~ubuntu-branches/ubuntu/trusty/postfix/trusty-updates

Committer: Package Import Robot
Author(s): LaMont Jones, LaMont Jones, localization folks
Date: 2014-02-11 07:44:30 UTC
mfrom: (58.1.1 sid)
Revision ID: package-import@ubuntu.com-20140211074430-kwkoxdz0fbajn0fj

Tags: 2.11.0-1

http://bugs.debian.org/734893

[LaMont Jones]

* New upstream release: 2.11.0

[localization folks]

* l10n: Updated German translations. Closes: #734893 (Helge Kreutzmann)

files added:
README_FILES/FORWARD_SECRECY_README

README_FILES/LMDB_README

RELEASE_NOTES-2.10

html/FORWARD_SECRECY_README.html

html/LMDB_README.html

html/lmdb_table.5.html

html/posttls-finger.1.html

html/socketmap_table.5.html

man/man1/posttls-finger.1

man/man5/lmdb_table.5

man/man5/socketmap_table.5

proto/FORWARD_SECRECY_README.html

proto/LMDB_README.html

proto/lmdb_table

proto/socketmap_table

src/global/mkmap_lmdb.c

src/global/safe_ultostr.in

src/global/safe_ultostr.ref

src/postconf/postconf_match.c

src/postconf/postconf_print.c

src/postconf/test41.ref

src/postconf/test42.ref

src/postconf/test43.ref

src/postconf/test44.ref

src/postconf/test45.ref

src/postconf/test46.ref

src/postconf/test47.ref

src/postconf/test48.ref

src/postconf/test49.ref

src/postconf/test50.ref

src/postconf/test51.ref

src/postconf/test52.ref

src/postconf/test53.ref

src/postconf/test54.ref

src/postconf/test55.ref

src/postconf/test56.ref

src/posttls-finger

src/posttls-finger/.indent.pro

src/posttls-finger/Makefile.in

src/posttls-finger/posttls-finger.c

src/posttls-finger/tlsmgrmem.c

src/posttls-finger/tlsmgrmem.h

src/smtp/smtp_key.c

src/smtp/smtp_tls_policy.c

src/tls/tls_dane.c

src/tls/tls_dane.sh

src/tls/tls_fprint.c

src/util/compat_va_copy.h

src/util/dict_lmdb.c

src/util/dict_lmdb.h

src/util/lmdb_cache_test_1.sh

src/util/lmdb_cache_test_2.sh

src/util/poll_fd.c

src/util/slmdb.c

src/util/slmdb.h

src/util/timecmp.c

src/util/timecmp.h

files removed:
src/util/read_wait.c

src/util/readable.c

src/util/writable.c

src/util/write_wait.c

files modified:
.indent.pro

AAAREADME

HISTORY

Makefile.in

README_FILES/AAAREADME

README_FILES/ADDRESS_REWRITING_README

README_FILES/ADDRESS_VERIFICATION_README

README_FILES/BACKSCATTER_README

README_FILES/CONNECTION_CACHE_README

README_FILES/DATABASE_README

README_FILES/INSTALL

README_FILES/MULTI_INSTANCE_README

README_FILES/POSTSCREEN_README

README_FILES/RESTRICTION_CLASS_README

README_FILES/SASL_README

README_FILES/SCHEDULER_README

README_FILES/SMTPD_ACCESS_README

README_FILES/STRESS_README

README_FILES/TLS_README

RELEASE_NOTES

conf/access

conf/canonical

conf/main.cf

conf/master.cf

conf/post-install

conf/postfix-files

conf/virtual

debian/changelog

debian/control

debian/po/de.po

html/ADDRESS_REWRITING_README.html

html/ADDRESS_VERIFICATION_README.html

html/BACKSCATTER_README.html

html/BASIC_CONFIGURATION_README.html

html/BUILTIN_FILTER_README.html

html/CONNECTION_CACHE_README.html

html/DATABASE_README.html

html/ETRN_README.html

html/INSTALL.html

html/LDAP_README.html

html/MAILDROP_README.html

html/MULTI_INSTANCE_README.html

html/Makefile.in

html/POSTSCREEN_README.html

html/QSHAPE_README.html

html/RESTRICTION_CLASS_README.html

html/SASL_README.html

html/SCHEDULER_README.html

html/SMTPD_ACCESS_README.html

html/SMTPD_POLICY_README.html

html/SOHO_README.html

html/STANDARD_CONFIGURATION_README.html

html/STRESS_README.html

html/TLS_LEGACY_README.html

html/TLS_README.html

html/UUCP_README.html

html/VIRTUAL_README.html

html/access.5.html

html/aliases.5.html

html/anvil.8.html

html/bounce.5.html

html/bounce.8.html

html/canonical.5.html

html/cidr_table.5.html

html/cleanup.8.html

html/defer.8.html

html/discard.8.html

html/dnsblog.8.html

html/error.8.html

html/flush.8.html

html/generic.5.html

html/header_checks.5.html

html/index.html

html/ldap_table.5.html

html/lmtp.8.html

html/local.8.html

html/mailq.1.html

html/master.5.html

html/master.8.html

html/memcache_table.5.html

html/mysql_table.5.html

html/newaliases.1.html

html/nisplus_table.5.html

html/oqmgr.8.html

html/pcre_table.5.html

html/pgsql_table.5.html

html/pickup.8.html

html/pipe.8.html

html/postalias.1.html

html/postcat.1.html

html/postconf.1.html

html/postconf.5.html

html/postdrop.1.html

html/postfix-manuals.html

html/postfix-wrapper.5.html

html/postfix.1.html

html/postkick.1.html

html/postlock.1.html

html/postlog.1.html

html/postmap.1.html

html/postmulti.1.html

html/postqueue.1.html

html/postscreen.8.html

html/postsuper.1.html

html/proxymap.8.html

html/qmgr.8.html

html/qmqp-sink.1.html

html/qmqp-source.1.html

html/qmqpd.8.html

html/qshape.1.html

html/regexp_table.5.html

html/relocated.5.html

html/scache.8.html

html/sendmail.1.html

html/showq.8.html

html/smtp-sink.1.html

html/smtp-source.1.html

html/smtp.8.html

html/smtpd.8.html

html/spawn.8.html

html/sqlite_table.5.html

html/tcp_table.5.html

html/tlsmgr.8.html

html/tlsproxy.8.html

html/trace.8.html

html/transport.5.html

html/trivial-rewrite.8.html

html/verify.8.html

html/virtual.5.html

html/virtual.8.html

makedefs

man/Makefile.in

man/man1/postconf.1

man/man1/postfix.1

man/man1/postmulti.1

man/man5/access.5

man/man5/canonical.5

man/man5/cidr_table.5

man/man5/header_checks.5

man/man5/ldap_table.5

man/man5/master.5

man/man5/memcache_table.5

man/man5/mysql_table.5

man/man5/nisplus_table.5

man/man5/pcre_table.5

man/man5/pgsql_table.5

man/man5/postconf.5

man/man5/regexp_table.5

man/man5/sqlite_table.5

man/man5/tcp_table.5

man/man5/virtual.5

man/man8/discard.8

man/man8/local.8

man/man8/oqmgr.8

man/man8/pipe.8

man/man8/postscreen.8

man/man8/qmgr.8

man/man8/smtp.8

man/man8/smtpd.8

man/man8/tlsmgr.8

man/man8/tlsproxy.8

man/man8/trivial-rewrite.8

mantools/ccformat

mantools/man2html

mantools/postconf2man

mantools/postlink

proto/ADDRESS_VERIFICATION_README.html

proto/CONNECTION_CACHE_README.html

proto/DATABASE_README.html

proto/INSTALL.html

proto/MULTI_INSTANCE_README.html

proto/Makefile.in

proto/POSTSCREEN_README.html

proto/SASL_README.html

proto/SCHEDULER_README.html

proto/STRESS_README.html

proto/TLS_README.html

proto/access

proto/canonical

proto/cidr_table

proto/header_checks

proto/ldap_table

proto/master

proto/memcache_table

proto/mysql_table

proto/nisplus_table

proto/pcre_table

proto/pgsql_table

proto/postconf.man.prolog

proto/postconf.proto

proto/regexp_table

proto/sqlite_table

proto/stop

proto/tcp_table

proto/virtual

src/cleanup/Makefile.in

src/cleanup/cleanup.h

src/cleanup/cleanup_addr.c

src/cleanup/cleanup_map11.c

src/cleanup/cleanup_map1n.c

src/cleanup/cleanup_masquerade.c

src/cleanup/cleanup_message.c

src/cleanup/cleanup_milter.c

src/cleanup/cleanup_state.c

src/discard/discard.c

src/dns/dns.h

src/dns/dns_lookup.c

src/dns/dns_rr.c

src/dns/dns_rr_eq_sa.in

src/dns/dns_rr_eq_sa.ref

src/dns/dns_sa_to_rr.c

src/dns/dns_strtype.c

src/dns/test_dns_lookup.c

src/global/Makefile.in

src/global/data_redirect.c

src/global/dict_ldap.c

src/global/dict_ldap.h

src/global/dict_memcache.c

src/global/dict_mysql.c

src/global/dsn_buf.c

src/global/dsn_buf.h

src/global/mail_addr_find.c

src/global/mail_params.c

src/global/mail_params.h

src/global/mail_proto.h

src/global/mail_version.h

src/global/match_service.c

src/global/mbox_open.c

src/global/memcache_proto.c

src/global/mkmap.h

src/global/mkmap_open.c

src/global/resolve_clnt.c

src/global/safe_ultostr.c

src/global/split_addr.c

src/global/split_addr.h

src/global/strip_addr.c

src/global/strip_addr.h

src/global/strip_addr.ref

src/global/xtext.c

src/global/xtext.h

src/local/bounce_workaround.c

src/local/local.c

src/local/local_expand.c

src/local/recipient.c

src/local/resolve.c

src/master/master_ent.c

src/master/master_vars.c

src/milter/Makefile.in

src/milter/milter8.c

src/milter/test-milter.c

src/oqmgr/qmgr.c

src/oqmgr/qmgr_message.c

src/pipe/pipe.c

src/postalias/postalias.c

src/postconf/Makefile.in

src/postconf/extract.awk

src/postconf/install_table.h

src/postconf/postconf.c

src/postconf/postconf.h

src/postconf/postconf_builtin.c

src/postconf/postconf_dbms.c

src/postconf/postconf_edit.c

src/postconf/postconf_lookup.c

src/postconf/postconf_main.c

src/postconf/postconf_master.c

src/postconf/postconf_misc.c

src/postconf/postconf_node.c

src/postconf/postconf_other.c

src/postconf/postconf_service.c

src/postconf/postconf_unused.c

src/postconf/postconf_user.c

src/postconf/test10.ref

src/postconf/test37.ref

src/postconf/test40.ref

src/postfix/postfix.c

src/postmap/postmap.c

src/postmulti/postmulti.c

src/postscreen/Makefile.in

src/postscreen/postscreen.c

src/postscreen/postscreen.h

src/postscreen/postscreen_early.c

src/postscreen/postscreen_endpt.c

src/postscreen/postscreen_state.c

src/postscreen/postscreen_tests.c

src/qmgr/qmgr.c

src/qmgr/qmgr_job.c

src/qmgr/qmgr_message.c

src/smtp/Makefile.in

src/smtp/lmtp_params.c

src/smtp/smtp.c

src/smtp/smtp.h

src/smtp/smtp_addr.c

src/smtp/smtp_addr.h

src/smtp/smtp_chat.c

src/smtp/smtp_connect.c

src/smtp/smtp_params.c

src/smtp/smtp_proto.c

src/smtp/smtp_rcpt.c

src/smtp/smtp_reuse.c

src/smtp/smtp_reuse.h

src/smtp/smtp_sasl_auth_cache.c

src/smtp/smtp_sasl_glue.c

src/smtp/smtp_sasl_proto.c

src/smtp/smtp_session.c

src/smtp/smtp_state.c

src/smtpd/Makefile.in

src/smtpd/smtpd.c

src/smtpd/smtpd_check.c

src/smtpd/smtpd_check.in

src/smtpd/smtpd_check.in2

src/smtpd/smtpd_check.ref

src/smtpd/smtpd_check.ref2

src/smtpd/smtpd_dsn_fix.h

src/smtpd/smtpd_proxy.c

src/smtpd/smtpd_proxy.h

src/smtpd/smtpd_sasl_glue.c

src/smtpstone/Makefile.in

src/smtpstone/smtp-sink.c

src/smtpstone/smtp-source.c

src/tls/Makefile.in

src/tls/tls.h

src/tls/tls_bio_ops.c

src/tls/tls_client.c

src/tls/tls_level.c

src/tls/tls_mgr.c

src/tls/tls_mgr.h

src/tls/tls_misc.c

src/tls/tls_proxy_clnt.c

src/tls/tls_proxy_print.c

src/tls/tls_proxy_scan.c

src/tls/tls_rsa.c

src/tls/tls_scache.c

src/tls/tls_scache.h

src/tls/tls_server.c

src/tls/tls_verify.c

src/tlsmgr/Makefile.in

src/tlsmgr/tlsmgr.c

src/tlsproxy/Makefile.in

src/tlsproxy/tlsproxy.c

src/trivial-rewrite/transport.c

src/trivial-rewrite/trivial-rewrite.c

src/util/Makefile.in

src/util/argv.c

src/util/argv.h

src/util/argv_split.c

src/util/attr_clnt.c

src/util/attr_clnt.h

src/util/attr_print0.c

src/util/attr_print64.c

src/util/attr_print_plain.c

src/util/base64_code.c

src/util/base64_code.h

src/util/concatenate.c

src/util/ctable.c

src/util/ctable.h

src/util/dict.c

src/util/dict.h

src/util/dict_alloc.c

src/util/dict_cache.c

src/util/dict_cdb.c

src/util/dict_cidr.c

src/util/dict_dbm.c

src/util/dict_ni.c

src/util/dict_open.c

src/util/dict_pcre.c

src/util/dict_regexp.c

src/util/dict_sockmap.c

src/util/dict_surrogate.c

src/util/dict_test.c

src/util/dict_thash.c

src/util/host_port.c

src/util/iostuff.h

src/util/mac_parse.c

src/util/name_mask.c

src/util/netstring.c

src/util/open_limit.c

src/util/split_nameval.c

src/util/sys_defs.h

src/util/vbuf_print.c

src/util/vstring_vstream.c

Show diffs side-by-side

added added

removed removed

proto/postconf.proto

583

This is enabled by default.

584

585

586

Note: with Postfix version 2.2, message header address rewriting

586

Note: as of Postfix version 2.2, message header address rewriting

587

happens only when one of the following conditions is true:

588

589

<ul>

1609

1610

<dt>$recipient_delimiter</dt>

1611

1612

<dd>The system-wide recipient address extension delimiter. </dd>

1612

<dd>The address extension delimiter that was found in the recipient

1613

address (Postfix 2.11 and later), or the system-wide recipient

1614

address extension delimiter (Postfix 2.10 and earlier). </dd>

1613

1615

1614

1616

<dt>${name?value}</dt>

1615

1617

1670

1672

1671

1673

<dt>$recipient_delimiter</dt>

1672

1674

1673

<dd>The system-wide recipient address extension delimiter. </dd>

1675

<dd>The address extension delimiter that was found in the recipient

1676

address (Postfix 2.11 and later), or the system-wide recipient

1677

address extension delimiter (Postfix 2.10 and earlier). </dd>

1674

1678

1675

1679

<dt>${name?value}</dt>

1676

1680

1971

1975

Postfix will do DNS type AAAA record lookups.

1972

1976

1973

1977

When both IPv4 and IPv6 support are enabled, the Postfix SMTP

1974

client will attempt to connect via IPv6 before attempting to use

1975

IPv4.

1978

client will choose the protocol as specified with the

1979

smtp_address_preference parameter. Postfix versions before 2.8

1980

attempt to connect via IPv6 before attempting to use IPv4.

1976

1981

1977

1982

1978

1983

Examples:

2404

2409

2405

2410

<dt>$recipient_delimiter</dt>

2406

2411

2407

<dd>The system-wide recipient address extension delimiter. </dd>

2412

<dd>The address extension delimiter that was found in the recipient

2413

address (Postfix 2.11 and later), or the system-wide recipient

2414

address extension delimiter (Postfix 2.10 and earlier). </dd>

2408

2415

2409

2416

<dt>$shell</dt>

2410

2417

2831

2838

Specify 0 when mail delivery should be tried only once.

2832

2839

2833

2840

2841

%PARAM lmdb_map_size 16777216

2842

2843

2844

The initial OpenLDAP LMDB database size limit in bytes. Each time

2845

a database becomes full, its size limit is doubled.

2846

2847

2848

2849

This feature is available in Postfix 2.11 and later.

2850

2851

2834

2852

%PARAM message_size_limit 10240000

2835

2853

2836

2854

3484

3502

recipient_canonical_maps = hash:/etc/postfix/recipient_canonical

3485

3503

</pre>

3486

3504

3487

%PARAM recipient_delimiter

3488

3489

3490

The separator between user names and address extensions (user+foo).

3491

See canonical(5), local(8), relocated(5) and virtual(5) for the

3492

effects this has on aliases, canonical, virtual, relocated and

3493

on .forward file lookups. Basically, the software tries user+foo

3494

and .forward+foo before trying user and .forward.

3495

3496

3497

3498

Example:

3499

3500

3505

%PARAM recipient_delimiter

3506

3507

The set of characters that can separate a user name from its

3508

extension (example: user+foo), or a .forward file name from its

3509

extension (example: .forward+foo). Basically, the software tries

3510

user+foo and .forward+foo before trying user and .forward. This

3511

implementation recognizes one delimiter character and one extension

3512

per email address or .forward file name.

3513

3514

When the recipient_delimiter set contains multiple characters

3515

(Postfix 2.11 and later), a user name or .forward file name is

3516

separated from its extension by the first character that matches

3517

the recipient_delimiter set.

3518

3519

See canonical(5), local(8), relocated(5) and virtual(5) for the

3520

effects of recipient_delimiter on lookups in aliases, canonical,

3521

virtual, and relocated maps, and see the propagate_unmatched_extensions

3522

parameter for propagating an extension from one email address to

3523

another.

3524

3525

When used in command_execution_directory, forward_path, or

3526

luser_relay, ${recipient_delimiter} is replaced with the actual

3527

recipient delimiter that was found in the recipient email address

3528

(Postfix 2.11 and later), or it is replaced with the main.cf

3529

recipient_delimiter parameter value (Postfix 2.10 and earlier).

3530

3531

3532

The recipient_delimiter is not applied to the mailer-daemon

3533

address, the postmaster address, or the double-bounce address. With

3534

the default "owner_request_special = yes" setting, the recipient_delimiter

3535

is also not applied to addresses with the special "owner-" prefix

3536

or the special "-request" suffix.

3537

3538

3539

Examples:

3540

3541

3501

3542

<pre>

3543

# Handle Postfix-style extensions.

3502

3544

recipient_delimiter = +

3503

3545

</pre>

3504

3546

3547

<pre>

3548

# Handle both Postfix and qmail extensions (Postfix 2.11 and later).

3549

recipient_delimiters = +-

3550

</pre>

3551

3552

<pre>

3553

# Use .forward for mail without address extension, and for mail with

3554

# an unrecognized address extension.

3555

forward_path = $home/.forward${recipient_delimiter}${extension},

3556

$home/.forward

3557

</pre>

3558

3505

3559

%PARAM reject_code 554

3506

3560

3507

3561

3859

3913

3860

3914

This feature is available in Postfix 2.2 and later.

3861

3915

3862

%PARAM smtp_connection_cache_reuse_limit 10

3863

3864

When SMTP connection caching is enabled, the number of times that

3865

an SMTP session may be reused before it is closed.

3866

3867

3868

This feature is available in Postfix 2.2. In Postfix 2.3 it is

3869

replaced by $smtp_connection_reuse_time_limit.

3870

3871

3916

%PARAM smtp_connection_reuse_time_limit 300s

3872

3917

3873

3918

The amount of time during which Postfix will use an SMTP

4167

4212

%PARAM smtp_host_lookup dns

4168

4213

4169

4214

4170

What mechanisms the Postfix SMTP client uses to look up a host's IP

4171

address. This parameter is ignored when DNS lookups are disabled

4172

(see: disable_dns_lookups).

4215

What mechanisms the Postfix SMTP client uses to look up a host's

4216

IP address. This parameter is ignored when DNS lookups are disabled

4217

(see: disable_dns_lookups and smtp_dns_support_level). The "dns"

4218

mechanism is always tried before "native" if both are listed.

4173

4219

4174

4220

4175

4221

4477

4523

%PARAM smtp_skip_5xx_greeting yes

4478

4524

4479

4525

4480

Skip remote SMTP servers that greet with a 5XX status code (go away,

4481

4482

not try again later).

4526

Skip remote SMTP servers that greet with a 5XX status code.

4483

4527

4484

4528

4485

4529

By default, the Postfix SMTP client moves on the next mail

4486

4530

exchanger. Specify "smtp_skip_5xx_greeting = no" if Postfix should

4487

bounce the mail immediately. The default setting is incorrect, but

4488

it is what a lot of people expect to happen.

4531

bounce the mail immediately. Caution: the latter behavior appears

4532

to contradict RFC 2821.

4489

4533

4490

4534

%PARAM smtp_skip_quit_response yes

4491

4535

4935

4979

Instead, use DUNNO in order to exclude specific hosts from blacklists.

4936

4980

This feature is available in Postfix 2.7 and later. </dd>

4937

4981

4982

<dt><a name="check_sasl_access">check_sasl_access</a> <a href="DATABASE_README.html">type:table</a></dt>

4983

4984

<dd> Use the remote SMTP client SASL user name as lookup key for

4985

the specified access(5) database. The lookup key has the form

4986

"username@domainname" when the smtpd_sasl_local_domain parameter

4987

value is non-empty. Unlike the check_client_access feature,

4988

check_sasl_access does not perform matches of parent domains or IP

4989

subnet ranges. This feature is available with Postfix version 2.11

4990

and later. </dd>

4991

4938

4992

<dt><a name="permit_inet_interfaces">permit_inet_interfaces</a></dt>

4939

4993

4940

4994

<dd>Permit the request when the client IP address matches

5491

5545

<dt><a name="reject_non_fqdn_helo_hostname">reject_non_fqdn_helo_hostname</a> (with Postfix < 2.3: reject_non_fqdn_hostname)</dt>

5492

5546

5493

5547

<dd>Reject the request when the HELO or EHLO hostname is not in

5494

fully-qualified domain form, as required by the RFC. Note: specify

5548

fully-qualified domain or address literal form, as required by the

5549

RFC. Note: specify

5495

5550

"smtpd_helo_required = yes" to fully enforce this restriction

5496

5551

(without "smtpd_helo_required = yes", a client can simply skip

5497

5552

reject_non_fqdn_helo_hostname by not sending HELO or EHLO).

5500

5555

5501

5556

<dt><a name="reject_rhsbl_helo">reject_rhsbl_helo rbl_domain=d.d.d.d</a></dt>

5502

5557

5503

<dd>Reject the request when the HELO or EHLO hostname hostname is

5558

<dd>Reject the request when the HELO or EHLO hostname is

5504

5559

listed with the A record "d.d.d.d" under rbl_domain

5505

5560

(Postfix version 2.1 and later only). Each "d" is a number,

5506

5561

or a pattern inside "[]" that contains one or more ";"-separated

5870

5925

numerical response code when an address probe failed due to a

5871

5926

temporary problem (default: 450). The

5872

5927

unverified_recipient_tempfail_action parameter specifies the action

5873

after addres probe failure due to a temporary problem (default:

5928

after address probe failure due to a temporary problem (default:

5874

5929

defer_if_permit). This feature is available in Postfix 2.1

5875

5930

and later. </dd>

5876

5931

6253

6308

authenticated clients only. This feature is available in

6254

6309

Postfix version 2.1 and later. </dd>

6255

6310

6311

<dt><a name="reject_known_sender_login_mismatch">reject_known_sender_login_mismatch</a></dt>

6312

6313

<dd>Apply the reject_sender_login_mismatch restriction only to MAIL

6314

FROM addresses that are known in $smtpd_sender_login_maps. This

6315

feature is available in Postfix version 2.11 and later. </dd>

6316

6256

6317

<dt><a name="reject_non_fqdn_sender">reject_non_fqdn_sender</a></dt>

6257

6318

6258

6319

<dd>Reject the request when the MAIL FROM address is not in

6319

6380

response code when an address is known to bounce (default: 450,

6320

6381

change into 550 when you are confident that it is safe to do so).

6321

6382

The unverified_sender_defer_code specifies the numerical response

6322

code when an address address probe failed due to a temporary problem

6383

code when an address probe failed due to a temporary problem

6323

6384

(default: 450). The unverified_sender_tempfail_action parameter

6324

6385

specifies the action after address probe failure due to a temporary

6325

6386

problem (default: defer_if_permit). This feature is available

6812

6873

6813

6874

6814

6875

Note: the command is subject to $name expansion, before it is

6815

passed to the default commmand interpreter. Specify "$$" to

6876

passed to the default command interpreter. Specify "$$" to

6816

6877

produce a single "$" character.

6817

6878

6818

6879

7303

7364

7304

7365

Disable DNS lookups in the Postfix SMTP and LMTP clients. When

7305

7366

disabled, hosts are looked up with the getaddrinfo() system

7306

library routine which normally also looks in /etc/hosts.

7367

library routine which normally also looks in /etc/hosts. As of

7368

Postfix 2.11, this parameter is deprecated; use smtp_dns_support_level

7369

instead.

7307

7370

7308

7371

7309

7372

9231

9294

tlsmgr(8) daemon and therefore per-smtpd-instance master.cf overrides

9232

9295

are not possible.

9233

9296

9234

This feature is available in Postfix 2.2 and later.

9297

As of Postfix 2.11 this setting cannot exceed 100 days. If set

9298

≤ 0, session caching is disabled, not just via the database, but

9299

also via RFC 5077 TLS session tickets, which don't require server-side

9300

storage. If set to a positive value less than 2 minutes, the minimum

9301

value of 2 minutes is used instead. TLS session tickets require

9302

an OpenSSL library (at least version 0.9.8h) that provides full

9303

support for this TLS extension.

9304

9305

This feature is available in Postfix 2.2 and later, and updated

9306

for TLS session ticket support in Postfix 2.11.

9235

9307

9236

9308

%PARAM relay_clientcerts

9237

9309

9283

9355

%PARAM smtpd_tls_dh1024_param_file

9284

9356

9285

9357

File with DH parameters that the Postfix SMTP server should

9286

use with EDH ciphers.

9358

use with non-export EDH ciphers.

9287

9359

9288

9360

Instead of using the exact same parameter sets as distributed

9289

9361

with other TLS packages, it is more secure to generate your own

9290

set of parameters with something like the following command:

9362

set of parameters with something like the following commands:

9291

9363

9292

9364

9293

9365

<pre>

9294

openssl gendh -out /etc/postfix/dh_1024.pem -2 1024

9366

openssl dhparam -out /etc/postfix/dh512.pem 512

9367

openssl dhparam -out /etc/postfix/dh1024.pem 1024

9368

openssl dhparam -out /etc/postfix/dh2048.pem 2048

9295

9369

</pre>

9296

9370

</blockquote>

9297

9371

9298

Your actual source for entropy may differ. Some systems have

9299

/dev/random; on other system you may consider using the "Entropy

9300

Gathering Daemon EGD", available at http://egd.sourceforge.net/

9301

9372

It is safe to share the same DH parameters between multiple

9373

Postfix instances. If you prefer, you can generate separate

9374

parameters for each instance.

9375

9376

If you want to take maximal advantage of ciphers that offer <a

9377

href="FORWARD_SECRECY_README.html#dfn_fs">forward secrecy</a> see

9378

the <a href="FORWARD_SECRECY_README.html#quick-start">Getting

9379

started</a> section of <a

9380

href="FORWARD_SECRECY_README.html">FORWARD_SECRECY_README</a>. The

9381

full document conveniently presents all information about Postfix

9382

"perfect" forward secrecy support in one place: what forward secrecy

9383

is, how to tweak settings, and what you can expect to see when

9384

Postfix uses ciphers with forward secrecy.

9302

9385

9303

9386

Example:

9304

9387

9305

9388

<pre>

9306

smtpd_tls_dh1024_param_file = /etc/postfix/dh_1024.pem

9389

smtpd_tls_dh1024_param_file = /etc/postfix/dh2048.pem

9307

9390

</pre>

9308

9391

9309

9392

This feature is available with Postfix version 2.2.

9311

9394

%PARAM smtpd_tls_dh512_param_file

9312

9395

9313

9396

File with DH parameters that the Postfix SMTP server should

9314

use with EDH ciphers.

9397

use with export-grade EDH ciphers.

9315

9398

9316

9399

See also the discussion under the smtpd_tls_dh1024_param_file

9317

9400

configuration parameter.

9533

9616

tlsmgr(8) daemon and therefore per-smtp-instance master.cf overrides

9534

9617

are not possible.

9535

9618

9619

As of Postfix 2.11 this setting cannot exceed 100 days. If set

9620

≤ 0, session caching is disabled. If set to a positive value

9621

less than 2 minutes, the minimum value of 2 minutes is used instead.

9622

9536

9623

This feature is available in Postfix 2.2 and later.

9537

9624

9538

9625

%PARAM smtp_use_tls no

10313

10400

This feature is available in Postfix 2.3 and later. In earlier

10314

10401

releases it was called smtpd_sasl_application_name.

10315

10402

10403

%PARAM smtpd_sasl_service smtp

10404

10405

The service name that is passed to the SASL plug-in that is

10406

selected with smtpd_sasl_type and smtpd_sasl_path.

10407

10408

10409

This feature is available in Postfix 2.11 and later. Prior

10410

versions behave as if "smtp" is specified.

10411

10316

10412

%PARAM cyrus_sasl_config_path

10317

10413

10318

10414

Search path for Cyrus SASL application configuration files,

10392

10488

10393

10489

%PARAM smtp_cname_overrides_servername version dependent

10394

10490

10395

Allow DNS CNAME records to override the servername that the

10396

Postfix SMTP client uses for logging, SASL password lookup, TLS

10491

When the remote SMTP servername is a DNS CNAME, replace the

10492

servername with the result from CNAME expansion for the purpose of

10493

logging, SASL password lookup, TLS

10397

10494

policy decisions, or TLS certificate verification. The value "no"

10398

10495

hardens Postfix smtp_tls_per_site hostname-based policies against

10399

10496

false hostname information in DNS CNAME records, and makes SASL

10400

10497

password file lookups more predictable. This is the default setting

10401

10498

as of Postfix 2.3.

10402

10499

10500

When DNS CNAME records are validated with secure DNS lookups

10501

(smtp_dns_support_level = dnssec), they are always allowed to

10502

override the above servername (Postfix 2.11 and later).

10503

10403

10504

This feature is available in Postfix 2.2.9 and later.

10404

10505

10405

10506

%PARAM lmtp_cname_overrides_servername yes

10561

10662

10562

10663

<dl>

10563

10664

10564

10665

10565

10666

<dd>No TLS. No additional attributes are supported at this level. </dd>

10566

10667

10567

10668

10568

10669

<dd>Opportunistic TLS. Since sending in the clear is acceptable,

10569

10670

demanding stronger than default TLS security merely reduces

10570

10671

inter-operability. The optional "ciphers", "exclude" and "protocols"

10575

10676

This allows mail delivery to sites with non-interoperable TLS

10576

10677

implementations.</dd>

10577

10678

10578

<dt>encrypt</dt> <dd>Mandatory TLS encryption. At this level

10679

<dt><a href="TLS_README.html#client_tls_encrypt">encrypt</a></dt>

10680

<dd>Mandatory TLS encryption. At this level

10579

10681

and higher, the optional "protocols" attribute overrides the main.cf

10580

10682

smtp_tls_mandatory_protocols parameter, the optional "ciphers" attribute

10581

10683

overrides the main.cf smtp_tls_mandatory_ciphers parameter, and the

10584

10686

multiple protocols or excluded ciphers must be separated by colons,

10585

10687

as attribute values may not contain whitespace or commas. </dd>

10586

10688

10587

<dt>fingerprint</dt> <dd>Certificate fingerprint

10689

10690

<dd>Opportunistic DANE TLS. The TLS policy for the destination is

10691

obtained via TLSA records in DNSSEC. If no TLSA records are found,

10692

the effective security level used is <a

10693

href="TLS_README.html#client_tls_may">may</a>. If TLSA records are

10694

found, but none are usable, the effective security level is <a

10695

href="TLS_README.html#client_tls_encrypt">encrypt</a>. When usable

10696

TLSA records are obtained for the remote SMTP server, the

10697

server certificate must match the TLSA records. RFC 6698 (DANE)

10698

TLS authentication and DNSSEC support is available with Postfix

10699

2.11 and later. </dd>

10700

10701

10702

<dd>Mandatory DANE TLS. The TLS policy for the destination is

10703

obtained via TLSA records in DNSSEC. If no TLSA records are found,

10704

or none are usable, no connection is made to the server. When

10705

usable TLSA records are obtained for the remote SMTP server, the

10706

server certificate must match the TLSA records. RFC 6698 (DANE) TLS

10707

authentication and DNSSEC support is available with Postfix 2.11

10708

and later. </dd>

10709

10710

<dt><a href="TLS_README.html#client_tls_fingerprint">fingerprint</a></dt>

10711

<dd>Certificate fingerprint

10588

10712

verification. Available with Postfix 2.5 and later. At this security

10589

10713

level, there are no trusted certificate authorities. The certificate

10590

10714

trust chain, expiration date, ... are not checked. Instead,

10599

10723

delimiter as it occurs between each pair of fingerprint (hexadecimal)

10600

10724

digits. </dd>

10601

10725

10602

<dt>verify</dt> <dd>Mandatory TLS verification. At this security

10726

<dt><a href="TLS_README.html#client_tls_verify">verify</a></dt>

10727

<dd>Mandatory TLS verification. At this security

10603

10728

level, DNS MX lookups are trusted to be secure enough, and the name

10604

10729

verified in the server certificate is usually obtained indirectly via

10605

10730

unauthenticated DNS MX lookups. The optional "match" attribute overrides

10608

10733

In practice explicit control over matching is more common with the

10609

10734

"secure" policy, described below. </dd>

10610

10735

10611

<dt>secure</dt> <dd>Secure-channel TLS. At this security level, DNS

10736

<dt><a href="TLS_README.html#client_tls_secure">secure</a></dt>

10737

<dd>Secure-channel TLS. At this security level, DNS

10612

10738

MX lookups, though potentially used to determine the candidate next-hop

10613

10739

gateway IP addresses, are not trusted to be secure enough for TLS

10614

10740

peername verification. Instead, the default name verified in the server

10670

10796

empty value means allow all protocols. The valid protocol names, (see

10671

10797

SSL_get_version(3)), are "SSLv2", "SSLv3" and "TLSv1".

10672

10798

10673

Note: As of OpenSSL 1.0.1 two new protocols are defined, "TLSv1.1"

10674

and "TLSv1.2". If an older Postfix version is linked against OpenSSL

10675

1.0.1 or later, these, or any other new protocol versions, are

10676

unconditionally enabled.

10677

10678

With Postfix ≥ 2.5 the parameter syntax is expanded to support

10679

protocol exclusions. One can now explicitly exclude SSLv2 by setting

10680

"smtp_tls_mandatory_protocols = !SSLv2". To exclude both SSLv2 and

10681

SSLv3 set "smtp_tls_mandatory_protocols = !SSLv2, !SSLv3". Listing

10799

With Postfix ≥ 2.5 the parameter syntax was expanded to support

10800

protocol exclusions. One can explicitly exclude "SSLv2" by setting

10801

"smtp_tls_mandatory_protocols = !SSLv2". To exclude both "SSLv2" and

10802

"SSLv3" set "smtp_tls_mandatory_protocols = !SSLv2, !SSLv3". Listing

10682

10803

the protocols to include, rather than protocols to exclude, is

10683

10804

supported, but not recommended. The exclusion form more closely

10684

matches the behavior when the OpenSSL library is newer than Postfix.

10805

matches the underlying OpenSSL interface semantics.

10685

10806

10686

10807

10808

The range of protocols advertised by an SSL/TLS client must be

10809

contiguous. When a protocol version is enabled, disabling any

10810

higher version implicitly disables all versions above that higher

10811

version. Thus, for example:

10812

10813

<pre>

10814

smtp_tls_mandatory_protocols = !SSLv2, !TLSv1

10815

</pre>

10816

</blockquote>

10817

also disables any protocols version higher than TLSv1 leaving

10818

only "SSLv3" enabled.

10819

10820

Note: As of OpenSSL 1.0.1 two new protocols are defined, "TLSv1.1"

10821

and "TLSv1.2". When Postfix ≤ 2.5 is linked against OpenSSL 1.0.1

10822

or later, these, or any other new protocol versions, cannot be

10823

disabled except by also disabling "TLSv1" (typically leaving just

10824

"SSLv3"). The latest patch levels of Postfix ≥ 2.6, and all

10825

versions of Postfix ≥ 2.10 can explicitly disable support for

10826

"TLSv1.1" or "TLSv1.2".

10827

10828

At the <a href="TLS_README.html#client_tls_dane">dane</a> and

10829

<a href="TLS_README.html#client_tls_dane">dane-only</a> security

10830

levels, when usable TLSA records are obtained for the remote SMTP

10831

server, the Postfix SMTP client is obligated to include the SNI TLS

10832

extension in its SSL client hello message. This may help the remote

10833

SMTP server live up to its promise to provide a certificate that

10834

matches its TLSA records. Since TLS extensions require TLS 1.0 or

10835

later, the Postfix SMTP client must disable "SSLv2" and "SSLv3" when

10836

SNI is required. If you use "dane" or "dane-only" do not disable

10837

TLSv1, except perhaps via the policy table for destinations which

10838

you are sure will support "TLSv1.1" or "TLSv1.2".

10839

10687

10840

Since SSL version 2 has known protocol weaknesses and is now

10688

10841

deprecated, the default setting excludes "SSLv2". This means that by

10689

10842

default, SSL version 2 will not be used at the "encrypt" security level

10695

10848

Example:

10696

10849

10697

10850

<pre>

10698

# Preferred form with Postfix ≥ 2.5:

10851

# Preferred syntax with Postfix ≥ 2.5:

10699

10852

smtp_tls_mandatory_protocols = !SSLv2, !SSLv3

10700

# Alternative form.

10853

# Legacy syntax:

10701

10854

smtp_tls_mandatory_protocols = TLSv1

10702

10855

</pre>

10703

10856

10783

10936

%PARAM smtp_tls_secure_cert_match nexthop, dot-nexthop

10784

10937

10785

10938

How the Postfix SMTP client verifies the server certificate

10786

peername for the

10787

"secure" TLS security level. In a "secure" TLS policy table

10939

peername for the "secure" TLS security level. In a "secure" TLS policy table

10788

10940

($smtp_tls_policy_maps) entry the optional "match" attribute

10789

10941

overrides this main.cf setting.

10790

10942

10852

11004

%PARAM smtpd_tls_mandatory_protocols !SSLv2

10853

11005

10854

11006

The SSL/TLS protocols accepted by the Postfix SMTP server with

10855

mandatory TLS encryption. If the list is empty, the server supports all

10856

available SSL/TLS protocol versions. A non-empty value is a list

10857

of protocol

10858

names separated by whitespace, commas or colons. The supported protocol

10859

names are "SSLv2", "SSLv3" and "TLSv1", and are not case sensitive.

10860

10861

Note: As of OpenSSL 1.0.1 two new protocols are defined, "TLSv1.1"

10862

and "TLSv1.2". If an older Postfix version is linked against OpenSSL

10863

1.0.1 or later, these, or any other new protocol versions, are

10864

unconditionally enabled.

10865

10866

With Postfix ≥ 2.5 the parameter syntax is expanded to support

10867

protocol exclusions. One can now explicitly exclude SSLv2 by setting

10868

"smtpd_tls_mandatory_protocols = !SSLv2". To exclude both SSLv2 and

10869

SSLv3 set "smtpd_tls_mandatory_protocols = !SSLv2, !SSLv3". Listing

11007

mandatory TLS encryption. If the list is empty, the server supports

11008

all available SSL/TLS protocol versions. A non-empty value is a

11009

list of protocol names separated by whitespace, commas or colons.

11010

The supported protocol names are "SSLv2", "SSLv3" and "TLSv1", and

11011

are not case sensitive.

11012

11013

With Postfix ≥ 2.5 the parameter syntax was expanded to support

11014

protocol exclusions. One can explicitly exclude "SSLv2" by setting

11015

"smtpd_tls_mandatory_protocols = !SSLv2". To exclude both "SSLv2" and

11016

"SSLv3" set "smtpd_tls_mandatory_protocols = !SSLv2, !SSLv3". Listing

10870

11017

the protocols to include, rather than protocols to exclude, is

10871

11018

supported, but not recommended. The exclusion form more closely

10872

matches the behavior when the OpenSSL library is newer than Postfix.

10873

11019

matches the underlying OpenSSL interface semantics.

11020

11021

Note: As of OpenSSL 1.0.1 two new protocols are defined, "TLSv1.1"

11022

and "TLSv1.2". When Postfix ≤ 2.5 is linked against OpenSSL 1.0.1

11023

or later, these, or any other new protocol versions, cannot be

11024

disabled. The latest patch levels of Postfix ≥ 2.6, and all

11025

versions of Postfix ≥ 2.10 can disable support for "TLSv1.1" or

11026

"TLSv1.2".

10874

11027

10875

11028

Since SSL version 2 has known protocol weaknesses and is now

10876

11029

deprecated, the default setting excludes "SSLv2". This means that

10880

11033

Example:

10881

11034

10882

11035

<pre>

11036

# Preferred syntax with Postfix ≥ 2.5:

11037

smtpd_tls_mandatory_protocols = !SSLv2, !SSLv3

11038

# Legacy syntax:

10883

11039

smtpd_tls_mandatory_protocols = TLSv1

10884

# Alternative form with Postfix ≥ 2.5:

10885

smtpd_tls_mandatory_protocols = !SSLv2, !SSLv3

10886

11040

</pre>

10887

11041

10888

11042

This feature is available in Postfix 2.3 and later.

10898

11052

10899

11053

<dl>

10900

11054

10901

<dt>none</dt> <dd> TLS will not be used unless enabled for specific

11055

11056

<dd> No TLS. TLS will not be used unless enabled for specific

10902

11057

destinations via smtp_tls_policy_maps. </dd>

10903

11058

10904

11059

10905

11060

<dd> Opportunistic TLS. Use TLS if this is supported by the remote

10906

11061

SMTP server, otherwise use plaintext. Since

10907

11062

sending in the clear is acceptable, demanding stronger than default TLS

10915

11070

This allows mail delivery to sites with non-interoperable TLS

10916

11071

implementations. </dd>

10917

11072

10918

<dt>encrypt</dt> <dd>Mandatory TLS encryption. Since a minimum

11073

<dt><a href="TLS_README.html#client_tls_encrypt">encrypt</a></dt>

11074

<dd>Mandatory TLS encryption. Since a minimum

10919

11075

level of security is intended, it is reasonable to be specific about

10920

11076

sufficiently secure protocol versions and ciphers. At this security level

10921

11077

and higher, the main.cf parameters smtp_tls_mandatory_protocols and

10924

11080

mandatory encrypted sessions. This security level is not an appropriate

10925

11081

default for systems delivering mail to the Internet. </dd>

10926

11082

10927

<dt>fingerprint</dt> <dd>Certificate fingerprint

10928

verification. Available with Postfix 2.5 and later. At this security

10929

level, there are no trusted certificate authorities. The certificate

10930

trust chain, expiration date, ... are not checked. Instead, the

10931

smtp_tls_fingerprint_cert_match parameter lists the certificate

10932

fingerprint or public key fingerprint (Postfix 2.9 and later) of

10933

the valid server certificate. The digest

11083

11084

<dd>Opportunistic DANE TLS. At this security level, the TLS policy

11085

for the destination is obtained via DNSSEC. For TLSA policy to be

11086

in effect, the destination domain's containing DNS zone must be

11087

signed and the Postfix SMTP client's operating system must be

11088

configured to send its DNS queries to a recursive DNS nameserver

11089

that is able to validate the signed records. Each MX host's DNS

11090

zone should also be signed, and should publish DANE TLSA (RFC 6698)

11091

records that specify how that MX host's TLS certificate is to be

11092

verified. TLSA records do not preempt the normal SMTP MX host

11093

selection algorithm, if some MX hosts support TLSA and others do

11094

not, TLS security will vary from delivery to delivery. It is up

11095

to the domain owner to configure their MX hosts and their DNS

11096

sensibly. To configure the Postfix SMTP client for DNSSEC lookups

11097

see the documentation for the smtp_dns_support_level main.cf

11098

parameter. When DNSSEC-validated TLSA records are not found the

11099

effective tls security level is "may". When TLSA records are found,

11100

but are all unusable the effective security level is "encrypt". For

11101

purposes of protocol and cipher selection, the "dane" security level

11102

is treated like a "mandatory" TLS security level, and weak ciphers

11103

and protocols are disabled. Since DANE authenticates server

11104

certificates the "aNULL" cipher-suites are transparently excluded

11105

at this level, no need to configure this manually. RFC 6698 (DANE)

11106

TLS authentication is available with Postfix 2.11 and later. </dd>

11107

11108

11109

<dd>Mandatory DANE TLS. This is just like "dane" above, but DANE

11110

TLSA authentication is required. There is no fallback to "may" or

11111

"encrypt" when TLSA records are missing or unusable. RFC 6698

11112

(DANE) TLS authentication is available with Postfix 2.11 and later.

11113

</dd>

11114

11115

<dt><a href="TLS_README.html#client_tls_fingerprint">fingerprint</a></dt>

11116

<dd>Certificate fingerprint verification.

11117

At this security level, there are no trusted certificate authorities.

11118

The certificate trust chain, expiration date, etc., are

11119

not checked. Instead, the smtp_tls_fingerprint_cert_match

11120

parameter lists the certificate fingerprint or public key fingerprint

11121

(Postfix 2.9 and later) of the valid server certificate. The digest

10934

11122

algorithm used to calculate the fingerprint is selected by the

10935

smtp_tls_fingerprint_digest parameter. </dd>

11123

smtp_tls_fingerprint_digest parameter. Available with Postfix

11124

2.5 and later. </dd>

10936

11125

10937

<dt>verify</dt> <dd>Mandatory TLS verification. At this security

11126

<dt><a href="TLS_README.html#client_tls_verify">verify</a></dt>

11127

<dd>Mandatory TLS verification. At this security

10938

11128

level, DNS MX lookups are trusted to be secure enough, and the name

10939

11129

verified in the server certificate is usually obtained indirectly

10940

11130

via unauthenticated DNS MX lookups. The smtp_tls_verify_cert_match

10943

11133

below. This security level is not an appropriate default for systems

10944

11134

delivering mail to the Internet. </dd>

10945

11135

10946

<dt>secure</dt> <dd>Secure-channel TLS. At this security level,

11136

<dt><a href="TLS_README.html#client_tls_secure">secure</a></dt>

11137

<dd>Secure-channel TLS. At this security level,

10947

11138

DNS MX lookups, though potentially used to determine the candidate

10948

11139

next-hop gateway IP addresses, are not trusted to be secure enough

10949

11140

for TLS peername verification. Instead, the default name verified in

11969

12160

protocol names, (see SSL_get_version(3)), are "SSLv2", "SSLv3"

11970

12161

and "TLSv1".

11971

12162

12163

The range of protocols advertised by an SSL/TLS client must be

12164

contiguous. When a protocol version is enabled, disabling any

12165

higher version implicitly disables all versions above that higher

12166

version. Thus, for example:

12167

12168

<pre>

12169

smtp_tls_mandatory_protocols = !SSLv2, !TLSv1

12170

</pre>

12171

</blockquote>

12172

also disables any protocols version higher than TLSv1 leaving

12173

only "SSLv3" enabled.

12174

11972

12175

Note: As of OpenSSL 1.0.1 two new protocols are defined, "TLSv1.1"

11973

and "TLSv1.2". If an older Postfix version is linked against OpenSSL

11974

1.0.1 or later, these, or any other new protocol versions, are

11975

unconditionally enabled.

12176

and "TLSv1.2". The latest patch levels of Postfix ≥ 2.6, and all

12177

versions of Postfix ≥ 2.10 can explicitly disable support for

12178

"TLSv1.1" or "TLSv1.2"

11976

12179

11977

12180

To include a protocol list its name, to exclude it, prefix the name

11978

12181

with a "!" character. To exclude SSLv2 even for opportunistic TLS set

11979

12182

"smtp_tls_protocols = !SSLv2". To exclude both "SSLv2" and "SSLv3" set

11980

12183

"smtp_tls_protocols = !SSLv2, !SSLv3". Explicitly listing the protocols to

11981

12184

include, rather than protocols to exclude, is supported, but not

11982

recommended. The exclusion form more closely matches the behavior

11983

when the OpenSSL library is newer than Postfix.

12185

recommended. The exclusion form more closely matches the underlying

12186

OpenSSL interface semantics.

11984

12187

11985

12188

Example:

11986

12189

<pre>

11987

# TLSv1 only!

12190

# TLSv1 or better:

11988

12191

smtp_tls_protocols = !SSLv2, !SSLv3

11989

12192

</pre>

11990

12193

11993

12196

%PARAM smtpd_tls_protocols

11994

12197

11995

12198

List of TLS protocols that the Postfix SMTP server will exclude

11996

or include with opportunistic TLS encryption. This parameter SHOULD be

11997

left at its default empty value, allowing all protocols to be used with

11998

opportunistic TLS.

11999

12000

In main.cf the values are separated by whitespace, commas or

12001

colons. An empty value means allow all protocols. The valid protocol

12002

names, (see SSL_get_version(3)), are "SSLv2", "SSLv3" and

12003

"TLSv1". In smtp_tls_policy_maps table entries, "protocols" attribute

12004

values are separated by a colon.

12199

or include with opportunistic TLS encryption. This parameter SHOULD

12200

be left at its default empty value, allowing all protocols to be

12201

used with opportunistic TLS. A non-empty value is a list of protocol

12202

names separated by whitespace, commas or colons. The supported

12203

protocol names are "SSLv2", "SSLv3" and "TLSv1", and are not case

12204

sensitive.

12005

12205

12006

12206

Note: As of OpenSSL 1.0.1 two new protocols are defined, "TLSv1.1"

12007

and "TLSv1.2". If an older Postfix version is linked against OpenSSL

12008

1.0.1 or later, these, or any other new protocol versions, are

12009

unconditionally enabled.

12207

and "TLSv1.2". The latest patch levels of Postfix ≥ 2.6, and all

12208

versions of Postfix ≥ 2.10 can disable support for "TLSv1.1" or

12209

"TLSv1.2".

12010

12210

12011

12211

To include a protocol list its name, to exclude it, prefix the name

12012

12212

with a "!" character. To exclude SSLv2 even for opportunistic TLS set

12013

12213

"smtpd_tls_protocols = !SSLv2". To exclude both "SSLv2" and "SSLv3" set

12014

12214

"smtpd_tls_protocols = !SSLv2, !SSLv3". Explicitly listing the protocols to

12015

12215

include, rather than protocols to exclude, is supported, but not

12016

recommended. The exclusion form more closely matches the behavior

12017

when the OpenSSL library is newer than Postfix.

12216

recommended. The exclusion form more closely matches the underlying

12217

OpenSSL interface semantics.

12018

12218

12019

12219

Example:

12020

12220

<pre>

12094

12294

attacks. The selected curve must be implemented by OpenSSL (as

12095

12295

reported by ecparam(1) with the "-list_curves" option) and be one

12096

12296

of the curves listed in Section 5.1.1 of RFC 4492. You should not

12097

generally change this setting.

12297

generally change this setting. Remote SMTP client implementations

12298

must support this curve for EECDH key exchange to take place. It

12299

is unwise to choose an "exotic" curve supported by only a small subset

12300

of clients.

12098

12301

12099

This default curve is specified in NSA "Suite B" Cryptography

12100

(see http://www.nsa.gov/ia/industry/crypto_suite_b.cfm) for

12101

information classified as SECRET.

12302

The default "strong" curve is rated in NSA <a

12303

href="http://www.nsa.gov/ia/programs/suiteb_cryptography/">Suite

12304

B</a> for information classified up to SECRET.

12102

12305

12103

12306

Note: elliptic curve names are poorly standardized; different

12104

12307

standards groups are assigning different names to the same underlying

12106

12309

under the SECG name "secp256r1", but OpenSSL does not recognize the

12107

12310

latter name.

12108

12311

12312

If you want to take maximal advantage of ciphers that offer <a

12313

href="FORWARD_SECRECY_README.html#dfn_fs">forward secrecy</a> see

12314

the <a href="FORWARD_SECRECY_README.html#quick-start">Getting

12315

started</a> section of <a

12316

href="FORWARD_SECRECY_README.html">FORWARD_SECRECY_README</a>. The

12317

full document conveniently presents all information about Postfix

12318

"perfect" forward secrecy support in one place: what forward secrecy

12319

is, how to tweak settings, and what you can expect to see when

12320

Postfix uses ciphers with forward secrecy.

12321

12109

12322

This feature is available in Postfix 2.6 and later, when it is

12110

compiled and linked with OpenSSL 1.0.0 or later.

12323

compiled and linked with OpenSSL 1.0.0 or later on platforms where

12324

EC algorithms have not been disabled by the vendor.

12111

12325

12112

12326

%PARAM tls_eecdh_ultra_curve secp384r1

12113

12327

12122

12336

"-list_curves" option) and be one of the curves listed in Section 5.1.1

12123

12337

of RFC 4492. You should not generally change this setting.

12124

12338

12125

This default "ultra" curve is specified in NSA "Suite B" Cryptography

12126

(see http://www.nsa.gov/ia/industry/crypto_suite_b.cfm) for information

12127

classified as TOP SECRET.

12339

This default "ultra" curve is rated in NSA <a

12340

href="http://www.nsa.gov/ia/programs/suiteb_cryptography/">Suite

12341

B</a> for information classified up to TOP SECRET.

12342

12343

If you want to take maximal advantage of ciphers that offer <a

12344

href="FORWARD_SECRECY_README.html#dfn_fs">forward secrecy</a> see

12345

the <a href="FORWARD_SECRECY_README.html#quick-start">Getting

12346

started</a> section of <a

12347

href="FORWARD_SECRECY_README.html">FORWARD_SECRECY_README</a>. The

12348

full document conveniently presents all information about Postfix

12349

"perfect" forward secrecy support in one place: what forward secrecy

12350

is, how to tweak settings, and what you can expect to see when

12351

Postfix uses ciphers with forward secrecy.

12128

12352

12129

12353

This feature is available in Postfix 2.6 and later, when it is

12130

compiled and linked with OpenSSL 1.0.0 or later.

12354

compiled and linked with OpenSSL 1.0.0 or later on platforms where

12355

EC algorithms have not been disabled by the vendor.

12131

12356

12132

12357

%PARAM smtpd_tls_eecdh_grade see "postconf -d" output

12133

12358

12156

12381

12157

12382

</dl>

12158

12383

12384

If you want to take maximal advantage of ciphers that offer <a

12385

href="FORWARD_SECRECY_README.html#dfn_fs">forward secrecy</a> see

12386

the <a href="FORWARD_SECRECY_README.html#quick-start">Getting

12387

started</a> section of <a

12388

href="FORWARD_SECRECY_README.html">FORWARD_SECRECY_README</a>. The

12389

full document conveniently presents all information about Postfix

12390

"perfect" forward secrecy support in one place: what forward secrecy

12391

is, how to tweak settings, and what you can expect to see when

12392

Postfix uses ciphers with forward secrecy.

12393

12159

12394

This feature is available in Postfix 2.6 and later, when it is

12160

compiled and linked with OpenSSL 1.0.0 or later.

12395

compiled and linked with OpenSSL 1.0.0 or later on platforms

12396

where EC algorithms have not been disabled by the vendor.

12161

12397

12162

12398

%PARAM smtpd_tls_eccert_file

12163

12399

12832

13068

12833

13069

Selectively disable master(8) listener ports by service type

12834

13070

or by service name and type. Specify a list of service types

12835

("inet", "unix", "fifo", or "pass") or "name.type" tuples, where

13071

("inet", "unix", "fifo", or "pass") or "name/type" tuples, where

12836

13072

"name" is the first field of a master.cf entry and "type" is a

12837

13073

service type. As with other Postfix matchlists, a search stops at

12838

13074

the first match. Specify "!pattern" to exclude a service from the

12845

13081

Examples:

12846

13082

12847

13083

<pre>

13084

# With Postfix 2.6..2.10 use '.' instead of '/'.

12848

13085

# Turn on all master(8) listener ports (the default).

12849

13086

master_service_disable =

12850

13087

# Turn off only the main SMTP listener port.

12851

master_service_disable = smtp.inet

13088

master_service_disable = smtp/inet

12852

13089

# Turn off all TCP/IP listener ports.

12853

13090

master_service_disable = inet

12854

13091

# Turn off all TCP/IP listener ports except "foo".

12855

master_service_disable = !foo.inet, inet

13092

master_service_disable = !foo/inet, inet

12856

13093

</pre>

12857

13094

12858

13095

This feature is available in Postfix 2.6 and later.

13718

13955

13719

13956

This feature is available in Postfix 2.8.

13720

13957

13958

%PARAM postscreen_dnsbl_whitelist_threshold 0

13959

13960

Allow a remote SMTP client to skip "before" and "after 220

13961

greeting" protocol tests, based on its combined DNSBL score as

13962

defined with the postscreen_dnsbl_sites parameter.

13963

13964

Specify a negative value to enable this feature. When a client

13965

passes the postscreen_dnsbl_whitelist_threshold without having

13966

failed other tests, all pending or disabled tests are flagged as

13967

completed with a time-to-live value equal to postscreen_dnsbl_ttl.

13968

When a test was already completed, its time-to-live value is updated

13969

if it was less than postscreen_dnsbl_ttl.

13970

13971

This feature is available in Postfix 2.11.

13972

13721

13973

%PARAM postscreen_command_count_limit 20

13722

13974

13723

13975

The limit on the total number of commands per SMTP session for

14092

14344

issues. In the past, some SSL clients have listed lower priority ciphers

14093

14345

that they did not implement correctly. If the server chooses a cipher

14094

14346

that the client prefers less, it may select a cipher whose client

14095

implementation is flawed.

14347

implementation is flawed. Most notably Windows 2003 Microsoft

14348

Exchange servers have flawed implementations of DES-CBC3-SHA, which

14349

OpenSSL considers stronger than RC4-SHA. Enabling server cipher-suite

14350

selection may create interoperability issues with Windows 2003

14351

Microsoft Exchange clients.

14096

14352

14097

14353

This feature is available in Postfix 2.8 and later, in combination

14098

14354

with OpenSSL 0.9.7 and later.

14325

14581

%PARAM tlsproxy_tls_dh1024_param_file $smtpd_tls_dh1024_param_file

14326

14582

14327

14583

File with DH parameters that the Postfix tlsproxy(8) server

14328

should use with EDH ciphers. See smtpd_tls_dh1024_param_file for

14329

further details.

14584

should use with non-export EDH ciphers. See smtpd_tls_dh1024_param_file

14585

for further details.

14330

14586

14331

14587

This feature is available in Postfix 2.8 and later.

14332

14588

14333

14589

%PARAM tlsproxy_tls_dh512_param_file $smtpd_tls_dh512_param_file

14334

14590

14335

14591

File with DH parameters that the Postfix tlsproxy(8) server

14336

should use with EDH ciphers. See smtpd_tls_dh512_param_file for

14337

further details.

14592

should use with export-grade EDH ciphers. See smtpd_tls_dh512_param_file

14593

for further details.

14338

14594

14339

14595

This feature is available in Postfix 2.8 and later.

14340

14596

14460

14716

14461

14717

%PARAM tlsproxy_tls_session_cache_timeout $smtpd_tls_session_cache_timeout

14462

14718

14463

The expiration time of Postfix tlsproxy(8) server TLS session

14464

cache information. A cache cleanup is performed periodically every

14465

$smtpd_tls_session_cache_timeout seconds. See

14466

smtpd_tls_session_cache_timeout for further details.

14719

Obsolete expiration time of Postfix tlsproxy(8) server TLS session

14720

cache information. Since the cache is shared with smtpd(8) and managed

14721

by tlsmgr(8), there is only one expiration time for the SMTP server cache

14722

shared by all three services, namely smtpd_tls_session_cache_timeout.

14467

14723

14468

14724

This feature is available in Postfix 2.8 and later.

14469

14725

14599

14855

14600

14856

%PARAM smtpd_per_record_deadline normal: no, overload: yes

14601

14857

14602

Change the behavior of the smtpd_timeout time limit, from a

14858

Change the behavior of the smtpd_timeout and smtpd_starttls_timeout

14859

time limits, from a

14603

14860

time limit per read or write system call, to a time limit to send

14604

14861

or receive a complete record (an SMTP command line, SMTP response

14605

14862

line, SMTP message content line, or TLS protocol message). This

14736

14993

change queue file names that don't match their message file inode

14737

14994

number).

14738

14995

14739

Note: see below for how to prepare long queue file names

14740

for migration to Postfix ≤ 2.8.

14996

Note: see below for how to convert long queue file names to

14997

Postfix ≤ 2.8.

14741

14998

14742

14999

Changing the parameter value to "yes" has the following effects:

14743

15000

14904

15161

14905

15162

This feature is available in Postfix 2.9 and later.

14906

15163

14907

%PARAM smtpd_log_access_permit_actions empty

15164

%PARAM smtpd_log_access_permit_actions

14908

15165

14909

15166

Enable logging of the named "permit" actions in SMTP server

14910

15167

access lists (by default, the SMTP server logs "reject" actions but

14935

15192

</pre>

14936

15193

14937

15194

This feature is available in Postfix 2.10 and later.

15195

15196

%PARAM smtp_dns_support_level

15197

15198

Level of DNS support in the Postfix SMTP client. With

15199

"smtp_dns_support_level" left at its empty default value, the legacy

15200

"disable_dns_lookups" parameter controls whether DNS is enabled in

15201

the Postfix SMTP client, otherwise the legacy parameter is ignored.

15202

15203

15204

Specify one of the following:

15205

15206

<dl>

15207

15208

<dt>disabled</dt>

15209

15210

<dd>Disable DNS lookups. No MX lookups are performed and hostname

15211

to address lookups are unconditionally "native". This setting is

15212

not appropriate for hosts that deliver mail to the public Internet.

15213

Some obsolete how-to documents recommend disabling DNS lookups in

15214

some configurations with content_filters. This is no longer required

15215

and strongly discouraged. </dd>

15216

15217

<dt>enabled</dt>

15218

15219

<dd>Enable DNS lookups. Nexthop destination domains not enclosed

15220

in "[]" will be subject to MX lookups. If "dns" and "native" are

15221

included in the "smtp_host_lookup" parameter value, DNS will be

15222

queried first to resolve MX-host A records, followed by "native"

15223

lookups if no answer is found in DNS. </dd>

15224

15225

<dt>dnssec</dt>

15226

15227

<dd>Enable <a href="https://tools.ietf.org/html/rfc4033">DNSSEC</a>

15228

lookups. The "dnssec" setting differs from the "enabled" setting

15229

above in the following ways: <ul> <li>Any MX lookups will set

15230

RES_USE_DNSSEC and RES_USE_EDNS0 to request DNSSEC-validated

15231

responses. If the MX response is DNSSEC-validated the corresponding

15232

hostnames are considered validated. <li> The address lookups of

15233

validated hostnames are also validated, (provided of course

15234

"smtp_host_lookup" includes "dns", see below). <li>Temporary

15235

failures in DNSSEC-enabled hostname-to-address resolution block any

15236

"native" lookups. Additional "native" lookups only happen when

15237

DNSSEC lookups hard-fail (NODATA or NXDOMAIN). </ul> </dd>

15238

15239

</dl>

15240

15241

The Postfix SMTP client considers non-MX "[nexthop]" and

15242

"[nexthop]:port" destinations equivalent to statically-validated

15243

MX records of the form "nexthop. IN MX 0 nexthop." Therefore,

15244

with "dnssec" support turned on, validated hostname-to-address

15245

lookups apply to the nexthop domain of any "[nexthop]" or

15246

"[nexthop]:port" destination. This is also true for LMTP "inet:host"

15247

and "inet:host:port" destinations, as LMTP hostnames are never

15248

subject to MX lookups.

15249

15250

The "dnssec" setting is recommended only if you plan to use the

15251

<a href="TLS_README.html#client_tls_dane">dane</a> or <a

15252

href="TLS_README.html#client_tls_dane">dane-only</a> TLS security

15253

level, otherwise enabling DNSSEC support in Postfix offers no

15254

additional security. Postfix DNSSEC support relies on an upstream

15255

recursive nameserver that validates DNSSEC signatures. Such a DNS

15256

server will always filter out forged DNS responses, even when Postfix

15257

itself is not configured to use DNSSEC.

15258

15259

When using Postfix DANE support the "smtp_host_lookup" parameter

15260

should include "dns", as <a

15261

href="https://tools.ietf.org/html/rfc6698">DANE</a> is not applicable

15262

to hosts resolved via "native" lookups.

15263

15264

As mentioned above, Postfix is not a validating <a

15265

href="https://tools.ietf.org/html/rfc4035#section-4.9">stub

15266

resolver</a>; it relies on the system's configured DNSSEC-validating

15267

<a href="https://tools.ietf.org/html/rfc4035#section-3.2">recursive

15268

nameserver</a> to perform all DNSSEC validation. Since this

15269

nameserver's DNSSEC-validated responses will be fully trusted, it

15270

is strongly recommended that the MTA host have a local DNSSEC-validating

15271

recursive caching nameserver listening on a loopback address, and

15272

be configured to use only this nameserver for all lookups. Otherwise,

15273

Postfix may remain subject to man-in-the-middle attacks that forge

15274

responses from the recursive nameserver

15275

15276

DNSSEC support requires a version of Postfix compiled against a

15277

reasonably-modern DNS resolver(3) library that implements the

15278

RES_USE_DNSSEC and RES_USE_EDNS0 resolver options.

15279

15280

This feature is available in Postfix 2.11 and later.

15281

15282

%PARAM lmtp_dns_support_level

15283

15284

The LMTP-specific version of the smtp_dns_support_level

15285

configuration parameter. See there for details.

15286

15287

This feature is available in Postfix 2.11 and later.

15288

15289

%PARAM smtp_tls_trust_anchor_file

15290

15291

Zero or more PEM-format files with trust-anchor certificates

15292

and/or public keys. If the parameter is not empty the root CAs in

15293

CAfile and CApath are no longer trusted. Rather, the Postfix SMTP

15294

client will only trust certificate-chains signed by one of the

15295

trust-anchors contained in the chosen files. The specified

15296

trust-anchor certificates and public keys are not subject to

15297

expiration, and need not be (self-signed) root CAs. They may, if

15298

desired, be intermediate certificates. Therefore, these certificates

15299

also may be found "in the middle" of the trust chain presented by

15300

the remote SMTP server, and any untrusted issuing parent certificates

15301

will be ignored. Specify a list of pathnames separated by comma

15302

or whitespace.

15303

15304

Whether specified in main.cf, or on a per-destination basis,

15305

the trust-anchor PEM file must be accessible to the Postfix SMTP

15306

client in the chroot jail if applicable. The trust-anchor file

15307

should contain only certificates and public keys, no private key

15308

material, and must be readable by the non-privileged $mail_owner

15309

user. This allows destinations to be bound to a set of specific

15310

CAs or public keys without trusting the same CAs for all destinations.

15311

15312

15313

The main.cf parameter supports single-purpose Postfix installations

15314

that send mail to a fixed set of SMTP peers. At most sites, if

15315

trust-anchor files are used at all, they will be specified on a

15316

per-destination basis via the "tafile" attribute of the "verify"

15317

and "secure" levels in smtp_tls_policy_maps.

15318

15319

The underlying mechanism is in support of RFC 6698 (DANE TLSA),

15320

which defines mechanisms for a client to securely determine server

15321

TLS certificates via DNS.

15322

15323

If you want your trust anchors to be public keys, with OpenSSL

15324

you can extract a single PEM public key from a PEM X.509 file

15325

containing a single certificate, as follows:

15326

15327

15328

<pre>

15329

$ openssl x509 -in cert.pem -out ta-key.pem -noout -pubkey

15330

</pre>

15331

</blockquote>

15332

15333

This feature is available in Postfix 2.11 and later.

15334

15335

%PARAM lmtp_tls_trust_anchor_file

15336

15337

The LMTP-specific version of the smtp_tls_trust_anchor_file

15338

configuration parameter. See there for details.

15339

15340

This feature is available in Postfix 2.11 and later.

15341

15342

%PARAM tls_dane_trust_anchor_digest_enable yes

15343

15344

RFC 6698 trust-anchor digest support in the Postfix TLS library.

15345

Enable support for RFC 6698 (DANE TLSA) DNS records that contain

15346

digests of trust-anchors with certificate usage "2". In this case

15347

the certificate usage logically requires the server administrator

15348

to configure the server to include the trust-anchor certificate in

15349

the server's SSL certificate chain. If enough domains mess this

15350

up, you can disable support for these TLSA records, but you'll no

15351

longer have secure connections that get it right and only publish

15352

trust anchor records.

15353

15354

At the <a href="TLS_README.html#client_tls_dane">dane</a>

15355

security level, when a TLSA RRset includes only unusable associations,

15356

the Postfix SMTP client will automatically switch the connection

15357

to the <a href="TLS_README.html#client_tls_encrypt">encrypt</a>

15358

security level. At the <a

15359

href="TLS_README.html#client_tls_dane">dane-only</a> security level,

15360

the server in question is skipped and delivery is deferred if no

15361

secure servers are found.

15362

15363

The tls_dane_digests parameter controls the list of digest

15364

algorithms that are supported in TLSA records. The tls_dane_digest_agility

15365

parameter controls digest algorithm downgrade attack resistance.

15366

15367

15368

This feature is available in Postfix 2.11 and later.

15369

15370

%PARAM tls_wildcard_matches_multiple_labels yes

15371

15372

Match multiple DNS labels with "*" in wildcard certificates.

15373

15374

15375

Some mail service providers prepend the customer domain name

15376

to a base domain for which they have a wildcard TLS certificate.

15377

For example, the MX records for example.com hosted by example.net

15378

may be:

15379

15380

15381

<pre>

15382

example.com. IN MX 0 example.com.mx1.example.net.

15383

example.com. IN MX 0 example.com.mx2.example.net.

15384

</pre>

15385

</blockquote>

15386

15387

and the TLS certificate may be for "*.example.net". The "*"

15388

then corresponds with multiple labels in the mail server domain

15389

name. While multi-label wildcards are not widely supported, and

15390

are not blessed by any standard, there is little to be gained by

15391

disallowing their use in this context.

15392

15393

Notes:

15394

15395

<ul>

15396

15397

<li> In a certificate name, the "*" is special only when it is

15398

used as the first label.

15399

15400

<li> While Postfix (2.11 or later) can match "*" with multiple

15401

domain name labels, other implementations likely will not.

15402

15403

<li> Earlier Postfix implementations behave as if

15404

"tls_wildcard_matches_multiple_labels = no".

15405

15406

</ul>

15407

15408

This feature is available in Postfix 2.11 and later.

15409

15410

%PARAM tls_ssl_options

15411

15412

List or bit-mask of OpenSSL options to enable.

15413

15414

The OpenSSL toolkit provides a set of options that applications

15415

can enable to tune the OpenSSL behavior. Some of these work around

15416

bugs in other implementations and are on by default. You can use

15417

the tls_disable_workarounds parameter to selectively disable some

15418

or all of the bug work-arounds, making OpenSSL more strict at the

15419

cost of non-interoperability with SSL clients or servers that exhibit

15420

the bugs.

15421

15422

Other options are off by default, and typically enable or disable

15423

features rather than bug work-arounds. These may be turned on (with

15424

care) via the tls_ssl_options parameter. The value is a white-space

15425

or comma separated list of named options chosen from the list below.

15426

The names are not case-sensitive, you can use lower-case if you

15427

prefer. The upper case values below match the corresponding macro

15428

name in the ssl.h header file with the SSL_OP_ prefix removed. It

15429

is possible that your OpenSSL version includes new options added

15430

after your Postfix source code was last updated, in that case you

15431

can only enable one of these via the hexadecimal syntax below.

15432

15433

You should only enable features via the hexadecimal mask when

15434

the need to control the feature is critical (to deal with a new

15435

vulnerability or a serious interoperability problem). Postfix DOES

15436

NOT promise backwards compatible behavior with respect to the mask

15437

bits. A feature enabled via the mask in one release may be enabled

15438

by other means in a later release, and the mask bit will then be

15439

ignored. Therefore, use of the hexadecimal mask is only a temporary

15440

measure until a new Postfix or OpenSSL release provides a better

15441

solution.

15442

15443

If the value of the parameter is a hexadecimal long integer

15444

starting with "0x", the options corresponding to the bits specified

15445

in its value are enabled (see openssl/ssl.h and SSL_CTX_set_options(3)).

15446

You can only enable options not already controlled by other Postfix

15447

settings. For example, you cannot disable protocols or enable

15448

server cipher preference. Do not attempt to turn all features by

15449

specifying 0xFFFFFFFF, this is unlikely to be a good idea.

15450

15451

<dl>

15452

15453

<dt>LEGACY_SERVER_CONNECT</dt> <dd>See SSL_CTX_set_options(3).</dd>

15454

15455

<dt>NO_TICKET</dt> <dd>See SSL_CTX_set_options(3).</dd>

15456

15457

<dt>NO_COMPRESSION</dt> <dd>Disable SSL compression even if

15458

supported by the OpenSSL library. Compression is CPU-intensive,

15459

and compression before encryption does not always improve security. </dd>

15460

15461

</dl>

15462

15463

This feature is available in Postfix 2.11 and later.

15464

15465

%PARAM tlsmgr_service_name tlsmgr

15466

15467

The name of the tlsmgr(8) service entry in master.cf. This

15468

service maintains TLS session caches and other information in support

15469

of TLS.

15470

15471

This feature is available in Postfix 2.11 and later.

15472

15473

%PARAM lmtp_connection_reuse_count_limit 0

15474

15475

The LMTP-specific version of the smtp_connection_reuse_count_limit

15476

configuration parameter. See there for details.

15477

15478

This feature is available in Postfix 2.11 and later.

15479

15480

%PARAM smtp_connection_reuse_count_limit 0

15481

15482

When SMTP connection caching is enabled, the number of times

15483

that an SMTP session may be reused before it is closed, or zero (no

15484

limit). With a reuse count limit of N, a connection is used up to

15485

N+1 times.

15486

15487

NOTE: This feature is unsafe. When a high-volume destination

15488

has multiple inbound MTAs, then the slowest inbound MTA will attract

15489

the most connections to that destination. This limitation does not

15490

exist with the smtp_connection_reuse_time_limit feature.

15491

15492

This feature is available in Postfix 2.11.

15493

15494

%PARAM lmtp_tls_force_insecure_host_tlsa_lookup no

15495

15496

The LMTP-specific version of the smtp_tls_force_insecure_host_tlsa_lookup

15497

configuration parameter. See there for details.

15498

15499

This feature is available in Postfix 2.11 and later.

15500

15501

%PARAM smtp_tls_force_insecure_host_tlsa_lookup no

15502

15503

Lookup the associated DANE TLSA RRset even when a hostname is

15504

not an alias and its address records lie in an unsigned zone. This

15505

is unlikely to ever yield DNSSEC validated results, since child

15506

zones of unsigned zones are also unsigned in the absence of DLV or

15507

locally configured non-root trust-anchors. We anticipate that such

15508

mechanisms will not be used for just the "_tcp" subdomain of a host.

15509

Suppressing the TLSA RRset lookup reduces latency and avoids potential

15510

interoperability problems with nameservers for unsigned zones that

15511

are not prepared to handle the new TLSA RRset.

15512

15513

This feature is available in Postfix 2.11.

15514

15515

%PARAM tls_dane_digest_agility on

15516

15517

Configure DANE TLSA digest algorithm agility. When digest

15518

algorithm agility is enabled, and the server and client support a

15519

common strong digest algorithm, TLSA records with weaker digest

15520

algorithms are ignored.

15521

15522

Specify one of the following:

15523

15524

<dl>

15525

15526

15527

<dd> DANE verification examines each well-formed record in the TLSA

15528

RRset whose matching type is either "0" (no hash used) or is one of

15529

the digest algorithms listed in $tls_dane_digests. This setting

15530

is not recommended. </dd>

15531

15532

15533

<dd> From each group of well-formed TLSA RRs a non-zero digest

15534

matching type with the same certificate usage and selector, DANE

15535

verification examines only those records whose matching type has

15536

the highest precedence (appear earliest in $tls_dane_digests).

15537

</dd>

15538

15539

<dt>maybe</dt>

15540

<dd> For compatibility with digest algorithm agility, each certificate

15541

or public key whose digest is included in a DANE TLSA RRset, SHOULD

15542

be published with the same set of digest matching type values as

15543

any other with the same usage and selector. Therefore, compatible

15544

TLSA RRsets will contain an identical count of well-formed RRs with

15545

each non-zero digest matching type for any fixed combination of

15546

usage and selector. When this constraint is violated, or any of

15547

the digest records are malformed, digest algorithm agility will

15548

disabled. Otherwise, digest algorithm agility is enabled. </dd>

15549

15550

</dl>

15551

15552

Digest algorithm agility ensures that the strongest digest

15553

supported by both the Postfix SMTP client and the remote server is

15554

used, and weaker digests are ignored. This supports non-disruptive

15555

deprecation of outdated digest algorithms.

15556

15557

To ensure compatibility with digest algorithm agility during

15558

key rotation, when a certificate or public key is being replaced

15559

with another, and both are published during the transition, both

15560

the old and the new certificate MUST be specified with the same set

15561

of digests. One can change the list of digest algorithms later,

15562

once old keys are retired. At any given time, change either the

15563

list of digests without changing the list of certificates or public

15564

keys or the list of certificates or public keys without changing

15565

the list of digests. Full value matching type "0" records are not

15566

subject to this constraint, but are discouraged due to the size of

15567

the resulting DNS records.

15568

15569

It is expected that this algorithm agility mechanism will be

15570

published in a standards track RFC for SMTP with DANE, and also in

15571

an eventual update to RFC 6698.

15572

15573

This feature is available in Postfix 2.11 and later.

15574

15575

%PARAM tls_dane_digests sha512 sha256

15576

15577

RFC 6698 TLSA resource-record "matching type" digest algorithms

15578

in descending preference order. All the specified algorithms must

15579

be supported by the underlying OpenSSL library, otherwise the Postfix

15580

SMTP client will not support DANE TLSA security.

15581

15582

Specify a list of digest names separated by commas and/or

15583

whitespace. Each digest name may be followed by an optional

15584

"=<number>" suffix. For example, "sha512" may instead be specified

15585

as "sha512=2" and "sha256" may instead be specified as "sha256=1".

15586

The optional number must match the <a

15587

href="https://www.iana.org/assignments/dane-parameters/dane-parameters.xhtml#matching-types"

15588

>IANA</a> assigned TLSA matching type number the algorithm in question.

15589

Postfix will check this constraint for the algorithms it knows about.

15590

Additional matching type algorithms registered with IANA can be added

15591

with explicit numbers provided they are supported by OpenSSL.

15592

15593

Invalid list elements are logged with a warning and disable DANE

15594

support. TLSA RRs that specify digests not included in the list are

15595

ignored with a warning.

15596

15597

Note: It is unwise to omit sha256 from the digest list. This

15598

digest algorithm is the only mandatory to implement digest algorithm

15599

in RFC 6698, and many servers are expected publish TLSA records

15600

with just sha256 digests. Unless one of the standard digests is

15601

seriously compromised and servers have had ample time to update their

15602

TLSA records you should not omit any standard digests, just arrange

15603

them in order from strongest to weakest.

15604

15605

When for a particular combination of "certificate usage" and

15606

"selector" the TLSA RRset contains records with more than one digest

15607

matching type, the tls_dane_digest_agility parameter determines

15608

whether all the RRs are used, or only those with the most preferred

15609

digest matching type.

15610

15611

The tls_dane_trust_anchor_digest_enable parameter controls

15612

whether any digest TLSA records are acceptable in usage "2" (trust

15613

anchor assertion) TLSA records.

15614

15615

This feature is available in Postfix 2.11 and later.

Older »