The message digest algorithm used to construct remote TLS server +certificate fingerprints. See smtp_tls_fingerprint_digest for +further details. </p> + +<p> This feature is available in Postfix 3.4 and later. </p> + +%PARAM tlsproxy_client_loglevel $smtp_tls_loglevel + +<p> Enable additional Postfix tlsproxy(8) client logging of TLS +activity. See smtp_tls_loglevel for further details. </p> + +<p> This feature is available in Postfix 3.4 and later. </p> + +%PARAM tlsproxy_client_loglevel_parameter smtp_tls_loglevel + +<p> The name of the parameter that provides the tlsproxy_client_loglevel +value. </p> + +<p> This feature is available in Postfix 3.4 and later. </p> + +%PARAM tlsproxy_client_scert_verifydepth $smtp_tls_scert_verifydepth + +<p> The verification depth for remote TLS server certificates. +See smtp_tls_scert_verifydepth for further details. </p> + +<p> This feature is available in Postfix 3.4 and later. </p> + +%PARAM tlsproxy_client_level $smtp_tls_security_level + +<p> The default TLS security level for the Postfix tlsproxy(8) +client. See smtp_tls_security_level for further details. </p> + +<p> This feature is available in Postfix 3.4 - 3.6. It was +renamed to tlsproxy_client_security_level in Postfix 3.7. </p> + +%PARAM tlsproxy_client_security_level $smtp_tls_security_level + +<p> The default TLS security level for the Postfix tlsproxy(8) +client. See smtp_tls_security_level for further details. </p> + +<p> This feature is available in Postfix 3.7 and later. It +was previously called tlsproxy_client_level. </p> + +%PARAM tlsproxy_client_per_site $smtp_tls_per_site + +<p> Optional lookup tables with the Postfix tlsproxy(8) client TLS +usage policy by next-hop destination and by remote TLS server +hostname. See smtp_tls_per_site for further details. </p> + +<p> This feature is available in Postfix 3.4 and later. </p> + +%PARAM tlsproxy_client_policy $smtp_tls_policy_maps + +<p> Optional lookup tables with the Postfix tlsproxy(8) client TLS +security policy by next-hop destination. See smtp_tls_policy_maps +for further details. </p> + +<p> This feature is available in Postfix 3.4 - 3.6. It was +renamed to tlsproxy_client_policy_maps in Postfix 3.7. </p> + +%PARAM tlsproxy_client_policy_maps $smtp_tls_policy_maps + +<p> Optional lookup tables with the Postfix tlsproxy(8) client TLS +security policy by next-hop destination. See smtp_tls_policy_maps +for further details. </p> + +<p> This feature is available in Postfix 3.7 and later. It +was previously called tlsproxy_client_policy. </p> + +%PARAM tlsproxy_client_use_tls $smtp_use_tls + +<p> Opportunistic mode: use TLS when a remote server announces TLS +support. See smtp_use_tls for further details. Use +tlsproxy_client_security_level instead. </p> + +<p> This feature is available in Postfix 3.4 and later. </p> + +%PARAM tlsproxy_client_enforce_tls $smtp_enforce_tls + +<p> Enforcement mode: require that SMTP servers use TLS encryption. +See smtp_enforce_tls for further details. Use +tlsproxy_client_security_level instead. </p> + +<p> This feature is available in Postfix 3.4 and later. </p> + +%PARAM smtpd_tls_chain_files + +<p> List of one or more PEM files, each holding one or more private keys +directly followed by a corresponding certificate chain. The file names +are separated by commas and/or whitespace. This parameter obsoletes the +legacy algorithm-specific key and certificate file settings. When this +parameter is non-empty, the legacy parameters are ignored, and a warning +is logged if any are also non-empty. </p> + +<p> With the proliferation of multiple private key algorithms—which, +as of OpenSSL 1.1.1, include DSA (obsolete), RSA, ECDSA, Ed25519 +and Ed448—it is increasingly impractical to use separate +parameters to configure the key and certificate chain for each +algorithm. Therefore, Postfix now supports storing multiple keys and +corresponding certificate chains in a single file or in a set of files. + +<p> Each key must appear <b>immediately before</b> the corresponding +certificate, optionally followed by additional issuer certificates that +complete the certificate chain for that key. When multiple files are +specified, they are equivalent to a single file that is concatenated +from those files in the given order. Thus, while a key must always +precede its certificate and issuer chain, it can be in a separate file, +so long as that file is listed immediately before the file that holds +the corresponding certificate chain. Once all the files are +concatenated, the sequence of PEM objects must be: <i>key1, cert1, +[chain1], key2, cert2, [chain2], ..., keyN, certN, [chainN].</i> </p> + +<p> Storing the private key in the same file as the corresponding +certificate is more reliable. With the key and certificate in separate +files, there is a chance that during key rollover a Postfix process +might load a private key and certificate from separate files that don't +match. Various operational errors may even result in a persistent +broken configuration in which the certificate does not match the private +key. </p> + +<p> The file or files must contain at most one key of each type. If, +for example, two or more RSA keys and corresponding chains are listed, +depending on the version of OpenSSL either only the last one will be +used or a configuration error may be detected. Note that while +"Ed25519" and "Ed448" are considered separate algorithms, the various +ECDSA curves (typically one of prime256v1, secp384r1 or secp521r1) are +considered as different parameters of a single "ECDSA" algorithm, so it +is not presently possible to configure keys for more than one ECDSA +curve. </p> + +<p> RSA is still the most widely supported algorithm. Presently (late +2018), ECDSA support is common, but not yet universal, and Ed25519 and +Ed448 support is mostly absent. Therefore, an RSA key should generally +be configured, along with any additional keys for the other algorithms +when desired. </p> + +<p> +Example (separate files for each key and corresponding certificate chain): +</p> +<blockquote> +<pre> +/etc/postfix/main.cf: + smtpd_tls_chain_files = + ${config_directory}/ed25519.pem, + ${config_directory}/ed448.pem, + ${config_directory}/rsa.pem +</pre> +</blockquote> + +<blockquote> +<pre> +/etc/postfix/ed25519.pem: + -----BEGIN PRIVATE KEY----- + MC4CAQAwBQYDK2VwBCIEIEJfbbO4BgBQGBg9NAbIJaDBqZb4bC4cOkjtAH+Efbz3 + -----END PRIVATE KEY----- + -----BEGIN CERTIFICATE----- + MIIBKzCB3qADAgECAhQaw+rflRreYuUZBp0HuNn/e5rMZDAFBgMrZXAwFDESMBAG + ... + nC0egv51YPDWxEHom4QA + -----END CERTIFICATE----- +</pre> +</blockquote> + +<blockquote> +<pre> +/etc/postfix/ed448.pem: + -----BEGIN PRIVATE KEY----- + MEcCAQAwBQYDK2VxBDsEOQf+m0P+G0qi+NZ0RolyeiE5zdlPQR8h8y4jByBifpIe + LNler7nzHQJ1SLcOiXFHXlxp/84VZuh32A== + -----END PRIVATE KEY----- + -----BEGIN CERTIFICATE----- + MIIBdjCB96ADAgECAhQSv4oP972KypOZPNPF4fmsiQoRHzAFBgMrZXEwFDESMBAG + ... + pQcWsx+4J29e6YWH3Cy/CdUaexKP4RPCZDrPX7bk5C2BQ+eeYOxyThMA + -----END CERTIFICATE----- +</pre> +</blockquote> + +<blockquote> +<pre> +/etc/postfix/rsa.pem: + -----BEGIN PRIVATE KEY----- + MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQDc4QusgkahH9rL + ... + ahQkZ3+krcaJvDSMgvu0tDc= + -----END PRIVATE KEY----- + -----BEGIN CERTIFICATE----- + MIIC+DCCAeCgAwIBAgIUIUkrbk1GAemPCT8i9wKsTGDH7HswDQYJKoZIhvcNAQEL + ... + Rirz15HGVNTK8wzFd+nulPzwUo6dH2IU8KazmyRi7OGvpyrMlm15TRE2oyE= + -----END CERTIFICATE----- +</pre> +</blockquote> + +<p> +Example (all keys and certificates in a single file): +</p> +<blockquote> +<pre> +/etc/postfix/main.cf: + smtpd_tls_chain_files = ${config_directory}/chains.pem +</pre> +</blockquote> + +<blockquote> +<pre> +/etc/postfix/chains.pem: + -----BEGIN PRIVATE KEY----- + MC4CAQAwBQYDK2VwBCIEIEJfbbO4BgBQGBg9NAbIJaDBqZb4bC4cOkjtAH+Efbz3 + -----END PRIVATE KEY----- + -----BEGIN CERTIFICATE----- + MIIBKzCB3qADAgECAhQaw+rflRreYuUZBp0HuNn/e5rMZDAFBgMrZXAwFDESMBAG + ... + nC0egv51YPDWxEHom4QA + -----END CERTIFICATE----- + -----BEGIN PRIVATE KEY----- + MEcCAQAwBQYDK2VxBDsEOQf+m0P+G0qi+NZ0RolyeiE5zdlPQR8h8y4jByBifpIe + LNler7nzHQJ1SLcOiXFHXlxp/84VZuh32A== + -----END PRIVATE KEY----- + -----BEGIN CERTIFICATE----- + MIIBdjCB96ADAgECAhQSv4oP972KypOZPNPF4fmsiQoRHzAFBgMrZXEwFDESMBAG + ... + pQcWsx+4J29e6YWH3Cy/CdUaexKP4RPCZDrPX7bk5C2BQ+eeYOxyThMA + -----END CERTIFICATE----- + -----BEGIN PRIVATE KEY----- + MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQDc4QusgkahH9rL + ... + ahQkZ3+krcaJvDSMgvu0tDc= + -----END PRIVATE KEY----- + -----BEGIN CERTIFICATE----- + MIIC+DCCAeCgAwIBAgIUIUkrbk1GAemPCT8i9wKsTGDH7HswDQYJKoZIhvcNAQEL + ... + Rirz15HGVNTK8wzFd+nulPzwUo6dH2IU8KazmyRi7OGvpyrMlm15TRE2oyE= + -----END CERTIFICATE----- +</pre> +</blockquote> + +<p> This feature is available in Postfix 3.4 and later. </p> + +%PARAM smtp_tls_chain_files + +<p> List of one or more PEM files, each holding one or more private keys +directly followed by a corresponding certificate chain. The file names +are separated by commas and/or whitespace. This parameter obsoletes the +legacy algorithm-specific key and certificate file settings. When this +parameter is non-empty, the legacy parameters are ignored, and a warning +is logged if any are also non-empty. </p> + +<p> With the proliferation of multiple private key algorithms—which, +as of OpenSSL 1.1.1, include DSA (obsolete), RSA, ECDSA, Ed25519 +and Ed448—it is increasingly impractical to use separate +parameters to configure the key and certificate chain for each +algorithm. Therefore, Postfix now supports storing multiple keys and +corresponding certificate chains in a single file or in a set of files. + +<p> Each key must appear <b>immediately before</b> the corresponding +certificate, optionally followed by additional issuer certificates that +complete the certificate chain for that key. When multiple files are +specified, they are equivalent to a single file that is concatenated +from those files in the given order. Thus, while a key must always +precede its certificate and issuer chain, it can be in a separate file, +so long as that file is listed immediately before the file that holds +the corresponding certificate chain. Once all the files are +concatenated, the sequence of PEM objects must be: <i>key1, cert1, +[chain1], key2, cert2, [chain2], ..., keyN, certN, [chainN].</i> </p> + +<p> Storing the private key in the same file as the corresponding +certificate is more reliable. With the key and certificate in separate +files, there is a chance that during key rollover a Postfix process +might load a private key and certificate from separate files that don't +match. Various operational errors may even result in a persistent +broken configuration in which the certificate does not match the private +key. </p> + +<p> The file or files must contain at most one key of each type. If, +for example, two or more RSA keys and corresponding chains are listed, +depending on the version of OpenSSL either only the last one will be +used or a configuration error may be detected. Note that while +"Ed25519" and "Ed448" are considered separate algorithms, the various +ECDSA curves (typically one of prime256v1, secp384r1 or secp521r1) are +considered as different parameters of a single "ECDSA" algorithm, so it +is not presently possible to configure keys for more than one ECDSA +curve. </p> + +<p> +Example (separate files for each key and corresponding certificate chain): +</p> +<blockquote> +<pre> +/etc/postfix/main.cf: + smtp_tls_chain_files = + ${config_directory}/ed25519.pem, + ${config_directory}/ed448.pem, + ${config_directory}/rsa.pem +</pre> +</blockquote> + +<blockquote> +<pre> +/etc/postfix/ed25519.pem: + -----BEGIN PRIVATE KEY----- + MC4CAQAwBQYDK2VwBCIEIEJfbbO4BgBQGBg9NAbIJaDBqZb4bC4cOkjtAH+Efbz3 + -----END PRIVATE KEY----- + -----BEGIN CERTIFICATE----- + MIIBKzCB3qADAgECAhQaw+rflRreYuUZBp0HuNn/e5rMZDAFBgMrZXAwFDESMBAG + ... + nC0egv51YPDWxEHom4QA + -----END CERTIFICATE----- +</pre> +</blockquote> + +<blockquote> +<pre> +/etc/postfix/ed448.pem: + -----BEGIN PRIVATE KEY----- + MEcCAQAwBQYDK2VxBDsEOQf+m0P+G0qi+NZ0RolyeiE5zdlPQR8h8y4jByBifpIe + LNler7nzHQJ1SLcOiXFHXlxp/84VZuh32A== + -----END PRIVATE KEY----- + -----BEGIN CERTIFICATE----- + MIIBdjCB96ADAgECAhQSv4oP972KypOZPNPF4fmsiQoRHzAFBgMrZXEwFDESMBAG + ... + pQcWsx+4J29e6YWH3Cy/CdUaexKP4RPCZDrPX7bk5C2BQ+eeYOxyThMA + -----END CERTIFICATE----- +</pre> +</blockquote> + +<blockquote> +<pre> +/etc/postfix/rsa.pem: + -----BEGIN PRIVATE KEY----- + MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQDc4QusgkahH9rL + ... + ahQkZ3+krcaJvDSMgvu0tDc= + -----END PRIVATE KEY----- + -----BEGIN CERTIFICATE----- + MIIC+DCCAeCgAwIBAgIUIUkrbk1GAemPCT8i9wKsTGDH7HswDQYJKoZIhvcNAQEL + ... + Rirz15HGVNTK8wzFd+nulPzwUo6dH2IU8KazmyRi7OGvpyrMlm15TRE2oyE= + -----END CERTIFICATE----- +</pre> +</blockquote> + +<p> +Example (all keys and certificates in a single file): +</p> +<blockquote> +<pre> +/etc/postfix/main.cf: + smtp_tls_chain_files = ${config_directory}/chains.pem +</pre> +</blockquote> + +<blockquote> +<pre> +/etc/postfix/chains.pem: + -----BEGIN PRIVATE KEY----- + MC4CAQAwBQYDK2VwBCIEIEJfbbO4BgBQGBg9NAbIJaDBqZb4bC4cOkjtAH+Efbz3 + -----END PRIVATE KEY----- + -----BEGIN CERTIFICATE----- + MIIBKzCB3qADAgECAhQaw+rflRreYuUZBp0HuNn/e5rMZDAFBgMrZXAwFDESMBAG + ... + nC0egv51YPDWxEHom4QA + -----END CERTIFICATE----- + -----BEGIN PRIVATE KEY----- + MEcCAQAwBQYDK2VxBDsEOQf+m0P+G0qi+NZ0RolyeiE5zdlPQR8h8y4jByBifpIe + LNler7nzHQJ1SLcOiXFHXlxp/84VZuh32A== + -----END PRIVATE KEY----- + -----BEGIN CERTIFICATE----- + MIIBdjCB96ADAgECAhQSv4oP972KypOZPNPF4fmsiQoRHzAFBgMrZXEwFDESMBAG + ... + pQcWsx+4J29e6YWH3Cy/CdUaexKP4RPCZDrPX7bk5C2BQ+eeYOxyThMA + -----END CERTIFICATE----- + -----BEGIN PRIVATE KEY----- + MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQDc4QusgkahH9rL + ... + ahQkZ3+krcaJvDSMgvu0tDc= + -----END PRIVATE KEY----- + -----BEGIN CERTIFICATE----- + MIIC+DCCAeCgAwIBAgIUIUkrbk1GAemPCT8i9wKsTGDH7HswDQYJKoZIhvcNAQEL + ... + Rirz15HGVNTK8wzFd+nulPzwUo6dH2IU8KazmyRi7OGvpyrMlm15TRE2oyE= + -----END CERTIFICATE----- +</pre> +</blockquote> + +<p> This feature is available in Postfix 3.4 and later. </p> + +%PARAM lmtp_tls_chain_files + +<p> The LMTP-specific version of the smtp_tls_chain_files configuration +parameter. See there for details. </p> + +<p> This feature is available in Postfix 3.4 and later. </p> + +%PARAM tlsproxy_client_chain_files $smtp_tls_chain_files + +<p> Files with the Postfix tlsproxy(8) client keys and certificate +chains in PEM format. See smtp_tls_chain_files for further details. </p> + +<p> This feature is available in Postfix 3.4 and later. </p> + +%PARAM tlsproxy_tls_chain_files $smtpd_tls_chain_files + +<p> Files with the Postfix tlsproxy(8) server keys and certificate +chains in PEM format. See smtpd_tls_chain_files for further details. </p> + +<p> This feature is available in Postfix 3.4 and later. </p> + +%PARAM tls_server_sni_maps + +<p> Optional lookup tables that map names received from remote SMTP +clients via the TLS Server Name Indication (SNI) extension to the +appropriate keys and certificate chains. This parameter is implemented +in the Postfix TLS library, and applies to both smtpd(8) and the SMTP +server mode of tlsproxy(8). </p> + +<p> When this parameter is non-empty, the Postfix SMTP server enables +SNI extension processing, and logs SNI values that are invalid or +don't match an entry in the specified tables. When an entry +does match, the SNI name is logged as part of the connection summary +at log levels 1 and higher. </p> + +<p> The lookup key is either the verbatim SNI domain name or an +ancestor domain prefixed with a leading dot. For internationalized +domains, the lookup key must be in IDNA 2008 A-label form (as +required in the TLS SNI extension). </p> + +<p> The syntax of the lookup value is the same as with the +smtp_tls_chain_files parameter (see there for additional details), +but here scoped to just TLS connections in which the client sends +a matching SNI domain name. </p> + +<p> Example: </p> +<blockquote> +<pre> +/etc/postfix/main.cf: + # + # The indexed SNI table must be created with "postmap -F" + # + indexed = ${default_database_type}:${config_directory}/ + tls_server_sni_maps = ${indexed}sni +</pre> +</blockquote> + +<blockquote> +<pre> +/etc/postfix/sni: + # + # The example.com domain has both an RSA and ECDSA certificate + # chain. The chain files MUST start with the private key, + # with the certificate chain next, starting with the leaf + # (server) certificate, and then the issuer certificates. + # + example.com /etc/postfix/sni-chains/rsa2048.example.com.pem, + /etc/postfix/sni-chains/ecdsa-p256.example.com.pem + # + # The example.net domain has a wildcard certificate, and two + # additional DNS names. So its certificate chain is also used + # with any subdomain, plus the additional names. + # + example.net /etc/postfix/sni-chains/example.net.pem + .example.net /etc/postfix/sni-chains/example.net.pem + example.info /etc/postfix/sni-chains/example.net.pem + example.org /etc/postfix/sni-chains/example.net.pem +</pre> +</blockquote> + +<p> Note that the SNI lookup tables should also have entries for +the domains that correspond to the Postfix SMTP server's default +certificate(s). This ensures that the remote SMTP client's TLS SNI +extension gets a positive response when it specifies one of the +Postfix SMTP server's default domains, and ensures that the Postfix +SMTP server will not log an SNI name mismatch for such a domain. +The Postfix SMTP server's default certificates are then only used +when the client sends no SNI or when it sends SNI with a domain +that the server knows no certificate(s) for. </p> + +<p> The mapping from an SNI domain name to a certificate chain is indirect. In +the input source files for "cdb", "hash", "btree" or other tables that are +converted to on-disk indexed files via postmap(1), the value specified for each +key is a list of filenames. When postmap(1) is used with the <b>-F</b> option, +the generated table stores for each lookup key the base64-encoded contents of +the associated files. When querying tables via <b>postmap -Fq</b>, the table +value is decoded from base64, yielding the original file content, plus a new +line. </p> + +<p> With "regexp", "pcre", "inline", "texthash", "static" and similar +tables that are interpreted at run-time, and don't have a separate +source format, the table value is again a list files, that are loaded +into memory when the table is opened. </p> + +<p> With tables whose content is managed outside of Postfix, such +as LDAP, MySQL, PostgreSQL, socketmap and tcp, the value must be a +concatenation of the desired PEM keys and certificate chains, that +is then further encoded to yield a single-line base64 string. +Creation of such tables and secure storage (the value includes +private key material) are outside the responsibility of Postfix. </p> + +<p> With "socketmap" and "tcp" the data will be transmitted in the clear, and +there is no query access control, so these are generally unsuitable for storing +SNI chains. With LDAP and SQL, you should restrict read access and use TLS to +protect the sensitive data in transit. </p> + +<p> Typically there is only one private key and its chain of certificates +starting with the "leaf" certificate corresponding to that key, and +continuing with the appropriate intermediate issuer CA certificates, +with each certificate ideally followed by its issuer. Servers +that have keys and certificates for more than one algorithm (e.g. +both an RSA key and an ECDSA key, or even RSA, ECDSA and Ed25519) +can use multiple chains concatenated together, with the key always +listed before the corresponding certificates. </p> + +<p> This feature is available in Postfix 3.4 and later. </p> + +%PARAM smtp_tls_servername + +<p> Optional name to send to the remote SMTP server in the TLS Server +Name Indication (SNI) extension. The SNI extension is always on when +DANE is used to authenticate the server, and in that case the SNI name +sent is the one required by RFC7672 and this parameter is ignored. </p> + +<p> Some SMTP servers use the received SNI name to select an appropriate +certificate chain to present to the client. While this may improve +interoperability with such servers, it may reduce interoperability with +other servers that choose to abort the connection when they don't have a +certificate chain configured for the requested name. Such servers +should select a default certificate chain and continue the handshake, +but some may not. Therefore, absent DANE, no SNI name is sent by +default. </p> + +<p> The SNI name must be either a valid DNS hostname, or else one of the +special values <b>hostname</b> or <b>nexthop</b>, which select either the +remote hostname or the nexthop domain respectively. DNS names for SNI must be +in A-label (punycode) form. Invalid DNS names log a configuration error +warning and mail delivery is deferred. </p> + +<p> Except when using a relayhost to forward all email, the only +sensible non-empty main.cf setting for this parameter is +<b>hostname</b>. Other non-empty values are only practical on a +per-destination basis via the <b>servername</b> attribute of the Postfix +TLS <a href="TLS_README.html#client_tls_policy">policy table</a>. When +in doubt, leave this parameter empty, and configure per-destination SNI +as needed. </p> + +<p> This feature is available in Postfix 3.4 and later. </p> + +%PARAM lmtp_tls_servername + +<p> The LMTP-specific version of the smtp_tls_servername configuration +parameter. See there for details. </p> + +<p> This feature is available in Postfix 3.4 and later. </p> + +%PARAM maillog_file + +<p> The name of an optional logfile that is written by the Postfix +postlogd(8) service. An empty value selects logging to syslogd(8). +Specify "/dev/stdout" to select logging to standard output. Stdout +logging requires that Postfix is started with "postfix start-fg". +</p> + +<p> Note 1: The maillog_file parameter value must contain a prefix +that is specified with the maillog_file_prefixes parameter. </p> + +<p> Note 2: Some Postfix non-daemon programs may still log information +to syslogd(8), before they have processed their configuration +parameters and command-line options. </p> + +<p> This feature is available in Postfix 3.4 and later. </p> + +%PARAM postlog_service_name postlog + +<p> The name of the postlogd(8) service entry in master.cf. +This service appends logfile records to the file specified +with the maillog_file parameter. </p> + +<p> This feature is available in Postfix 3.4 and later. </p> + +%PARAM postlogd_watchdog_timeout 10s + +<p> How much time a postlogd(8) process may take to process a request +before it is terminated by a built-in watchdog timer. This is a +safety mechanism that prevents postlogd(8) from becoming non-responsive +due to a bug in Postfix itself or in system software. This limit +cannot be set under 10s. </p> + +<p> Specify a non-zero time value (an integral value plus an optional +one-letter suffix that specifies the time unit). Time units: s +(seconds), m (minutes), h (hours), d (days), w (weeks). +The default time unit is s (seconds). </p> + +<p> This feature is available in Postfix 3.4 and later. </p> + +%PARAM maillog_file_prefixes /var, /dev/stdout + +<p> A list of allowed prefixes for a maillog_file value. This is a +safety feature to contain the damage from a single configuration +mistake. Specify one or more prefix strings, separated by comma or +whitespace. </p> + +<p> This feature is available in Postfix 3.4 and later. </p> + +%PARAM maillog_file_compressor gzip + +<p> The program to run after rotating $maillog_file with "postfix +logrotate". The command is run with the rotated logfile name as its +first argument. </p> + +<p> This feature is available in Postfix 3.4 and later. </p> + +%PARAM maillog_file_rotate_suffix %Y%m%d-%H%M%S + +<p> The format of the suffix to append to $maillog_file while rotating +the file with "postfix logrotate". See strftime(3) for syntax. The +default suffix, YYYYMMDD-HHMMSS, allows logs to be rotated frequently. +</p> + +<p> This feature is available in Postfix 3.4 and later. </p> + +%PARAM info_log_address_format external + +<p> The email address form that will be used in non-debug logging +(info, warning, etc.). As of Postfix 3.5 when an address localpart +contains spaces or other special characters, the localpart will be +quoted, for example: </p> + +<blockquote> +<pre> + from=<"name with spaces"@example.com> +</pre> +</blockquote> + +<p> Older Postfix versions would log the internal (unquoted) form: </p> + +<blockquote> +<pre> + from=<name with spaces@example.com> +</pre> +</blockquote> + +<p> The external and internal forms are identical for the vast +majority of email addresses that contain no spaces or other special +characters in the localpart. </p> + +<p> The logging in external form is consistent with the address +form that Postfix 3.2 and later prefer for most table lookups. This +is therefore the more useful form for non-debug logging. </p> + +<p> Specify "<b>info_log_address_format = internal</b>" for backwards +compatibility. </p> + +<p> Postfix uses the unquoted form internally, because an attacker +can specify an email address in different forms by playing games +with quotes and backslashes. An attacker should not be able to use +such games to circumvent Postfix access policies. </p> + +<p> This feature is available in Postfix 3.5 and later. </p> + +%PARAM smtpd_sasl_mechanism_filter !external, static:rest + +<p> If non-empty, a filter for the SASL mechanism names that the +Postfix SMTP server will announce in the EHLO response. By default, +the Postfix SMTP server will not announce the EXTERNAL mechanism, +because Postfix support for that is not implemented. </p> + +<p> Specify mechanism names, "/file/name" patterns, or "type:table" +lookup tables, separated by comma or whitespace. The right-hand +side result from "type:table" lookups is ignored. Specify "!pattern" +to exclude a mechanism name from the list. </p> + +<p> +Examples: +</p> + +<pre> +smtpd_sasl_mechanism_filter = !external, !gssapi, static:rest +smtpd_sasl_mechanism_filter = login, plain +smtpd_sasl_mechanism_filter = /etc/postfix/smtpd_mechs +</pre> + +<p> This feature is available in Postfix 3.6 and later. </p> + +%PARAM dnssec_probe ns:. + +<p> The DNS query type (default: "ns") and DNS query name (default: +".") that Postfix may use to determine whether DNSSEC validation +is available. +</p> + +<p> Background: DNSSEC validation is needed for Postfix DANE support; +this ensures that Postfix receives TLSA records with secure TLS +server certificate info. When DNSSEC validation is unavailable, +mail deliveries using <i>opportunistic</i> DANE will not be protected +by server certificate info in TLSA records, and mail deliveries +using <i>mandatory</i> DANE will not be made at all. </p> + +<p> By default, a Postfix process will send a DNSSEC probe after +1) the process made a DNS query that requested DNSSEC validation, +2) the process did not receive a DNSSEC validated response to this +query or to an earlier query, and 3) the process did not already +send a DNSSEC probe. <p> + +<p> When the DNSSEC probe has no response, or when the response is +not DNSSEC validated, Postfix logs a warning that DNSSEC validation +may be unavailable. </p> + +<p> Example: </p> + +<pre> +warning: DNSSEC validation may be unavailable +warning: reason: dnssec_probe 'ns:.' received a response that is not DNSSEC validated +warning: reason: dnssec_probe 'ns:.' received no response: Server failure +</pre> + +<p> Possible reasons why DNSSEC validation may be unavailable: </p> + +<ul> + +<li> The local /etc/resolv.conf file specifies a DNS resolver that +does not validate DNSSEC signatures (that's +$queue_directory/etc/resolv.conf when a Postfix daemon runs in a +chroot jail). + +<li> The local system library does not pass on the "DNSSEC validated" +bit to Postfix, or Postfix does not know how to ask the library to +do that. + +</ul> + +<p> By default, the DNSSEC probe asks for the DNS root zone NS +records, because resolvers should always have that information +cached. If Postfix runs on a network where the DNS root zone is not +reachable, specify a different probe, or specify an empty dnssec_probe +value to disable the feature. </p> + +<p> This feature is available in Postfix 3.6 and later. It was backported +to Postfix versions 3.5.9, 3.4.19, 3.3.16. 3.2.21. </p> + +%PARAM local_login_sender_maps static:* + +<p> A list of lookup tables that are searched by the UNIX login name, +and that return a list of allowed envelope sender patterns separated +by space or comma. These sender patterns are enforced by the Postfix +postdrop(1) command. The default is backwards-compatible: +every user may specify any sender envelope address. </p> + +<p> When no UNIX login name is available, the postdrop(1) command will +prepend "<b>uid:</b>" to the numerical UID and use that instead. </p> + +<p> This feature ignores address extensions in the user-specified +envelope sender address. </p> + +<p> The following sender patterns are special; these cannot be used +as part of a longer pattern. </p> + +<dl compact> + +<dt> <b> * </b> <dd> This pattern allows any envelope sender address. +</dd> + +<dt> <b> <> </b> </dt> <dd> This pattern allows the empty +envelope sender address. See the +empty_address_local_login_sender_maps_lookup_key configuration +parameter. </dd> + +<dt> <b> @</b><i>domain</i> </dt> <dd> This pattern allows an +envelope sender address when the '<b>@</b>' and <i>domain</i> part +match. </dd> + +</dl> + +<p> Examples: </p> + +<pre> +/etc/postfix/main.cf: + # Allow root and postfix full control, anyone else can only + # send mail as themselves. Use "uid:" followed by the numerical + # UID when the UID has no entry in the UNIX password file. + local_login_sender_maps = + inline:{ { root = * }, { postfix = * } }, + pcre:/etc/postfix/login_senders +</pre> + +<pre> +/etc/postfix/login_senders: + # Allow both the bare username and the user@domain forms. + /(.+)/ $1 $1@example.com +</pre> + +<p> This feature is available in Postfix 3.6 and later. </p> + +%PARAM empty_address_local_login_sender_maps_lookup_key <> + +<p> +The lookup key to be used in local_login_sender_maps tables, instead +of the null sender address. +</p> + +<p> This feature is available in Postfix 3.6 and later. </p> + +%PARAM enable_threaded_bounces no + +<p> Enable non-delivery, success, and delay notifications that link +to the original message by including a References: and In-Reply-To: +header with the original Message-ID value. There are advantages and +disadvantages to consider. </p> + +<dl> + +<dt> <b> advantage </b> </dt> <dd> This allows mail readers to present +a delivery status notification in the same email thread as the original +message. </dd> + +<dt> <b> disadvantage </b> </dt> <dd> This makes it easy for users to +mistakenly delete the whole email thread (all related messages), +instead of deleting only the non-delivery notification. </dd> + +</dl> + +<p> This feature is available in Postfix 3.6 and later. </p> + +%PARAM smtpd_relay_before_recipient_restrictions see "postconf -d" output + +<p> Evaluate smtpd_relay_restrictions before smtpd_recipient_restrictions. +Historically, smtpd_relay_restrictions was evaluated after +smtpd_recipient_restrictions, contradicting documented behavior. </p> + +<p> Background: the smtpd_relay_restrictions feature is primarily +designed to enforce a mail relaying policy, while +smtpd_recipient_restrictions is primarily designed to enforce spam +blocking policy. Both are evaluated while replying to the RCPT TO +command, and both support the same features. </p> + +<p> This feature is available in Postfix 3.6 and later. </p> + +%PARAM respectful_logging see 'postconf -d' output + +<p> Avoid logging that implies white is better than black. Instead +use 'allowlist', 'denylist', and variations of those words. </p> + +<p> This feature is available in Postfix 3.6 and later. </p> + +%PARAM known_tcp_ports lmtp=24, smtp=25, smtps=submissions=465, submission=587 + +<p> Optional setting that avoids lookups in the services(5) database. +This feature was implemented to address inconsistencies in the name +of the port "465" service. The ABNF is: +</p> + +<blockquote> +<p> +known_tcp_ports = empty | name-to-port *("," name-to-port) <br> +name-to-port = 1*(service-name "=') port-number +</p> +</blockquote> + +<p> The comma is required. Whitespace is optional but it cannot appear +inside a service name or port number. </p> + +<p> This feature is available in Postfix 3.6 and later. </p> + +%PARAM smtpd_min_data_rate 500 + +<p> The minimum plaintext data transfer rate in bytes/second for +DATA and BDAT requests, when deadlines are enabled with +smtpd_per_request_deadline. After a read operation transfers N +plaintext message bytes (possibly after TLS decryption), and after +the DATA or BDAT request deadline is decremented by the elapsed +time of that read operation, the DATA or BDAT request deadline is +incremented by N/smtpd_min_data_rate seconds. However, the deadline +will never be incremented beyond the time limit specified with +smtpd_timeout. </p> + +<p> This feature is available in Postfix 3.7 and later. </p> + +%PARAM smtpd_per_request_deadline normal: no, overload: yes + +<p> Change the behavior of the smtpd_timeout and smtpd_starttls_timeout +time limits, from a time limit per plaintext or TLS read or write +call, to a combined time limit for receiving a complete SMTP request +and for sending a complete SMTP response. The deadline limits only +the time spent waiting for plaintext or TLS read or write calls, +not time spent elsewhere. The per-request deadline limits the impact +from hostile peers that trickle data one byte at a time. </p> + +<p> See smtpd_min_data_rate for how the per-request deadline is +managed during the DATA and BDAT phase. </p> + +<p> Note: when per-request deadlines are enabled, a short time limit +may cause problems with TLS over very slow network connections. The +reason is that a TLS protocol message can be up to 16 kbytes long +(with TLSv1), and that an entire TLS protocol message must be +transferred within the per-request deadline. </p> + +<p> This feature is available in Postfix 3.7 and later. A weaker +feature, called smtpd_per_record_deadline, is available with Postfix +2.9-3.6. With older Postfix releases, the behavior is as if this +parameter is set to "no". </p> + +<p> This feature is available in Postfix 3.7 and later. </p> + +%PARAM lmtp_min_data_rate 500 + +<p> The LMTP-specific version of the smtp_min_data_rate configuration +parameter. See there for details. </p> + +<p> This feature is available in Postfix 3.7 and later. </p> + +%PARAM lmtp_per_request_deadline no + +<p> The LMTP-specific version of the smtp_per_request_deadline +configuration parameter. See there for details. </p> + +<p> This feature is available in Postfix 3.7 and later. </p> + +%PARAM smtp_min_data_rate 500 + +<p> The minimum plaintext data transfer rate in bytes/second for +DATA requests, when deadlines are enabled with smtp_per_request_deadline. +After a write operation transfers N plaintext message bytes (possibly +after TLS encryption), and after the DATA request deadline is +decremented by the elapsed time of that write operation, the DATA +request deadline is incremented by N/smtp_min_data_rate seconds. +However, the deadline will never be incremented beyond the time +limit specified with smtp_data_xfer_timeout. </p> + +<p> This feature is available in Postfix 3.7 and later. </p> + +%PARAM smtp_per_request_deadline no + +<p> Change the behavior of the smtp_*_timeout time limits, from a +time limit per plaintext or TLS read or write call, to a combined +time limit for sending a complete SMTP request and for receiving a +complete SMTP response. The deadline limits only the time spent +waiting for plaintext or TLS read or write calls, not time spent +elsewhere. The per-request deadline limits the impact from hostile +peers that trickle data one byte at a time. </p> + +<p> See smtp_min_data_rate for how the per-request deadline is +managed during the DATA phase. </p> + +<p> Note: when per-request deadlines are enabled, a short time limit +may cause problems with TLS over very slow network connections. The +reason is that a TLS protocol message can be up to 16 kbytes long +(with TLSv1), and that an entire TLS protocol message must be +transferred within the per-request deadline. </p> + +<p> This feature is available in Postfix 3.7 and later. A weaker +feature, called smtp_per_record_deadline, is available with Postfix +2.9-3.6. </p> + +<p> This feature is available in Postfix 3.7 and later. </p> + +%PARAM smtp_bind_address_enforce no + +<p> Defer delivery when the Postfix SMTP client cannot apply the +smtp_bind_address or smtp_bind_address6 setting. By default, the +Postfix SMTP client will continue delivery after logging a warning. +</p> + +<p> This feature is available in Postfix 3.7 and later. </p> + +%PARAM lmtp_bind_address_enforce + +<p> The LMTP-specific version of the smtp_bind_address_enforce +configuration parameter. See there for details. </p> + +<p> This feature is available in Postfix 3.7 and later. </p> + +%PARAM tls_config_name + +<p> The application name passed by Postfix to OpenSSL library +initialization functions. This name is used to select the desired +configuration "section" in the OpenSSL configuration file specified +via the tls_config_file parameter. When empty, or when the +selected name is not present in the configuration file, the default +application name ("openssl_conf") is used as a fallback. </p> + +<p> This feature is available in Postfix ≥ 3.9, 3.8.1, 3.7.6, +3.6.10, and 3.5.20. </p> + +%PARAM tls_config_file default + +<p> Optional configuration file with baseline OpenSSL settings. +OpenSSL loads any SSL settings found in the configuration file for +the selected application name (see tls_config_name) or else the +built-in application name "openssl_conf" when no application name is +specified, or no corresponding configuration section is present. +</p> + +<p> With OpenSSL releases 1.1.1 and 1.1.1a, applications (including +Postfix) can neither specify an alternative configuration file, nor +avoid loading the default configuration file. </p> + +<p> With OpenSSL 1.1.1b or later, this parameter may be set to one of: +</p> + +<dl> + +<dt> <b>default</b> (default) </dt> <dd> Load the system-wide +"openssl.cnf" configuration file. </dd> + +<dt> <b>none</b> (recommended, OpenSSL 1.1.1b or later only) </dt> +<dd> This setting disables loading of the system-wide "openssl.cnf" +file. </dd> + +<dt> <b><i>/absolute-path</i></b> (OpenSSL 1.1.1b or later only) </dt> +<dd> Load the configuration file specified by <i>/absolute-path</i>. +With this setting it is an error for the file to not contain any +settings for the selected tls_config_name. There is no fallback to +the default "openssl_conf" name. </dd> + +</dl> + +<p> Failures in processing of the built-in default configuration file, +are silently ignored. Any errors in loading a non-default configuration +file are detected by Postfix, and cause TLS support to be disabled. +</p> + +<p> The OpenSSL configuration file format is not documented here, +beyond giving two examples. <p> + +<p> Example: Default settings for all applications. </p> + +<blockquote> +<pre> +# The name 'openssl_conf' is the default application name +# The section name to the right of the '=' sign is arbitrary, +# any name will do, so long as it refers to the desired section. +# +# The name 'system_default' selects the settings applied internally +# by the SSL library as part of SSL object creation. Applications +# can then apply any additional settings of their choice. +# +# In this example, TLS versions prior to 1.2 are disabled by default. +# +openssl_conf = system_wide_settings +[system_wide_settings] +ssl_conf = ssl_library_settings +[ssl_library_settings] +system_default = initial_ssl_settings +[initial_ssl_settings] +MinProtocol = TLSv1.2 +</pre> +</blockquote> + +<p> Example: Custom settings for an application named "postfix". </p> + +<blockquote> +<pre> +# The mapping from an application name to the corresponding configuration +# section must appear near the top of the file, (in what is sometimes called +# the "default section") prior to the start of any explicitly named +# "[sections]". The named sections can appear in any order and don't nest. +# +postfix = postfix_settings +[postfix_settings] +ssl_conf = postfix_ssl_settings +[postfix_ssl_settings] +system_default = baseline_postfix_settings +[baseline_postfix_settings] +MinProtocol = TLSv1 +</pre> +</blockquote> + +<p> This feature is available in Postfix ≥ 3.9, 3.8.1, 3.7.6, +3.6.10, and 3.5.20. </p> + +%PARAM smtpd_forbid_bare_newline Postfix < 3.9: no + +<p> Reject or restrict input lines from an SMTP client that end in +<LF> instead of the standard <CR><LF>. Such line +endings are commonly allowed with UNIX-based SMTP servers, but they +violate RFC 5321, and allowing such line endings can make a server +vulnerable to <a href="https://www.postfix.org/smtp-smuggling.html"> +SMTP smuggling</a>. </p> + +<p> Specify one of the following values (case does not matter): </p> + +<dl compact> + +<dt> <b>normalize</b></dt> <dd> Require the standard +End-of-DATA sequence <CR><LF>.<CR><LF>. +Otherwise, allow command or message content lines ending in the +non-standard <LF>, and process them as if the client sent the +standard <CR><LF>. <br> <br> This maintains compatibility +with many legitimate SMTP client applications that send a mix of +standard and non-standard line endings, but will fail to receive +email from client implementations that do not terminate DATA content +with the standard End-of-DATA sequence +<CR><LF>.<CR><LF>. <br> <br> Such clients +can be excluded with smtpd_forbid_bare_newline_exclusions. </dd> + +<dt> <b>yes</b> </dt> <dd> Compatibility alias for <b>normalize</b>. </dd> + +<dt> <b>reject</b> </dt> <dd> Require the standard End-of-DATA +sequence <CR><LF>.<CR><LF>. Reject a command +or message content when a line contains bare <LF>, log a "bare +<LF> received" error, and reply with the SMTP status code in +$smtpd_forbid_bare_newline_reject_code. <br> <br> This will reject +email from SMTP clients that send any non-standard line endings +such as web applications, netcat, or load balancer health checks. +<br> <br> This will also reject email from services that use BDAT +to send MIME text containing a bare newline (RFC 3030 Section 3 +requires canonical MIME format for text message types, defined in +RFC 2045 Sections 2.7 and 2.8). <br> <br> Such clients can be +excluded with smtpd_forbid_bare_newline_exclusions (or, in the case +of BDAT violations, BDAT can be selectively disabled with +smtpd_discard_ehlo_keyword_address_maps, or globally disabled with +smtpd_discard_ehlo_keywords). </dd> + +<dt> <b>no</b> (default)</dt> <dd> Do not require the standard +End-of-DATA +sequence <CR><LF>.<CR><LF>. Always process +a bare <LF> as if the client sent <CR><LF>. This +option is fully backwards compatible, but is not recommended for +an Internet-facing SMTP server, because it is vulnerable to <a +href="https://www.postfix.org/smtp-smuggling.html"> SMTP smuggling</a>. +</dd> + +</dl> + +<p> Recommended settings: </p> + +<blockquote> +<pre> +# Require the standard End-of-DATA sequence <CR><LF>.<CR><LF>. +# Otherwise, allow bare <LF> and process it as if the client sent +# <CR><LF>. +# +# This maintains compatibility with many legitimate SMTP client +# applications that send a mix of standard and non-standard line +# endings, but will fail to receive email from client implementations +# that do not terminate DATA content with the standard End-of-DATA +# sequence <CR><LF>.<CR><LF>. +# +# Such clients can be allowlisted with smtpd_forbid_bare_newline_exclusions. +# The example below allowlists SMTP clients in trusted networks. +# +smtpd_forbid_bare_newline = normalize +smtpd_forbid_bare_newline_exclusions = $mynetworks +</pre> +</blockquote> + +<p> Alternative: </p> + +<blockquote> +<pre> +# Reject input lines that contain <LF> and log a "bare <LF> received" +# error. Require that input lines end in <CR><LF>, and require the +# standard End-of-DATA sequence <CR><LF>.<CR><LF>. +# +# This will reject email from SMTP clients that send any non-standard +# line endings such as web applications, netcat, or load balancer +# health checks. +# +# This will also reject email from services that use BDAT to send +# MIME text containing a bare newline (RFC 3030 Section 3 requires +# canonical MIME format for text message types, defined in RFC 2045 +# Sections 2.7 and 2.8). +# +# Such clients can be allowlisted with smtpd_forbid_bare_newline_exclusions. +# The example below allowlists SMTP clients in trusted networks. +# +smtpd_forbid_bare_newline = reject +smtpd_forbid_bare_newline_exclusions = $mynetworks +# +# Alternatively, in the case of BDAT violations, BDAT can be selectively +# disabled with smtpd_discard_ehlo_keyword_address_maps, or globally +# disabled with smtpd_discard_ehlo_keywords. +# +# smtpd_discard_ehlo_keyword_address_maps = cidr:/path/to/file +# /path/to/file: +# 10.0.0.0/24 chunking, silent-discard +# smtpd_discard_ehlo_keywords = chunking, silent-discard +</pre> +</blockquote> + +<p> This feature with settings <b>yes</b> and <b>no</b> is available +in Postfix 3.8.4, 3.7.9, 3.6.13, and 3.5.23. Additionally, the +settings <b>reject</b>, and <b>normalize</b> are available with +Postfix ≥ 3.9, 3.8.5, 3.7.10, 3.6.14, and 3.5.24. </p> + +%PARAM smtpd_forbid_bare_newline_exclusions $mynetworks + +<p> Exclude the specified clients from smtpd_forbid_bare_newline +enforcement. This setting uses the same syntax and parent-domain +matching behavior as mynetworks. </p> + +<p> This feature is available in Postfix ≥ 3.9, 3.8.4, 3.7.9, +3.6.13, and 3.5.23. </p> + +%PARAM smtpd_forbid_bare_newline_reject_code 550 + +<p> +The numerical Postfix SMTP server response code when rejecting a +request with "smtpd_forbid_bare_newline = reject". +Specify a 5XX status code (521 to disconnect). +</p> + +<p> This feature is available in Postfix ≥ 3.9, 3.8.5, 3.7.10, +3.6.14, and 3.5.24. </p> + +%PARAM cleanup_replace_stray_cr_lf yes + +<p> Replace each stray <CR> or <LF> character in message +content with a space character, to prevent outbound SMTP smuggling, +and to make the evaluation of Postfix-added DKIM or other signatures +independent from how a remote mail server handles such characters. +</p> + +<p> SMTP does not allow such characters unless they are part of a +<CR><LF> sequence, and different mail systems handle +such stray characters in an implementation-dependent manner. Stray +<CR> or <LF> characters could be used for outbound +SMTP smuggling, where an attacker uses a Postfix server to send +message content with a non-standard End-of-DATA sequence that +triggers inbound SMTP smuggling at a remote SMTP server.</p> + +<p> The replacement happens before all other content management, +and before Postfix may add a DKIM etc. signature; if the signature +were created first, the replacement could invalidate the signature. +</p> + +<p> In addition to preventing SMTP smuggling, replacing stray +<CR> or <LF> characters ensures that the result of +signature validation by later mail system will not depend on how +that mail system handles those stray characters in an +implementation-dependent manner. </p> + +<p> This feature is available in Postfix ≥ 3.9, 3.8.5, 3.7.10, +3.6.14, and 3.5.24. </p> + +%PARAM smtpd_forbid_unauth_pipelining Postfix ≥ 3.9: yes + +<p> Disconnect remote SMTP clients that violate RFC 2920 (or 5321) +command pipelining constraints. The server replies with "554 5.5.0 +Error: SMTP protocol synchronization" and logs the unexpected remote +SMTP client input. Specify "smtpd_forbid_unauth_pipelining = yes" +to enable. This feature is enabled by default with Postfix ≥ +3.9. </p> + +<p> This feature is available in Postfix ≥ 3.9, 3.8.1, 3.7.6, +3.6.10, and 3.5.20. </p> |