POSTCONF(5) File Formats Manual POSTCONF(5) (NAME) postconf - Postfix (SYNOPSIS) postconf parameter ... postconf -e "parameter=value" ... (DESCRIPTION) main.cf Postfix Postfix . . main.cf : o <> . (whitespace) <<=>> . o <<#>> . o . . o . o <<$name>> <<${name}>> . [a-zA-Z0-9_] . . o <<${name?value}>> <<${name?{value}}>> <<$name>> <> . [a-zA-Z0-9_] . 2.2 <= 3.0 <= Postfix . o <<${name:value}>> <<${name:{value}}>> <<$name>> <> . [a-zA-Z0-9_] . 2.2 <= 3.0 <= Postfix . o <<${name?{value1}:{value2}}>> <<$name>> <> <<$name>> <> . <<{}>> <> <> . [a-zA-Z0-9_] . 3.0 <= Postfix . o <<${...}>> <<{value3} == {value4}>> . <<==>> () Postfix <> () <<<>> <<<=>> <<>=>> <<>>> . . 3.0 <= Postfix . o <<${name{value}}>> name value <<{>> <<}>> . domain_to_ascii{} . o <> . o <<{value}>> . o <<$>> <<$$>> . o <<$(...)>> <<${...}>> . o . o main.cf . Postfix . <> . : Postfix . . 2bounce_notice_recipient (default: postmaster) . notify_classes . access_map_defer_code (default: 450) SMTP Postfix <> access(5) <> <>. Postfix 2.6 <<450>> . RFC 5321 . Postfix 2.6 . access_map_reject_code (default: 554) SMTP Postfix <> access(5). RFC 5321 . address_verify_cache_cleanup_interval (default: 12h) verify(8). <> <> . . verify(8) . <> <> max_idle$ <> () . ( ). : s () m () h () d () w (). h () . Postfix 2.7 . address_verify_default_transport (default: $default_transport) default_transport . Postfix 2.1 . address_verify_local_transport (default: $local_transport) local_transport . Postfix 2.1 . address_verify_map (default: Postfix >= 3.11: $default_cache_db_type:$data_directory/verify_cache; Postfix < 3.11: btree:$data_directory/verify_cache) . verify(8) . (Postfix 2.7 ). () <> <> . Postfix 2.6 . . . ( /truncate) <> . Postfix (root) (Postfix 2.5 ). Postfix data_directory . Postfix data_directory Postfix . : address_verify_map = $default_cache_db_type:$data_directory/verify_cache address_verify_map = lmdb:/var/lib/postfix/verify_cache address_verify_map = btree:/var/lib/postfix/verify_cache Postfix 2.1 . address_verify_negative_cache (default: yes) () . . Postfix . Postfix 2.1 . address_verify_negative_expire_time (default: 3d) . ( ). : s () m () h () d () w (). d () . Postfix 2.1 . address_verify_negative_refresh_time (default: 3h) . ( ). : s () m () h () d () w (). h () . Postfix 2.1 . address_verify_pending_request_limit (default: see postconf -d output) Postfix . 1/4 (qmgr_message_active_limit) . (tempfail) . verify(8) . Postfix 3.1 . address_verify_poll_count (default: normal: 3, overload: 1) verify(8) . SMTP Postfix verify(8) (poll) . Postfix 2.5 SMTP verify(8) . (greylisting) 1 . : # Postfix <= 2.6 default address_verify_poll_count = 3 # Poor man's greylisting address_verify_poll_count = 1 Postfix 2.1 . address_verify_poll_delay (default: 3s) . 3 . ( ). : s () m () h () d () w (). s () . Postfix 2.1 . address_verify_positive_expire_time (default: 31d) . ( ). : s () m () h () d () w (). d () . Postfix 2.1 . address_verify_positive_refresh_time (default: 7d) . ( ). ( ). : s () m () h () d () w (). d () . Postfix 2.1 . address_verify_relay_transport (default: $relay_transport) relay_transport . Postfix 2.1 . address_verify_relayhost (default: $relayhost) relayhost . transport(5) . Postfix 2.1 . address_verify_sender (default: $double_bounce_sender) Postfix 2.5 <> . SMTP Postfix SMTPD . (address_verify_sender =) <> . <> RFC . : address_verify_sender = <> address_verify_sender = postmaster@mydomain Postfix 2.1 . address_verify_sender_dependent_default_transport_maps (default: $sender_dependent_default_transport_maps) sender_dependent_default_transport_maps . Postfix 2.7 . address_verify_sender_dependent_relayhost_maps (default: $sender_dependent_relayhost_maps) sender_dependent_relayhost_maps . Postfix 2.3 . address_verify_sender_ttl (default: 0s) . (localpart) address_verify_sender . ( address_verify_sender <> ) . . . . (greylisting) . TTL . ( ). : s () m () h () d () w (). s () . Postfix 2.9 . address_verify_service_name (default: verify) verify(8). / Postfix . address_verify_transport_maps (default: $transport_maps) transport_maps . Postfix 2.1 . address_verify_virtual_transport (default: $virtual_transport) virtual_transport . Postfix 2.1 . alias_database (default: see postconf -d output) (alias) local(8) <> <> . alias_maps$ . : alias_database = $default_database_type:/etc/aliases alias_database = lmdb:/etc/aliases alias_database = lmdb:/etc/mail/aliases :lmdb :cdb :hash :dbm . alias_maps (default: see postconf -d output) (localpart) ( ) local(8) virtual_alias_maps ( ) : local(8) (virtual) (remote). alias_maps aliases(5) . Postfix ADDRESS_REWRITING_README . "type:name" . . : (recursive) . . NIS NIS . local(8) $1 alias_maps . local(8) proxymap(8) alias_maps . . Postfix 2.2 local(8) . : alias_maps = $default_database_type:/etc/aliases, nis:mail.aliases alias_maps = $default_database_type:/etc/aliases alias_maps = lmdb:/etc/mail/aliases alias_maps = lmdb:/etc/aliases lmdb: cdb: hash: dbm: . "postalias /path/to/aliases" aliases () . "postalias type:/path/to/aliases" . default_database_type . "postconf -m" . . "postfix reload" . allow_mail_to_commands (default: alias, forward) local(8) . "|command" :include: ( aliases(5) ). : alias forward include aliases(5) .forward :include: . : allow_mail_to_commands = alias,forward,include allow_mail_to_files (default: alias, forward) local(8) . "/file/name" :include: ( aliases(5) ). : alias forward include "/file/name" aliases(5) .forward :include: . : allow_mail_to_files = alias,forward,include allow_min_user (default: no) `-' . . . "--" . Postfix 2.5 trivial-rewrite(8) . qmgr(8) . allow_percent_hack (default: yes) "user%domain" "user@domain" . . : Postfix 2.2 : o sendmail(1) Postfix o $local_header_rewrite_clients o remote_header_rewrite_domain . Postfix 2.2 "local_header_rewrite_clients = static:all" . : allow_percent_hack = no allow_srv_lookup_fallback (default: no) SRV SRV MX IP SRV . Postfix 3.8 . allow_untrusted_routing (default: no) (user[@%!]remote[@%!]site) $relay_domains. . (open relay) MX MX . Postfix . Postfix . alternate_config_directories (default: empty) Postfix "-c config_directory" ( sendmail(1) "-C") MAIL_CONFIG . main.cf Postfix set-gid Postfix postqueue(1) postdrop(1) . . : $name . always_add_missing_headers (default: no) (Resent-) From: To: Date: Message-ID: . Postfix 2.6 local_header_rewrite_clients . Postfix DKIM . undisclosed_recipients_header To: . always_bcc (default: empty) << >> (BCC) Postfix . : Postfix 2.3 BCC NOTIFY=NONE . RFC 3461 BCC . : Postfix 2.2 BCC . : BCC . (loops) BCC Postfix Postfix . : BCC ( ) canonical_maps masquerade_domains virtual_alias_maps . anvil_rate_time_unit (default: 60s) . anvil(8) Postfix 2.2 . . anvil(8) . . ( ). : s () m () h () d () w (). s () . anvil_status_update_time (default: 600s) anvil(8) . ( ). : s () m () h () d () w (). s () . Postfix 2.2 . append_at_myorigin (default: yes) "@$myorigin" . "@$remote_header_rewrite_domain" . : . Postfix . : Postfix 2.2 : o sendmail(1) Postfix o $local_header_rewrite_clients o remote_header_rewrite_domain . Postfix 2.2 "local_header_rewrite_clients = static:all" . append_dot_mydomain (default: Postfix >= 3.0: no, Postfix < 3.0: yes) ".$mydomain" ".domain" . ".$remote_header_rewrite_domain" . : (Postfix 3.0 ) "user@partialdomainname" . : Postfix 2.2 : o sendmail(1) Postfix o $local_header_rewrite_clients o remote_header_rewrite_domain . Postfix 2.2 "local_header_rewrite_clients = static:all" . application_event_drain_time (default: 100s) postkick(1) Postfix . ( ). : s () m () h () d () w (). s () . Postfix 2.1 . authorized_flush_users (default: static:anyone) (flush) . . (super-user) $mail_owner . UID . "unknown" UID . "/file/name" "type:table" / . . "/file/name" "type:table" ( ). . "!pattern" . "!/file/name" Postfix 2.4 . Postfix 2.2 . authorized_mailq_users (default: static:anyone) . . (super-user) $mail_owner . UID . "unknown" UID . "/file/name" "type:table" / . . "/file/name" "type:table" ( ). . "!pattern" . "!/file/name" Postfix 2.4 . Postfix 2.2 . authorized_submit_users (default: static:anyone) sendmail(1) ( postdrop(1)) . . UID . "unknown" UID . . "/file/name" "type:table" / . . "/file/name" "type:table" ( ). . "!pattern" . "!/file/name" Postfix 2.4 . : authorized_submit_users = !www, static:all Postfix 2.2 . authorized_verp_clients (default: $mynetworks) SMTP XVERP . . XVERP . Postfix 1.1 . Postfix 2.1 smtpd_authorized_verp_clients none . network/netmask / . . .domain ( ) "/file/name" "type:table" . "/file/name" "type:table" ( ). . "!pattern" . "!/file/name" Postfix 2.4 . : (IPv6) [] authorized_verp_clients "/file/name" . ":" "type:table" . backwards_bounce_logfile_compatibility (default: yes) bounce(8) Postfix 2.0 . "name = value" . Postfix 2.1 . berkeley_db_create_buffer_size (default: 16777216) / (I/O) hash btree Berkeley DB . . Postfix 2.0 . berkeley_db_read_buffer_size (default: 131072) / (I/O) hash btree Berkeley DB . . Postfix 2.0 . best_mx_transport (default: empty) SMTP Postfix <> ( ) . MTA (MX) SMTP $mydestination $inet_interfaces $proxy_interfaces $virtual_alias_domains $virtual_mailbox_domains . SMTP Postfix . SMTP Postfix local(8) "best_mx_transport = local" . <> <> master.cf . <> <> transport(5) . local(8) SMTP Postfix . Postfix . biff (default: yes) biff. << >> <> . . biff . "biff = no" main.cf . body_checks (default: empty) body_checks(5) . : Postfix 2.0 . body_checks_size_limit (default: 51200) ( ) body_checks . . Postfix 2.0 . bounce_notice_recipient (default: postmaster) postmaster Postfix SMTP Postfix . notify_classes . bounce_queue_lifetime (default: 5d) (bounce) bounce_queue_lifetime . . ( ). : s () m () h () d () w (). d () . 0 . Postfix 2.1 . bounce_service_name (default: bounce) bounce(8). . Postfix 2.0 . bounce_size_limit (default: 50000) . . message/rfc822 ( ) text/rfc822-headers ( ) . Postfix 2.4 message/rfc822 (truncated) . : o mime_nesting_limit . o . MTA . bounce_template_file (default: empty) (bounce). (DSN) . bounce(5) . $name Postfix . $name Postfix <> . Postfix 2.3 . broken_sasl_auth_clients (default: no) SMTP AUTH (RFC 4954) . MicroSoft Outlook Express 4 MicroSoft Exchange 5.0. Postfix AUTH "broken_sasl_auth_clients = yes" . canonical_classes (default: envelope_sender, envelope_recipient, header_sender, header_recipient) canonical_maps . canonical_maps (envelope) (header) . : envelope_sender envelope_recipient header_sender header_recipient Postfix 2.2 . canonical_maps (default: empty) . canonical_classes . Firstname.Lastname . canonical(5) . Postfix ADDRESS_REWRITING_README . "type:name" . . : (recursive) . : Postfix 2.2 : o sendmail(1) Postfix o $local_header_rewrite_clients o remote_header_rewrite_domain . Postfix 2.2 "local_header_rewrite_clients = static:all" . : canonical_maps = lmdb:/etc/postfix/canonical lmdb: cdb: hash: dbm: . canonical "postmap /etc/postfix/canonical" () . "postmap type:/etc/postfix/canonical" . default_database_type . "postconf -m" . . "postfix reload" . cleanup_replace_stray_cr_lf (default: yes) SMTP (outbound SMTP smuggling) DKIM Postfix . SMTP . SMTP Postfix End-of-DATA SMTP SMTP . Postfix DKIM . SMTP . : "receive_override_options = no_header_body_checks" . Postfix >= 3.9 3.8.5 3.7.10 3.6.14 3.5.24 . cleanup_service_name (default: cleanup) cleanup(8). canonical(5) virtual(5) . Postfix 2.0 . command_directory (default: see postconf -d output) Postfix. command_execution_directory (default: empty) local(8) . . command_execution_directory $name Postfix . $name command_execution_directory . . $name execution_directory_expansion_filter . $user . $shell . $home . $recipient . $extension . $domain . $local . $recipient_delimiter (Postfix 2.11 ) (Postfix 2.10 ). ${name?value} ${name?{value}} (Postfix >= 3.0) $name value . ${name:value} ${name:{value}} (Postfix >= 3.0) $name value . ${name?{value1}:{value2}} (Postfix >= 3.0) $name value1 value2 . $name ${name} $(name) . Postfix 2.2 . command_expansion_filter (default: see postconf -d output) local(8) $name $mailbox_command $command_execution_directory . (underscore) . command_time_limit (default: 1000s) . local(8) pipe(8) . : ipc_timeout . compatibility_level (default: 0) Postfix Postfix . ( compatibility_level main.cf Postfix ) Postfix . using backwards-compatible default setting name=value to [accept a specific client request] using backwards-compatible default setting name=value to [enable specific Postfix behavior] COMPATIBILITY_README . main.cf master.cf : # postconf name=value # postfix reload compatibility_level main.cf : # postconf compatibility_level=N # postfix reload N postfix(1) : warning: To disable backwards compatibility use "postconf compatibility_level=N" and "postfix reload" Postfix 3.6 Postfix . major.minor.patch patch . 0 1 2 . : ""<=level" . "<" "<=" "3.10" "3.9" . Postfix 3.0 . config_directory (default: see postconf -d output) main.cf master.cf Postfix. : o MAIL_CONFIG ( ). o <<-c>> ( ). Postfix set-gid config_directory (root) alternate_config_directories main.cf . confirm_delay_cleared (default: no) << >> . . : delay_warning_time. Postfix 3.0 . connection_cache_protocol_timeout (default: 5s) (connection cache). . Postfix 2.3 . connection_cache_service_name (default: scache) scache(8). . Postfix 2.2 . connection_cache_status_update_time (default: 600s) scache(8) (hit) (miss) . connection_cache_ttl_limit (default: 2s) (TTL) scache(8). TTL TTL . . TTL $max_idle . content_filter (default: empty) transport:destination . transport master.cf (destination) . FILTER_README Postfix . : o FILTER access(5) header_checks(5) body_checks(5) . o destination . Postfix 2.7 $myhostname . Postfix 2.6 "default_filter_nexthop = $myhostname" content_filter (destination) . cyrus_sasl_config_path (default: empty) Cyrus SASL $smtpd_sasl_path.conf . Cyrus SASL . : Postfix "cyrus_sasl_config_path" Postfix /etc/postfix/sasl/smtpd.conf . Postfix 2.5 Cyrus SASL 2.1.22 . daemon_directory (default: see postconf -d output) Postfix. . (root) . daemon_table_open_error_is_fatal (default: no) (lookup tables) Postfix: . no () : "error" . "warning" . notify_classes "data" SMTP Postfix . yes ( ) : "fatal" . Postfix . "error" 13 . Postfix 2.9 . daemon_timeout (default: 18000s) Postfix (watchdog) . ( ). : s () m () h () d () w (). s () . data_directory (default: see postconf -d output) Postfix ( : ). mail_owner Postfix . Postfix 2.5 . debug_peer_level (default: 2) (verbose) debug_peer_list . (per-nexthop) Postfix 3.6 . debug_peer_list (default: empty) $debug_peer_level . (per-nexthop) Postfix 3.6 . / "/file/name" "type:table" . "type:table" . IPv6 [] . "debug_peer_list" parent_domain_matches_subdomains . : debug_peer_list = 127.0.0.1 debug_peer_list = example.com debugger_command (default: empty) Postfix -D . "command .. & sleep 5" (debugger) . X Postfix XAUTHORITY . : ($name expansion) . <<$>> <<$$>> . : debugger_command = PATH=/usr/bin:/usr/X11R6/bin ddd $daemon_directory/$process_name $process_id & sleep 5 default_cache_db_type (default: see 'postconf -d default_cache_db_type' output) address_verify_map postscreen_cache_map. Postfix 3.11 btree . Postfix 3.11 . default_database_type (default: see postconf -d output) newaliases(1) postalias(1) postmap(1). UNIX lmdb hash . (build) Postfix . : default_database_type = lmdb default_database_type = hash default_delivery_slot_cost (default: 5) Postfix (preempt) . << >> . ( - ) ( ). - default_delivery_slot_cost . 0 . 2 - . 50 . 2 (mailing list) . (cost+1/cost) (cost/cost-1) . 5 20 25 . transport_delivery_slot_cost transport master.cf . : default_delivery_slot_cost = 0 default_delivery_slot_cost = 2 default_delivery_slot_discount (default: 50) _delivery_slot_discount . . transport_delivery_slot_discount transport_delivery_slot_loan . . transport_delivery_slot_discount transport master.cf . default_delivery_slot_loan (default: 3) _delivery_slot_loan . . transport_delivery_slot_discount transport_delivery_slot_loan . . transport_delivery_slot_loan transport master.cf . default_delivery_status_filter (default: empty) Postfix . (4.X.X) (5.X.X) (2.X.X) (4.X.X 5.X.X) . : (smtp|lmtp)_delivery_status_filter : 5XX MX A . smtp_reply_filter lmtp_reply_filter . : lmtp_delivery_status_filter local_delivery_status_filter pipe_delivery_status_filter smtp_delivery_status_filter virtual_delivery_status_filter. . "type:table" . : enhanced-status-code SPACE explanatory-text . (2.X.X) (4.X.X 5.X.X) . . 1: TLS (enhanced status code). /etc/postfix/main.cf: smtp_delivery_status_filter = pcre:/etc/postfix/smtp_dsn_filter /etc/postfix/smtp_dsn_filter: /^4(\.\d+\.\d+ TLS is required, but host \S+ refused to start TLS: .+)/ 5$1 /^4(\.\d+\.\d+ TLS is required, but was not offered by host .+)/ 5$1 # Do not change the following into hard bounces. They may # result from a local configuration problem. # 4.\d+.\d+ TLS is required, but our TLS engine is unavailable # 4.\d+.\d+ TLS is required, but unavailable # 4.\d+.\d+ Cannot start TLS: handshake failure 2: . /etc/postfix/main.cf: local_delivery_status_filter = pcre:/etc/postfix/local_dsn_filter /etc/postfix/local_dsn_filter: /^(2\S+ delivered to file).+/ $1 /^(2\S+ delivered to command).+/ $1 : o soft_bounce . o maillog . Postfix 3.0 . default_destination_concurrency_failed_cohort_limit (default: 1) (pseudo-cohort) (handshake) ( ). . . . transport_destination_concurrency_failed_cohort_limit transport master.cf . Postfix 2.5 . Postfix . default_destination_concurrency_limit (default: 20) . lmtp(8) pipe(8) smtp(8) virtual(8) . > 1 . transport_destination_concurrency_limit transport master.cf . default_destination_concurrency_negative_feedback (default: 1) . 0..1 ( ) . 1/feedback . 1/feedback . Postfix 2.5 . $default_destination_concurrency_failed_cohort_limit ( $transport_destination_concurrency_failed_cohort_limit) (dead) ( ). . : number number / number . 0..1 ( ) . "1" Postfix 2.5 ( ) . number / concurrency "number / ( )". number 0..1 ( ) . number "1" 1 . . transport_destination_concurrency_negative_feedback transport master.cf . Postfix 2.5 . Postfix . default_destination_concurrency_positive_feedback (default: 1) . 0..1 ( ) . . 1/feedback . 1/feedback . : number number / number . 0..1 ( ) . "1" Postfix 2.5 . number / concurrency "number / ( )". number 0..1 ( ) . number "1" 1 . . transport_destination_concurrency_positive_feedback transport master.cf . Postfix 2.5 . default_destination_rate_delay (default: 0s) . $default_destination_rate_delay . . o > 1 same domain ( ) . master.cf . o 1 same recipient ( ) . master.cf . ( ) . : s () m () h () d () w (). s () . : . <> <> . transport_destination_rate_delay transport master.cf . : _destination_rate_delay transport_destination_concurrency_failed_cohort_limit 10 Postfix . Postfix 2.5 . default_destination_recipient_limit (default: 50) . lmtp(8) pipe(8) smtp(8) virtual(8) . 1 : o same domain ( ) same recipient ( ) . master.cf . o same domain ( ) same recipient ( ) . master.cf . o same domain ( ) same recipient ( ) . transport_destination_recipient_limit transport master.cf . default_extra_recipient_limit (default: 1000) . Postfix (preempt) . transport_extra_recipient_limit transport master.cf . default_filter_nexthop (default: empty) content_filter FILTER (next-hop) $default_filter_nexthop . Postfix 2.6 "default_filter_nexthop = $myhostname" content_filter FILTER . Postfix 2.7 . default_minimum_delivery_slots (default: 3) Postfix . ( ) (preempt) . transport_minimum_delivery_slots transport master.cf . default_privs (default: nobody) local(8) . aliases(5) root root . POSTFIX . default_process_limit (default: 100) Postfix . master.cf . default_rbl_reply (default: see postconf -d output) SMTP Postfix RBL . rbl_reply_maps . Postfix 2.0 . Postfix $name . $name : $client IP name[address]. $client_address IP . $client_name "unknown". reject_unknown_client_hostname . $reverse_client_name address->name "unknown". reject_unknown_reverse_client_hostname . $helo_name HELO EHLO . $rbl_class : Client host Helo command Sender address Recipient address. $rbl_code SMTP maps_rbl_reject_code . : SMTP . Postfix 2.3 RFC 3463 . $rbl_domain RBL ( =address-filter) $rbl_what . $rbl_reason $rbl_what . $rbl_what ( IP ). $recipient <> (null). $recipient_domain . $recipient_name (localpart) <> . $sender <> (null). $sender_domain . $sender_name (localpart) <> . ${name?value} ${name?{value}} (Postfix >= 3.0) $name value . ${name:value} ${name:{value}} (Postfix >= 3.0) $name value . ${name?{value1}:{value2}} (Postfix >= 3.0) $name value1 value2 . $name ${name} $(name) . : RBL . RBL client helo sender recipient . o SMTP Postfix DSN ( 4.1.1-4.1.6) DSN . o ( HELO / ) SMTP Postfix DSN DSN ( 4.0.0) . default_recipient_limit (default: 20000) . qmgr_message_recipient_limit . default_extra_recipient_limit qmgr_message_recipient_minimum . transport_recipient_limit transport master.cf . default_recipient_refill_delay (default: 5s) . . $default_recipient_refill_limit . transport_recipient_refill_delay transport master.cf . Postfix 2.4 . default_recipient_refill_limit (default: 100) . . $default_recipient_refill_delay . transport_recipient_refill_limit transport master.cf . Postfix 2.4 . default_transport (default: smtp) (nexthop) : $mydestination $inet_interfaces $proxy_interfaces $virtual_alias_domains $virtual_mailbox_domains $relay_domains . sender_dependent_default_transport_maps transport(5) . : o : ) $transport_maps ) $sender_dependent_default_transport_maps $default_transport. o nexthop : ) $transport_maps ) $sender_dependent_default_transport_maps $default_transport ) $sender_dependent_relayhost_maps $relayhost . transport:nexthop transport master.cf . :nexthop . SMTP LMTP ( . ). : default_transport = uucp:relayhostname default_transport_rate_delay (default: 0s) . $default_transport_rate_delay . transport_transport_rate_delay transport master.cf . : SMTP . /etc/postfix/main.cf: smtp_transport_rate_delay = 20s ( ). : s () m () h () d () w (). s () . : (queue manager) . . . default_verp_delimiters (default: +=) VERP. SMTP XVERP <> ( . : -V). verp_delimiter_filter . . . defer_code (default: 450) SMTP SMTP <> . RFC 5321 . defer_service_name (default: defer) defer. bounce(8) . . . defer_transports (default: empty) <> . master.cf . : defer_transports = smtp delay_logging_resolution_limit (default: 2) . . : o >= 100s . o < 10^-$delay_logging_resolution_limit <<0>> . o delay_logging_resolution_limit . <> : o a = . o b = . o c = . SMTP MAIL FROM : DNS TCP EHLO STARTTLS DNS IP RSET . o d = . SMTP MAIL FROM . . . delay_notice_recipient (default: postmaster) postmaster $delay_warning_time . : delay_warning_time notify_classes. delay_warning_time (default: 0h) . confirm_delay_cleared . ( ). : s () m () h () d () w (). h () . : delay_notice_recipient notify_classes confirm_delay_cleared. deliver_lock_attempts (default: 20) bounce(8). deliver_lock_delay (default: 1s) bounce(8). ( ). : s () m () h () d () w (). s () . destination_concurrency_feedback_debug (default: no) (verbose) . . . detect_8bit_encoding_header (default: yes) 8BITMIME Content-Transfer-Encoding: << >> . . . disable_dns_lookups (default: no) DNS SMTP LMTP . getaddrinfo() /etc/hosts . . smtp_dns_support_level . DNS . disable_mime_input_processing (default: no) MIME . Content-Type: . . . MIME MIME . disable_mime_output_conversion (default: no) 8BITMIME 7BIT. MIME 8BITMIME . . . disable_verp_bounces (default: no) (bounce) . ( ) ezmlm . . . disable_vrfy_command (default: no) SMTP VRFY. . : disable_vrfy_command = no dns_ncache_ttl_fix_enable (default: no) libc . RFC 2308 res_query() res_search() res_send() . DNS <> . . . dnsblog_reply_delay (default: 0s) DNS. . . dnsblog_service_name (default: dnsblog) dnsblog(8) master.cf. / (allow/denylist) DNS . . . dnssec_probe (default: ns:.) DNS (: <>) DNS (: <<.>>) DNSSEC . : DNSSEC DANE TLSA TLS . DNSSEC DANE (opportunistic) TLSA DANE (mandatory) . DNSSEC : ) DNS DNSSEC ) DNSSEC ) DNSSEC . DNSSEC DNSSEC DNSSEC . : warning: DNSSEC validation may be unavailable warning: reason: dnssec_probe 'ns:.' received a response that is not DNSSEC validated warning: reason: dnssec_probe 'ns:.' received no response: Server failure DNSSEC: o /etc/resolv.conf DNS DNSSEC ( chroot jail $queue_directory/etc/resolv.conf ). o <> . DNSSEC NS DNS (cache) . DNS dnssec_probe . . . 3.5.9 3.4.19 3.3.16 3.2.21 . domain_to_ascii (default: no default) ASCII . ASCII ( ) ( A-label) domain_to_ascii{} . ASCII ( U-label) domain_to_ascii{} Punycode ( A-label). . : o smtp_requiretls_policy : smtp_requiretls_policy = inline:{ { ${domain_to_ascii{$mydomain}} = opportunistic }, { .${domain_to_ascii{$mydomain}} = opportunistic }, ... o : mydomain ASCII domain_to_ascii{} . # postconf -o 'mydomain=foo.example' -x smtp_requiretls_policy smtp_requiretls_policy = inline:{ { foo.example = opportunistic }, { .foo.example = opportunistic }, ... o : mydomain ASCII domain_to_ascii{} Punycode . # postconf -o 'mydomain=.example' -x smtp_requiretls_policy smtp_requiretls_policy = inline:{ { xn--1xa.example = opportunistic }, { .xn--1xa.example = opportunistic }, ... >= 3.11 . dont_remove (default: 0) <> . . postcat(1) . double_bounce_sender (default: double-bounce) (postmaster) . . duplicate_filter_limit (default: 1000) aliases(5) virtual(5) showq(8). empty_address_default_transport_maps_lookup_key (default: <>) sender_dependent_default_transport_maps (null) . . . empty_address_local_login_sender_maps_lookup_key (default: <>) local_login_sender_maps (null). Postfix 3.6 . empty_address_recipient (default: MAILER-DAEMON) (null) . Postfix SMTP . empty_address_relayhost_maps_lookup_key (default: <>) sender_dependent_relayhost_maps (null) . Postfix 2.5 . sender_dependent_relayhost_maps . enable_errors_to (default: no) Errors-To: ( Postfix 2.2 Postfix 2.1 Postfix ). enable_idna2003_compatibility (default: no) <<>> IDNA2003 IDNA2008 UTF-8 / ASCII DNS . Postfix 3.1 "yes" ( ). sz . https://unicode.org/cldr/utility/idna.jsp . Postfix 3.2 . enable_long_queue_ids (default: no) ( ) . ( "postsuper" inode ). : Postfix 2.8 . "yes" : o . o 3Pt2mN2VXxznjll . (0-9) (B-Z) (b-z) . (AEIOUaeiou) . : 'z' inode . o Message-ID queueID@myhostname . o mailq (postqueue -p) Queue ID . . o hash_queue_depth . "enable_long_queue_ids = no" . "no" : o ( "postfix reload" "postsuper"). o C3CD21F3E90 (0-9) (A-F) . : inode . o Message-ID YYYYMMDDHHMMSS.queueid@myhostname YYYYMMDDHHMMSS . o mailq (postqueue -p) Postfix 2.8 . o hash_queue_depth . Postfix 2.8 : # postfix stop # postconf enable_long_queue_ids=no # postsuper postsuper . Postfix 2.9 . enable_original_recipient (default: yes) ( ). : "enable_original_recipient = yes" X-Original-To . . "enable_original_recipient = yes" cleanup(8) ( ) . cleanup(8) . : Postfix 3.2 "enable_original_recipient = no" (Postfix ). Postfix 2.1 . Postfix 2.0 yes . Postfix 2.0 . enable_threaded_bounces (default: no) References: In-Reply-To: Message-ID . . (thread) . ( ) . Postfix 3.6 . error_notice_recipient (default: postmaster) (postmaster) . notify_classes . error_service_name (default: error) error(8). . Postfix 2.0 . execution_directory_expansion_filter (default: see postconf -d output) local(8) $name $command_execution_directory . (underscore) . Postfix 2.2 . expand_owner_alias (default: no) "aliasname" "owner-aliasname" "owner-aliasname" . Postfix "owner-aliasname" . export_environment (default: see postconf -d output) Postfix Postfix (export) . TZ System-V . / name=value . "{ name=value }" ( "{" "}" ). name=value Postfix 2.1 {} Postfix 3.0 . : export_environment = TZ PATH=/bin:/usr/bin extract_recipient_limit (default: 10240) Postfix "sendmail -t" . Postfix 2.1 . fallback_relay (default: empty) SMTP . Postfix 2.3 smtp_fallback_relay . . SMTP . host:port [host]:port [address] [address]:port [host] MX . SMTP Postfix . : Postfix 2.2 MX fallback_relay . MX Postfix fallback_relay . o main.cf "relay_transport = relay" o master.cf "-o fallback_relay =" ( ) relay . o (transport maps) "relay:nexthop..." MX . Postfix 2.2 fallback_relay MX . fallback_transport (default: empty) local(8) aliases(5) UNIX . local(8) : aliases .forward mailbox_transport_maps mailbox_transport mailbox_command_maps mailbox_command home_mailbox mail_spool_directory fallback_transport_maps fallback_transport luser_relay. fallback_transport_maps (default: empty) local(8) aliases(5) UNIX . local(8) : aliases .forward mailbox_transport_maps mailbox_transport mailbox_command_maps mailbox_command home_mailbox mail_spool_directory fallback_transport_maps fallback_transport luser_relay. $number . Postfix 2.3 . fast_flush_domains (default: $relay_domains) . Postfix "fast flush" SMTP Postfix ( : "fast_flush_domains = $relay_domains" relay_domains postconf(5) ). "/file/name" "type:table" / . . "/file/name" "type:table" . "fast_flush_domains" parent_domain_matches_subdomains . "fast_flush_domains =" ( ) . fast_flush_purge_time (default: 7d) "fast flush" . : s= m= h= d= w=. . fast_flush_refresh_time (default: 12h) "fast flush" . . : s= m= h= d= w=. . fault_injection_code (default: 0) . flush_service_name (default: flush) flush(8). . Postfix 2.0 . force_mime_input_conversion (default: no) 8-bit quoted-printable header_checks body_checks Milter (after-queue). smtpd_proxy_filter . (MTA) MTA 8BITMIME SMTP . Postfix 3.9 . fork_attempts (default: 5) fork() . fork_delay (default: 1s) fork() . ( ). : s () m () h () d () w (). s () . forward_expansion_filter (default: see postconf -d output) local(8) $name $forward_path . . forward_path (default: see postconf -d output) local(8) .forward . . forward_path $name Postfix . $name forward_path . $name forward_expansion_filter . $user . $shell . $home . $recipient . $extension . $domain . $local (localpart) . $recipient_delimiter (Postfix 2.11 ) <<>> (Postfix 3.5.22 3.6.12 3.7.8 3.8.3 ). (Postfix 2.10 ). ${name?value} ${name?{value}} (Postfix >= 3.0) $name value . ${name:value} ${name:{value}} (Postfix >= 3.0) $name value . ${name?{value1}:{value2}} (Postfix >= 3.0) $name value1 value2 . name$ {name}$ (name)$ . : forward_path = /var/forward/$user forward_path = /var/forward/$user/.forward$recipient_delimiter$extension, /var/forward/$user/.forward frozen_delivered_to (default: yes) local(8) :Delivered-To ( prepend_delivered_header ) forward. :Delivered-To . Postfix 2.3 . Postfix "no" . forward. . forward. :Delivered-To cleanup . full_name_encoding_charset (default: utf-8) ( "charset" ) Postfix RFC 2047 . ASCII SMTPUTF8 SMTPUTF8 . "=?charset?q?gibberish?=" quoted-printable "=?charset?b?gibberish?=" base64 . Postfix quoted-printable base64 . : :From sendmail(1) cleanup(8) :From "-F" sendmail(1) "NAME" sendmail(1) GECOS UNIX . Postfix "&" (login name) . : Postfix . full_name_encoding_charset "-F" sendmail "NAME" sendmail GECOS UNIX . (MUA) . "utf-8" "iso-8859-1" ( Latin1 ). . RFC 2047 Postfix . Postfix >= 3.10 . hash_queue_depth (default: 1) hash_queue_names . . . . . . hash_queue_names hash_queue_depth <> . hash_queue_names (default: deferred, defer) . Postfix 2.2 . incoming active . Postfix . hash_queue_names hash_queue_depth <> . header_address_token_limit (default: 10240) (token) . . cleanup(8) . header_checks (default: empty) MIME header_checks(5) . header_from_format (default: standard) From: Postfix. << >> bin/mail/ :From sendmail(1) . : standard () "From: name
" . Postfix 3.3 . obsolete "From: address (name)" . Postfix 3.3 . : o name Postfix "From: address" . Postfix 3.3 . o standard name (specials) RFC 5322 "!%" (quote) . o sendmail(1) name -F NAME UNIX . Postfix 3.3 . header_size_limit (default: 102400) . . cleanup(8) . helpful_warnings (default: yes) . Postfix 2.0 . home_mailbox (default: empty) local(8). qmail "/" . local(8) : aliases forward. mailbox_transport_maps mailbox_transport mailbox_command_maps mailbox_command home_mailbox mail_spool_directory fallback_transport_maps fallback_transport luser_relay. : home_mailbox = Mailbox home_mailbox = Maildir/ hopcount_limit (default: 50) :Received . (bounce ). html_directory (default: see postconf -d output) HTML Postfix . ignore_mx_lookup_error (default: no) DNS MX . SMTP . SMTP . DNS A "ignore_mx_lookup_error = yes" . SMTP . ignore_srv_lookup_error (default: no) SRV MX IP SRV . Postfix 3.8 . import_environment (default: see postconf -d output) Postfix Postfix name=value. name=value . : TZ System-V . DISPLAY Postfix X-windows . XAUTHORITY Postfix X-windows . MAIL_CONFIG <> . POSTLOG_HOSTNAME <> . POSTLOG_SERVICE <> . XDG_RUNTIME_DIR Postfix XDG . / name=value . "{ name=value }" ( "{" "}" ). name=value Postfix 2.1 {} Postfix 3.0 . in_flow_delay (default: 1s) . ( SCO UNIX SCO ). SMTP "in_flow_delay = 1s" . 0 . 0..10 . inet_interfaces (default: all) . "all" () "loopback-only" (Postfix 2.2 ) IPv4 IPv6 (IPv6 Postfix 2.2 ). Postfix user@[ip.address] Postfix MX . Postfix IP master.cf . : Postfix . : [] . smtp_bind_address / smtp_bind_address6 inet_interfaces IP SMTP LMTP . SMTP IPv4 . IPv6 LMTP . IPv4 IPv6 SMTP LMTP inet_protocols . o inet_interfaces IPv4 SMTP IPv4 . o SMTP IPv4 IPv4 . inet_interfaces all IPv4 IPv4 IPv4 . IP smtp_bind_address smtp_bind_address6 inet_interfaces SMTP SMTP . Postfix (multi-homed) IP SMTP SMTP . smtp_bind_address 0.0.0.0 IPv4 smtp_bind_address6 :: IPv6 . inet_interfaces IP SMTP master.cf . IP SMTP . inet_interfaces$ IPv4 / IPv6 IP IP ( myhostname$ ). proxy_interfaces Postfix . : inet_interfaces = all (DEFAULT) inet_interfaces = loopback-only (Postfix version 2.2 and later) inet_interfaces = 127.0.0.1 inet_interfaces = 127.0.0.1, [::1] (Postfix version 2.2 and later) inet_interfaces = 192.168.1.2, 127.0.0.1 inet_protocols (default: see 'postconf -d' output) Postfix . "ipv4" "ipv6" . "all" IPv6 "ipv4, ipv6" "ipv4" . Postfix 2.8 "ipv4" . Postfix 2.9 "inet_protocols = ipv4" main.cf . IPv6 . Postfix 2.2 . : Postfix . IPV6_V6ONLY ( RFC 3493) IPv6 IPv4 IPv4 inet_protocols . IPV6_V6ONLY IPv6 IPv4 . IPv4 inet_protocols Postfix A DNS IP IPv4-in-IPv6 ( ::ffff:1.2.3.4) IPv4 (1.2.3.4) . IPV6_V6ONLY ( RFC 3493) . IPv6 inet_protocols Postfix DNS AAAA . IPv4 IPv6 SMTP smtp_address_preference . Postfix 2.8 IPv4 IPv6 . : inet_protocols = ipv4 inet_protocols = all (DEFAULT) inet_protocols = ipv6 inet_protocols = ipv4, ipv6 info_log_address_format (default: external) (info warning ). Postfix 3.5 (localpart) : from=<"name with spaces"@example.com> Postfix ( ) : from= . Postfix 3.2 . <> . Postfix . Postfix . Postfix 3.5 . initial_destination_concurrency (default: 5) . 1 (per-destination recipient limit > 1) . transport_initial_destination_concurrency transport master.cf (Postfix 2.5 ). : 1 . internal_mail_filter_classes (default: empty) Postfix non_smtpd_milters header_checks body_checks . . bounce (DSN). notify (postmaster) smtp(8) smtpd(8). : Postfix . . Postfix 2.3 . invalid_hostname_reject_code (default: 501) SMTP Postfix HELO EHLO reject_invalid_helo_hostname . RFC 5321 . ipc_idle (default: version dependent) (idle) . Postfix . Postfix . Postfix 2.4 100s 5s . ( ). : s () m () h () d () w (). s () . ipc_timeout (default: 3600s) . (deadlock) . . ( ). : s () m () h () d () w (). s () . ipc_ttl (default: 1000s) . Postfix . Postfix . ( ). : s () m () h () d () w (). s () . Postfix 2.1 . known_tcp_ports (default: lmtp=24, smtp=25, smtps=submissions=465, submission=587) services(5). <<465>> . ABNF : known_tcp_ports = empty | name-to-port *("," name-to-port) name-to-port = 1*(service-name "=') port-number . . Postfix 3.6 . line_length_limit (default: 2048) . lmdb_map_size (default: 16777216) OpenLDAP LMDB . . Postfix 2.11 . lmtp_address_preference (default: ipv6) LMTP smtp_address_preference. . Postfix 2.8 . lmtp_address_verify_target (default: rcpt) LMTP smtp_address_verify_target. . Postfix 3.0 . lmtp_assume_final (default: no) LMTP DSN <> <> . LMTP . lmtp_balance_inet_protocols (default: yes) LMTP smtp_balance_inet_protocols. . Postfix 3.3 . lmtp_bind_address (default: empty) LMTP smtp_bind_address. . Postfix 2.3 . lmtp_bind_address6 (default: empty) LMTP smtp_bind_address6. . Postfix 2.3 . lmtp_bind_address_enforce (default: empty) LMTP smtp_bind_address_enforce. . Postfix 3.7 . lmtp_body_checks (default: empty) LMTP smtp_body_checks. . Postfix 2.5 . lmtp_cache_connection (default: yes) LMTP Postfix $max_idle . LMTP . Postfix 2.2 . Postfix 2.3 lmtp_connection_cache_on_demand lmtp_connection_cache_destinations lmtp_connection_reuse_time_limit . LMTP LMTP Postfix . : o LMTP Postfix. max_idle Postfix . o . o . max_use Postfix . o LMTP RSET . Postfix LMTP . lmtp_cname_overrides_servername (default: yes) LMTP smtp_cname_overrides_servername. . Postfix 2.3 . lmtp_connect_timeout (default: 0s) LMTP Postfix TCP ( ). LMTP . ( ). : s () m () h () d () w (). s () . : lmtp_connect_timeout = 30s lmtp_connection_cache_destinations (default: empty) LMTP smtp_connection_cache_destinations. . Postfix 2.3 . lmtp_connection_cache_on_demand (default: yes) LMTP smtp_connection_cache_on_demand. . Postfix 2.3 . lmtp_connection_cache_time_limit (default: 2s) LMTP smtp_connection_cache_time_limit. . Postfix 2.3 . lmtp_connection_reuse_count_limit (default: 0) LMTP smtp_connection_reuse_count_limit. . Postfix 2.11 . lmtp_connection_reuse_time_limit (default: 300s) LMTP smtp_connection_reuse_time_limit. . Postfix 2.3 . lmtp_data_done_timeout (default: 600s) LMTP Postfix <<.>> LMTP LMTP . . ( ). : s () m () h () d () w (). s () . lmtp_data_init_timeout (default: 120s) LMTP Postfix DATA LMTP LMTP . ( ). : s () m () h () d () w (). s () . lmtp_data_xfer_timeout (default: 180s) LMTP Postfix LMTP. $lmtp_data_xfer_timeout LMTP . ( ). : s () m () h () d () w (). s () . lmtp_defer_if_no_mx_address_found (default: no) LMTP smtp_defer_if_no_mx_address_found. . Postfix 2.3 . lmtp_delivery_status_filter (default: empty) LMTP smtp_delivery_status_filter. . Postfix 3.0 . lmtp_destination_concurrency_limit (default: $default_destination_concurrency_limit) lmtp. (queue manager) . master.cf . lmtp_destination_recipient_limit (default: $default_destination_recipient_limit) lmtp. (queue manager) . master.cf . 1 lmtp_destination_concurrency_limit . lmtp_discard_lhlo_keyword_address_maps (default: empty) LMTP LHLO ( pipelining starttls auth ) LMTP Postfix LHLO LMTP . lmtp_discard_lhlo_keywords . smtpd_discard_ehlo_keyword_address_maps . Postfix 2.3 . lmtp_discard_lhlo_keywords (default: empty) LHLO ( pipelining starttls auth ) LMTP Postfix LHLO LMTP . Postfix 2.3 . : o silent-discard . o LHLO lmtp_discard_lhlo_keyword_address_maps . lmtp_dns_reply_filter (default: empty) DNS LMTP Postfix. smtp_dns_reply_filter . Postfix 3.0 . lmtp_dns_resolver_options (default: empty) LMTP smtp_dns_resolver_options. . Postfix 2.8 . lmtp_dns_support_level (default: empty) LMTP smtp_dns_support_level. . Postfix 2.11 . lmtp_enforce_tls (default: no) LMTP smtp_enforce_tls. . Postfix 3.9 . lmtp_tls_security_level . Postfix 2.3 . lmtp_fallback_relay (default: empty) LMTP . main.cf . . TCP "inet:" . host:port . MX LMTP "[host]" "[host]:port" . LMTP Postfix . Postfix 3.1 . lmtp_generic_maps (default: empty) LMTP smtp_generic_maps. . Postfix 2.3 . lmtp_header_checks (default: empty) LMTP smtp_header_checks. . Postfix 2.5 . lmtp_host_lookup (default: dns) LMTP smtp_host_lookup. . Postfix 2.3 . lmtp_lhlo_name (default: $myhostname) LHLO LMTP. . [ip.add.re.ss] [ip:v6:add:re::ss] . main.cf LMTP master.cf : /etc/postfix/master.cf: mylmtp ... lmtp -o lmtp_lhlo_name=foo.bar.com Postfix 2.3 . lmtp_lhlo_timeout (default: 300s) LMTP Postfix LHLO LMTP. : s () m () h () d () w (). s () . lmtp_line_length_limit (default: 998) LMTP smtp_line_length_limit. . Postfix 2.3 . lmtp_log_tls_feature_status (default: yes) LMTP smtp_log_tls_feature_status. . Postfix >= 3.11 . lmtp_mail_timeout (default: 300s) LMTP Postfix MAIL FROM LMTP. ( ). : s () m () h () d () w (). s () . lmtp_mime_header_checks (default: empty) LMTP smtp_mime_header_checks. . Postfix 2.5 . lmtp_min_data_rate (default: 500) LMTP smtp_min_data_rate. . Postfix 3.7 . lmtp_mx_address_limit (default: 5) LMTP smtp_mx_address_limit. . Postfix 2.3 . lmtp_mx_session_limit (default: 2) LMTP smtp_mx_session_limit. . Postfix 2.3 . lmtp_nested_header_checks (default: empty) LMTP smtp_nested_header_checks. . Postfix 2.5 . lmtp_per_record_deadline (default: no) LMTP smtp_per_record_deadline. . Postfix 2.9 . lmtp_per_request_deadline (default: no) LMTP smtp_per_request_deadline. . Postfix 3.7 . lmtp_pix_workaround_delay_time (default: 10s) LMTP smtp_pix_workaround_delay_time. . Postfix 2.3 . lmtp_pix_workaround_maps (default: empty) LMTP smtp_pix_workaround_maps. . Postfix 2.4 . lmtp_pix_workaround_threshold_time (default: 500s) LMTP smtp_pix_workaround_threshold_time. . Postfix 2.3 . lmtp_pix_workarounds (default: empty) LMTP smtp_pix_workaround. . Postfix 2.4 . lmtp_quit_timeout (default: 300s) LMTP Postfix QUIT LMTP. ( ). : s () m () h () d () w (). s () . lmtp_quote_rfc821_envelope (default: yes) LMTP smtp_quote_rfc821_envelope. . Postfix 2.3 . lmtp_randomize_addresses (default: yes) LMTP smtp_randomize_addresses. . Postfix 2.3 . lmtp_rcpt_timeout (default: 300s) LMTP Postfix RCPT TO LMTP. ( ). : s () m () h () d () w (). s () . lmtp_reply_filter (default: empty) LMTP smtp_reply_filter. . Postfix 2.7 . lmtp_requiretls_policy (default: opportunistic) LMTP smtp_requiretls_policy. . Postfix >= 3.11 . lmtp_rset_timeout (default: 20s) LMTP Postfix RSET LMTP. LMTP RSET . ( ). : s () m () h () d () w (). s () . lmtp_sasl_auth_cache_name (default: empty) LMTP smtp_sasl_auth_cache_name. . Postfix 2.5 . lmtp_sasl_auth_cache_time (default: 90d) LMTP smtp_sasl_auth_cache_time. . Postfix 2.5 . lmtp_sasl_auth_enable (default: no) SASL LMTP Postfix. lmtp_sasl_auth_soft_bounce (default: yes) LMTP smtp_sasl_auth_soft_bounce. . Postfix 2.5 . lmtp_sasl_mechanism_filter (default: empty) LMTP smtp_sasl_mechanism_filter. . Postfix 2.3 . lmtp_sasl_password_maps (default: empty) LMTP Postfix username:password . username:password LMTP Postfix . lmtp_sasl_password_result_delimiter (default: :) LMTP smtp_sasl_password_result_delimiter. . lmtp_sasl_path (default: empty) SASL lmtp_sasl_type . (rendezvous point) . Postfix 2.3 . lmtp_sasl_security_options (default: noplaintext, noanonymous) SASL Postfix 2.3 SASL lmtp_sasl_type . SASL cyrus : noplaintext . noactive . nodictionary . noanonymous . : lmtp_sasl_security_options = noplaintext lmtp_sasl_tls_security_options (default: $lmtp_sasl_security_options) LMTP smtp_sasl_tls_security_options. . Postfix 2.3 . lmtp_sasl_tls_verified_security_options (default: $lmtp_sasl_tls_security_options) LMTP smtp_sasl_tls_verified_security_options. . Postfix 2.3 . lmtp_sasl_type (default: cyrus) SASL LMTP Postfix . "postconf -A" . Postfix 2.3 . lmtp_send_dummy_mail_auth (default: no) LMTP smtp_send_dummy_mail_auth. . Postfix 2.9 . lmtp_send_xforward_command (default: no) XFORWARD LMTP LHLO LMTP XFORWARD . lmtp(8) HELO LMTP . yes . Postfix 2.1 . lmtp_sender_dependent_authentication (default: no) LMTP smtp_sender_dependent_authentication. . Postfix 2.3 . lmtp_skip_5xx_greeting (default: yes) LMTP smtp_skip_5xx_greeting. . Postfix 2.3 . lmtp_skip_quit_response (default: no) QUIT LMTP. lmtp_starttls_timeout (default: 300s) LMTP smtp_starttls_timeout. . Postfix 2.3 . lmtp_tcp_port (default: 24) TCP LMTP Postfix . ( services(5) ) . lmtp_tls_CAfile (default: empty) LMTP smtp_tls_CAfile. . Postfix 2.3 . lmtp_tls_CApath (default: empty) LMTP smtp_tls_CApath. . Postfix 2.3 . lmtp_tls_block_early_mail_reply (default: empty) LMTP smtp_tls_block_early_mail_reply. . Postfix 2.7 . lmtp_tls_cert_file (default: empty) LMTP smtp_tls_cert_file. . Postfix 2.3 . lmtp_tls_chain_files (default: empty) LMTP smtp_tls_chain_files. . Postfix 3.4 . lmtp_tls_ciphers (default: medium) LMTP smtp_tls_ciphers. . Postfix 2.6 . lmtp_tls_connection_reuse (default: no) LMTP smtp_tls_connection_reuse. . Postfix 3.4 . lmtp_tls_dcert_file (default: empty) LMTP smtp_tls_dcert_file. . Postfix 2.3 . lmtp_tls_dkey_file (default: $lmtp_tls_dcert_file) LMTP smtp_tls_dkey_file. . Postfix 2.3 . lmtp_tls_eccert_file (default: empty) LMTP smtp_tls_eccert_file. . Postfix 2.6 Postfix OpenSSL 1.0.0 . lmtp_tls_eckey_file (default: empty) LMTP smtp_tls_eckey_file. . Postfix 2.6 Postfix OpenSSL 1.0.0 . lmtp_tls_enable_rpk (default: yes) LMTP smtp_tls_enable_rpk. . Postfix 3.9 . lmtp_tls_enforce_peername (default: yes) LMTP smtp_tls_enforce_peername. . Postfix 2.3 . lmtp_tls_enforce_sts_mx_patterns (default: yes) smtp_tls_enforce_sts_mx_patterns . Postfix >= 3.10.5 . lmtp_tls_exclude_ciphers (default: empty) LMTP smtp_tls_exclude_ciphers. . Postfix 2.3 . lmtp_tls_fingerprint_cert_match (default: empty) LMTP smtp_tls_fingerprint_cert_match. . Postfix 2.5 . lmtp_tls_fingerprint_digest (default: see postconf -d output) LMTP smtp_tls_fingerprint_digest. . Postfix 2.5 . lmtp_tls_force_insecure_host_tlsa_lookup (default: no) LMTP smtp_tls_force_insecure_host_tlsa_lookup. . Postfix 2.11 . lmtp_tls_key_file (default: $lmtp_tls_cert_file) LMTP smtp_tls_key_file. . Postfix 2.3 . lmtp_tls_loglevel (default: 0) LMTP smtp_tls_loglevel. . Postfix 2.3 . lmtp_tls_mandatory_ciphers (default: medium) LMTP smtp_tls_mandatory_ciphers. . Postfix 2.3 . lmtp_tls_mandatory_exclude_ciphers (default: empty) LMTP smtp_tls_mandatory_exclude_ciphers. . Postfix 2.3 . lmtp_tls_mandatory_protocols (default: see 'postconf -d' output) LMTP smtp_tls_mandatory_protocols. . Postfix 2.3 . lmtp_tls_note_starttls_offer (default: no) LMTP smtp_tls_note_starttls_offer. . Postfix 2.3 . lmtp_tls_per_site (default: empty) LMTP smtp_tls_per_site. . Postfix 3.9 . lmtp_tls_policy_maps . Postfix 2.3 . lmtp_tls_policy_maps (default: empty) LMTP smtp_tls_policy_maps. . Postfix 2.3 . lmtp_tls_protocols (default: see 'postconf -d' output) LMTP smtp_tls_protocols. . Postfix 2.6 . lmtp_tls_scert_verifydepth (default: 9) LMTP smtp_tls_scert_verifydepth. . Postfix 2.3 . lmtp_tls_secure_cert_match (default: nexthop) LMTP smtp_tls_secure_cert_match. . Postfix 2.3 . lmtp_tls_security_level (default: empty) LMTP smtp_tls_security_level. . Postfix 2.3 . lmtp_tls_servername (default: empty) LMTP smtp_tls_servername. . Postfix 3.4 . lmtp_tls_session_cache_database (default: empty) LMTP smtp_tls_session_cache_database. . Postfix 2.3 . lmtp_tls_session_cache_timeout (default: 3600s) LMTP smtp_tls_session_cache_timeout. . Postfix 2.3 . lmtp_tls_trust_anchor_file (default: empty) LMTP smtp_tls_trust_anchor_file. . Postfix 2.11 . lmtp_tls_verify_cert_match (default: hostname) LMTP smtp_tls_verify_cert_match. . Postfix 2.3 . lmtp_tls_wrappermode (default: no) LMTP smtp_tls_wrappermode. . Postfix 3.0 . lmtp_use_tls (default: no) LMTP smtp_use_tls. . Postfix 3.9 . lmtp_tls_security_level . Postfix 2.3 . lmtp_xforward_timeout (default: 300s) LMTP Postfix XFORWARD LMTP . . ( ). : s () m () h () d () w (). s () . Postfix 2.1 . local_command_shell (default: empty) local(8) Postfix. Postfix ( /bin/sh) . << sendmail>> (smrsh) forward. (smrsh Sendmail ). : . : local_command_shell = /some/where/smrsh -c local_command_shell = /bin/bash -c local_delivery_status_filter (default: $default_delivery_status_filter) local(8) . default_delivery_status_filter . Postfix 3.0 . local_destination_concurrency_limit (default: 2) ( "local_destination_recipient_limit = 1") ( "local_destination_recipient_limit > 1"). . master.cf . forward. ( ). . local_destination_recipient_limit (default: 1) . . master.cf . local_destination_concurrency_limit . local_header_rewrite_clients (default: permit_inet_interfaces) myorigin$ mydomain$ . append_at_myorigin append_dot_mydomain . remote_header_rewrite_domain . : permit_inet_interfaces myorigin$ mydomain$ IP inet_interfaces$ . . permit_mynetworks myorigin$ mydomain$ IP mynetworks$ . . permit_sasl_authenticated myorigin$ mydomain$ (RFC 4954 (AUTH . permit_tls_clientcerts myorigin$ mydomain$ TLS SMTP ( Postfix 2.9 ) relay_clientcerts$ . smtpd_tls_fingerprint_digest ( Postfix md5 ). Postfix >= 3.6 compatibility_level sha256 . Postfix <= 3.5 md5 . sha256 . md5 sha1 sha256 . << >> . permit_tls_all_clientcerts myorigin$ mydomain$ TLS SMTP . check_address_map type:table type:table myorigin$ mydomain$ IP . . pop-before-smtp . : Postfix < 2.2: . local_header_rewrite_clients = static:all ( ): sendmail Postfix SMTP . local_header_rewrite_clients = permit_inet_interfaces : myorigin$ mydomain$ Postfix sendmail SMTP. : . local_header_rewrite_clients = permit_mynetworks, permit_sasl_authenticated permit_tls_clientcerts check_address_map lmdb:/etc/postfix/pop-before-smtp :lmdb :cdb :hash :dbm . local_login_sender_maps (default: static:*) UNIX . postdrop(1) Postfix . : . UNIX postdrop(1) "uid:" . . : :From (MAIL FROM) Milter non_smtpd_milters . : . . * . <> . empty_address_local_login_sender_maps_lookup_key . @domain '@' domain . : /etc/postfix/main.cf: # Allow root and postfix full control, anyone else can only # send mail as themselves. Use "uid:" followed by the numerical # UID when the UID has no entry in the UNIX password file. local_login_sender_maps = inline:{ { root = * }, { postfix = * } }, pcre:/etc/postfix/login_senders /etc/postfix/login_senders: # Allow both the bare username and the user@domain forms. /(.+)/ $1 $1@example.com Postfix 3.6 . local_recipient_maps (default: proxy:unix:passwd.byname $alias_maps) . $mydestination $inet_interfaces $proxy_interfaces . local_recipient_maps ( ) SMTP local_recipient_maps "Local recipient table query format" . Postfix sendmail(1) <<>> . local_recipient_maps local_transport local(8) passwd ( /etc/passwd) ( /etc/aliases) . proxy: SMTP chroot passwd . "When you need to change the local_recipient_maps setting in main.cf" . $local_recipient_maps : SMTP . "type:name" . . SMTP "local_recipient_maps =" ( ) . : local_recipient_maps = local_transport (default: local:$myhostname) (next-hop) mydestination [ipaddress] $inet_interfaces $proxy_interfaces . transport(5) . "local" master.cf . transport:nexthop transport master.cf . :nexthop . : LOCAL_RECIPIENT_README SMTP . luser_relay (default: empty) (catch-all) local(8). $mydestination $inet_interfaces $proxy_interfaces . luser_relay $name Postfix . $name : $domain . $extension . $home . $local (localpart) . $recipient . $recipient_delimiter (Postfix . ) (Postfix . ). $shell . $user . ${name?value} ${name?{value}} (Postfix >= 3.0) $name value . ${name:value} ${name:{value}} (Postfix >= 3.0) $name value . ${name?{value1}:{value2}} (Postfix >= 3.0) $name value1 value2 . $name ${name} $(name) . : luser_relay local(8) . : main.cf "local_recipient_maps =" ( ) SMTP "User unknown in local recipient table" . : luser_relay = $user@other.host luser_relay = $local@other.host luser_relay = admin+$local mail_name (default: Postfix) Received: SMTP . mail_owner (default: postfix) Postfix Postfix . ( ) (UID) (GID) . nobody daemon . . "postfix set-permissions" ( . Postfix: "/etc/postfix/post-install set-permissions"). mail_release_date (default: see postconf -d output) Postfix "YYYYMMDD". mail_spool_directory (default: see postconf -d output) local(8). . maildir / . : maildir . mail_spool_directory maildir maildir . Postfix . : mail_spool_directory = /var/mail mail_spool_directory = /var/spool/mail mail_version (default: see postconf -d output) . major.minor.patchlevel . . SMTP . mailbox_command (default: empty) local(8) . . : root $default_privs . ) root alias ) root "su" . (export) : CLIENT_ADDRESS . Postfix . . CLIENT_HELO EHLO . Postfix . . CLIENT_HOSTNAME . Postfix . . CLIENT_PROTOCOL . Postfix . . DOMAIN . ENVID (envelope ID) RFC 3461. Postfix . . EXTENSION . HOME . LOCAL . LOGNAME . ORIGINAL_RECIPIENT (aliasing). RECIPIENT . SASL_METHOD SASL AUTH . Postfix . . SASL_SENDER SASL MAIL FROM . Postfix . . SASL_USER SASL AUTH . Postfix . . SENDER . SHELL . USER . Postfix mailbox_command $name . ( ). Postfix . "procmail" . : mailbox_command root . local(8) : aliases .forward mailbox_transport_maps mailbox_transport mailbox_command_maps mailbox_command home_mailbox mail_spool_directory fallback_transport_maps fallback_transport luser_relay. : mailbox_command = /some/where/procmail mailbox_command = /some/where/procmail -a "$EXTENSION" mailbox_command = /some/where/maildrop -d "$USER" -f "$SENDER" "$EXTENSION" mailbox_command_maps (default: empty) local(8). mailbox_command . local(8) : aliases .forward mailbox_transport_maps mailbox_transport mailbox_command_maps mailbox_command home_mailbox mail_spool_directory fallback_transport_maps fallback_transport luser_relay. "type:name" . . mailbox_delivery_lock (default: see postconf -d output) local(8) . "postconf -l" . maildir . : dotlock UID GID . : . mailbox_size_limit (default: 51200000) local(8) maildir (). local(8) . LONG_MAX ( ) . . mailbox_transport (default: empty) local(8) passwd . local(8) : aliases .forward mailbox_transport_maps mailbox_transport mailbox_command_maps mailbox_command home_mailbox mail_spool_directory fallback_transport_maps fallback_transport luser_relay. mailbox_transport_maps (default: empty) local(8) passwd . local(8) : aliases .forward mailbox_transport_maps mailbox_transport mailbox_command_maps mailbox_command home_mailbox mail_spool_directory fallback_transport_maps fallback_transport luser_relay. "type:name" . . $number (regex) . Postfix . . maillog_file (default: empty) postlogd(8) . syslogd(8) . "/dev/stdout" . stdout Postfix "postfix start-fg" . : maillog_file maillog_file_prefixes . : Postfix syslogd(8) . Postfix . . maillog_file_compressor (default: gzip) (rotate) $maillog_file "postfix logrotate" . . Postfix . . maillog_file_permissions (default: 0600) $maillog_file . : 0600 ( / ) 0640 ( 'group') 0644 ( 'other'). '0' . Postfix . . maillog_file_prefixes (default: /var, /dev/stdout) maillog_file. . . Postfix 3.4 . maillog_file_rotate_suffix (default: %Y%m%d-%H%M%S) <> $maillog_file . strftime(3) . YYYYMMDD-HHMMSS . Postfix 3.4 . mailq_path (default: see postconf -d output) Sendmail mailq(1) Postfix . Postfix . manpage_directory (default: see postconf -d output) Postfix. maps_rbl_domains (default: empty) : reject_rbl_client . maps_rbl_reject_code (default: 554) SMTP Postfix SMTP reject_rbl_client reject_rhsbl_client reject_rhsbl_reverse_client reject_rhsbl_sender reject_rhsbl_recipient . RFC 5321 . masquerade_classes (default: envelope_sender, header_sender, header_recipient) (address masquerading) . (envelope sender) . . : envelope_sender envelope_recipient header_sender header_recipient masquerade_domains (default: empty) . . masquerade_domains = foo.example.com example.com <> <> <> <> . ! . masquerade_domains = !foo.example.com example.com <> <> <> <> . : Postfix 2.2 : o sendmail(1) Postfix o $local_header_rewrite_clients o remote_header_rewrite_domain . 2.2 Postfix <> . : masquerade_domains = $mydomain masquerade_exceptions (default: empty) $masquerade_domains . . <> <> / . . <> <> ( ). . <> . <> Postfix 2.4 . : masquerade_exceptions = root, mailer-daemon masquerade_exceptions = root master_service_disable (default: empty) master(8) . (<> <> <> <>) <> <> master.cf <> . Postfix . <> . master(8) . : <> <> <<*>> <> . . : # With Postfix 2.6..2.10 use '.' instead of '/'. # Turn on all master(8) listener ports (the default). master_service_disable = # Turn off only the main SMTP listener port. master_service_disable = smtp/inet # Turn off all TCP/IP listener ports. master_service_disable = inet # Turn off all TCP/IP listener ports except "foo". master_service_disable = !foo/inet, inet Postfix 2.6 . max_idle (default: 100s) Postfix . Postfix . ( ). : s () m () h () d () w (). s () . max_use (default: 100) Postfix . Postfix . maximal_backoff_time (default: 4000s) (deferred). $minimal_backoff_time . $queue_run_delay . ( ). : s () m () h () d () w (). s () . maximal_queue_lifetime (default: 5d) maximal_queue_lifetime . ( ). : s () m () h () d () w (). d () . 0 . message_drop_headers (default: bcc, content-length, resent-bcc, return-path) cleanup(8) header_checks(5) Milter . Postfix 3.0 . . . . Postfix 3.0 . message_reject_characters (default: empty) Postfix . -C : \a \b \f \n \r \t \v \ddd ( ) \\. : MIME . header_checks body_checks. : <> . : message_reject_characters = \0 Postfix 2.3 . message_size_limit (default: 10240000) . LONG_MAX ( ) . : . (bounce) MTA . message_strip_characters (default: empty) Postfix . -C : \a \b \f \n \r \t \v \ddd ( ) \\. : MIME . header_checks body_checks. : <> . : message_strip_characters = \0 Postfix 2.3 . meta_directory (default: see 'postconf -d' output) Postfix postfix-files dynamicmaps.cf main.cf.proto master.cf.proto. Postfix . meta_directory config_directory (/etc/postfix /usr/local/etc/postfix). 2.6 2.11 Postfix Postfix <> main.cf <> <> <> <> . Postfix 3.0 . milter_command_timeout (default: 30s) SMTP Milter ( ) . ( ). : s () m () h () d () w (). s () . Postfix 2.3 . milter_connect_macros (default: see postconf -d output) SMTP Milter ( ) . MILTER_README . Postfix 2.3 . milter_connect_timeout (default: 30s) Milter ( ) . ( ). : s () m () h () d () w (). s () . Postfix 2.3 . milter_content_timeout (default: 300s) Milter ( ) . ( ). : s () m () h () d () w (). s () . Postfix 2.3 . milter_data_macros (default: see postconf -d output) SMTP DATA Milter ( ) . MILTER_README . Postfix 2.3 . milter_default_action (default: Postfix >= 3.11: shutdown; Postfix < 3.11: tempfail) Milter ( ) ( Postfix Milter). : accept . reject . tempfail . shutdown smtpd_milters SMTP 421 SMTP non_smtpd_milters . Postfix 3.11 . quarantine <> <> . Postfix 2.6 . Postfix 3.10 <> . Postfix 3.11 <> SMTP . Postfix (tempfail) Milter . Postfix 2.3 . milter_end_of_data_macros (default: see postconf -d output) Milter ( ) . MILTER_README . Postfix 2.3 . milter_end_of_header_macros (default: see postconf -d output) Milter ( ) . MILTER_README . Postfix 2.5 . milter_header_checks (default: empty) Milter . header_checks(5) . PREPEND . (SPAM) . . /etc/postfix/main.cf: milter_header_checks = pcre:/etc/postfix/milter_header_checks /etc/postfix/milter_header_checks: /^X-SPAM-FLAG:\s+YES/ FILTER mysmtp:sanitizer.example.com:25 milter_header_checks (allowlisting) . DKIM . Postfix 2.7 Postfix 2.6 . milter_helo_macros (default: see postconf -d output) SMTP HELO EHLO Milter ( ) . MILTER_README . Postfix 2.3 . milter_macro_daemon_name (default: $myhostname) {daemon_name} Milter ( ). MILTER_README . Postfix 2.3 . milter_macro_defaults (default: empty) name=value Postfix Milter . . name=value {name=value} . "{}" ( "{" "=" "}" ). Postfix 3.1 . milter_macro_v (default: $mail_name $mail_version) {v} Milter ( ). MILTER_README . Postfix 2.3 . milter_mail_macros (default: see postconf -d output) SMTP MAIL FROM Milter ( ) . MILTER_README . Postfix 2.3 . milter_protocol (default: 6) Milter Postfix 2.6 2 . Postfix . ( Milter ) . : 2 2 Sendmail 8 ( Sendmail 8.11 .. 8.13 Postfix 2.3 .. 2.5). 3 3 Sendmail 8. 4 4 Sendmail 8. 6 6 Sendmail 8 ( Sendmail 8.14 Postfix 2.6). : no_header_reply Milter . Postfix 2.3 . milter_rcpt_macros (default: see postconf -d output) SMTP RCPT TO Milter ( ) . MILTER_README . Postfix 2.3 . milter_unknown_command_macros (default: see postconf -d output) SMTP Milter ( ) 3 . MILTER_README . Postfix 2.3 . mime_boundary_length_limit (default: 2048) (boundary) MIME. MIME $mime_boundary_length_limit . Postfix 2.0 . mime_header_checks (default: $header_checks) MIME header_checks(5) . Postfix 2.0 . mime_nesting_limit (default: 100) MIME . Postfix . Postfix 2.0 . minimal_backoff_time (default: 300s) Postfix 2.4 1000s . ( ) . $queue_run_delay . $maximal_backoff_time . ( ). : s () m () h () d () w (). s () . multi_instance_directories (default: empty) Postfix Postfix Postfix Postfix . . $multi_instance_directories postfix(1) Postfix . postfix(1) multi_instance_wrapper . postfix(1) Postfix $multi_instance_directories . main.cf . Postfix 2.6 . multi_instance_enable (default: no) Postfix . . . Postfix 2.6 . multi_instance_group (default: empty) Postfix. Postfix . . Postfix 2.6 . multi_instance_name (default: empty) Postfix. syslog_name . Postfix 2.6 . multi_instance_wrapper (default: empty) multi_instance_directories postfix(1) . . postfix(1) postfix(1) . postfix(1) Postfix "postfix -c config_directory command" . Postfix 2.6 . multi_recipient_bounce_reject_code (default: 550) SMTP SMTP reject_multi_recipient_bounce . RFC 5321 . Postfix 2.1 . mydestination (default: $myhostname, localhost.$mydomain, localhost) $local_transport . local(8) /etc/passwd /etc/aliases . SMTP $local_recipient_maps . ADDRESS_CLASS_README . mydestination . $mydomain . $local_transport user@[the.net.work.address] ( IP inet_interfaces proxy_interfaces) . : o - . VIRTUAL_README . o MX . MX STANDARD_CONFIGURATION_README . o SMTP local_recipient_maps . local_recipient_maps unknown_local_recipient_reject_code postconf(5) . "/file/name" "type:table" / . "/file/name" "type:table" ( ). . : mydestination = $myhostname, localhost.$mydomain $mydomain mydestination = $myhostname, localhost.$mydomain www.$mydomain, ftp.$mydomain mydomain (default: see postconf -d output) . $myhostname "localdomain" ( Postfix 2.3 ) . $mydomain . : mydomain = domain.tld myhostname (default: see postconf -d output) . (FQDN) gethostname() -FQDN gethostname() ".$mydomain" . $myhostname . : myhostname = host.example.com mynetworks (default: see postconf -d output) SMTP " " "" . SMTP " " (relay) Postfix . smtpd_relay_restrictions postconf(5) . " " Postfix ( ). mynetworks_style . mynetworks Postfix mynetworks_style . / / . . . "/file/name" "type:table" . "/file/name" "type:table" ( ). . "!pattern" . "!/file/name" Postfix 2.4 . : "mynetworks" parent_domain_matches_subdomains . : IPv6 [] mynetworks "/file/name" . IPv6 ":" "type:table" . : CIDR hash . CIDR cidr . : mynetworks = 127.0.0.0/8 168.100.189.0/28 mynetworks = !192.168.0.1, 192.168.0.0/28 mynetworks = 127.0.0.0/8 168.100.189.0/28 [::1]/128 [2001:240:587::]/64 mynetworks = $config_directory/mynetworks mynetworks = lmdb:/etc/postfix/network_table mynetworks = cidr:/etc/postfix/network_table.cidr lmdb: cdb: hash: dbm: . . "postfix reload" . mynetworks_style (default: Postfix >= 3.0: host, Postfix < 3.0: subnet) mynetworks. . o Postfix "" "mynetworks_style = host" . o Postfix SMTP IP "" "mynetworks_style = subnet" . "ifconfig" "ip" . o Postfix SMTP A/B/C "" "mynetworks_style = class" . : Postfix "" . mynetworks mynetworks . myorigin (default: $myhostname) . $myhostname . () $mydomain () user@that.users.mailhost . : myorigin = $mydomain nested_header_checks (default: $header_checks) -MIME header_checks(5) . Postfix 2.0 . newaliases_path (default: see postconf -d output) Sendmail newaliases(1) . aliases(5) local(8) . non_bdb_custom_mapping (default: empty) Berkeley-DB hash: btree: Berkeley-DB. hash: $default_database_type btree: $default_cache_db_type . o type ( ':') type:name. o type:name type ( ':') . o type Berkeley-DB ( ':') :name . o hash btree . Postfix 3.11 . non_bdb_migration_allow_root_prefixes (default: see 'postconf -d non_bdb_migration_allow_root_prefixes' output) non-Berkeley-DB (nbdb_reindexd(8)) postmap(1) postalias(1) "root" . Postfix 3.11 . non_bdb_migration_allow_user_prefixes (default: see 'postconf -d non_bdb_migration_allow_user_prefixes' output) non-Berkeley-DB (nbdb_reindexd(8)) postmap(1) postalias(1) ( root) . Postfix 3.11 . non_bdb_migration_level (default: disable) non-Berkeley-DB. "postfix non-bdb name-of-level" ( postfix-non-bdb(1) ). disable non-Berkeley-DB. mailman NON_BERKELEYDB_README#disable . enable-redirect (aliasing) ( /aliasing) Berkeley DB hash $default_database_type Berkeley DB btree $default_cache_db_type cdb lmdb Postfix. NON_BERKELEYDB_README#enable-redirect . enable-reindex enable-redirect Berkeley-DB . nbdb_reindexd(8) postmap(1) postalias(1) . NON_BERKELEYDB_README#enable-reindex . : enable-reindex Berkeley-DB Postfix . . enable-redirect . Postfix 3.11 . non_bdb_migration_log_redirect (default: yes) Berkeley-DB Berkeley-DB. Postfix 3.11 . non_bdb_migration_service_name (default: nbdb_reindex) master.cf non-Berkeley-DB . Postfix 3.11 . non_empty_end_of_header_action (default: fix_quietly) cleanup(8) . fix_quietly : . Postfix <= 3.10 . add_header MIME-Error: . : MIME-Error: message header was not terminated by empty line reject . : queueid reject: mime-error message header was terminated with non-empty line: erroneous text; from= to= Postfix 3.11 . non_fqdn_reject_code (default: 504) SMTP Postfix reject_non_fqdn_helo_hostname reject_non_fqdn_sender reject_non_fqdn_recipient . non_smtpd_milters (default: empty) Milter ( ) smtpd(8) . sendmail(1) qmqpd(8) "postsuper -r" . . MILTER_README . Postfix 2.3 . notify_classes (default: resource, software) postmaster . postmaster . . policy ( UCE ) protocol ( ) . : postmaster SASL . . : bounce (also implies 2bounce) SMTP Postfix postmaster. bounce_notice_recipient (: postmaster). 2bounce postmaster. 2bounce_notice_recipient (: postmaster). data SMTP postmaster . error_notice_recipient (: postmaster). Postfix 2.9 . delay postmaster ( delay_warning_time ). delay_notice_recipient (: postmaster). policy SMTP postmaster (UCE). error_notice_recipient (: postmaster). protocol SMTP postmaster . error_notice_recipient (: postmaster). resource postmaster . error_notice_recipient (: postmaster). software postmaster . error_notice_recipient (: postmaster). : notify_classes = bounce, delay, policy, protocol, resource, software notify_classes = 2bounce, resource, software openssl_path (default: openssl) OpenSSL openssl(1). "postfix tls" DANE TLSA . (multi-instance) Postfix . : /etc/postfix/main.cf: # NetBSD pkgsrc: openssl_path = /usr/pkg/bin/openssl # Local build: openssl_path = /usr/local/bin/openssl Postfix 3.1 . owner_request_special (default: yes) owner-listname aliases(5) owner-listname listname-request recipient_delimiter "-" . . parent_domain_matches_subdomains (default: see postconf -d output) Postfix "example.com" example.com ".example.com" . : Postfix ".example.com" . Postfix . Postfix 1.0 debug_peer_list, fast_flush_domains, mynetworks, permit_mx_backup_networks, relay_domains, transport_maps Postfix 1.1 qmqpd_authorized_clients, smtpd_access_maps, Postfix 2.8 postscreen_access_list Postfix 3.0 smtpd_client_event_limit_exceptions permit_mx_backup_networks (default: empty) SMTP permit_mx_backup MX . () mynetworks . "permit_mx_backup_networks" parent_domain_matches_subdomains . pickup_service_name (default: pickup) pickup(8). maildrop . Postfix 2.0 . pipe_delivery_status_filter (default: $default_delivery_status_filter) pipe(8) . default_delivery_status_filter . Postfix 3.0 . plaintext_reject_code (default: 450) SMTP Postfix reject_plaintext_session . Postfix 2.3 . postlog_service_name (default: postlog) postlogd(8) master.cf. maillog_file . Postfix 3.4 . postlogd_watchdog_timeout (default: 10s) postlogd(8) (watchdog) . postlogd(8) Postfix . 10s . ( ). : s () m () h () d () w (). s () . Postfix 3.4 . postmulti_control_commands (default: reload flush) postfix(1) postmulti(1) "control" . . Postfix 2.6 . postmulti_start_commands (default: start) postfix(1) postmulti(1) "start" . "start" "check" () "start" . Postfix 2.6 . postmulti_stop_commands (default: see postconf -d output) postfix(1) postmulti(1) "stop" . . Postfix 2.6 . postscreen_access_list (default: permit_mynetworks) / IP SMTP. postscreen(8) SMTP . ( ) . IP . permit_mynetworks IP $mynetworks . 220 . SMTP . "postscreen_access_list" parent_domain_matches_subdomains . type:table . type:table . hash btree smtpd(8) . CIDR . permit . 220 . SMTP Postfix . reject . postscreen_denylist_action . dunno postscreen(8) . dunno . dunno / (greeting) . : /etc/postfix/main.cf: postscreen_access_list = permit_mynetworks, cidr:/etc/postfix/postscreen_access.cidr # Postfix < 3.6 use postscreen_blacklist_action. postscreen_denylist_action = enforce /etc/postfix/postscreen_access.cidr: # Rules are evaluated in the order as specified. # Denylist 192.168.* except 192.168.0.1. 192.168.0.1 dunno 192.168.0.0/16 reject Postfix 2.8 . postscreen_allowlist_interfaces (default: static:all) IP postscreen(8) SMTP postscreen(8) . SMTP Postfix . postscreen(8) IP postscreen(8) . postscreen(8) MX postscreen_allowlist_interfaces MX . SMTP Postfix . MX SMTP Postfix . / / . . . "/file/name" "type:table" . "/file/name" "type:table" ( ). . "!pattern" . : (IPv6) [] postscreen_allowlist_interfaces "/file/name" . IPv6 ":" "type:table" . : /etc/postfix/main.cf: # Don't allowlist connections to the backup IP address. # Postfix < 3.6 use postscreen_whitelist_interfaces. postscreen_allowlist_interfaces = !168.100.189.8, static:all Postfix 3.6 . postscreen_whitelist_interfaces Postfix 2.9 - 3.5 . postscreen_bare_newline_action (default: ignore) postscreen(8) (bare newline) SMTP carriage return . : ignore . . . . enforce . SMTP helo// . . drop SMTP . . Postfix 2.8 . postscreen_bare_newline_enable (default: no) SMTP << >> (bare newline) postscreen(8) . : SMTP SMTP Postfix . Postfix 2.8 . postscreen_bare_newline_ttl (default: 30d) postscreen(8) IP SMTP << >> . SMTP SMTP Postfix . ( ). : s () m () h () d () w (). d () . Postfix 2.8 . postscreen_blacklist_action (default: ignore) Postfix 3.6 postscreen_denylist_action . Postfix 2.8 - 3.5 . postscreen_cache_cleanup_interval (default: 12h) postscreen(8). . "delete" "sequence" . . postscreen(8) . <> <> $max_idle "partial" () . ( ). : s () m () h () d () w (). h () . Postfix 2.8 . postscreen_cache_map (default: Postfix >= 3.11: $default_cache_db_type:$data_directory/postscreen_cache; Postfix < 3.11: btree:$data_directory/postscreen_cache) postscreen(8). postscreen(8) postscreen(8) "postscreen_cache_map = proxy:lmdb:/path/to/file" "proxy:btree:/path/to/file" . . Postfix proxymap(8) . memcache_table(5) . Postfix 2.8 . postscreen_cache_retention_time (default: 7d) postscreen(8) . "NEW" . . ( ). : s () m () h () d () w (). d () . Postfix 2.8 . postscreen_client_connection_count_limit (default: $smtpd_client_connection_count_limit) SMTP postscreen(8) . SMTP Postfix . postscreen_greet_wait SMTP postscreen(8) . Postfix 2.8 . postscreen_command_count_limit (default: 20) SMTP SMTP postscreen(8). SMTP (defer) (reject) (junk) . Postfix 2.8 . postscreen_command_filter (default: $smtpd_command_filter) SMTP . smtpd_command_filter . Postfix 2.8 . postscreen_command_time_limit (default: normal: 300s, overload: 10s) SMTP postscreen(8). Postfix 2.8 . postscreen_denylist_action (default: ignore) postscreen(8) SMTP postscreen_access_list . : ignore () . . . . enforce . SMTP helo// . . drop SMTP . . Postfix 3.6 . postscreen_blacklist_action Postfix 2.8 - 3.5 . postscreen_disable_vrfy_command (default: $disable_vrfy_command) VRFY SMTP postscreen(8) . disable_vrfy_command . Postfix 2.8 . postscreen_discard_ehlo_keyword_address_maps (default: $smtpd_discard_ehlo_keyword_address_maps) SMTP EHLO ( pipelining starttls auth ) postscreen(8) EHLO SMTP . smtpd_discard_ehlo_keywords . . Postfix 2.8 . postscreen_discard_ehlo_keywords (default: $smtpd_discard_ehlo_keywords) EHLO ( pipelining starttls auth ) postscreen(8) EHLO SMTP . smtpd_discard_ehlo_keywords . Postfix 2.8 . postscreen_dnsbl_action (default: ignore) postscreen(8) DNSBL SMTP ( postscreen_dnsbl_sites postscreen_dnsbl_threshold). : ignore () . . . . enforce . SMTP helo// . . drop SMTP . . Postfix 2.8 . postscreen_dnsbl_allowlist_threshold (default: 0) SMTP DNSBL postscreen_dnsbl_sites <<>> << >> . . postscreen_dnsbl_allowlist_threshold TTL DNS . TTL DNS . postscreen_dnsbl_max_ttl postscreen_dnsbl_min_ttl . Postfix 3.6 . postscreen_dnsbl_whitelist_threshold Postfix 2.11 - 3.5 . postscreen_dnsbl_max_ttl (default: ${postscreen_dnsbl_ttl?{$postscreen_dnsbl_ttl}:{1}}h) postscreen(8) IP DNS . DNS TTL postscreen_dnsbl_min_ttl . ( ). : s () m () h () d () w (). h () . Postfix 3.1 . Postfix . postscreen_dnsbl_min_ttl (default: 60s) postscreen(8) IP DNS . DNS TTL postscreen_dnsbl_max_ttl . ( ). : s () m () h () d () w (). s () . Postfix 3.1 . postscreen_dnsbl_reply_map (default: empty) DNSBL DNSBL postscreen . DNSBL . pcre: regexp: texthash: ( texthash: hash: ) postmap(1) ) texthash: ). : /etc/postfix/main.cf: postscreen_dnsbl_reply_map = texthash:/etc/postfix/dnsbl_reply /etc/postfix/dnsbl_reply: secret.zen.spamhaus.org zen.spamhaus.org : rbl_reply_maps SMTP Postfix ) <<=address-filter>> ) $name . Postfix 2.8 . postscreen_dnsbl_sites (default: empty) / DNS (allow/denylist) . dnsblog(8) IP SMTP postscreen(8) DNSBL SMTP . : . ISP API . : postscreen SMTP DNSBL . postscreen_dnsbl_reply_map <<>> DNSBL . postscreen_dnsbl_threshold postscreen(8) SMTP . domain=filter*weight . o "=filter" postscreen(8) DNSBL . postscreen(8) DNSBL . d.d.d.d d [] .. ";" . o "*weight" . . . o DNSBL postscreen(8) DNSBL SMTP . : example.com example.net example.org : postscreen_dnsbl_threshold = 2 postscreen_dnsbl_sites = example.com*2, example.net, example.org DNSBL 127.0.0.4: postscreen_dnsbl_sites = example.com=127.0.0.4 Postfix 2.8 . postscreen_dnsbl_threshold (default: 1) SMTP DNSBL postscreen_dnsbl_sites. Postfix 2.8 . postscreen_dnsbl_timeout (default: 10s) DNSBL DNSWL. dnsblog(8) resolver(3) . ( ). : s () m () h () d () w (). s () . Postfix 3.0 . postscreen_dnsbl_ttl (default: 1h) postscreen(8) IP DNS . ( ). : s () m () h () d () w (). h () . Postfix 2.8-3.0 . Postfix 3.1 postscreen_dnsbl_max_ttl . postscreen_dnsbl_whitelist_threshold (default: 0) Postfix 3.6 postscreen_dnsbl_allowlist_threshold . Postfix 2.11 - 3.5 . postscreen_enforce_tls (default: $smtpd_enforce_tls) TLS: STARTTLS SMTP TLS. smtpd_postscreen_enforce_tls . Postfix 2.8 . postscreen_tls_security_level . postscreen_expansion_filter (default: see postconf -d output) postscreen_reject_footer . smtpd_expansion_filter . Postfix 2.8 . postscreen_forbidden_commands (default: $smtpd_forbidden_commands) postscreen(8) SMTP . smtpd_forbidden_commands postscreen_non_smtp_command_action . Postfix 2.8 . postscreen_greet_action (default: ignore) postscreen(8) SMTP postscreen_greet_wait . : ignore () . . . . enforce . 550 SMTP helo// . . drop 521 SMTP . . postscreen(8) IP SMTP . Postfix 2.8 . postscreen_greet_banner (default: $smtpd_banner) "220-text..." postscreen(8) "220 text..." SMTP Postfix SMTP (pre-greet). . Postfix 2.8 . postscreen_greet_ttl (default: 1d) postscreen(8) IP PREGREET . SMTP Postfix . ( ). : s () m () h () d () w (). d () . Postfix 2.8 . postscreen_greet_wait (default: normal: 6s, overload: 2s) postscreen(8) SMTP DNS (: ). ( ). : s () m () h () d () w (). s () . Postfix 2.8 . postscreen_helo_required (default: $smtpd_helo_required) SMTP HELO EHLO MAIL. Postfix 2.8 . postscreen_non_smtp_command_action (default: drop) postscreen(8) SMTP ( postscreen_forbidden_commands) SMTP . : ignore . . . . enforce . 550 SMTP helo// . . drop 521 SMTP . . smtpd_forbidden_commands SMTP Postfix . Postfix 2.8 . postscreen_non_smtp_command_enable (default: no) << SMTP>> postscreen(8). : SMTP Postfix . Postfix 2.8 . postscreen_non_smtp_command_ttl (default: 30d) postscreen(8) IP SMTP "non_smtp_command" . SMTP Postfix . ( ). : s () m () h () d () w (). d () . Postfix 2.8 . postscreen_pipelining_action (default: enforce) postscreen(8) SMTP . : ignore . . . . enforce . 550 SMTP helo// . . drop 521 SMTP . . Postfix 2.8 . postscreen_pipelining_enable (default: no) SMTP "pipelining" postscreen(8). : SMTP Postfix . Postfix 2.8 . postscreen_pipelining_ttl (default: 30d) postscreen(8) IP SMTP "pipelining" . SMTP Postfix . ( ). : s () m () h () d () w (). d () . Postfix 2.8 . postscreen_post_queue_limit (default: $default_process_limit) SMTP Postfix . 421 . Postfix 2.8 . postscreen_pre_queue_limit (default: $default_process_limit) Postfix SMTP . 421 . Postfix 2.8 . postscreen_reject_footer (default: $smtpd_reject_footer) 4XX 5XX postscreen(8) . smtpd_reject_footer . Postfix 2.8 . postscreen_reject_footer_maps (default: $smtpd_reject_footer_maps) 4XX 5XX postscreen(8) . smtpd_reject_footer_maps . Postfix 3.4 . postscreen_tls_security_level (default: $smtpd_tls_security_level) SMTP TLS postscreen(8) postscreen_use_tls postscreen_enforce_tls . smtpd_tls_security_level . Postfix 2.8 . postscreen_upstream_proxy_protocol (default: empty) postscreen. . "postscreen_upstream_proxy_protocol = haproxy" haproxy Postfix 3.5 . Postfix 2.10 . postscreen_upstream_proxy_timeout (default: 5s) postscreen_upstream_proxy_protocol. Postfix 2.10 . postscreen_use_tls (default: $smtpd_use_tls) TLS: STARTTLS SMTP TLS. Postfix 2.8 . postscreen_tls_security_level . postscreen_watchdog_timeout (default: 10s) postscreen(8) SMTP (watchdog) . postscreen(8) Postfix . 10s . ( ). : s () m () h () d () w (). s () . Postfix 2.8 . postscreen_whitelist_interfaces (default: static:all) Postfix 3.6 postscreen_allowlist_interfaces . Postfix 2.9 - 3.5 . prepend_delivered_header (default: command, file, forward) local(8) Postfix Delivered-To: . . Postfix Delivered-To: ( ) . Delivered-To: . forward file command . : prepend_delivered_header = forward process_id (read-only) (PID) Postfix. process_id_directory (default: pid) PID Postfix $queue_directory. . process_name (read-only) Postfix. propagate_unmatched_extensions (default: canonical, virtual) . virtual(5) < joe.user@example.net>> <> <> . canonical virtual alias forward include generic . canonical(5) virtual(5) aliases(5) .forward :include: local(8) generic smtp(8) . : canonical virtual (mailing list exploder) . : propagate_unmatched_extensions = canonical, virtual, alias, forward, include propagate_unmatched_extensions = canonical, virtual proxy_interfaces (default: empty) (NAT) . Postfix 2.0 . MX (backup MX) <<>> /NAT MX . : proxy_interfaces = 1.2.3.4 proxy_read_maps (default: see postconf -d output) proxymap(8) . <> . :proxy . Postfix 2.0 . proxy_write_maps (default: see postconf -d output) proxymap(8) - . Postfix data_directory Postfix . :proxy . Postfix 2.5 . proxymap_service_name (default: proxymap) proxymap. proxymap(8) . Postfix 2.6 . proxywrite_service_name (default: proxywrite) - proxywrite. proxymap(8) . Postfix 2.6 . qmgr_clog_warn_time (default: 300s) Postfix . 0 . ( ). : s () m () h () d () w (). s () . helpful_warnings . Postfix 2.0 . qmgr_daemon_timeout (default: 1000s) Postfix (watchdog) . ( ). : s () m () h () d () w (). s () . Postfix 2.8 . qmgr_fudge_factor (default: 100) : . oqmgr(8) . . qmgr_ipc_timeout (default: 60s) . (deadlock) . . ( ). : s () m () h () d () w (). s () . Postfix 2.8 . qmgr_message_active_limit (default: 20000) (active queue). qmgr_message_recipient_limit (default: 20000) Postfix <<>> (dead). qmgr_message_recipient_minimum (default: 10) . ( qmgr_message_recipient_limit _recipient_limit ) . 1 . qmqpd_authorized_clients (default: empty) QMQP QMQP Postfix . QMQP . . / . <> . IPv6 [] . . (!) . <> Postfix 2.4 . <> parent_domain_matches_subdomains . : qmqpd_authorized_clients = !192.168.0.1, 192.168.0.0/24 qmqpd_client_port_logging (default: no) QMQP IP. <> . Postfix 2.5 . qmqpd_error_delay (default: 1s) QMQP Postfix QMQP . . ( ). : s () m () h () d () w (). s () . qmqpd_timeout (default: 300s) . qmqpd_timeout$ QMQP Postfix . ( ). : s () m () h () d () w (). s () . queue_directory (default: see postconf -d output) Postfix. Postfix chrooted . queue_file_attribute_count_limit (default: 100) (name=value) Postfix . cleanup(8) . Postfix 2.0 . queue_minfree (default: 0) . SMTP Postfix . SMTP Postfix MAIL FROM 1.5*$message_size_limit (Postfix 2.1 ). queue_minfree 1.5*$message_size_limit . Postfix 2.0 queue_minfree . queue_run_delay (default: 300s) (deferred queue) Postfix 2.4 1000s . minimal_backoff_time$ . maximal_backoff_time$ . ( ). : s () m () h () d () w (). s () . queue_service_name (default: qmgr) qmgr(8). Postfix . Postfix 2.0 . rbl_reply_maps (default: empty) RBL RHSBL. reject_rbl_* reject_rhsbl_* <<=address-filter>> . Postfix 3.10 << >> domain=address-filter rbl_reply_maps domain . Postfix default_rbl_reply . . : /etc/postfix/main.cf: rbl_reply_maps = lmdb:/etc/postfix/rbl_reply smtpd_recipient_restrictions = permit_mynetworks, reject_rbl_client secret.zen.dq.spamhaus.net=127.0.0.[2..11], ... /etc/postfix/rbl_reply: # See https://www.postfix.org/postconf.5.html#default_rbl_reply # for the definition of the $client_address and $rbl_class etc. # variables. secret.zen.dq.spamhaus.net=127.0.0.[2..11] 554 $rbl_class $rbl_what blocked using ZEN - see https://www.spamhaus.org/query/ip/$client_address for details # Postfix >= 3.10: if a search key domain=address-filter # is not found, then rbl_reply_maps will also search with the # domain. secret.zen.dq.spamhaus.net 554 $rbl_class $rbl_what blocked using ZEN - see https://www.spamhaus.org/query/ip/$client_address for details lmdb: cdb: hash: dbm: . : postscreen_dnsbl_reply_map ( <<=address-filter>> <<*weight>>) ( $name). rbl_reply <> . <> . default_database_type . <> . . <> . Postfix 2.0 . <> Postfix 2.8 . readme_directory (default: see postconf -d output) README Postfix Postfix . receive_override_options (default: empty) . master.cf smtpd(8) qmqpd(8) pickup(8) . . main.cf smtpd(8) qmqpd(8) pickup(8) cleanup . no_unknown_recipient_checks ( SMTP). . no_address_mappings canonical (virtual alias map) (address masquerading) BCC. . no_header_body_checks header/body_checks. . no_milters Milter ( ). . : receive_override_options << >> main.cf << >> master.cf ( ). : receive_override_options = no_unknown_recipient_checks, no_header_body_checks receive_override_options = no_address_mappings Postfix 2.1 . recipient_bcc_maps (default: empty) BCC ( ) (envelope recipient) . BCC ( ) Postfix . <> . . : o <> . o "user@domain.tld" . o "user+extension" $myorigin $mydestination $inet_interfaces $proxy_interfaces . o "user" $myorigin $mydestination $inet_interfaces $proxy_interfaces . o "@domain.tld". : Postfix 2.3 BCC NOTIFY=NONE . (downstream) RFC 3461 BCC . : Postfix 2.2 BCC . : BCC . (mailer loops) Postfix Postfix BCC . : BCC ( ) canonical_maps masquerade_domains virtual_alias_maps . : recipient_bcc_maps = lmdb:/etc/postfix/recipient_bcc lmdb: cdb: hash: dbm: . "postmap /etc/postfix/recipient_bcc" recipient_bcc () . "postmap type:/etc/postfix/recipient_bcc" . default_database_type . "postconf -m" . . "postfix reload" . Postfix 2.1 . recipient_canonical_classes (default: envelope_recipient, header_recipient) recipient_canonical_maps . recipient_canonical_maps (envelope) (header) . : envelope_recipient header_recipient Postfix 2.2 . recipient_canonical_maps (default: empty) . canonical(5) . : $recipient_canonical_maps $canonical_maps . : recipient_canonical_maps = lmdb:/etc/postfix/recipient_canonical lmdb: cdb: hash: dbm: . "postmap /etc/postfix/recipient_canonical" recipient_canonical () . "postmap type:/etc/postfix/recipient_canonical" . default_database_type . "postconf -m" . . "postfix reload" . recipient_delimiter (default: empty) .forward . "recipient_delimiter = +" user@example.com user+foo@example.com user user+foo .forward .forward+foo . recipient_delimiter . .forward . . Postfix 2.10 recipient_delimiter . recipient_delimiter aliases canonical virtual relocated canonical(5) local(8) relocated(5) virtual(5) propagate_unmatched_extensions . command_execution_directory forward_path luser_relay ${recipient_delimiter} (Postfix 2.11 ) recipient_delimiter main.cf (Postfix 2.10 ). recipient_delimiter mailer-daemon postmaster double-bounce . "owner_request_special = yes" recipient_delimiter "owner-" "-request" . : # Handle Postfix-style extensions. recipient_delimiter = + # Handle both Postfix and qmail extensions (Postfix 2.11 and later). recipient_delimiter = +- # Use .forward for mail without address extension, and for mail with # an unrecognized address extension. forward_path = $home/.forward${recipient_delimiter}${extension}, $home/.forward reject_code (default: 554) SMTP Postfix SMTP "reject" . RFC 5321 . reject_tempfail_action (default: defer_if_permit) SMTP Postfix (reject) . SMTP "defer" . "defer_if_permit" SMTP Postfix . : unverified_recipient_tempfail_action unverified_sender_tempfail_action unknown_address_tempfail_action unknown_helo_hostname_tempfail_action. Postfix 2.6 . relay_clientcerts (default: empty) SMTP (Postfix 2.9 ) SMTP Postfix permit_tls_clientcerts . smtpd_tls_fingerprint_digest ( 2.5 Postfix md5 ). Postfix >= 3.6 compatibility_level 3.6 sha256 . Postfix <= 3.5 md5 . sha256 . md5 sha1 sha256 . (second pre-image) . Postfix (key, value) . : D7:04:2F:A7:0B:8C:A5:21:FA:31:77:E1:41:8A:EE:80 lutzpc.at.home : relay_clientcerts = lmdb:/etc/postfix/relay_clientcerts lmdb: cdb: hash: dbm: . check_ccert_access access(5) . RESTRICTION_CLASS_README . "postmap /etc/postfix/relay_clientcerts" relay_clientcerts () . "postmap type:/etc/postfix/relay_clientcerts" . default_database_type . "postconf -m" . . "postfix reload" . Postfix 2.2 . relay_destination_concurrency_limit (default: $default_destination_concurrency_limit) relay. (queue manager) . master.cf . Postfix 2.0 . relay_destination_recipient_limit (default: $default_destination_recipient_limit) relay. . master.cf . 1 relay_destination_concurrency_limit . Postfix 2.0 . relay_domains (default: Postfix >= 3.0: empty, Postfix < 3.0: $mydestination) ( ) . relay_domains SMTP permit_auth_destination reject_unauth_destination . $relay_domains $relay_transport . SMTP $relay_recipient_maps . ADDRESS_CLASS_README . : Postfix MX . permit_mx_backup postconf(5) . "/file/name" "type:table" / . . "/file/name" "type:table" ( ) . "!pattern" . "!/file/name" Postfix 2.4 . "relay_domains" parent_domain_matches_subdomains . relay_domains_reject_code (default: 554) SMTP Postfix reject_unauth_destination . RFC 5321 . relay_recipient_maps (default: empty) $relay_domains. @domain (wildcard) (backscatter mail) : Postfix . $relay_recipient_maps : Postfix . "type:name" . . SMTP Postfix . . ADDRESS_CLASS_README . : relay_recipient_maps = lmdb:/etc/postfix/relay_recipients lmdb: cdb: hash: dbm: . "postmap /etc/postfix/relay_recipients" relay_recipients () . "postmap type:/etc/postfix/relay_recipients" . default_database_type . "postconf -m" . . "postfix reload" . Postfix 2.0 . relay_transport (default: relay) (nexthop) : $relay_domains . : o : 1) $transport_maps 2) $relay_transport. o : 1) $transport_maps 2) $relay_transport 3) $sender_dependent_relayhost_maps $relayhost . transport:nexthop transport master.cf . :nexthop . ADDRESS_CLASS_README . Postfix 2.0 . relayhost (default: empty) () . $sender_dependent_relayhost_maps . : o ( $relay_domains) : 1) $transport_maps 2) $relay_transport 3) $sender_dependent_relayhost_maps $relayhost . o ( $mydestination $inet_interfaces $proxy_interfaces $virtual_alias_domains $virtual_mailbox_domains $relay_domains ) : 1) $transport_maps 2) $sender_dependent_default_transport_maps $default_transport 3) $sender_dependent_relayhost_maps $relayhost . . DNS MX . SMTP hostname:service [hostname]:service [hostaddress] [hostaddress]:service . [hostname] MX SRV . Postfix 3.5 . . SMTP . SMTP Postfix SMTP . UUCP UUCP_README . : relayhost = $mydomain relayhost = [gateway.example.com] relayhost = mail1.example:587, mail2.example:587 relayhost = [an.ip.add.ress] relocated_maps (default: empty) . relocated(5) . <> . . : relocated_maps = lmdb:/etc/postfix/relocated lmdb: cdb: hash: dbm: . relocated <> () . <> . default_database_type . <> . . <> . relocated_prefix_enable (default: yes) <<5.1.6 User has moved to >> relocated_maps . <> RFC 3463 (: <<[45].number.number text...>>). : /etc/postfix/main.cf: relocated_maps = lmdb:/etc/postfix/relocated relocated_prefix_enable = no /etc/postfix/relocated: user@example.com 5.2.1 User account is disabled lmdb: cdb: hash: dbm: . relocated <> () . <> . default_database_type . <> . . <> . Postfix 3.11 . remote_header_rewrite_domain (default: empty) remote_header_rewrite_domain remote_header_rewrite_domain . local_header_rewrite_clients Postfix . : : <> SMTP . remote_header_rewrite_domain = domain.invalid (purist): . remote_header_rewrite_domain = require_home_directory (default: no) local(8) . . ( ). requiretls_enable (default: yes) ESMTP <> <>. RFC 8689 REQUIRETLS : o SMTP LMTP TLS o MX ( DNSSEC MTA-STS) o ( TLS SMTP LMTP Postfix <> <> <> dane-only <> ) o STARTTLS <> . REQUIRETLS SMTP Postfix smtp_mx_address_limit smtp_mx_session_limit MX . SMTP LMTP Postfix . : o SMTP LMTP Postfix REQUIRETLS smtp_requiretls_policy lmtp_requiretls_policy . LMTP . o ESMTP REQUIRETLS <> . Postfix 3.11 . requiretls_esmtp_header (default: yes) ESMTP REQUIRETLS <> . REQUIRETLS smtpd_proxy_filter content_filter FILTER access(5) SMTPD header_checks(5) body_checks(5) . Milter . . . Postfix 3.11 . requiretls_redact_dsn (default: yes) REQUIRETLS ( <> ) REQUIRETLS ( REQUIRETLS ). RFC 8689 5 . : <<>> <<>> . REQUIRETLS . <> . reset_owner_alias (default: no) local(8) owner-alias . Postfix 2.8 . Postfix <> . aliases(5) name owner-name . . local(8) . : . : . . Postfix 2.8 owner-alias . . Postfix owner-alias . . local(8) . . resolve_dequoted_address (default: yes) . Postfix RFC 822 @ % ! . . <> Postfix @ . user@domain@domain Postfix MX Sendmail . resolve_null_domain (default: no) <<@>> . Postfix 2.1 . . SMTP Postfix <<@>> <<@>> . resolve_numeric_domain (default: no) <> <> . Postfix 2.3 . respectful_logging (default: see 'postconf -d' output) . <> <> . Postfix 3.6 . rewrite_service_name (default: rewrite) . ( ) . Postfix 2.0 . sample_directory (default: /etc/postfix) Postfix. Postfix 2.1 postconf(5) . send_cyrus_sasl_authzid (default: no) SMTP LMTP <> SASL ( authzid) SASL ( authcid) authcid . <> Postfix . SASL authzid SASL authcid SMTP . Postfix 2.4.4 . sender_based_routing (default: no) . Postfix 2.3 sender_dependent_relayhost_maps . sender_bcc_maps (default: empty) (BCC) . BCC ( ) Postfix . <> . . : o <> . o <> . o <> $myorigin $mydestination $inet_interfaces $proxy_interfaces . o <> $myorigin $mydestination $inet_interfaces $proxy_interfaces . o <<@domain.tld>>. : Postfix 2.3 BCC NOTIFY=NONE . RFC 3461 BCC . : Postfix 2.2 BCC . : BCC . BCC Postfix Postfix . : BCC ( ) canonical_maps masquerade_domains virtual_alias_maps . : sender_bcc_maps = lmdb:/etc/postfix/sender_bcc lmdb: cdb: hash: dbm: . sender_bcc <> () . <> . default_database_type . <> . . <> . Postfix 2.1 . sender_canonical_classes (default: envelope_sender, header_sender) sender_canonical_maps . sender_canonical_maps . : envelope_sender header_sender Postfix 2.2 . sender_canonical_maps (default: empty) (envelope) . canonical(5) . : (SENDER) "user@ugly.example" "user@pretty.example" (RECIPIENT) "user@ugly.example" . : $sender_canonical_maps $canonical_maps . : sender_canonical_maps = lmdb:/etc/postfix/sender_canonical lmdb: cdb: hash: dbm: . sender_canonical "postmap /etc/postfix/sender_canonical" () . "postmap type:/etc/postfix/sender_canonical" . default_database_type . "postconf -m" . . "postfix reload" . sender_dependent_default_transport_maps (default: empty) default_transport. domain@ . DUNNO default_transport . transport(5) . ( $mydestination $inet_interfaces $proxy_interfaces $virtual_alias_domains $virtual_mailbox_domains $relay_domains ): o : ) $transport_maps ) $sender_dependent_default_transport_maps $default_transport. o (nexthop) : ) $transport_maps ) $sender_dependent_default_transport_maps $default_transport ) $sender_dependent_relayhost_maps $relayhost . : default_transport transport_maps default_transport transport_maps. transport_maps transport nexthop . "type:name" . . $number . Postfix 2.7 . sender_dependent_relayhost_maps (default: empty) relayhost. domain@ . DUNNO relayhost (Postfix 2.6 ). : o ( $relay_domains) nexthop : ) $transport_maps ) $relay_transport ) $sender_dependent_relayhost_maps $relayhost . o ( mydestination $inet_interfaces $proxy_interfaces $virtual_alias_domains $virtual_mailbox_domains $relay_domains ) nexthop : ) $transport_maps ) $sender_dependent_default_transport_maps $default_transport ) $sender_dependent_relayhost_maps $relayhost . "type:name" . . $number . Postfix 2.3 . sendmail_fix_line_endings (default: always) () sendmail Postfix . always . Postfix 2.9 . strict . Postfix 2.8 . never . . Postfix 2.9 . sendmail_path (default: see postconf -d output) Sendmail sendmail(1) Postfix . Postfix . service_name (read-only) master.cf Postfix. . master.cf: # Distinguish inbound MTA logging from submission and submissions logging. smtp inet n - n - - smtpd submission inet n - n - - smtpd -o syslog_name=postfix/$service_name submissions inet n - n - - smtpd -o syslog_name=postfix/$service_name # Distinguish outbound MTA logging from inbound relay logging. smtp unix - - n - - smtp relay unix - - n - - smtp -o syslog_name=postfix/$service_name Postfix 3.3 . service_throttle_time (default: 60s) master(8) Postfix (fork) . ( ). : s () m () h () d () w (). s () . setgid_group (default: postdrop) set-gid Postfix Postfix. "postfix set-permissions" ( Postfix 2.0 : "/etc/postfix/post-install set-permissions"). shlib_directory (default: see 'postconf -d' output) Postfix ( libpostfix-*.so) Postfix ( postfix-*.so) dynamicmaps.cf . shlib_directory "no" /usr/lib/postfix /usr/local/lib/postfix . : o shlib_directory Postfix . Postfix /usr/lib /usr/local/lib . Postfix . (API) Postfix . o shlib_directory Postfix . Postfix libpostfix-*.so ldconfig . libpostfix-*.so $shlib_directory ldconfig . Postfix 3.0 . show_user_unknown_table_name (default: yes) "User unknown". . Postfix 2.0 . showq_service_name (default: showq) showq(8). . Postfix 2.0 . smtp_address_preference (default: any) ("ipv6" "ipv4" "any") SMTP Postfix IPv6 IPv4 MX . inet_protocols IPv4 IPv6 . SMTP Postfix . Postfix 2.8 "ipv6" IPv6 IPv4 . IPv4 IPv6 : o "smtp_address_preference = ipv6" . IPv6 IPv4 . 3.3 "smtp_balance_inet_protocols" . "smtp_address_preference = ipv4" . o "smtp_address_preference = any" . "smtp_balance_inet_protocols = yes" () IPv6 IPv4 . o "smtp_address_preference = ipv4" IPv6 ( PTR AAAA ) . Postfix IPv4 IPv6 IPv4 . /etc/postfix/main.cf: inet_protocols = all /etc/postfix/master.cf smtp ...other fields... smtp -o inet_protocols=ipv4 Postfix 2.8 . smtp_address_verify_target (default: rcpt) SMTP . "rcpt" "data" . SMTP DATA . transport_maps : /etc/postfix/main.cf: transport_maps = lmdb:/etc/postfix/transport /etc/postfix/transport: smtp-domain-that-verifies-after-data smtp-data-target: lmtp-domain-that-verifies-after-data lmtp-data-target: /etc/postfix/master.cf: smtp-data-target unix - - n - - smtp -o smtp_address_verify_target=data lmtp-data-target unix - - n - - lmtp -o lmtp_address_verify_target=data lmdb: cdb: hash: dbm: . "data" "lost connection after DATA" SMTP/LMTP . transport "postmap /etc/postfix/transport" . "postmap type:/etc/postfix/transport" . default_database_type . "postconf -m" . . "postfix reload" . Postfix 3.0 . smtp_always_send_ehlo (default: yes) EHLO SMTP. "smtp_always_send_ehlo = no" SMTP Postfix EHLO "ESMTP" (banner) ( : 220 spike.porcupine.org ESMTP Postfix). smtp_balance_inet_protocols (default: yes) IPv4 IPv6 SMTP Postfix smtp_mx_address_limit . IPv6 smtp_address_limit IPv4 IPv6 . Postfix 3.3 . smtp_bind_address (default: empty) SMTP Postfix IPv4 (bind) . main.cf SMTP master.cf : /etc/postfix/master.cf: smtp ... smtp -o smtp_bind_address=11.22.33.44 Postfix smtp_bind_address_enforce (Postfix 3.7 ). : inet_interfaces IPv4 smtp_bind_address . IP (multi-homed) . inet_interfaces . : [] . smtp_bind_address6 (default: empty) SMTP Postfix IPv6 (bind) . Postfix 2.2 . main.cf SMTP master.cf : /etc/postfix/master.cf: smtp ... smtp -o smtp_bind_address6=1:2:3:4:5:6:7:8 Postfix smtp_bind_address_enforce (Postfix 3.7 ). : inet_interfaces IPv6 (non-loopback) smtp_bind_address6 . IP (multi-homed) . inet_interfaces . : [] . smtp_bind_address_enforce (default: no) SMTP Postfix smtp_bind_address smtp_bind_address6 . SMTP Postfix . Postfix 3.7 . smtp_body_checks (default: empty) body_checks(5) SMTP Postfix. . . Postfix 2.5 . smtp_cname_overrides_servername (default: version dependent) servername SMTP CNAME DNS SASL TLS TLS CNAME . "no" smtp_tls_per_site Postfix CNAME DNS SASL . Postfix 2.3 . Postfix 2.2.9 Postfix 3.11 . smtp_connect_timeout (default: 30s) SMTP Postfix TCP ( ). SMTP Postfix (mail exchanger) . 0 ( ). ( ). : s () m () h () d () w (). s () . smtp_connection_cache_destinations (default: empty) SMTP . SMTP . $smtp_connection_cache_time_limit . . : o (relay host) : ( [] IP ) o : ( [] TCP) main.cf transport map o (UNIX-domain socket) : ( unix:) o /file/name / o "type:table" / . "type:table" . Postfix 2.2 . smtp_connection_cache_on_demand (default: yes) SMTP (active queue) . SMTP . $smtp_connection_cache_time_limit . . Postfix 2.2 . smtp_connection_cache_time_limit (default: 2s) SMTP SMTP . . Postfix 2.2 . smtp_connection_reuse_count_limit (default: 0) SMTP SMTP ( ). N N+1 . : . MTA MTA . smtp_connection_reuse_time_limit . Postfix 2.11 . smtp_connection_reuse_time_limit (default: 300s) Postfix SMTP . ( connect greeting helo ). SMTP . Postfix : MTA SMTP MX . MX . SMTP MX MX MX MX . MX . MX N N MX . MX N MX MX . Postfix 2.2 . ( ) Postfix MX . 300s smtp . . Postfix 2.2 10 . MTA . . Postfix 2.3 . smtp_data_done_timeout (default: 600s) SMTP Postfix "." SMTP SMTP. . ( ). : s () m () h () d () w (). s () . smtp_data_init_timeout (default: 120s) SMTP Postfix DATA SMTP SMTP. : s () m () h () d () w (). s () . smtp_data_xfer_timeout (default: 180s) SMTP Postfix SMTP. $smtp_data_xfer_timeout SMTP Postfix . : s () m () h () d () w (). s () . smtp_defer_if_no_mx_address_found (default: no) MX IP . (no) . Postfix MX . : SMTP Postfix MX MTA . Postfix 2.1 . smtp_delivery_status_filter (default: $default_delivery_status_filter) smtp(8) . default_delivery_status_filter . : SMTP Postfix SMTP . smtp_reply_filter SMTP . smtp_destination_concurrency_limit (default: $default_destination_concurrency_limit) smtp. (queue manager) . master.cf . smtp_destination_recipient_limit (default: $default_destination_recipient_limit) smtp. (queue manager) . master.cf . 1 smtp_destination_concurrency_limit . smtp_discard_ehlo_keyword_address_maps (default: empty) SMTP EHLO ( pipelining starttls auth ) SMTP Postfix EHLO SMTP . smtp_discard_ehlo_keywords . smtpd_discard_ehlo_keyword_address_maps . "type:name" . . Postfix 2.2 . smtp_discard_ehlo_keywords (default: empty) EHLO ( pipelining starttls auth ) SMTP Postfix EHLO SMTP . Postfix 2.2 . : o silent-discard . o smtp_discard_ehlo_keyword_address_maps EHLO . smtp_dns_reply_filter (default: empty) DNS SMTP Postfix. . DNS : name ttl class type preference value class "IN" preference MX "." ASCII ( xn--mumble UTF8). (action) . . IGNORE . : o DNS Postfix DNS nsswitch.conf . o SMTP/LMTP Postfix smtp_dns_reply_filter lmtp_dns_reply_filter SMTP LMTP ( MX A AAAA TLSA) . reject_unverified_sender reject_unverified_recipient . o SMTP/LMTP Postfix . o SMTP Postfix smtpd_dns_reply_filter MX A AAAA TXT reject_unknown_helo_hostname reject_unknown_sender_domain reject_unknown_recipient_domain reject_rbl_* reject_rhsbl_* . o SMTP Postfix . : AAAA Google DNS SMTP Postfix Google IPv6 PTR (hard-reject) . /etc/postfix/main.cf: smtp_dns_reply_filter = pcre:/etc/postfix/smtp_dns_reply_filter /etc/postfix/smtp_dns_reply_filter: # /domain ttl IN AAAA address/ action, all case-insensitive. # Note: the domain name ends in ".". /^\S+\.google\.com\.\s+\S+\s+\S+\s+AAAA\s+/ IGNORE Postfix 3.0 . smtp_dns_resolver_options (default: empty) DNS SMTP Postfix. . . /etc/resolv.conf . res_defnames ( "." ). Postfix 2.8 . res_dnsrch . . Postfix 2.8 . smtp_dns_support_level (default: empty) DNS SMTP Postfix. "smtp_dns_support_level" "disable_dns_lookups" DNS SMTP Postfix . : disabled DNS . MX <> . . DNS content_filters . . enabled DNS . nexthop <<[]>> MX . <> <> <> A MX DNS DNS <> . dnssec DNSSEC . <> <> : o MX RES_USE_DNSSEC RES_USE_EDNS0 DNSSEC . MX DNSSEC . o ( <> <> ). o DNSSEC <> . <> DNSSEC (NODATA NXDOMAIN) . SMTP Postfix MX <<[nexthop]>> <<[nexthop]:port>> MX <> . <> nexthop <<[nexthop]>> <<[nexthop]:port>> . LMTP <> <> LMTP MX . <> TLS dane dane-only DNSSEC Postfix . DNSSEC Postfix DNSSEC . DNS DNS Postfix DNSSEC . DANE Postfix <> <> DANE <> . Postfix stub resolver DNSSEC DNSSEC . DNSSEC MTA DNSSEC loopback . Postfix (man-in-the-middle) . DNSSEC Postfix resolver(3) DNS RES_USE_DNSSEC RES_USE_EDNS0 . Postfix 2.11 . smtp_enforce_tls (default: no) : SMTP TLS (cleartext) . SMTP SMTP (CA) SMTP Postfix . (deferred) . dNSNames SubjectAlternativeName . dNSNames CommonName . smtp_tls_enforce_peername . RFC 2487 . mailhub . Postfix 2.2 . Postfix 2.3 smtp_tls_security_level . smtp_fallback_relay (default: $fallback_relay) (relay) SMTP . Postfix 2.2 fallback_relay . smtp_fallback_relay . MTA IP . IP ( greylist ) . SMTP . domain host host:port [host]:port [address] [address]:port [host] MX . SMTP Postfix . MX fallback 2.2 Postfix MX ( DNS ). smtp_generic_maps (default: empty) SMTP Postfix . localdomain.local . <> . . generic(5) ADDRESS_REWRITING_README STANDARD_CONFIGURATION_README . Postfix 2.2 . smtp_header_checks (default: empty) header_checks(5) SMTP Postfix. . . Postfix 2.5 . smtp_helo_name (default: $myhostname) HELO EHLO SMTP . . [ip.add.re.ss] . main.cf SMTP master.cf : /etc/postfix/master.cf: mysmtp ... smtp -o smtp_helo_name=foo.bar.com Postfix 2.0 . smtp_helo_timeout (default: 300s) SMTP Postfix HELO EHLO SMTP . ( ). : s () m () h () d () w (). s () . smtp_host_lookup (default: dns) SMTP Postfix IP . DNS (: disable_dns_lookups smtp_dns_support_level) . <> <> . : dns DNS ( ). native (nsswitch.conf ). dns, native DNS . Postfix 2.1 . smtp_line_length_limit (default: 998) Postfix SMTP . . <<>> MIME . . Postfix SMTP . Postfix 2.8 . smtp_log_tls_feature_status (default: yes) TLS . TLS REQUIRETLS . . o <> <> . o <> . . o TLS : 'none' 'may' 'encrypt' . . REQUIRETLS 'requiretls' . o ':downgrade-level' (downgrade) . downgrade-level none . (strict) (permissive) . o <> . o <> . . TLS: tls=none TLS . tls=may Opportunistic TLS. (handshake) TLS . tls=may? Opportunistic TLS. . tls=may:none Opportunistic TLS. TLS STARTTLS opportunistic TLS (plaintext) . tls=dane DANE . tls=dane:halfdane Opportunistic DANE. 'halfdane' DNSSEC . tls=dane:encrypt Opportunistic DANE. 'encrypt' TLSA . tls=dane? DANE TLS . REQUIRETLS ( smtp_requiretls_policy) <> TLS : tls=xxx/requiretls 'Enforce'. TLS REQUIRETLS REQUIRETLS . tls=xxx/!requiretls:nocertmatch 'Enforce'. TLS TLS . tls=xxx/requiretls:nocertmatch 'Opportunistic+starttls' 'opportunistic'. TLS REQUIRETLS REQUIRETLS . tls=xxx/!requiretls:nostarttls 'Enforce' 'opportunistic+starttls'. STARTTLS . tls=xxx/!requiretls:noencryption 'Enforce' 'opportunistic+starttls'. TLS . tls=xxx/!requiretls:none 'Enforce'. TLS REQUIRETLS . tls=xxx/requiretls:none 'Opportunistic+starttls'. TLS REQUIRETLS REQUIRETLS . tls=xxx/requiretls:none 'Opportunistic'. STARTTLS REQUIRETLS REQUIRETLS . tls=xxx/requiretls? TLS . Postfix 3.11 . smtp_mail_timeout (default: 300s) SMTP Postfix MAIL FROM SMTP . ( ). : s () m () h () d () w (). s () . smtp_mime_header_checks (default: empty) mime_header_checks(5) SMTP Postfix. . . Postfix 2.5 . smtp_min_data_rate (default: 500) / DATA smtp_per_request_deadline . N ( TLS) DATA DATA N/smtp_min_data_rate . smtp_data_xfer_timeout . Postfix 3.7 . smtp_mx_address_limit (default: 5) IP MX ( ) SMTP Postfix ( ). Postfix 2.3 . Postfix 2.1 . smtp_mx_session_limit (default: 2) SMTP SMTP (fall-back relay host) ( ). SMTP (Postfix . ) EHLO TLS (Postfix . ) . Postfix . . smtp_nested_header_checks (default: empty) nested_header_checks(5) SMTP . . . Postfix . . smtp_never_send_ehlo (default: no) SMTP EHLO . smtp_always_send_ehlo . smtp_per_record_deadline (default: no) smtp_*_timeout ( SMTP SMTP SMTP TLS). . : per-record TLS . TLS ( TLSv1) TLS per-record . Postfix . . . Postfix "no" . Postfix . smtp_per_request_deadline . smtp_per_request_deadline (default: no) smtp_*_timeout TLS SMTP SMTP. TLS . per-request . per-request DATA smtp_min_data_rate . : per-request TLS . TLS ( TLSv1) TLS per-request . Postfix . . smtp_per_record_deadline Postfix . . . Postfix . . smtp_pix_workaround_delay_time (default: 10s) SMTP "." "." PIX . . ( ). : s () m () h () d () w (). s () . smtp_pix_workaround_maps (default: empty) SMTP CISCO PIX. smtp_discard_ehlo_keyword_address_maps . "type:name" . . Postfix . . smtp_pix_workaround_threshold_time (default: 500s) SMTP "." PIX "smtp fixup" . ( ). : s () m () h () d () w (). s () . . . 0 "." PIX . smtp_pix_workarounds (default: disable_esmtp, delay_dotcrlf) CISCO PIX . SMTP . . smtp_pix_workaround_maps . delay_dotcrlf "." . smtp_pix_workaround_delay_time smtp_pix_workaround_threshold_time . disable_esmtp ESMTP ( ): HELO EHLO. Postfix . . Postfix . smtp_quit_timeout (default: 300s) SMTP QUIT SMTP . ( ). : s () m () h () d () w (). s () . smtp_quote_rfc821_envelope (default: yes) () MAIL FROM RCPT TO SMTP RFC 5321. (localpart) "." . RFC 5321 . SMTP SMTP master.cf : /etc/postfix/master.cf: broken-smtp . . . smtp -o smtp_quote_rfc821_envelope=no transport(5) "broken-smtp" . Postfix . . smtp_randomize_addresses (default: yes) MX . SMTP . smtp_rcpt_timeout (default: 300s) SMTP SMTP RCPT TO SMTP . ( ). : s () m () h () d () w (). s () . smtp_reply_filter (default: empty) SMTP . SMTP . (fault injection) Postfix . : o SMTP SMTP . o SMTP ( XYZ) (X.Y.Z) . SMTP SMTP (X.0.0) . "type:table" . SMTP SMTP . SMTP . : /etc/postfix/main.cf: smtp_reply_filter = pcre:/etc/postfix/reply_filter /etc/postfix/reply_filter: # Some Microsoft servers violate RFC 2554 section 4, causing Postfix # to complain with "non-empty initial GSSAPI challenge from server" /^334\s+GSSAPI\s+supported/ 334 # Transform garbage into "250-filler..." so that it looks like # one line from a multi-line reply. It does not matter what we # substitute here as long it has the right syntax. The Postfix # SMTP client will use the final line's numerical SMTP reply # code and enhanced status code. !/^([2-5][0-9][0-9]($|[- ]))/ 250-filler for garbage Postfix . . smtp_requiretls_policy (default: see 'postconf -d smtp_requiretls_policy' output) REQUIRETLS SMTP LMTP REQUIRETLS. SMTP LMTP . o . o (action - ) type:table ( type:table ). o (next-hop) TLS TCP transport_maps relayhost content_filter . LMTP UNIX-domain myhostname . o type:table next-hop TLS ( [ ] :service :port) . next-hop -ASCII ASCII ( Punycode) ASCII . o ( lmdb: cdb: hash:) ".parent" next-hop ( '.' ). ".parent" regexp: pcre: socketmap: tcp: . TLS "smtp_log_tls_feature_status = yes" (): enforce STARTTLS STARTTLS REQUIRETLS . REQUIRETLS "tls=level/requiretls" level TLS SMTP . "tls=level/!requiretls:nocertmatch" "tls=level/!requiretls:noencryption" "tls=level/!requiretls:nostarttls" smtp_log_tls_feature_status . : REQUIRETLS . opportunistic+starttls STARTTLS REQUIRETLS . REQUIRETLS REQUIRETLS "tls=level/requiretls" "tls=level/requiretls:nomatch" REQUIRETLS "tls=level/requiretls:none" level TLS SMTP . "tls=level/!requiretls:noencryption" "tls=level/!requiretls:nostarttls" smtp_log_tls_feature_status . MTA TLS DANE MTA-STS . opportunistic STARTTLS REQUIRETLS . REQUIRETLS STARTTLS REQUIRETLS "tls=level/requiretls" "tls=level/requiretls:nomatch" REQUIRETLS "tls=level/requiretls:none" level TLS SMTP . REQUIRETLS . MTA STARTTLS REQUIRETLS . MTA REQUIRETLS . disable REQUIRETLS. REQUIRETLS . REQUIRETLS . : o "example.com" ".example.com" type:table . lmdb: cdb: hash: . o ".domain" regexp: pcre: socketmap: tcp: smtp_requiretls_policy . SMTP. REQUIRETLS_README . o : REQUIRETLS STARTTLS REQUIRETLS REQUIRETLS ( ) TLS DANE STS ( ). REQUIRETLS REQUIRETLS ( ). 1 /etc/postfix/main.cf: 2 smtp_tls_security_level = may 3 smtp_tls_policy_maps = ...dane/sts plugin... 4 smtp_requiretls_policy = opportunistic 5 lmtp_requiretls_policy = opportunistic o REQUIRETLS SMTP ( -): REQUIRETLS STARTTLS REQUIRETLS DANE STS ( ) REQUIRETLS ( -) ( -) . ASCII ( -) ${domain_to_ascii{$mydomain}} ASCII $mydomain ASCII Punycode ( xn--mumble) . : main.cf $name Punycode ASCII . 1 /etc/postfix/main.cf: 2 smtp_tls_security_level = may 3 smtp_tls_policy_maps = ...dane/sts plugin... 4 smtp_requiretls_policy = 5 inline:{ 6 { ${domain_to_ascii{$mydomain}} = opportunistic } 7 { .${domain_to_ascii{$mydomain}} = opportunistic } 8 { localhost = opportunistic } } 9 cidr:{ 10 { 0.0.0.0/0 opportunistic }, 11 { ::/0 opportunistic } }, 12 enforce o REQUIRETLS SMTP ( ): REQUIRETLS STARTTLS TLS DANE STS ( ) REQUIRETLS . ( -). ASCII ( -) ${domain_to_ascii{$mydomain}} ASCII $mydomain ASCII Punycode ( xn--mumble) . : main.cf $name Punycode ASCII . 1 /etc/postfix/main.cf: 2 smtp_tls_security_level = may 3 smtp_tls_policy_maps = ...dane/sts plugin... 4 smtp_requiretls_policy = 5 inline:{ 6 { ${domain_to_ascii{$mydomain}} = opportunistic } 7 { .${domain_to_ascii{$mydomain}} = opportunistic } 8 { localhost = opportunistic } } 9 cidr:{ 10 { 0.0.0.0/0 opportunistic }, 11 { ::/0 opportunistic } }, 12 opportunistic+starttls o . /etc/postfix/main.cf: smtp_tls_security_level = may smtp_tls_policy_maps = ...dane/sts plugin... smtp_requiretls_policy = inline:{ { ${domain_to_ascii{$mydomain}} = opportunistic } { .${domain_to_ascii{$mydomain}} = opportunistic } { localhost = opportunistic } } cidr:{ { 0.0.0.0/0 opportunistic }, { ::/0 opportunistic } }, lmdb:/etc/postfix/requiretls-per-site opportunistic+starttls /etc/postfix/requiretls-per-site: one.example enforce two.example enforce three.example opportunistic ... lmdb: cdb: hash: dbm: . requiretls-per-site "postmap /etc/postfix/requiretls-per-site" () . "postmap type:/etc/postfix/requiretls-per-site" . default_database_type . "postconf -m" . . "postfix reload" . LMTP. REQUIRETLS_README . o REQUIRETLS LMTP: REQUIRETLS REQUIRETLS REQUIRETLS . : (UNIX-domain socket) (next-hop) lmtp_requiretls_policy myhostname . /etc/postfix/main.cf: lmtp_requiretls_policy = opportunistic Postfix . . smtp_rset_timeout (default: 20s) SMTP RSET SMTP . SMTP RSET . ( ). : s () m () h () d () w (). s () . Postfix . . smtp_sasl_auth_cache_name (default: empty) SASL SMTP . ( ) . SMTP . smtp_sasl_password_maps smtp_sasl_auth_cache_name ( smtp_sasl_auth_cache_time ) SMTP SASL smtp_sasl_auth_soft_bounce (bounce) (defer). ( "smtp_destination_concurrency_limit = 1" "relay_destination_concurrency_limit = 1" ) . proxywrite "proxy:" . data_directory . Postfix TLS . : smtp_sasl_auth_cache_name = proxy:lmdb:/var/lib/postfix/sasl_auth_cache smtp_sasl_auth_cache_name = proxy:btree:/var/lib/postfix/sasl_auth_cache Postfix . . smtp_sasl_auth_cache_time (default: 90d) smtp_sasl_auth_cache_name . ( ). : s () m () h () d () w (). d () . Postfix . . smtp_sasl_auth_enable (default: no) SASL SMTP . SMTP . : smtp_sasl_auth_enable = yes smtp_sasl_auth_soft_bounce (default: yes) SASL SMTP . . (hard-coded) . : "yes" soft_bounce "no" . : # Default as of Postfix 2.5 smtp_sasl_auth_soft_bounce = yes # The old hard-coded default smtp_sasl_auth_soft_bounce = no Postfix . . smtp_sasl_mechanism_filter (default: empty) SMTP SASL SMTP . SMTP . smtp_sasl_mechanism_filter . "/file/name" "type:table" . "type:table" . "!pattern" . "!/file/name" Postfix . . Postfix . . : smtp_sasl_mechanism_filter = plain, login smtp_sasl_mechanism_filter = /etc/postfix/smtp_mechs smtp_sasl_mechanism_filter = !gssapi, !login, static:rest smtp_sasl_password_maps (default: empty) SMTP username:password (next-hop). sender-dependent authentication . username:password SMTP . smtp_sasl_password_result_delimiter . SMTP chroot /etc/postfix . "type:name" . . smtp_sasl_password_result_delimiter (default: :) sasl_passwd_maps. . Postfix >= 3.9 . smtp_sasl_path (default: empty) SMTP SASL smtp_sasl_type . (rendezvous point) . Postfix . . smtp_sasl_security_options (default: noplaintext, noanonymous) SASL SMTP . SASL smtp_sasl_type . SASL cyrus : : noplaintext . noactive (). nodictionary (). noanonymous . mutual_auth ( SASL ). : smtp_sasl_security_options = noplaintext smtp_sasl_tls_security_options (default: $smtp_sasl_security_options) SASL SMTP TLS . Postfix . . smtp_sasl_tls_verified_security_options (default: $smtp_sasl_tls_security_options) SASL SMTP SMTP TLS . MX . (submission) SASL . smtp_sasl_tls_verified_security_options . submission SASL . Postfix . . smtp_sasl_type (default: cyrus) SASL SMTP . "postconf -A" . Postfix . . smtp_send_dummy_mail_auth (default: no) "AUTH=<>" MAIL FROM SASL . SMTP . Postfix . "smtp_send_dummy_mail_auth = yes" . Postfix . . smtp_send_xforward_command (default: no) XFORWARD EHLO SMTP XFORWARD . SMTP ( ) HELO SMTP . localhost[127.0.0.1] . Postfix . . smtp_sender_dependent_authentication (default: no) (sender-dependent authentication) SMTP SASL SMTP . Postfix 2.3 . smtp_skip_4xx_greeting (default: yes) SMTP 4XX ( ). SMTP Postfix . Postfix "smtp_skip_4xx_greeting = no" . Postfix 2.0 . Postfix SMTP 4XX . smtp_skip_5xx_greeting (default: yes) SMTP 5XX . SMTP Postfix . Postfix (bounce) "smtp_skip_5xx_greeting = no" . : RFC 2821 . smtp_skip_quit_response (default: yes) SMTP QUIT. smtp_starttls_timeout (default: 300s) SMTP TLS. ( ). : s () m () h () d () w (). s () . Postfix 2.2 . smtp_tcp_port (default: smtp) TCP SMTP . ( services(5)) . smtp_tls_CAfile (default: empty) CA SMTP CA . smtp(8) chroot . smtp_tls_CApath smtp(8) chroot chroot . $smtp_tls_cert_file ( Postfix >= 3.4 $smtp_tls_chain_files) . "smtp_tls_CAfile = /path/to/system_CA_file" . Postfix "tls_append_default_CA = no" . : smtp_tls_CAfile = /etc/postfix/CAcert.pem Postfix 2.2 . smtp_tls_CApath (default: empty) PEM SMTP Postfix SMTP . "hash" "$OPENSSL_HOME/bin/c_rehash /etc/postfix/certs" . chroot ( ) chroot . "smtp_tls_CApath = /path/to/system_CA_directory" . Postfix "tls_append_default_CA = no" . : smtp_tls_CApath = /etc/postfix/certs Postfix 2.2 . smtp_tls_block_early_mail_reply (default: no) TLS ( CVE-2009-3555) HELO MAIL RCPT DATA TLS SMTP Postfix . SMTP TLS SMTP HELO MAIL RCPT DATA . Postfix 2.7 . smtp_tls_cert_file (default: empty) RSA SMTP Postfix PEM. RSA SMTP RSA SMTP . Postfix >= 3.4 "smtp_tls_chain_files" . TLS . . : smtp_tls_cert_file = smtp_tls_key_file = smtp_tls_eccert_file = smtp_tls_eckey_file = # Obsolete DSA parameters smtp_tls_dcert_file = smtp_tls_dkey_file = # Postfix >= 3.4 interface smtp_tls_chain_files = main.cf ( ) . SMTP SMTP CA . ( ). : "client.example.com" "intermediate CA" "root CA" . "root" chain.pem : # umask 077 # cat client_key.pem client_cert.pem intermediate_CA.pem > chain.pem SMTP CA CA smtp_tls_CAfile smtp_tls_cert_file smtp_tls_dcert_file () smtp_tls_eccert_file . SSL "openssl verify -purpose sslclient ..." . : smtp_tls_cert_file = /etc/postfix/chain.pem Postfix 2.2 . smtp_tls_chain_files (default: empty) PEM . / . . . -- OpenSSL 1.1.1 DSA () RSA ECDSA Ed25519 Ed448 -- . Postfix . . . . PEM : key1, cert1, [chain1], key2, cert2, [chain2], ..., keyN, certN, [chainN]. . (rollover) Postfix . . . RSA OpenSSL . "Ed25519" "Ed448" ECDSA ( prime256v1 secp384r1 secp521r1) "ECDSA" ECDSA . ( ): /etc/postfix/main.cf: smtp_tls_chain_files = ${config_directory}/ed25519.pem, ${config_directory}/ed448.pem, ${config_directory}/rsa.pem /etc/postfix/ed25519.pem: -----BEGIN PRIVATE KEY----- MC4CAQAwBQYDK2VwBCIEIEJfbbO4BgBQGBg9NAbIJaDBqZb4bC4cOkjtAH+Efbz3 -----END PRIVATE KEY----- -----BEGIN CERTIFICATE----- MIIBKzCB3qADAgECAhQaw+rflRreYuUZBp0HuNn/e5rMZDAFBgMrZXAwFDESMBAG ... nC0egv51YPDWxEHom4QA -----END CERTIFICATE----- /etc/postfix/ed448.pem: -----BEGIN PRIVATE KEY----- MEcCAQAwBQYDK2VxBDsEOQf+m0P+G0qi+NZ0RolyeiE5zdlPQR8h8y4jByBifpIe LNler7nzHQJ1SLcOiXFHXlxp/84VZuh32A== -----END PRIVATE KEY----- -----BEGIN CERTIFICATE----- MIIBdjCB96ADAgECAhQSv4oP972KypOZPNPF4fmsiQoRHzAFBgMrZXEwFDESMBAG ... pQcWsx+4J29e6YWH3Cy/CdUaexKP4RPCZDrPX7bk5C2BQ+eeYOxyThMA -----END CERTIFICATE----- /etc/postfix/rsa.pem: -----BEGIN PRIVATE KEY----- MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQDc4QusgkahH9rL ... ahQkZ3+krcaJvDSMgvu0tDc= -----END PRIVATE KEY----- -----BEGIN CERTIFICATE----- MIIC+DCCAeCgAwIBAgIUIUkrbk1GAemPCT8i9wKsTGDH7HswDQYJKoZIhvcNAQEL ... Rirz15HGVNTK8wzFd+nulPzwUo6dH2IU8KazmyRi7OGvpyrMlm15TRE2oyE= -----END CERTIFICATE----- ( ): /etc/postfix/main.cf: smtp_tls_chain_files = ${config_directory}/chains.pem /etc/postfix/chains.pem: -----BEGIN PRIVATE KEY----- MC4CAQAwBQYDK2VwBCIEIEJfbbO4BgBQGBg9NAbIJaDBqZb4bC4cOkjtAH+Efbz3 -----END PRIVATE KEY----- -----BEGIN CERTIFICATE----- MIIBKzCB3qADAgECAhQaw+rflRreYuUZBp0HuNn/e5rMZDAFBgMrZXAwFDESMBAG ... nC0egv51YPDWxEHom4QA -----END CERTIFICATE----- -----BEGIN PRIVATE KEY----- MEcCAQAwBQYDK2VxBDsEOQf+m0P+G0qi+NZ0RolyeiE5zdlPQR8h8y4jByBifpIe LNler7nzHQJ1SLcOiXFHXlxp/84VZuh32A== -----END PRIVATE KEY----- -----BEGIN CERTIFICATE----- MIIBdjCB96ADAgECAhQSv4oP972KypOZPNPF4fmsiQoRHzAFBgMrZXEwFDESMBAG ... pQcWsx+4J29e6YWH3Cy/CdUaexKP4RPCZDrPX7bk5C2BQ+eeYOxyThMA -----END CERTIFICATE----- -----BEGIN PRIVATE KEY----- MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQDc4QusgkahH9rL ... ahQkZ3+krcaJvDSMgvu0tDc= -----END PRIVATE KEY----- -----BEGIN CERTIFICATE----- MIIC+DCCAeCgAwIBAgIUIUkrbk1GAemPCT8i9wKsTGDH7HswDQYJKoZIhvcNAQEL ... Rirz15HGVNTK8wzFd+nulPzwUo6dH2IU8KazmyRi7OGvpyrMlm15TRE2oyE= -----END CERTIFICATE----- Postfix 3.4 . smtp_tls_cipherlist (default: empty) Postfix < 2.3 TLS SMTP Postfix. TLS . : . MTA TLS . : "" . 2.2 . Postfix 2.3 smtp_tls_mandatory_ciphers . smtp_tls_ciphers (default: medium) TLS SMTP Postfix TLS . smtp_tls_exclude_ciphers . Postfix "medium" "export" . TLS smtp_tls_mandatory_ciphers . smtp_tls_policy_maps . Postfix 2.6 . Postfix smtp_tls_mandatory_ciphers TLS "export" ( ) . smtp_tls_connection_reuse (default: no) TLS. tlsproxy(8) SMTP scache(8) qmgr(8) . <> . Postfix 3.4 . smtp_tls_dane_insecure_mx_policy (default: dane) TLS MX TLSA <<>> (secure) nexthop dane MX MX <<>> (insecure) . : may TLSA TLS . MX STARTTLS STARTTLS . encrypt TLSA TLS . TLS . dane TLSA MX <<>> . TLS TLSA << >> . <> <> MX . 3.6.17 3.7.13 3.8.8 3.9.2 3.10.0 <> . smtp_tls_security_level . MX <<>> MX SMTP << >> (tamper-evident) MX . MX . Postfix 3.1 . may Postfix . smtp_tls_dcert_file (default: empty) DSA SMTP PEM. DSA SMTP . DSA . smtp_tls_cert_file . : smtp_tls_dcert_file = /etc/postfix/client-dsa.pem Postfix 2.2 . smtp_tls_dkey_file (default: $smtp_tls_dcert_file) DSA SMTP PEM. DSA SMTP $smtp_tls_dcert_file . DSA . (pass-phrase) . (<>) . Postfix 2.2 . smtp_tls_eccert_file (default: empty) ECDSA SMTP PEM. ECDSA SMTP . Postfix >= 3.4 <> . smtp_tls_cert_file . : smtp_tls_eccert_file = /etc/postfix/ecdsa-ccert.pem Postfix 2.6 Postfix OpenSSL 1.0.0 . smtp_tls_eckey_file (default: $smtp_tls_eccert_file) ECDSA SMTP PEM. ECDSA SMTP $smtp_tls_eccert_file . Postfix >= 3.4 <> . . (<>) . Postfix 2.6 Postfix OpenSSL 1.0.0 . smtp_tls_enable_rpk (default: no) SMTP RFC7250 X.509. enable_rpk TLS . o <> <> <> <> <> SMTP TLS . o <> <> <> . SMTP TLS ( ). . . o <> <> SMTP smtp_tls_enable_rpk enable_rpk . o <> SMTP smtp_tls_enable_rpk enable_rpk ( <> <> ). TLSA ( ) TLS TLS . o <> SMTP smtp_tls_enable_rpk enable_rpk . TLSA ( ) TLS TLS . SMTP TLS . SHA256 : # SHA256 digest of the first certificate in "cert.pem" $ openssl x509 -in cert.pem -outform DER | openssl dgst -sha256 -c # SHA256 digest of the SPKI of the first certificate in "cert.pem" $ openssl x509 -in cert.pem -pubkey -noout | openssl pkey -pubin -outform DER | openssl dgst -sha256 -c # SHA256 digest of the SPKI of the first private key in "pkey.pem" $ openssl pkey -in pkey.pem -pubout -outform DER | openssl dgst -sha256 -c Postfix 3.9 . smtp_tls_enforce_peername (default: yes) TLS SMTP SMTP . RFC 2487 MTA . <> . smtp_tls_per_site . . << >> (man-in-the-middle) (CommonName ). Postfix 2.2 . Postfix 2.3 smtp_tls_security_level . smtp_tls_enforce_sts_mx_patterns (default: yes) TLS STS: MX MX STS MX. TLSRPT STS STS Postfix . TLSRPT Postfix . Postfix STS : MX DNS MX STS. Postfix >= 3.10.5 . smtp_tls_exclude_ciphers (default: empty) SMTP TLS . OpenSSL / . <<+>> . ( ): smtp_tls_exclude_ciphers = aNULL smtp_tls_exclude_ciphers = MD5, DES smtp_tls_exclude_ciphers = DES+MD5 smtp_tls_exclude_ciphers = AES256-SHA, DES-CBC3-MD5 smtp_tls_exclude_ciphers = kEDH+aRSA (anonymous) . MD5 () DES . MD5 DES . <> <> . <> RSA . Postfix 2.3 . smtp_tls_fingerprint_cert_match (default: empty) SMTP TLS <> (smtp_tls_security_level = fingerprint). (CA) . (Postfix 2.9 ) . ( ) . smtp_tls_fingerprint_digest . (Postfix >= 3.6). Postfix . smtp_tls_policy_maps <> <> . <<|>> match match . : mailhub . . relayhost (load-balancer) / . relayhost / . relayhost = [mailhub.example.com] smtp_tls_security_level = fingerprint smtp_tls_fingerprint_digest = sha256 smtp_tls_fingerprint_cert_match = cd:fc:d8:db:f8:c4:82:96:6c:...:28:71:e8:f5:8d:a5:0d:9b:d4:a6 dd:5c:ef:f5:c3:bc:64:25:36:...:99:36:06:ce:40:ef:de:2e:ad:a4 : . : /etc/postfix/main.cf: smtp_tls_policy_maps = lmdb:/etc/postfix/tls_policy smtp_tls_fingerprint_digest = sha256 /etc/postfix/tls_policy: example.com fingerprint match=51:e9:af:2e:1e:40:1f:...:64:0a:30:35:2d:09:16:31:5a:eb:82:76 match=b6:b4:72:34:e2:59:cd:...:c2:ca:63:0d:4d:cc:2c:7d:84:de:e6:2f lmdb: cdb: hash: dbm: . tls_policy <> () . <> . default_database_type . <> . . <> . Postfix 2.5 . smtp_tls_fingerprint_digest (default: see postconf -d output) SMTP . TLS <> (smtp_tls_security_level = fingerprint) (Postfix 2.9 ) . ( ) . << >> (second pre-image) ( /) . Postfix >= 3.6 compatibility_level 3.6 sha256 . Postfix <= 3.5 md5 . (best-practice) sha256 . md5 sha1 sha256 . << >> . libcrypto OpenSSL libssl SSL Postfix . md5 sha1 sha256 sha512 . : $ openssl x509 -noout -fingerprint -digest -in certfile.pem <<=>> . : $ openssl x509 -noout -fingerprint -sha256 -in cert.pem SHA256 Fingerprint=D4:6A:AB:19:24:...:BB:A6:CB:66:82:C0:8E:9B:EE:29:A8:1A X.509 DER (ASN.1) . OpenSSL <<-pubkey>> <> <> . OpenSSL DER <> . DER OpenSSL . OpenSSL 1.0.0 <> . # OpenSSL >= 1.0 with SHA-256 fingerprints. $ openssl x509 -in cert.pem -noout -pubkey | openssl pkey -pubin -outform DER | openssl dgst -sha256 -c (stdin)= 64:3f:1f:f6:e5:1e:d4:2a:56:...:fc:09:1a:61:98:b5:bc:7c:60:58 SMTP TLS 2 ( leaf) . Postfix 2.5 . smtp_tls_force_insecure_host_tlsa_lookup (default: no) RRset DANE TLSA (alias) (zone) . DNSSEC DLV trust-anchor . <<_tcp>> . TLSA RRset (nameservers) TLSA RRset . Postfix 2.11 . smtp_tls_key_file (default: $smtp_tls_cert_file) RSA SMTP Postfix PEM. RSA SMTP Postfix $smtp_tls_cert_file . Postfix 3.4 "smtp_tls_chain_files" . (passphrase) . ("root") . : smtp_tls_key_file = $smtp_tls_cert_file Postfix 2.2 . smtp_tls_loglevel (default: 0) (logging) TLS SMTP Postfix. . 0 TLS. 1 TLS - (trust-chain) SMTP . Postfix 2.8 . 2 TLS Postfix (session cache) OpenSSL SSL. 3 (dump) TLS. 4 STARTTLS. "smtp_tls_loglevel = 2" . 4 . Postfix 2.2 . smtp_tls_mandatory_ciphers (default: medium) TLS (cipher grade) SMTP Postfix TLS . "medium" TLS . smtp_tls_policy_maps . : high OpenSSL "HIGH". TLS ( relayhost ) "HIGH" . tls_high_cipherlist . medium OpenSSL "MEDIUM" . tls_medium_cipherlist . null OpenSSL "NULL" . NULL ( TLS ). LMTP UNIX-domain "NULL" . tls_null_cipherlist . low OpenSSL "LOW" . Postfix 3.8 "medium" . OpenSSL "LOW" . Postfix tls_low_cipherlist . (SHOULD NOT) . export OpenSSL "EXPORT" . Postfix 3.8 "medium" . OpenSSL "EXPORT" . Postfix tls_export_cipherlist . (SHOULD NOT) . "null" (anonymous) SMTP Postfix . . "may" "encrypt" ( SMTP Postfix ) "smtp_tls_exclude_ciphers = aNULL" . TLS "smtp_tls_mandatory_exclude_ciphers = aNULL" . Postfix 2.3 . smtp_tls_mandatory_exclude_ciphers (default: empty) SMTP Postfix TLS. smtp_tls_exclude_ciphers ( ). Postfix 2.6 "exclude" TLS . smtp_tls_policy_maps . Postfix 2.3 . smtp_tls_mandatory_protocols (default: see postconf -d output) TLS SMTP Postfix TLS . main.cf . "protocols" ( smtp_tls_policy_maps ) (:) . . ( SSL_get_version(3) ) "SSLv2" "SSLv3" "TLSv1" "TLSv1.1" "TLSv1.2" "TLSv1.3". Postfix 3.6 ">=TLSv1" TLS 1.0 TLS ( ). "!" . Postfix 3.6 / TLS . ">=version" version TLS TLS (0301 TLS 1.0 0302 TLS 1.1 ). "<=version" . ">=" "<=" . TLS OpenSSL Postfix . . "0" "0x" . "301" "0301" "0x301" "0x0301" "TLSv1" . OpenSSL . Postfix OpenSSL TLS 1.4 Postfix . (Postfix >= 3.6): # Allow only TLS 1.2 through (hypothetical) TLS 1.4, once supported # in some future version of OpenSSL (presently a warning is logged). smtp_tls_mandatory_protocols = >=TLSv1.2, <=0305 # Allow only TLS 1.2 and up: smtp_tls_mandatory_protocols = >=0x0303 Postfix 3.6 . TLS 1.0 "smtp_tls_mandatory_protocols = !SSLv2, !SSLv3" . . OpenSSL . SMTP Postfix . . : smtp_tls_mandatory_protocols = !SSLv2, !SSLv3, !TLSv1.1 TLSv1.1 "TLSv1" . "TLSv1.3" OpenSSL 1.1.1 . "!TLSv1.3" Postfix 3.4 ( >= 3.0.14 3.1.10 3.2.7 3.3.2) . SMTP DANE TLSA TLS 1.2 TLS 1.0 . "dane" "dane-only" TLSv1 "TLSv1.2" . smtp_tls_policy_maps TLS_README . : # Preferred syntax with Postfix >= 3.6: smtp_tls_mandatory_protocols = >=TLSv1.2, <=TLSv1.3 # Legacy syntax: smtp_tls_mandatory_protocols = !SSLv2, !SSLv3, !TLSv1, !TLSv1.1 Postfix 2.3 . smtp_tls_note_starttls_offer (default: no) (hostname) SMTP STARTTLS TLS . : postfix/smtp[pid]: Host offered STARTTLS: [name.of.host] Postfix 2.2 . smtp_tls_per_site (default: empty) TLS SMTP Postfix (next-hop) SMTP . per-site ( NONE MUST ) (MAY) per-site ( MUST ) (NONE) . Postfix 2.3 smtp_tls_per_site : smtp_tls_policy_maps . (bare hostname) per-site . next-hop ( [] ":port") . next-hop MX destination . next-hop (wildcard) . next-hop transport(5) relayhost relay_transport . : NONE TLS . MAY next-hop smtp_use_tls smtp_enforce_tls smtp_tls_enforce_peername . MAY TLS TLS TLS minimal_backoff_time (plaintext). ( NONE) next-hop "smtp_enforce_tls = yes" "smtp_tls_enforce_peername = yes" . MUST_NOPEERMATCH TLS SMTP SMTP (CA) . NONE MAY next-hop smtp_use_tls smtp_enforce_tls smtp_tls_enforce_peername . MUST TLS SMTP SMTP SMTP CA . NONE MUST_NOPEERMATCH MAY next-hop smtp_use_tls smtp_enforce_tls smtp_tls_enforce_peername . "none" "may" "encrypt" "verify" smtp_tls_security_level Postfix 2.3 . Postfix 2.3 smtp_tls_mandatory_ciphers smtp_tls_mandatory_protocols TLS . "export" ( smtp_tls_ciphers smtp_tls_protocols ). DNS MX CNAME Postfix TLS . Postfix . TLS_README ( Closing a DNS loophole with obsolete per-site TLS policies) . Postfix 2.2 . Postfix 2.3 smtp_tls_policy_maps . smtp_tls_policy_maps (default: empty) TLS SMTP Postfix (next-hop) smtp_tls_per_site . TLS TLS_README MTA-STS TLSRPT_README . "type:name" . . TLS next-hop next-hop transport $local_transport $virtual_transport $relay_transport $default_transport. . LMTP ( inet: unix:) . next-hop $myhostname LMTP UNIX-domain next-hop . . :port ( ) transport(5) "." . . name=value / main.cf . TLS : none TLS. . may TLS (Opportunistic TLS). TLS . <> <> <> ( TLS Postfix >= 2.6) <> (Postfix >= 3.4) <> <> <> <> . (policy table) (colon) . <> ( Postfix >= 3.4) <> SNI SMTP . <> (Postfix >= 3.9) smtp_tls_enable_rpk main.cf . TLS Postfix TLS . TLS . encrypt TLS. SMTP STARTTLS TLS . <> smtp_tls_mandatory_protocols main.cf <> smtp_tls_mandatory_ciphers main.cf <> (Postfix >= 2.6) smtp_tls_mandatory_exclude_ciphers main.cf <> (Postfix >= 3.4) smtp_tls_connection_reuse main.cf . . <> (Postfix >= 3.9) smtp_tls_enable_rpk main.cf . dane TLS DANE. TLS TLSA DNSSEC . TLSA may . TLSA encrypt . TLSA SMTP TLSA . TLS RFC 7672 (DANE) DNSSEC Postfix 2.11 . <> (Postfix >= 3.4) smtp_tls_connection_reuse main.cf . may <> <> <> (Postfix >= 2.6) <> <> <> . encrypt <> <> <> (Postfix >= 2.6) <> <> <> . dane-only DANE TLS . TLS TLSA DNSSEC . TLSA . TLSA SMTP TLSA . TLS RFC 7672 (DANE) DNSSEC Postfix 2.11 . <> <> <> (Postfix >= 2.6) <> <> <> . <> (Postfix >= 3.4) smtp_tls_connection_reuse main.cf . fingerprint (fingerprint) . Postfix 2.5 . (CA) . ... . <> smtp_tls_fingerprint_cert_match main.cf (Postfix 2.9 ) . (digest) smtp_tls_fingerprint_digest . <<|>> match match . <<:>> () . <> <> <> (Postfix >= 2.6) <> <> <> . <> (Postfix >= 3.4) smtp_tls_connection_reuse main.cf . <> (Postfix >= 3.9) smtp_tls_enable_rpk main.cf . verify TLS. TLS SMTP DNS . DNS MX DNS MX . <> smtp_tls_verify_cert_match main.cf . . <> ( ) . <> <> <> (Postfix >= 2.6) <> <> <> . Postfix >= 2.11 <> <> . <> (trust-anchor) . <> (Postfix >= 3.4) smtp_tls_connection_reuse main.cf . secure . TLS SMTP DNS . DNS MX IP (next-hop) peername TLS . next-hop <> smtp_tls_secure_cert_match main.cf . . match : . transport nexthop . <> MX (deferred). <> <> <> (Postfix >= 2.6) <> <> <> . Postfix >= 2.11 <> <> . <> trust-anchor . <> (Postfix >= 3.4) smtp_tls_connection_reuse main.cf . : /etc/postfix/main.cf: smtp_tls_policy_maps = lmdb:/etc/postfix/tls_policy # Postfix 2.5 and later. # # The default digest is sha256 with Postfix >= 3.6 and # compatibility level >= 3. # smtp_tls_fingerprint_digest = sha256 /etc/postfix/tls_policy: example.edu none example.mil may example.gov encrypt protocols=TLSv1 example.com verify ciphers=high example.net secure .example.net secure match=.example.net:example.net [mail.example.org]:587 secure match=nexthop # Postfix 2.5 and later [thumb.example.org] fingerprint match=b6:b4:72:34:e2:59:cd:...:c2:ca:63:0d:4d:cc:2c:7d:84:de:e6:2f match=51:e9:af:2e:1e:40:1f:...:64:0a:30:35:2d:09:16:31:5a:eb:82:76 :lmdb :cdb :hash :dbm . : <> smtp_tls_secure_cert_match <> <> DNS (DNS forgery) . DNS <> . tls_policy <> ( ) . <> . default_database_type . <> . . <> . Postfix 2.3 . smtp_tls_protocols (default: see 'postconf -d' output) TLS SMTP Postfix TLS . main.cf . <> ( smtp_tls_policy_maps ) . . ( SSL_get_version(3) ) <> <> <> <> <> <> . Postfix 3.6 <<>=TLSv1>> TLS 1.0 TLS ( ). <> . Postfix 3.6 TLS / TLS . <<>=version>> version TLS TLS (0301 TLS 1.0 0302 TLS 1.1 ). <<<=version>> . <<>=>> <<<=>> . TLS OpenSSL Postfix . . <<0>> <<0x>> . <<301>> <<0301>> <<0x301>> <<0x0301>> <> . OpenSSL . Postfix OpenSSL TLS 1.4 Postfix . (Postfix >= 3.6): # Allow only TLS 1.0 through (hypothetical) TLS 1.4, once supported # in some future version of OpenSSL (presently a warning is logged). smtp_tls_protocols = >=TLSv1, <=0305 # Allow only TLS 1.0 and up: smtp_tls_protocols = >=0x0301 Postfix < 3.6 . TLS 1.0 <> . . OpenSSL . SSL/TLS . . : smtp_tls_protocols = !SSLv2, !SSLv3, !TLSv1.1 TLSv1.1 <> . <> OpenSSL 1.1.1 . <> Postfix 3.4 ( >= 3.0.14 3.1.10 3.2.7 3.3.2) . : # Preferred syntax with Postfix >= 3.6: smtp_tls_protocols = >=TLSv1, <=TLSv1.3 # Legacy syntax: smtp_tls_protocols = !SSLv2, !SSLv3 Postfix 2.6 . smtp_tls_scert_verifydepth (default: 9) SMTP . CA CA . Postfix ( OpenSSL). Postfix 2.5 . . CA . CA CA . Postfix 2.2 . smtp_tls_secure_cert_match (default: nexthop, dot-nexthop) peername SMTP Postfix TLS <>. TLS <> ($smtp_tls_policy_maps) <> main.cf . . . smtp_tls_verify_cert_match . <> DNS MX (man-in-the-middle) DNS . main.cf: smtp_tls_secure_cert_match = nexthop : example.net secure match=example.com:.example.com .example.net secure match=example.com:.example.com Postfix 2.3 . smtp_tls_security_level (default: Postfix >= 3.11: may; Postfix < 3.11: empty) SMTP TLS SMTP Postfix. smtp_use_tls smtp_enforce_tls smtp_tls_enforce_peername SMTP TLS may (compatibility_level >= 3.11) none (compatibility_level < 3.11) . : none TLS. TLS smtp_tls_policy_maps . may TLS . SMTP TLS (plaintext) TLS minimal_backoff_time (fallback) . TLS . <> <> (Postfix >= 2.6) TLS . TLS <> . TLS TLS . TLS . encrypt TLS. . smtp_tls_mandatory_protocols smtp_tls_mandatory_ciphers main.cf TLS . . dane TLS DANE. TLS DNSSEC . TLSA DNS Postfix SMTP DNS DNS . DNS MX DANE TLSA (RFC 7672) TLS MX . TLSA SMTP MX MX TLSA TLS . MX DNS . Postfix SMTP DNSSEC smtp_dns_support_level main.cf . TLSA DNSSEC tls "may" . TLSA "encrypt" . "dane" "mandatory" . DANE "aNULL" . RFC 7672 (DANE) TLS Postfix 2.11 . dane-only TLS DANE. "dane" DANE TLSA . (fallback) "may" "encrypt" TLSA . RFC 7672 (DANE) TLS Postfix 2.11 . fingerprint . (CA) . . smtp_tls_fingerprint_cert_match (Postfix 2.9 ) . smtp_tls_fingerprint_digest . Postfix 2.5 . verify TLS. DNS MX DNS MX . smtp_tls_verify_cert_match . "secure" ( ) . . secure TLS. DNS MX IP nexthop (peername) TLS . nexthop smtp_tls_secure_cert_match . nexthop . . : # No TLS. Formerly: smtp_use_tls=no and smtp_enforce_tls=no. smtp_tls_security_level = none # Opportunistic TLS. smtp_tls_security_level = may # Do not tweak opportunistic ciphers or protocols unless it is essential # to do so (if a security vulnerability is found in the SSL library that # can be mitigated by disabling a particular protocol or raising the # cipher grade). smtp_tls_ciphers = medium smtp_tls_protocols = >=TLSv1 # Legacy (Postfix < 3.6) syntax: smtp_tls_protocols = !SSLv2, !SSLv3 # Mandatory (high-grade) TLS encryption. smtp_tls_security_level = encrypt smtp_tls_mandatory_ciphers = high # Authenticated TLS 1.2 or better matching the nexthop domain or a # subdomain. smtp_tls_security_level = secure smtp_tls_mandatory_ciphers = high smtp_tls_mandatory_protocols = >=TLSv1.2 smtp_tls_secure_cert_match = nexthop, dot-nexthop # Certificate fingerprint verification (Postfix >= 2.5). # The CA-less "fingerprint" security level only scales to a limited # number of destinations. As a global default rather than a per-site # setting, this is practical only when mail for all recipients is sent # to a central mail hub. relayhost = [mailhub.example.com] smtp_tls_security_level = fingerprint smtp_tls_mandatory_protocols = >=TLSv1.2 smtp_tls_mandatory_ciphers = high smtp_tls_fingerprint_cert_match = 3D:95:34:51:...:40:99:C0:C1 EC:3B:2D:B0:...:A3:9D:72:F6 Postfix 2.3 . smtp_tls_servername (default: empty) SMTP Server Name Indication (SNI) TLS. DANE SNI SNI RFC7672 . SMTP SNI . . . DANE SNI . SNI DNS hostname nexthop nexthop . DNS SNI A-label (punycode) . . relayhost main.cf hostname . servername TLS . SNI . Postfix 3.4 . smtp_tls_session_cache_database (default: empty) TLS Postfix SMTP. (enumeration) lmdb btree . . smtp(8) tlsmgr(8) . master.cf smtp . tlsmgr(8): $smtpd_tls_session_cache_database $smtp_tls_session_cache_database ( Postfix 2.3 $lmtp_tls_session_cache_database) . . : dbm TLS . 2.5 root . data_directory Postfix . data_directory . : smtp_tls_session_cache_database = lmdb:/var/lib/postfix/smtp_scache smtp_tls_session_cache_database = btree:/var/lib/postfix/smtp_scache Postfix 2.2 . smtp_tls_session_cache_timeout (default: 3600s) TLS Postfix SMTP. $smtp_tls_session_cache_timeout . $smtp_tls_session_cache_database tlsmgr(8) master.cf smtp . Postfix 2.11 100 . <= 0 . 2 2 . ( ). : s () m () h () d () w (). s () . Postfix 2.2 . smtp_tls_trust_anchor_file (default: empty) PEM (trust-anchor) / . (Root CA) CAfile CApath Postfix SMTP . ( ) . SMTP . . PEM main.cf chroot Postfix SMTP . ( ) $mail_owner . CA . main.cf SMTP . "tafile" "verify" "secure" smtp_tls_policy_maps . RFC 7672 (DANE TLSA) TLS DNS SMTP . OpenSSL PEM PEM X.509 : $ openssl x509 -in cert.pem -out ta-key.pem -noout -pubkey Postfix 2.11 . smtp_tls_verify_cert_match (default: hostname) (peername) Postfix SMTP "verify". "match" ($smtp_tls_policy_maps) . . (:) . : example.com example.com example.com . . .example.com example.com .example.com . . nexthop : nexthop nexthop . MX MX . LMTP nexthop $myhostname . "secure" . . dot-nexthop nexthop . . hostname DNS MX . LMTP $myhostname . "MUST" smtp_tls_per_site "verify" . MX nexthop "hostname" "nexthop" . . main.cf: smtp_tls_verify_cert_match = hostname, nexthop, dot-nexthop : example.com verify match=hostname:nexthop .example.com verify match=example.com:.example.com:hostname Postfix 2.3 . smtp_tls_wrappermode (default: no) Postfix SMTP SUBMISSIONS ( SMTPS ) STARTTLS. "smtp_tls_security_level = encrypt" . : submissions "mail.example.com": /etc/postfix/main.cf: # Client-side SUBMISSIONS requires "encrypt" or stronger. smtp_tls_security_level = encrypt smtp_tls_wrappermode = yes # The [] suppress MX lookups. relayhost = [mail.example.com]:submissions TLS_README . Postfix 3.0 . smtp_tlsrpt_enable (default: no) RFC 8460 TLSRPT. TLSRPT DNS SMTP TLS MX . Postfix TLSRPT . smtp_tls_policy_maps MTA-STS TLSRPT_README . Postfix 3.10 . smtp_tlsrpt_skip_reused_handshakes (default: Postfix >= 3.11: no, Postfix 3.10: yes) "yes" TLSRPT "" TLS . "no" TLSRPT TLS TLS . : SMTP TLS TLS . Postfix 3.10 . smtp_tlsrpt_socket_name (default: empty) (UNIX-domain datagram socket) TLSRPT . "smtp_tlsrpt_enable = yes" ( $queue_directory) . smtp_tls_policy_maps MTA-STS TLSRPT_README . Postfix 3.10 . smtp_use_tls (default: no) (Opportunistic mode): TLS SMTP STARTTLS () . : SMTP STARTTLS . Postfix 2.3 TLS . smtp_tls_per_site . Postfix 2.2 . Postfix 2.3 smtp_tls_security_level . smtp_xforward_timeout (default: 300s) Postfix SMTP XFORWARD SMTP . ( ). : s () m () h () d () w (). s () . Postfix 2.1 . smtpd_authorized_verp_clients (default: $authorized_verp_clients) SMTP XVERP . . XVERP . 2.1 . Postfix 2.0 . network/netmask / . . .domain ( ) "/file/name" "type:table" . "/file/name" "type:table" ( ). . "!pattern" . "!/file/name" Postfix 2.4 . : IPv6 [] smtpd_authorized_verp_clients "/file/name" . IPv6 ":" "type:table" . smtpd_authorized_xclient_hosts (default: empty) SMTP XCLIENT . SMTP (override) . SMTP fetchmail SMTP . XCLIENT_README . Postfix 2.1 . XCLIENT . network/netmask / . . .domain ( ) "/file/name" "type:table" . "/file/name" "type:table" ( ). . "!pattern" . "!/file/name" Postfix 2.4 . : IPv6 [] smtpd_authorized_xclient_hosts "/file/name" . IPv6 ":" "type:table" . smtpd_authorized_xforward_hosts (default: empty) SMTP XFORWARD . (logging) SMTP . XFORWARD_README . Postfix 2.1 . XFORWARD . network/netmask / . . .domain ( ) "/file/name" "type:table" . "/file/name" "type:table" ( ). . "!pattern" . "!/file/name" Postfix 2.4 . : IPv6 [] smtpd_authorized_xforward_hosts "/file/name" . IPv6 ":" "type:table" . smtpd_banner (default: $myhostname ESMTP $mail_name) 220 SMTP . . Postfix . myhostname$ . SMTP . : smtpd_banner = $myhostname ESMTP $mail_name ($mail_version) smtpd_client_auth_rate_limit (default: 0) AUTH Postfix . anvil_rate_time_unit . AUTH . 0 . : . . Postfix 3.1 . smtpd_client_connection_count_limit (default: 50) . . 0 . : . . Postfix 2.2 . smtpd_client_connection_limit_exceptions (default: $mynetworks) Postfix 2.2 smtpd_client_event_limit_exceptions . smtpd_client_connection_rate_limit (default: 0) . anvil_rate_time_unit . Postfix . 0 . : . . Postfix 2.2 . : smtpd_client_connection_rate_limit = 1000 smtpd_client_event_limit_exceptions (default: $mynetworks) smtpd_client_*_count/rate_limit . mynetworks . . .domain ( ) . : IPv6 [] smtpd_client_event_limit_exceptions "/file/name" . IPv6 ":" "type:table" . "smtpd_client_event_limit_exceptions" parent_domain_matches_subdomains (Postfix 3.0 ). Postfix 2.2 . smtpd_client_ipv4_prefix_length (default: 32) smtpd_client_*_count smtpd_client_*_rate IPv4 . anvil(8) . IPv4 . Postfix 3.8 . smtpd_client_ipv6_prefix_length (default: 84) smtpd_client_*_count smtpd_client_*_rate IPv6 . anvil(8) . IPv6 . Postfix 3.8 . smtpd_client_message_rate_limit (default: 0) Postfix . anvil_rate_time_unit . Postfix . 0 . : . . Postfix 2.2 . : smtpd_client_message_rate_limit = 1000 smtpd_client_new_tls_session_rate_limit (default: 0) ( ) TLS SMTP . anvil_rate_time_unit . SMTP Postfix TLS . 0 . . : . . Postfix 2.3 . : smtpd_client_new_tls_session_rate_limit = 100 smtpd_client_port_logging (default: no) SMTP IP. "host[address]:port" . Postfix 2.5 . smtpd_client_recipient_rate_limit (default: 0) Postfix . anvil_rate_time_unit . Postfix . 0 . : . . Postfix 2.2 . : smtpd_client_recipient_rate_limit = 1000 smtpd_client_restrictions (default: empty) Postfix SMTP . SMTPD_ACCESS_README "Delayed evaluation of SMTP access restriction lists" . . / . . . . check_ccert_access type:table SMTP (Postfix 2.9 ) access(5) Postfix 2.2 SMTP . smtpd_tls_fingerprint_digest ( Postfix 2.5 md5 ). "smtpd_tls_ask_ccert = yes" Postfix 2.2 . Postfix >= 3.6 compatibility_level 3.6 sha256 . Postfix <= 3.5 md5 . sha256 . md5 sha1 sha256 . " " . check_ccert_access (Postfix 3.5 ). : check_ccert_access { type:table, { search_order = cert_fingerprint, pubkey_fingerprint } } . check_client_access type:table IP . access(5) . check_client_a_access type:table access(5) IP . : <> . DUNNO . Postfix . . check_client_mx_access type:table access(5) MX . MX SMTP Postfix A AAAA . : <> . DUNNO . Postfix . . check_client_ns_access type:table access(5) DNS . : <> . DUNNO . Postfix . . check_reverse_client_hostname_access type:table IP . access(5) . : <> . DUNNO . Postfix . . check_reverse_client_hostname_a_access type:table access(5) IP . : <> . DUNNO . Postfix . . check_reverse_client_hostname_mx_access type:table access(5) MX . MX SMTP Postfix A AAAA . : <> . DUNNO . Postfix . . check_reverse_client_hostname_ns_access type:table access(5) DNS . : <> . DUNNO . Postfix . . check_sasl_access type:table SASL SMTP access(5) . smtpd_sasl_local_domain "username@domainname" . check_client_access check_sasl_access IP . Postfix . . permit_inet_interfaces IP $inet_interfaces . permit_mynetworks IP $mynetworks . permit_sasl_authenticated RFC 4954 (AUTH) . permit_tls_all_clientcerts SMTP . CA CA CA . . CA smtpd_tls_CAfile smtpd_tls_CApath "tls_append_default_CA = no" CA Postfix . "smtpd_tls_ask_ccert = yes" Postfix . . permit_tls_clientcerts SMTP (Postfix . ) $relay_clientcerts . smtpd_tls_fingerprint_digest ( . Postfix md5 ). "smtpd_tls_ask_ccert = yes" Postfix . . Postfix >= 3.6 compatibility_level . sha256 . Postfix <= 3.5 md5 . sha256 . md5 sha1 sha256 . << >> . reject_rbl_client rbl_domain=d.d.d.d A "d.d.d.d" rbl_domain ( Postfix . ). "d" "[]" number..number ";" (Postfix . ). "=d.d.d.d" A rbl_domain . maps_rbl_reject_code (: 554) default_rbl_reply rbl_reply_maps rbl_domain . : . ISP API ( SMTP rbl_reply_maps ). Postfix . . permit_dnswl_client dnswl_domain=d.d.d.d A "d.d.d.d" dnswl_domain . "d" "[]" number..number ";" . "=d.d.d.d" A dnswl_domain . permit_dnswl_client reject_unauth_destination . DEFER_IF_REJECT . : . ISP API ( API SMTP rbl_reply_maps ). Postfix . . reject_rhsbl_client rbl_domain=d.d.d.d A "d.d.d.d" rbl_domain ( Postfix . ). "d" "[]" number..number ";" (Postfix . ). "=d.d.d.d" A rbl_domain . RBL reject_rbl_client . : . ISP API ( API SMTP rbl_reply_maps ). Postfix . Postfix . reject_rhsbl_reverse_client . permit_rhswl_client rhswl_domain=d.d.d.d A "d.d.d.d" rhswl_domain . "d" "[]" number..number ";" . "=d.d.d.d" A rhswl_domain . : . DNS . permit_rhswl_client reject_unauth_destination . DEFER_IF_REJECT . : . ISP API ( API SMTP rbl_reply_maps ). Postfix . . reject_rhsbl_reverse_client rbl_domain=d.d.d.d A "d.d.d.d" rbl_domain . "d" "[]" number..number ";" . "=d.d.d.d" A rbl_domain . RBL reject_rbl_client . : . ISP API ( API SMTP rbl_reply_maps ). Postfix . . reject_unknown_client_hostname (with Postfix < 2.3: reject_unknown_client) : ) IP-> ) -> ) -> IP . reject_unknown_reverse_client_hostname ) . unknown_client_reject_code (: 450). -> -> 450 . reject_unknown_reverse_client_hostname IP -> . reject_unknown_client_hostname -> -> IP . unknown_client_reject_code (: 450). -> 450 . Postfix . . . SMTP . check_policy_service servername . SMTPD_POLICY_README . Postfix . . defer . . . defer_code SMTP (: 450). defer_if_permit PERMIT . . Postfix . . defer_if_reject REJECT . . Postfix . . permit . . reject_multi_recipient_bounce (null) . : DSN NOTIFY=NEVER . : smtpd_data_restrictions smtpd_end_of_data_restrictions SMTP . RCPT . multi_recipient_bounce_reject_code (: 550). Postfix . . reject_plaintext_session . AUTH STARTTLS . plaintext_reject_code (: 450). Postfix . . reject_unauth_pipelining SMTP Postfix (pipelining) ESMTP . ESMTP . Postfix . SMTP ( HELO EHLO) . reject_unauth_pipelining . Postfix reject_unauth_pipelining smtpd_data_restrictions . reject . . reject_code (: 554). sleep seconds ( ) . (zombie mail) : /etc/postfix/main.cf: smtpd_client_restrictions = sleep 1, reject_unauth_pipelining smtpd_delay_reject = no Postfix . . warn_if_reject . "warn_if_reject" (reject-type) check_policy_service "reject_warning" ( "defer_if_permit" "reject_warning" ). defer_if_reject . : o SMTP smtpd_helo_restrictions smtpd_sender_restrictions smtpd_recipient_restrictions . helo smtpd_client_restrictions "smtpd_delay_reject = yes" $smtpd_client_restrictions RCPT TO . : smtpd_client_restrictions = permit_mynetworks, reject_unknown_client_hostname smtpd_command_filter (default: empty) SMTP. SMTP . Postfix . "type:table" . SMTP SMTP . SMTP . smtpd_command_filter : o "user@ipaddress" "resolve_numeric_domain = yes" . o "user@[ipaddress]" . virtual_alias_maps canonical_maps . o "RCPT TO:>" "strict_rfc821_envelopes = no" . "User Name" . smtpd_command_filter : /etc/postfix/main.cf: smtpd_command_filter = pcre:/etc/postfix/command_filter /etc/postfix/command_filter: # HELO . /^HELO\s*$/ HELO domain.invalid # . /^\s*$/ NOOP # RCPT TO:<'user@domain'> . # : . /^(RCPT\s+TO:\s*<)'([^[:space:]]+)'(>.*)/ $1$2$3 # XVERP MAIL FROM VERP. # Postfix VERP VERP_README . /^(MAIL\s+FROM:\s*.*)/ $1 XVERP # (Bounce-never). # postmaster ( ) notify_classes=bounce,resource,software . /^(RCPT\s+TO:\s*<.*>.*)\s+NOTIFY=\S+(.*)/ $1 NOTIFY=NEVER$2 /^(RCPT\s+TO:.*)/ $1 NOTIFY=NEVER Postfix 2.7 . smtpd_data_restrictions (default: empty) SMTP SMTP DATA . "Delayed evaluation of SMTP access restriction lists" SMTPD_ACCESS_README . Postfix 2.0 . / . . . : o SMTP smtpd_client_restrictions . o SMTP smtpd_client_restrictions smtpd_helo_restrictions smtpd_sender_restrictions smtpd_recipient_restrictions. o . . . : smtpd_data_restrictions = reject_unauth_pipelining smtpd_data_restrictions = reject_multi_recipient_bounce smtpd_delay_open_until_valid_rcpt (default: yes) SMTP RCPT TO . SMTP MAIL FROM "no" . . ( ) NOQUEUE . Postfix 2.3 . smtpd_delay_reject (default: yes) RCPT TO $smtpd_client_restrictions $smtpd_helo_restrictions $smtpd_sender_restrictions ETRN $smtpd_client_restrictions $smtpd_helo_restrictions. SMTP RCPT TO . : Postfix / . smtpd_discard_ehlo_keyword_address_maps (default: empty) SMTP EHLO ( pipelining starttls auth ) SMTP EHLO SMTP . smtpd_discard_ehlo_keywords . . "type:name" . . Postfix 2.2 . smtpd_discard_ehlo_keywords (default: empty) EHLO ( pipelining starttls auth ) SMTP EHLO SMTP . Postfix 2.2 . : o silent-discard . o smtpd_discard_ehlo_keyword_address_maps EHLO . smtpd_dns_reply_filter (default: empty) DNS SMTP . smtp_dns_reply_filter . Postfix 3.0 . smtpd_end_of_data_restrictions (default: empty) SMTP SMTP END-OF-DATA . "Delayed evaluation of SMTP access restriction lists" SMTPD_ACCESS_README . Postfix 2.2 . smtpd_data_restrictions . smtpd_enforce_tls (default: no) TLS: STARTTLS SMTP (plaintext) HELO EHLO XCLIENT STARTTLS NOOP QUIT (Postfix >= 3.9) HELP. RFC 2487 SMTP . submission ( 587) . . : "smtpd_enforce_tls = yes" "smtpd_tls_auth_only = yes" . : "sendmail -bs" STARTTLS . . Postfix 3.9 . smtpd_tls_security_level . Postfix 2.2 . Postfix 2.3 smtpd_tls_security_level . smtpd_error_sleep_time (default: 1s) Postfix 2.1 : SMTP $smtpd_soft_error_limit $smtpd_hard_error_limit . Postfix 2.0 : SMTP (4xx 5xx) $smtpd_soft_error_limit . $smtpd_soft_error_limit ( ) $smtpd_error_sleep_time . ( ). : s () m () h () d () w (). s () . smtpd_etrn_restrictions (default: empty) SMTP ETRN . "Delayed evaluation of SMTP access restriction lists" SMTPD_ACCESS_README . ETRN "fast flush" . ETRN_README . / . . . ETRN . check_etrn_access type:table ETRN. access(5) . : o SMTP smtpd_client_restrictions. o SMTP smtpd_client_restrictions smtpd_helo_restrictions. : smtpd_etrn_restrictions = permit_mynetworks, reject smtpd_expansion_filter (default: see postconf -d output) $name RBL . "_" . C . smtpd_expansion_filter $name . Postfix 2.0 . smtpd_forbid_bare_newline (default: Postfix >= 3.9: normalize) SMTP . SMTP UNIX RFC 5321 SMTP (SMTP smuggling) . ( ): normalize ( Postfix >= 3.9) (End-of-DATA) .. . SMTP DATA . . smtpd_forbid_bare_newline_exclusions . note "normalize" SMTP " " . "disconnect from name[address] ... notes=bare_lf" . notes . Postfix 3.9 . yes normalize. reject End-of-DATA .. bare "bare received" SMTP $smtpd_forbid_bare_newline_reject_code. SMTP ( netcat ) . BDAT MIME bare newline ( 3 RFC 3030 MIME RFC 2045 2.7 2.8). smtpd_forbid_bare_newline_exclusions ( BDAT BDAT smtpd_discard_ehlo_keyword_address_maps smtpd_discard_ehlo_keywords ). no ( Postfix < 3.9) DATA . . . SMTP SMTP ( SMTP smuggling) . : # Require the standard End-of-DATA sequence .. # Otherwise, allow bare and process it as if the client sent # . # # This maintains compatibility with many legitimate SMTP client # applications that send a mix of standard and non-standard line # endings, but will fail to receive email from client implementations # that do not terminate DATA content with the standard End-of-DATA # sequence .. # # Such clients can be allowlisted with smtpd_forbid_bare_newline_exclusions. # The example below allowlists SMTP clients in trusted networks. # smtpd_forbid_bare_newline = normalize smtpd_forbid_bare_newline_exclusions = $mynetworks : # Reject input lines that contain and log a "bare received" # error. Require that input lines end in , and require the # standard End-of-DATA sequence .. # # This will reject email from SMTP clients that send any non-standard # line endings such as web applications, netcat, or load balancer # health checks. # # This will also reject email from services that use BDAT to send # MIME text containing a bare newline (RFC 3030 Section 3 requires # canonical MIME format for text message types, defined in RFC 2045 # Sections 2.7 and 2.8). # # Such clients can be allowlisted with smtpd_forbid_bare_newline_exclusions. # The example below allowlists SMTP clients in trusted networks. # smtpd_forbid_bare_newline = reject smtpd_forbid_bare_newline_exclusions = $mynetworks # # Alternatively, in the case of BDAT violations, BDAT can be selectively # disabled with smtpd_discard_ehlo_keyword_address_maps, or globally # disabled with smtpd_discard_ehlo_keywords. # # smtpd_discard_ehlo_keyword_address_maps = cidr:/path/to/file # /path/to/file: # 10.0.0.0/24 chunking, silent-discard # smtpd_discard_ehlo_keywords = chunking, silent-discard yes no Postfix 3.8.4 3.7.9 3.6.13 3.5.23 . reject normalize Postfix >= 3.9 3.8.5 3.7.10 3.6.14 3.5.24 . smtpd_forbid_bare_newline_exclusions (default: $mynetworks) smtpd_forbid_bare_newline . (parent-domain) mynetworks . Postfix >= 3.9 3.8.4 3.7.9 3.6.13 3.5.23 . smtpd_forbid_bare_newline_reject_code (default: 550) SMTP Postfix "smtpd_forbid_bare_newline = reject". 5XX (521 ). Postfix >= 3.9 3.8.5 3.7.10 3.6.14 3.5.24 . smtpd_forbid_unauth_pipelining (default: Postfix >= 3.9: yes) SMTP (command pipelining) RFC 2920 ( 5321) . "554 5.5.0 Error: SMTP protocol synchronization" SMTP . Postfix >= 3.9 . "smtpd_forbid_unauth_pipelining = no" . Postfix >= 3.9 3.8.1 3.7.6 3.6.10 3.5.20 . smtpd_forbidden_commands (default: CONNECT GET POST regexp:{{/^[^A-Z]/ Bogus}}) SMTP Postfix 221 . . ":Label" . 3.6 Postfix "CONNECT GET POST" . Postfix 2.2 . Postfix 3.7 . regexp_table(5) . smtpd_hard_error_limit (default: normal: 20, overload: 1) SMTP . SMTP Postfix . 20 (overload) 1 . Postfix 2.5 SMTP 20 . . smtpd_helo_required (default: no) SMTP HELO EHLO MAIL EHLO . : smtpd_helo_required = yes smtpd_helo_restrictions (default: empty) SMTP Postfix HELO . SMTPD_ACCESS_README "Delayed evaluation of SMTP access restriction lists" . . : "smtpd_helo_required = yes" ( "smtpd_helo_required = yes" HELO EHLO smtpd_helo_restrictions ). / . . . HELO EHLO . check_helo_access type:table access(5) HELO EHLO . : "smtpd_helo_required = yes" ( "smtpd_helo_required = yes" HELO EHLO check_helo_access ). check_helo_a_access type:table access(5) IP HELO EHLO . : "OK" . DUNNO . : "smtpd_helo_required = yes" ( "smtpd_helo_required = yes" HELO EHLO check_helo_a_access ). Postfix 3.0 . check_helo_mx_access type:table access(5) MX HELO EHLO . MX SMTP Postfix A AAAA . : "OK" . DUNNO . : "smtpd_helo_required = yes" ( "smtpd_helo_required = yes" HELO EHLO check_helo_mx_access ). Postfix 2.1 . check_helo_ns_access type:table access(5) DNS HELO EHLO . : "OK" . DUNNO . : "smtpd_helo_required = yes" ( "smtpd_helo_required = yes" HELO EHLO check_helo_ns_access ). Postfix 2.1 . reject_invalid_helo_hostname ( Postfix < 2.3: reject_invalid_hostname) HELO EHLO . : "smtpd_helo_required = yes" ( "smtpd_helo_required = yes" HELO EHLO reject_invalid_helo_hostname ). invalid_hostname_reject_code (: 501). reject_non_fqdn_helo_hostname ( Postfix < 2.3: reject_non_fqdn_hostname) HELO EHLO RFC (FQDN) (address literal) . : "smtpd_helo_required = yes" ( "smtpd_helo_required = yes" HELO EHLO reject_non_fqdn_helo_hostname ). non_fqdn_reject_code (: 504). reject_rhsbl_helo rbl_domain=d.d.d.d HELO EHLO A "d.d.d.d" rbl_domain ( Postfix 2.1 ). "d" "[]" .. ";" (Postfix 2.8 ). "=d.d.d.d" HELO EHLO A rbl_domain . RBL reject_rbl_client . : "smtpd_helo_required = yes" ( "smtpd_helo_required = yes" HELO EHLO reject_rhsbl_helo ). : . ISP API ( API SMTP rbl_reply_maps ). Postfix 2.0 . reject_unknown_helo_hostname ( Postfix < 2.3: reject_unknown_hostname) HELO EHLO DNS A MX . unknown_hostname_reject_code (: 450) unknown_helo_hostname_tempfail_action (: defer_if_permit) . . : "smtpd_helo_required = yes" ( "smtpd_helo_required = yes" HELO EHLO reject_unknown_helo_hostname ). : o SMTP smtpd_client_restrictions. o smtpd_client_restrictions. o SMTP smtpd_sender_restrictions smtpd_recipient_restrictions. smtpd_helo_restrictions "smtpd_delay_reject = yes" $smtpd_helo_restrictions RCPT TO . : smtpd_helo_restrictions = permit_mynetworks, reject_invalid_helo_hostname smtpd_helo_restrictions = permit_mynetworks, reject_unknown_helo_hostname smtpd_hide_client_session (default: no) SMTP Received: SMTP Postfix. o "smtpd_hide_client_session = no" MTA 25 . 4.4 RFC 5321 . o "smtpd_hide_client_session = yes" MUA 587 465 . IP SMTP TLS SASL SMTP . Received: : Received: by mail.example.com (Postfix) id postfix-queue-id for ; Day, dd Mon yyyy hh:mm:ss tz-offset (zone) Received: by mail.example.com (Postfix) id postfix-queue-id; Day, dd Mon yyyy hh:mm:ss tz-offset (zone) SMTP 4.4 RFC 5321 FROM . RFC 5322 . Postfix >= 3.10 . smtpd_history_flush_threshold (default: 100) SMTP Postfix (flush) EHLO RSET DATA. smtpd_junk_command_limit (default: normal: 100, overload: 1) (NOOP VRFY ETRN RSET) SMTP SMTP Postfix . . smtpd_error_sleep_time smtpd_soft_error_limit . 100 1 . Postfix 2.5 SMTP 100 . smtpd_log_access_permit_actions (default: empty) "permit" SMTP ( SMTP "reject" "permit" ). "defer_if_permit" . "permit" "/file/name" "type:table" / . . "/file/name" "type:table" ( ). . "!pattern" . : /etc/postfix/main.cf: # Log all "permit" actions. smtpd_log_access_permit_actions = static:all /etc/postfix/main.cf: # Log "permit_dnswl_client" only. smtpd_log_access_permit_actions = permit_dnswl_client Postfix 2.10 . smtpd_milter_maps (default: empty) Milter IP SMTP . smtpd_milters . : . Milter DISABLE ( ). Milter : /etc/postfix/main.cf: smtpd_milter_maps = cidr:/etc/postfix/smtpd_milter_map smtpd_milters = inet:host:port, { inet:host:port, ... }, ... /etc/postfix/smtpd_milter_map: # Disable Milters for local clients. 127.0.0.0/8 DISABLE 192.168.0.0/16 DISABLE ::/64 DISABLE 2001:db8::/32 DISABLE Postfix 3.2 . smtpd_milters (default: empty) Milter ( ) smtpd(8) Postfix . . MILTER_README . Postfix 2.3 . smtpd_min_data_rate (default: 500) / DATA BDAT smtpd_per_request_deadline . N ( TLS) DATA BDAT DATA BDAT N/smtpd_min_data_rate . smtpd_timeout . Postfix 3.7 . smtpd_noop_commands (default: empty) SMTP Postfix "250 Ok" . SMTP Postfix . smtpd_null_access_lookup_key (default: <>) (null) access(5) SMTP . smtpd_peername_lookup (default: yes) SMTP IP . "unknown" . DNS . Postfix 2.3 . smtpd_per_record_deadline (default: normal: no, overload: yes) smtpd_timeout smtpd_starttls_timeout ( SMTP SMTP SMTP TLS). . : TLS . TLS ( TLSv1) TLS . Postfix 2.9-3.6 . Postfix "no" . Postfix 3.7 smtpd_per_request_deadline . smtpd_per_request_deadline (default: normal: no, overload: yes) smtpd_timeout smtpd_starttls_timeout TLS SMTP SMTP. TLS . . DATA BDAT smtpd_min_data_rate . : TLS . TLS ( TLSv1) TLS . Postfix 3.7 . smtpd_per_record_deadline Postfix 2.9-3.6 . Postfix "no" . Postfix 3.7 . smtpd_policy_service_default_action (default: 451 4.3.5 Server configuration problem) SMTPD . "DUNNO" SMTPD ( ) . : o SMTPD ( access(5)) . access(5) restriction_class . o check_policy_service . Postfix 3.0 . smtpd_policy_service_max_idle (default: 300s) SMTPD . ( ). : s () m () h () d () w (). s () . Postfix 2.1 . smtpd_policy_service_max_ttl (default: 1000s) SMTPD . ( ). : s () m () h () d () w (). s () . Postfix 2.1 . smtpd_policy_service_policy_context (default: empty) SMTP Postfix "policy_context" ( check_policy_service). Postfix 3.1 . smtpd_policy_service_request_limit (default: 0) SMTPD ( ). . . Postfix 3.0 . smtpd_policy_service_retry_delay (default: 1s) SMTPD. . ( ). : s () m () h () d () w (). s () . Postfix 3.0 . smtpd_policy_service_timeout (default: 100s) SMTPD. ( ). : s () m () h () d () w (). s () . Postfix 2.1 . smtpd_policy_service_try_limit (default: 2) SMTPD . . Postfix 3.0 . smtpd_proxy_ehlo (default: $myhostname) SMTP Postfix . Postfix . Postfix 2.1 . smtpd_proxy_filter (default: empty) TCP . SMTP Postfix SMTP Postfix . "host:port" "inet:host:port" TCP "unix:pathname" . IP MX . "host" "host:" . Postfix . Postfix 2.1 . "inet:" "unix:" Postfix 2.3 . smtpd_proxy_options (default: empty) SMTP Postfix (before-queue) . . speed_adjust . . : . . : $message_size_limit . . Postfix 2.7 . smtpd_proxy_timeout (default: 100s) . maillog . ( ). : s () m () h () d () w (). s () . Postfix 2.1 . smtpd_recipient_limit (default: 1000) SMTP Postfix . smtpd_recipient_overshoot_limit (default: 1000) SMTP $smtpd_recipient_limit SMTP Postfix . smtpd_recipient_restrictions (default: see postconf -d output) SMTP Postfix RCPT TO smtpd_relay_restrictions . SMTPD_ACCESS_README "Delayed evaluation of SMTP access restriction lists" . Postfix 2.10 smtpd_recipient_restrictions . 2.10 Postfix smtpd_relay_restrictions smtpd_recipient_restrictions . 2.10 smtpd_relay_restrictions smtpd_recipient_restrictions . : smtpd_relay_restrictions smtpd_recipient_restrictions . Postfix : reject, reject_unauth_destination defer, defer_if_permit, defer_unauth_destination / . . . RCPT TO . check_recipient_access type:table access(5) RCPT TO . check_recipient_a_access type:table access(5) IP RCPT TO . : "OK" . DUNNO . Postfix 3.0 . check_recipient_mx_access type:table access(5) MX RCPT TO . MX A AAAA SMTP Postfix . : "OK" . DUNNO . Postfix 2.1 . check_recipient_ns_access type:table access(5) DNS RCPT TO . : "OK" . DUNNO . Postfix 2.1 . permit_auth_destination : o Postfix : RCPT TO $relay_domains (user@elsewhere@domain) o Postfix : RCPT TO $mydestination $inet_interfaces $proxy_interfaces $virtual_alias_domains $virtual_mailbox_domains (user@elsewhere@domain) . permit_mx_backup MX RCPT TO ( permit_auth_destination ). o : permit_mx_backup (: user@elsewhere@domain) . o : permit_mx_backup_networks permit_mx_backup . o : 2.3 Postfix MX permit_mx_backup . : permit_mx_backup ( permit_auth_destination ). o : Postfix 2.0 DNS . reject_non_fqdn_recipient RCPT TO RFC (FQDN) . non_fqdn_reject_code (: 504). reject_rhsbl_recipient rbl_domain=d.d.d.d RCPT TO A "d.d.d.d" rbl_domain ( Postfix 2.1 ). "d" "[]" ";" .. (Postfix 2.8 ). "=d.d.d.d" RCPT TO A rbl_domain . maps_rbl_reject_code (: 554) default_rbl_reply rbl_reply_maps rbl_domain . : . ISP API ( API SMTP rbl_reply_maps ). Postfix 2.0 . reject_unauth_destination : o Postfix : RCPT TO $relay_domains (user@elsewhere@domain) o Postfix : RCPT TO $mydestination $inet_interfaces $proxy_interfaces $virtual_alias_domains $virtual_mailbox_domains (user@elsewhere@domain) . relay_domains_reject_code (: 554). defer_unauth_destination reject_unauth_destination . Postfix 2.10 . reject_unknown_recipient_domain Postfix RCPT TO ) DNS MX DNS A ) MX MX (Postfix 2.3 ). unknown_address_reject_code (: 450) unknown_address_tempfail_action (: defer_if_permit) 556 (nullmx Postfix 3.0 ) . . reject_unlisted_recipient (with Postfix version 2.0: check_recipient_maps) RCPT TO . smtpd_reject_unlisted_recipient . Postfix 2.1 . reject_unverified_recipient RCPT TO (bounce) . verify(8) ADDRESS_VERIFICATION_README . unverified_recipient_reject_code (: 450 550 ). unverified_recipient_defer_code (: 450). unverified_recipient_tempfail_action (: defer_if_permit). "enable_original_recipient = no" (Postfix <= 3.2). Postfix 2.1 . : o SMTP smtpd_client_restrictions . o SMTP smtpd_client_restrictions smtpd_helo_restrictions smtpd_sender_restrictions . : # The Postfix before 2.10 default mail relay policy. Later Postfix # versions implement this preferably with smtpd_relay_restrictions. smtpd_recipient_restrictions = permit_mynetworks, reject_unauth_destination smtpd_reject_filter_maps (default: empty) SMTP Postfix SMTP Postfix . . regexp: pcre: . 4XX 5XX (RFC 5321 ) (RFC 3463 ) . . . : smtpd_reject_filter_maps SMTP Postfix SMTP . SMTP Postfix ( "reject filter in" ) ( "reject filter out" ) . : /etc/postfix/main.cf: smtpd_reject_filter_maps = regexp:/etc/postfix/smtpd_reject_filter /etc/postfix/smtpd_reject_filter: # Replace soft reject with hard reject. /^451 4(\.6\.0 Alias expansion error)/ 550 5${1} # Silly rule for demo purposes. /^(4.+[^.])\.*$/ $1. See you later. /var/log/maillog: NOQUEUE: reject filter in: 451 4.6.0 Alias expansion error NOQUEUE: reject filter out: 550 5.6.0 Alias expansion error Postfix 3.11 . smtpd_reject_footer (default: empty) 4XX 5XX SMTP Postfix . "\c" ( Postfix 2.10 ) . Postfix "\c" . /etc/postfix/main.cf: smtpd_reject_footer = \c. For assistance, call 800-555-0101. Please provide the following information in your problem report: time ($localtime), client ($client_address) and server ($server_name). : 550-5.5.1 Recipient address rejected: User unknown. For assistance, call 800-555-0101. Please provide the following information in your problem report: time (Jan 4 15:42:00), client (192.168.1.248) and server (mail1.example.com). : Postfix SMTP . maillog SMTP Postfix . . maillog SMTP (delivery status notification) . Postfix $name . $name . SMTP . : smtpd_reject_footer_maps regexp: pcre: $$name Postfix . client_address IP maillog . client_port TCP maillog . localtime (Mmm dd hh:mm:ss) maillog . server_name myhostname . MTA ( ) . : o main.cf . o $smtpd_expansion_filter . \n . Postfix SMTP ( ) Postfix . \c . (Postfix 2.10 ). Postfix 2.8 . smtpd_reject_footer_maps (default: empty) 4xx 5xx SMTP Postfix . smtpd_reject_footer . "type:name" . . Postfix 3.4 . smtpd_reject_unlisted_recipient (default: yes) SMTP Postfix reject_unlisted_recipient . Postfix MAILER-DAEMON . <<>> ) virtual(5) canonical(5) ) . ADDRESS_CLASS_README . Postfix 2.1 . smtpd_reject_unlisted_sender (default: no) SMTP Postfix reject_unlisted_sender . . <<>> ) virtual(5) canonical(5) ) . ADDRESS_CLASS_README . Postfix 2.1 . smtpd_relay_before_recipient_restrictions (default: see postconf -d output) smtpd_relay_restrictions smtpd_recipient_restrictions. smtpd_relay_restrictions smtpd_recipient_restrictions . : smtpd_relay_restrictions smtpd_recipient_restrictions . RCPT TO . Postfix 3.6 . smtpd_relay_restrictions (default: permit_mynetworks, permit_sasl_authenticated, defer_unauth_destination) SMTP Postfix RCPT TO smtpd_recipient_restrictions . "Delayed evaluation of SMTP access restriction lists" SMTPD_ACCESS_README . Postfix 2.10 smtpd_recipient_restrictions . 2.10 Postfix smtpd_relay_restrictions smtpd_recipient_restrictions . Postfix 2.10 smtpd_relay_restrictions smtpd_recipient_restrictions . SMTP Postfix : o IP $mynetworks : o SASL : o $relay_domains (user@elsewhere@domain) : o $inet_interfaces $proxy_interfaces $mydestination $virtual_alias_domains $virtual_mailbox_domains . : smtpd_relay_restrictions smtpd_recipient_restrictions . Postfix : reject, reject_unauth_destination defer, defer_if_permit, defer_unauth_destination / . . smtpd_recipient_restrictions . Postfix 2.10 . smtpd_restriction_classes (default: empty) . smtpd_recipient_restrictions access(5) Postfix . UCE . RESTRICTION_CLASS_README . smtpd_sasl_application_name (default: smtpd) SMTP Postfix SASL . SASL . smtpd SASL smtpd.conf . Postfix 2.1 2.2 . Postfix 2.3 smtpd_sasl_path . smtpd_sasl_auth_enable (default: no) SASL SMTP (Postfix). SMTP . SMTP permit_sasl_authenticated (relay) : # With Postfix 2.10 and later, the mail relay policy is # preferably specified under smtpd_relay_restrictions. smtpd_relay_restrictions = permit_mynetworks, permit_sasl_authenticated, ... # With Postfix before 2.10, the relay policy can be # specified only under smtpd_recipient_restrictions. smtpd_recipient_restrictions = permit_mynetworks, permit_sasl_authenticated, ... SMTP "smtpd_delay_reject = yes" ( ) : smtpd_client_restrictions = permit_sasl_authenticated, reject SASL SASL_README . smtpd_sasl_authenticated_header (default: no) SASL Received smtpd(8). Postfix 2.3 . smtpd_sasl_exceptions_networks (default: empty) SMTP SMTP AUTH . ( Netscape 4) AUTH . $mynetworks AUTH Postfix . network/netmask / . (mask) . "/file/name" "type:table" . "/file/name" "type:table" ( ). . "!pattern" . "!/file/name" Postfix 2.4 . : IP 6 [] smtpd_sasl_exceptions_networks "/file/name" . IP 6 ":" "type:table" . : smtpd_sasl_exceptions_networks = $mynetworks Postfix 2.1 . smtpd_sasl_local_domain (default: empty) (realm) SASL SMTP . (null string) . : smtpd_sasl_local_domain = $mydomain smtpd_sasl_local_domain = $myhostname smtpd_sasl_mechanism_filter (default: !external, static:rest) SASL SMTP EHLO . SMTP EXTERNAL Postfix . "/file/name" "type:table" . "type:table" . "!pattern" . : smtpd_sasl_mechanism_filter = !external, !gssapi, static:rest smtpd_sasl_mechanism_filter = login, plain smtpd_sasl_mechanism_filter = /etc/postfix/smtpd_mechs Postfix 3.6 . smtpd_sasl_path (default: smtpd) SMTP SASL smtpd_sasl_type . (rendezvous point) . Postfix 2.3 . smtpd_sasl_application_name . smtpd_sasl_response_limit (default: 12288) SASL (challenge) . << >> SMTP << >> . RFC4954 12288 (octet) base64 . . Postfix 3.4 . "line_length_limit" ( GSSAPI Windows AD ) . smtpd_sasl_security_options (default: noanonymous) SASL SMTP Postfix 2.3 SASL smtpd_sasl_type . SASL cyrus : SMTP . . : noplaintext (plaintext) . noactive () . nodictionary () . noanonymous (anonymous) . forward_secrecy (forward secrecy) ( Dovecot). mutual_auth ( Cyrus SASL 1 ). SMTP . : ( PLAIN ANONYMOUS CRAM-MD5) CRAM-MD5 . . . : smtpd_sasl_security_options = noanonymous, noplaintext smtpd_sasl_service (default: smtp) SASL smtpd_sasl_type smtpd_sasl_path . Postfix 2.11 . "smtp" . smtpd_sasl_tls_security_options (default: $smtpd_sasl_security_options) SASL SMTP SMTP TLS . Postfix 2.2 . smtpd_sasl_type (default: cyrus) SASL SMTP . "postconf -a" . Postfix 2.3 . smtpd_sender_login_maps (default: empty) SASL (envelope sender MAIL FROM) . : From: (MAIL FROM) Milter submission submissions ( smtps) . : https://github.com/magcks/milterfrom "type:name" . . DB DBM NIS LDAP SQL user@domain : 1) user@domain . 2) user domain $myorigin $mydestination $inet_interfaces $proxy_interfaces . 3) @domain . " " (not found) SASL / . smtpd_sender_restrictions (default: empty) SMTP (context) MAIL FROM . SMTPD_ACCESS_README "Delayed evaluation of SMTP access restriction lists" . . / . . . MAIL FROM . check_sender_access type:table access(5) MAIL FROM . check_sender_a_access type:table access(5) IP MAIL FROM . : "OK" . DUNNO (denylists) . Postfix 3.0 . check_sender_mx_access type:table access(5) MX MAIL FROM . MX SMTP A AAAA . : "OK" . DUNNO . Postfix 2.1 . check_sender_ns_access type:table access(5) DNS MAIL FROM . : "OK" . DUNNO . Postfix 2.1 . reject_authenticated_sender_login_mismatch SASL MAIL FROM $smtpd_sender_login_maps SASL . MAIL FROM . : From: (MAIL FROM) Milter submission submissions ( smtps) . : https://github.com/magcks/milterfrom Postfix 2.1 . reject_known_sender_login_mismatch SASL MAIL FROM $smtpd_sender_login_maps SASL . SASL SASL MAIL FROM $smtpd_sender_login_maps . MAIL FROM $smtpd_sender_login_maps MAIL FROM . : From: (MAIL FROM) Milter submission submissions ( smtps) . : https://github.com/magcks/milterfrom Postfix 2.11 . reject_non_fqdn_sender MAIL FROM RFC (FQDN) . non_fqdn_reject_code (: 504). reject_rhsbl_sender rbl_domain=d.d.d.d MAIL FROM A "d.d.d.d" rbl_domain ( Postfix 2.1 ). "d" "[]" .. ";" (Postfix 2.8 ). "=d.d.d.d" MAIL FROM A rbl_domain . maps_rbl_reject_code (: 554) default_rbl_reply rbl_reply_maps rbl_domain . : . ISP API ( API SMTP rbl_reply_maps ). Postfix 2.0 . reject_sender_login_mismatch Postfix 2.1 (alias) "reject_authenticated_sender_login_mismatch, reject_unauthenticated_sender_login_mismatch" . reject_unauthenticated_sender_login_mismatch SASL MAIL FROM $smtpd_sender_login_maps SASL . SASL MAIL FROM $smtpd_sender_login_maps . : :From (MAIL FROM) Milter submission submissions ( smtps ) . : https://github.com/magcks/milterfrom Postfix 2.1 . reject_unknown_sender_domain Postfix MAIL FROM ) DNS MX DNS A ) MX MX (Postfix 2.3 ). unknown_address_reject_code (: 450) unknown_address_tempfail_action (: defer_if_permit) 550 (nullmx Postfix 3.0 ) . . reject_unlisted_sender MAIL FROM . smtpd_reject_unlisted_sender . Postfix 2.1 . reject_unverified_sender MAIL FROM (bounce) . verify(8) ADDRESS_VERIFICATION_README . unverified_sender_reject_code (: 450 550 ). unverified_sender_defer_code (: 450). unverified_sender_tempfail_action (: defer_if_permit). "enable_original_recipient = no" (Postfix <= 3.2). Postfix 2.1 . : o SMTP smtpd_client_restrictions. o SMTP smtpd_client_restrictions smtpd_helo_restrictions. o SMTP smtpd_recipient_restrictions. smtpd_sender_restrictions "smtpd_delay_reject = yes" $smtpd_sender_restrictions RCPT TO . : smtpd_sender_restrictions = reject_unknown_sender_domain smtpd_sender_restrictions = reject_unknown_sender_domain, check_sender_access lmdb:/etc/postfix/access :lmdb :cdb :hash :dbm . access "postmap /etc/postfix/access" () . "postmap type:/etc/postfix/access" . default_database_type . "postconf -m" . . "postfix reload" . smtpd_service_name (default: smtpd) postscreen(8) . SMTP . Postfix 2.8 . smtpd_soft_error_limit (default: 10) SMTP SMTP Postfix . o Postfix 2.1 $smtpd_soft_error_limit SMTP Postfix $smtpd_error_sleep_time . o Postfix 2.0 $smtpd_soft_error_limit SMTP Postfix ( ) $smtpd_error_sleep_time . o Postfix 2.0 $smtpd_soft_error_limit SMTP Postfix 4XX 5XX $smtpd_error_sleep_time . smtpd_starttls_timeout (default: see postconf -d output) SMTP Postfix TLS. (stress) . Postfix 2.8 300s . ( ). : s () m () h () d () w (). s () . Postfix 2.2 . smtpd_timeout (default: normal: 300s, overload: 10s) SMTP Postfix SMTP SMTP Postfix SMTP . smtpd_per_request_deadline ( Postfix 2.9-3.6 smtpd_per_record_deadline ). 300s (overload) 10s . Postfix 2.5 SMTP 300s . : SMTP ipc_timeout . ( ). : s () m () h () d () w (). s () . smtpd_tls_CAfile (default: empty) CA ( PEM) CA SMTP CA . smtpd(8) chroot . smtpd_tls_CApath smtpd(8) chroot chroot . . "smtpd_tls_CAfile = /path/to/system_CA_file" . CA "tls_append_default_CA = no" . (smtpd_tls_ask_ccert ) smtpd_tls_CAfile . (DN) smtpd_tls_CAfile SMTP . MUA . CA CA <<>> CA $smtpd_tls_CApath . : smtpd_tls_CAfile = /etc/postfix/CAcert.pem Postfix 2.2 . smtpd_tls_CApath (default: empty) CA ( PEM) CA SMTP CA . <> "$OPENSSL_HOME/bin/c_rehash /etc/postfix/certs". smtpd_tls_CApath chroot ( ) chroot . "smtpd_tls_CApath = /path/to/system_CA_directory" . CA "tls_append_default_CA = no" . (smtpd_tls_ask_ccert ) smtpd_tls_CApath . smtpd_tls_CAfile (DN) $smtpd_tls_CApath . MUA . CA CA <<>> $smtpd_tls_CAfile CA $smtpd_tls_CApath . : smtpd_tls_CApath = /etc/postfix/certs Postfix 2.2 . smtpd_tls_always_issue_session_ids (default: yes) SMTP Postfix TLS TLS (smtpd_tls_session_cache_database ). Postfix 2.3 . Postfix 2.3 SMTP Postfix TLS . SMTP . SMTP Postfix TLS . MS Outlook MTA . : smtpd_tls_always_issue_session_ids = no Postfix 2.3 . smtpd_tls_ask_ccert (default: no) SMTP . permit_tls_clientcerts . Netscape ( CA $smtpd_tls_CAfile) . "off" . Postfix 2.2 . smtpd_tls_auth_only (default: no) TLS SMTP Postfix SASL . Postfix 2.2 . smtpd_tls_ccert_verifydepth (default: 9) SMTP . CA CA . Postfix 9 ( OpenSSL) . Postfix 2.5 5 . . (CA) . CA CA . Postfix 2.2 . smtpd_tls_cert_file (default: empty) RSA SMTP Postfix PEM. RSA SMTP Postfix . Postfix >= 3.4 "smtpd_tls_chain_files" . MX CA <<>> CA . Postfix 2.3 . MX Postfix . (anonymous TLS ciphers) SMTP . TLS (fall back ) SMTP Postfix TLS . Postfix "smtpd_tls_cert_file = none" . SMTP Postfix TLS . TLS 1.3 . TLS 1.3 '!TLSv1.3' "smtpd_tls_protocols" "smtpd_tls_mandatory_protocols" . . . RSA DSA . . Netscape OpenSSL RSA . SMTP Postfix SMTP CA . CA() ( ). : "server.example.com" "intermediate CA" "root CA" . server.pem "cat server_cert.pem intermediate_CA.pem root_CA.pem > server.pem" . CA CA smtpd_tls_CAfile smtpd_tls_cert_file smtpd_tls_dcert_file () smtpd_tls_eccert_file . SSL "... openssl verify -purpose sslserver" . : smtpd_tls_cert_file = /etc/postfix/server.pem Postfix 2.2 . smtpd_tls_chain_files (default: empty) PEM . / . . . -- OpenSSL 1.1.1 DSA () RSA ECDSA Ed25519 Ed448 -- . Postfix . . . . PEM : key1, cert1, [chain1], key2, cert2, [chain2], ..., keyN, certN, [chainN]. . (rollover) Postfix . . . RSA OpenSSL . "Ed25519" "Ed448" ECDSA ( prime256v1 secp384r1 secp521r1) "ECDSA" ECDSA . RSA . ( ) ECDSA Ed25519 Ed448 . RSA . ( ): /etc/postfix/main.cf: smtpd_tls_chain_files = ${config_directory}/ed25519.pem, ${config_directory}/ed448.pem, ${config_directory}/rsa.pem /etc/postfix/ed25519.pem: -----BEGIN PRIVATE KEY----- MC4CAQAwBQYDK2VwBCIEIEJfbbO4BgBQGBg9NAbIJaDBqZb4bC4cOkjtAH+Efbz3 -----END PRIVATE KEY----- -----BEGIN CERTIFICATE----- MIIBKzCB3qADAgECAhQaw+rflRreYuUZBp0HuNn/e5rMZDAFBgMrZXAwFDESMBAG ... nC0egv51YPDWxEHom4QA -----END CERTIFICATE----- /etc/postfix/ed448.pem: -----BEGIN PRIVATE KEY----- MEcCAQAwBQYDK2VxBDsEOQf+m0P+G0qi+NZ0RolyeiE5zdlPQR8h8y4jByBifpIe LNler7nzHQJ1SLcOiXFHXlxp/84VZuh32A== -----END PRIVATE KEY----- -----BEGIN CERTIFICATE----- MIIBdjCB96ADAgECAhQSv4oP972KypOZPNPF4fmsiQoRHzAFBgMrZXEwFDESMBAG ... pQcWsx+4J29e6YWH3Cy/CdUaexKP4RPCZDrPX7bk5C2BQ+eeYOxyThMA -----END CERTIFICATE----- /etc/postfix/rsa.pem: -----BEGIN PRIVATE KEY----- MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQDc4QusgkahH9rL ... ahQkZ3+krcaJvDSMgvu0tDc= -----END PRIVATE KEY----- -----BEGIN CERTIFICATE----- MIIC+DCCAeCgAwIBAgIUIUkrbk1GAemPCT8i9wKsTGDH7HswDQYJKoZIhvcNAQEL ... Rirz15HGVNTK8wzFd+nulPzwUo6dH2IU8KazmyRi7OGvpyrMlm15TRE2oyE= -----END CERTIFICATE----- ( ): /etc/postfix/main.cf: smtpd_tls_chain_files = ${config_directory}/chains.pem /etc/postfix/chains.pem: -----BEGIN PRIVATE KEY----- MC4CAQAwBQYDK2VwBCIEIEJfbbO4BgBQGBg9NAbIJaDBqZb4bC4cOkjtAH+Efbz3 -----END PRIVATE KEY----- -----BEGIN CERTIFICATE----- MIIBKzCB3qADAgECAhQaw+rflRreYuUZBp0HuNn/e5rMZDAFBgMrZXAwFDESMBAG ... nC0egv51YPDWxEHom4QA -----END CERTIFICATE----- -----BEGIN PRIVATE KEY----- MEcCAQAwBQYDK2VxBDsEOQf+m0P+G0qi+NZ0RolyeiE5zdlPQR8h8y4jByBifpIe LNler7nzHQJ1SLcOiXFHXlxp/84VZuh32A== -----END PRIVATE KEY----- -----BEGIN CERTIFICATE----- MIIBdjCB96ADAgECAhQSv4oP972KypOZPNPF4fmsiQoRHzAFBgMrZXEwFDESMBAG ... pQcWsx+4J29e6YWH3Cy/CdUaexKP4RPCZDrPX7bk5C2BQ+eeYOxyThMA -----END CERTIFICATE----- -----BEGIN PRIVATE KEY----- MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQDc4QusgkahH9rL ... ahQkZ3+krcaJvDSMgvu0tDc= -----END PRIVATE KEY----- -----BEGIN CERTIFICATE----- MIIC+DCCAeCgAwIBAgIUIUkrbk1GAemPCT8i9wKsTGDH7HswDQYJKoZIhvcNAQEL ... Rirz15HGVNTK8wzFd+nulPzwUo6dH2IU8KazmyRi7OGvpyrMlm15TRE2oyE= -----END CERTIFICATE----- Postfix 3.4 . smtpd_tls_cipherlist (default: empty) Postfix < 2.3 TLS SMTP Postfix. . MX TLS . TLS SMTP . MSA TLS . : "" . Postfix 2.2 . Postfix 2.3 smtpd_tls_mandatory_ciphers . smtpd_tls_ciphers (default: medium) (cipher grade) TLS SMTP Postfix (opportunistic TLS) . smtpd_tls_exclude_ciphers . Postfix "medium" "export" . TLS smtpd_tls_mandatory_ciphers . Postfix 2.6 . Postfix smtpd_tls_mandatory_ciphers TLS "export" ( ) . smtpd_tls_dcert_file (default: empty) DSA SMTP Postfix PEM. DSA SMTP Postfix . DSA . smtpd_tls_cert_file . : smtpd_tls_dcert_file = /etc/postfix/server-dsa.pem Postfix 2.2 . smtpd_tls_dh1024_param_file (default: empty) DH SMTP Postfix EDH . Postfix >= 3.7 OpenSSL 3.0.0 "auto" DH OpenSSL TLS . SMTP TLS Postfix >= 3.7 OpenSSL 3.0.0 . . "1024" . SMTP . Postfix 3.1 DH . TLS : openssl dhparam -out /etc/postfix/dh2048.pem 2048 openssl dhparam -out /etc/postfix/dh1024.pem 1024 # As of Postfix 3.6, export-grade 512-bit DH parameters are no longer # supported or needed. openssl dhparam -out /etc/postfix/dh512.pem 512 DH Postfix . . (forward secrecy) Getting started FORWARD_SECRECY_README . Postfix ("perfect" forward secrecy) : Postfix . : smtpd_tls_dh1024_param_file = /etc/postfix/dh2048.pem Postfix 2.2 . smtpd_tls_dh512_param_file (default: empty) DH SMTP Postfix EDH . SMTP Postfix "medium" . Postfix >= 3.6 - . smtpd_tls_dh1024_param_file . : smtpd_tls_dh512_param_file = /etc/postfix/dh_512.pem Postfix 2.2 Postfix 3.6 . smtpd_tls_dkey_file (default: $smtpd_tls_dcert_file) DSA SMTP Postfix PEM. DSA SMTP Postfix $smtpd_tls_dcert_file . DSA . (pass-phrase) . ("root") . Postfix 2.2 . smtpd_tls_eccert_file (default: empty) ECDSA SMTP Postfix PEM. ECDSA SMTP Postfix . Postfix >= 3.4 "smtpd_tls_chain_files" . smtpd_tls_cert_file . : smtpd_tls_eccert_file = /etc/postfix/ecdsa-scert.pem Postfix 2.6 Postfix OpenSSL 1.0.0 . smtpd_tls_eckey_file (default: $smtpd_tls_eccert_file) ECDSA SMTP Postfix PEM. ECDSA SMTP Postfix $smtpd_tls_eccert_file . Postfix >= 3.4 "smtpd_tls_chain_files" . (pass-phrase) . ("root") . Postfix 2.6 Postfix OpenSSL 1.0.0 . smtpd_tls_eecdh_grade (default: see postconf -d output) SMTP Postfix - (EECDH). Postfix 3.6 Postfix auto ( ) . Postfix 3.6 . . : auto . Postfix >= 3.2 OpenSSL >= 1.0.2 . ( Postfix >= 3.6 ). none EECDH. EECDH . Postfix 2.6 2.7 . strong EECDH . . . Postfix . ultra EECDH ECC . (forward secrecy) Getting started FORWARD_SECRECY_README . Postfix <<>> ("perfect" forward secrecy) : Postfix . Postfix . OpenSSL .. EC . smtpd_tls_enable_rpk (default: no) SMTP X.509 RFC7250 . TLS . SMTP Postfix "smtpd_tls_enable_rpk = yes" SMTP check_ccert_access check_ccert_access . SMTP TLS . SMTP Postfix SMTP TLS . TLS SNI tls_server_sni_maps . (digest) SHA256 : # SHA256 digest of the first certificate in "cert.pem" $ openssl x509 -in cert.pem -outform DER | openssl dgst -sha256 -c # SHA256 digest of the SPKI of the first certificate in "cert.pem" $ openssl x509 -in cert.pem -pubkey -noout | openssl pkey -pubin -outform DER | openssl dgst -sha256 -c # SHA256 digest of the SPKI of the first private key in "pkey.pem" $ openssl pkey -in pkey.pem -pubout -outform DER | openssl dgst -sha256 -c Postfix . . smtpd_tls_exclude_ciphers (default: empty) SMTP TLS. . . cipherlist OpenSSL / . <<+>> all () . ( ): smtpd_tls_exclude_ciphers = aNULL smtpd_tls_exclude_ciphers = MD5, DES smtpd_tls_exclude_ciphers = DES+MD5 smtpd_tls_exclude_ciphers = AES256-SHA, DES-CBC3-MD5 smtpd_tls_exclude_ciphers = kEDH+aRSA (anonymous) . MD5 () DES . MD5 DES . "AES256-SHA" "DES-CBC3-MD5" . "EDH" RSA . Postfix . . smtpd_tls_fingerprint_digest (default: see postconf -d output) (message digest) SMTP (Postfix . ) check_ccert_access permit_tls_clientcerts. Postfix >= 3.6 compatibility_level . sha256 . Postfix <= 3.5 md5 . sha256 . md5 sha1 sha256 . << >> (second pre-image) . libcrypto OpenSSL libssl SSL Postfix . md5 sha1 sha256 sha512 . : $ openssl x509 -noout -fingerprint -digest -in certfile.pem <<=>> . : $ openssl x509 -noout -fingerprint -sha256 -in cert.pem SHA256 Fingerprint=D4:6A:AB:19:24:...:A6:CB:66:82:C0:8E:9B:EE:29:A8:1A X.509 DER (ASN.1) . OpenSSL <<-pubkey>> <> <> . (pipe) OpenSSL DER <> . : $ openssl x509 -in cert.pem -noout -pubkey | openssl pkey -pubin -outform DER | openssl dgst -sha256 -c (stdin)= 64:3f:1f:f6:e5:1e:d4:2a:56:8b:fc:09:1a:61:98:b5:bc:7c:60:58 SMTP Postfix loglevel TLS ( / leaf) . : sha256: /etc/postfix/main.cf: smtpd_tls_fingerprint_digest = sha256 smtpd_client_restrictions = check_ccert_access lmdb:/etc/postfix/access, reject /etc/postfix/access: # Action folded to next line... AF:88:7C:AD:51:95:6F:36:96:...:01:FB:2E:48:CD:AB:49:25:A2:3B OK 85:16:78:FD:73:6E:CE:70:E0:...:5F:0D:3C:C8:6D:C4:2C:24:59:E1 permit_auth_destination lmdb: cdb: hash: dbm: . access "postmap /etc/postfix/access" () . "postmap type:/etc/postfix/access" . default_database_type . "postconf -m" . . "postfix reload" . Postfix . . smtpd_tls_key_file (default: $smtpd_tls_cert_file) RSA SMTP Postfix PEM. RSA SMTP Postfix $smtpd_tls_cert_file . Postfix >= 3.4 "smtpd_tls_chain_files" . (passphrase) . (read-only) ("root") . smtpd_tls_loglevel (default: 0) TLS SMTP Postfix. . 0 TLS. 1 TLS - . Postfix . . 2 (verbose) TLS Postfix (session cache) SSL OpenSSL. 3 ASCII TLS. 4 ASCII STARTTLS. "smtpd_tls_loglevel = 2" . loglevel 4 . Postfix . . smtpd_tls_mandatory_ciphers (default: medium) TLS SMTP Postfix TLS . ("medium") TLS ( "high") "high" . "high" . "export" "low" . SMTP "medium" "high" . : high OpenSSL "HIGH" . tls_high_cipherlist . medium OpenSSL "MEDIUM" . . TLS . tls_medium_cipherlist . null OpenSSL "NULL" . NULL ( TLS ). tls_null_cipherlist . low OpenSSL "LOW" . Postfix >= 3.8 "medium" . OpenSSL "LOW" . Postfix tls_low_cipherlist . . export OpenSSL "EXPORT" . Postfix >= 3.8 "medium" . OpenSSL "EXPORT" . Postfix tls_export_cipherlist . . smtpd_tls_mandatory_exclude_ciphers smtpd_tls_exclude_ciphers . TLS (opportunistic) smtpd_tls_ciphers . "null" (anonymous) SMTP . . Postfix "smtpd_tls_exclude_ciphers = aNULL" . TLS "smtpd_tls_mandatory_exclude_ciphers = aNULL" . Postfix . . smtpd_tls_mandatory_exclude_ciphers (default: empty) SMTP Postfix TLS. smtpd_tls_exclude_ciphers ( ). Postfix . . smtpd_tls_mandatory_protocols (default: see postconf -d output) TLS SMTP Postfix TLS. TLS . . (: SSL_get_version(3)) "SSLv2" "SSLv3" "TLSv1" "TLSv1.1" "TLSv1.2" "TLSv1.3". Postfix . ">=TLSv1" TLS 1.0 TLS ( ). "!" . Postfix . TLS / TLS . ">=version" version TLS TLS ( 0301 TLS 1.0 0302 TLS 1.1 ). "<=version" . ">=" "<=" . TLS OpenSSL Postfix . . "0" "0x" . "301" "0301" "0x301" "0x0301" "TLSv1" . OpenSSL . Postfix OpenSSL TLS 1.4 Postfix . (Postfix >= 3.6): # Allow only TLS 1.2 through (hypothetical) TLS 1.4, once supported # in some future version of OpenSSL (presently a warning is logged). smtpd_tls_mandatory_protocols = >=TLSv1.2, <=0305 # Allow only TLS 1.2 and up: smtpd_tls_mandatory_protocols = >=0x0303 Postfix < 3.6 . TLS 1.0 "smtpd_tls_mandatory_protocols = !SSLv2, !SSLv3" . . OpenSSL . "TLSv1.3" OpenSSL 1.1.1 . "!TLSv1.3" Postfix . ( >= 3.0.14 3.1.10 3.2.7 3.3.2) . : # Preferred syntax with Postfix >= 3.6: smtpd_tls_mandatory_protocols = >=TLSv1.2, <=TLSv1.3 # Legacy syntax: smtpd_tls_mandatory_protocols = !SSLv2, !SSLv3, !TLSv1, !TLSv1.1 Postfix . . smtpd_tls_protocols (default: see 'postconf -d' output) TLS SMTP Postfix TLS. TLS . . (: SSL_get_version(3)) "SSLv2" "SSLv3" "TLSv1" "TLSv1.1" "TLSv1.2" "TLSv1.3". Postfix 3.6 ">=TLSv1" TLS 1.0 TLS ( ). "!" . Postfix 3.6 TLS / TLS . ">=version" version TLS TLS (0301 TLS 1.0 0302 TLS 1.1 ). "<=version" . ">=" "<=" . TLS OpenSSL Postfix . . "0" "0x" . "301" "0301" "0x301" "0x0301" "TLSv1" . OpenSSL . Postfix OpenSSL TLS 1.4 Postfix . (Postfix >= 3.6): # Allow only TLS 1.0 through (hypothetical) TLS 1.4, once supported # in some future version of OpenSSL (presently a warning is logged). smtpd_tls_protocols = >=TLSv1, <=0305 # Allow only TLS 1.0 and up: smtpd_tls_protocols = >=0x0301 Postfix < 3.6 . TLS 1.0 "smtpd_tls_protocols = !SSLv2, !SSLv3" . . OpenSSL . "TLSv1.3" OpenSSL 1.1.1 . "!TLSv1.3" Postfix 3.4 ( >= 3.0.14 3.1.10 3.2.7 3.3.2) . : # Preferred syntax with Postfix >= 3.6: smtpd_tls_protocols = >=TLSv1, <=TLSv1.3 # Legacy syntax: smtpd_tls_protocols = !SSLv2, !SSLv3 Postfix 2.6 . smtpd_tls_received_header (default: no) SMTP Postfix Received: (cipher) CommonName SMTP CommonName . . . Postfix 2.2 . smtpd_tls_req_ccert (default: no) TLS TLS SMTP . "smtpd_tls_ask_ccert = yes" . TLS . Postfix 2.2 . smtpd_tls_security_level (default: empty) SMTP TLS SMTP Postfix smtpd_use_tls smtpd_enforce_tls . "smtpd_tls_wrappermode = yes" . : none TLS . may TLS (Opportunistic TLS): STARTTLS SMTP TLS . encrypt TLS: STARTTLS SMTP HELO EHLO XCLIENT STARTTLS NOOP QUIT (Postfix >= 3.9) HELP . RFC 2487 SMTP . submission ( 587) . : "fingerprint" "verify" "secure" . SMTP Postfix "encrypt" . SMTP smtpd_tls_ask_ccert smtpd_tls_req_ccert permit_tls_clientcerts TLS_README . : "smtpd_tls_security_level = encrypt" "smtpd_tls_auth_only = yes" . : "sendmail -bs" Postfix STARTTLS . . Postfix 2.3 . smtpd_tls_session_cache_database (default: empty) (cache) TLS SMTP Postfix. btree sdbm . . smtpd(8) tlsmgr(8) . master.cf smtpd . tlsmgr(8): $smtpd_tls_session_cache_database $smtp_tls_session_cache_database ( Postfix 2.3 $lmtp_tls_session_cache_database) . . : dbm TLS . 2.5 Postfix (root) . data_directory Postfix . Postfix data_directory Postfix . Postfix 2.11 TLS RFC 5077 . Postfix >= 2.11 . TLS OpenSSL ( 0.9.8h) TLS . : smtpd_tls_session_cache_timeout. : smtpd_tls_session_cache_database = lmdb:/var/lib/postfix/smtpd_scache smtpd_tls_session_cache_database = btree:/var/lib/postfix/smtpd_scache Postfix 2.2 . smtpd_tls_session_cache_timeout (default: 3600s) TLS SMTP Postfix. $smtpd_tls_session_cache_timeout . $smtpd_tls_session_cache_database tlsmgr(8) master.cf smtpd . Postfix 2.11 . TLS RFC 5077 ( ) . . TLS OpenSSL ( 0.9.8h) TLS . ( ). : s () m () h () d () w (). s () . Postfix 2.2 Postfix 2.11 TLS . smtpd_tls_wrappermode (default: no) SMTP Postfix "wrapper" TLS STARTTLS. master.cf "-o smtpd_tls_wrappermode=yes" SMTP . 465 (submissions smtps ) . Postfix 2.2 . smtpd_upstream_proxy_protocol (default: empty) smtpd (before-smtpd). . haproxy "smtpd_upstream_proxy_protocol = haproxy" 2 Postfix 3.5 . : nginx smtpd(8) XCLIENT smtpd_authorized_xclient_hosts . SASL (Postfix 2.9 ). Postfix 2.10 . smtpd_upstream_proxy_timeout (default: 5s) smtpd_upstream_proxy_protocol. ( ). : s () m () h () d () w (). s () . Postfix 2.10 . smtpd_use_tls (default: no) TLS: STARTTLS SMTP TLS . : "sendmail -bs" Postfix STARTTLS . . Postfix 3.9 . smtpd_tls_security_level . Postfix 2.2 . Postfix 2.3 smtpd_tls_security_level . smtputf8_autodetect_classes (default: sendmail, verify) SMTPUTF8 . << >> SMTPUTF8 UTF8 . Postfix MTA SMTPUTF8 . Postfix SMTPUTF8 UTF8 ( Received: Postfix @$myorigin .$mydomain (alias) (BCC) Milter). "SMTPUTF8 required" sendmail Postfix . SMTPUTF8 . UTF8 ( ) SMTPUTF8 . : sendmail sendmail(1) Postfix. smtpd smtpd(8). qmqpd qmqpd(8). forward . "SMTPUTF8 required" ( ) "SMTPUTF8 required" . bounce bounce(8). "SMTPUTF8 required" "SMTPUTF8 required" . notify (postmaster) smtp(8) smtpd(8). verify verify(8). all SMTPUTF8 . Postfix 3.0 . smtputf8_enable (default: yes) SMTPUTF8 RFC 6531 RFC 6532 RFC 6533 . Postfix . Postfix 3.0 . socketmap_max_reply_size (default: 100000) socketmap netstring. Postfix >= 3.10 . soft_bounce (default: no) (bounce) . 5xx 4xx SMTP Postfix . soft_bounce . : "soft_bounce = yes" . Postfix . : soft_bounce = yes stale_lock_time (default: 500s) . . ( ). : s () m () h () d () w (). s () . stress (default: empty) STRESS_README . Postfix 2.5 . strict_7bit_headers (default: no) 8-bit . . . Postfix 2.0 . strict_8bitmime (default: no) strict_7bit_headers strict_8bitmime_body. . Postfix 2.0 . strict_8bitmime_body (default: no) 8- 8- MIME. . majordomo 8- MIME (bounce) 8- MIME ( qmail Postfix) . . Postfix 2.0 . strict_mailbox_ownership (default: yes) . . Postfix 2.5.3 . strict_mime_encoding_domain (default: no) Content-Transfer-Encoding: MIME message/* multipart/*. . . Postfix 2.0 . strict_rfc821_envelopes (default: no) SMTP MAIL FROM RCPT TO <> RFC 822 . . SMTP Postfix RFC 822 MAIL FROM RCPT TO . strict_smtputf8 (default: no) SMTPUTF8. SMTP Postfix UTF8 SMTPUTF8 . Postfix 3.0 . sun_mailtool_compatibility (default: no) SUN mailtool. "mailbox_delivery_lock = dotlock" . swap_bangpath (default: yes) "site!user" "user@site". UUCP . . : Postfix 2.2 : o sendmail(1) Postfix o $local_header_rewrite_clients o remote_header_rewrite_domain . Postfix 2.2 "local_header_rewrite_clients = static:all" . : swap_bangpath = no syslog_facility (default: mail) (facility) Postfix syslog. syslog.conf(5) . "mail" . : syslog_facility Postfix . main.cf Postfix. syslog_name (default: see postconf -d output) syslog "smtpd" "prefix/smtpd" . : syslog_name Postfix . main.cf Postfix. tcp_windowsize (default: 0) TCP (TCP window scaling) . > 0 < 65536 . TCP Postfix (smtpd(8), qmqpd(8)) master(8) . Postfix TCP Postfix : # postconf -e master_service_disable=inet # postfix reload . TCP Postfix tcp_windowsize : # postconf -e tcp_windowsize=65535 master_service_disable= # postfix reload Postfix tcp_windowsize TCP Postfix (smtp(8) lmtp(8)) . Postfix 2.6 . tls_append_default_CA (default: no) (CA) *_tls_CApath *_tls_CAfile. "no" Postfix permit_tls_all_clientcerts . Postfix 2.4.15 2.5.11 2.6.8 2.7.2 . permit_tls_all_clientcerts "tls_append_default_CA = yes" . tls_config_file (default: default) OpenSSL. OpenSSL SSL ( tls_config_name) "openssl_conf" . 1.1.1 1.1.1a OpenSSL ( Postfix) . OpenSSL 1.1.1b : default () "openssl.cnf". none ( OpenSSL 1.1.1b ) "openssl.cnf" . /absolute-path ( OpenSSL 1.1.1b ) /absolute-path. tls_config_name . "openssl_conf" . . Postfix TLS . OpenSSL . : . # The name 'openssl_conf' is the default application name # The section name to the right of the '=' sign is arbitrary, # any name will do, so long as it refers to the desired section. # # The name 'system_default' selects the settings applied internally # by the SSL library as part of SSL object creation. Applications # can then apply any additional settings of their choice. # # In this example, TLS versions prior to 1.2 are disabled by default. # openssl_conf = system_wide_settings [system_wide_settings] ssl_conf = ssl_library_settings [ssl_library_settings] system_default = initial_ssl_settings [initial_ssl_settings] MinProtocol = TLSv1.2 : "postfix". # The mapping from an application name to the corresponding configuration # section must appear near the top of the file, (in what is sometimes called # the "default section") prior to the start of any explicitly named # "[sections]". The named sections can appear in any order and don't nest. # postfix = postfix_settings [postfix_settings] ssl_conf = postfix_ssl_settings [postfix_ssl_settings] system_default = baseline_postfix_settings [baseline_postfix_settings] MinProtocol = TLSv1 : OpenSSL. main.cf: tls_config_file = ${config_directory}/openssl.cnf tls_config_name = postfix # Clear Postfix curve/group settings to let custom OpenSSL # configuration settings take effect. For most users, the # default Postfix settings are strongly recommended. tls_eecdh_auto_curves = tls_ffdhe_auto_groups = openssl.cnf: postfix = postfix_settings [postfix_settings] ssl_conf = postfix_ssl_settings [postfix_ssl_settings] system_default = baseline_postfix_settings [baseline_postfix_settings] # New OpenSSL 3.5 syntax, for older releases consider # the Postfix default: # # Groups = X25519:X448:prime256v1:secp384r1:secp521r1:ffdhe2048:ffdhe3072 # Groups = ?X25519MLKEM768 / ?*X25519:?secp256r1 / ?X448:?secp384r1:?secp521r1 / ?ffdhe2048:?ffdhe3072 : OpenSSL "tls_config_file = none" . TLS TLS (opportunistic) Postfix SMTP . Postfix >= 3.9 3.8.1 3.7.6 3.6.10 3.5.20 . tls_config_name (default: empty) Postfix OpenSSL . <<>> (section) OpenSSL tls_config_file . ("openssl_conf") . Postfix >= 3.9 . tls_daemon_random_bytes (default: 32) smtp(8) smtpd(8) tlsmgr(8) (seed) (PRNG) . ( ) ( ) . Postfix 2.2 . tls_dane_digest_agility (default: on) RFC7671 DANE TLSA. . 8 RFC7671 . Postfix 2.11 3.1 . Postfix 3.2 "on" . tls_dane_digests (default: sha512 sha256) << >> (matching type) DANE TLSA ( RFC 6698 RFC 7671 RFC 7672) . OpenSSL SMTP Postfix DANE TLSA . / . "=" . "sha512" "sha512=2" "sha256" "sha256=1" . TLSA IANA : . Postfix . IANA OpenSSL . DANE . TLSA RR . : sha256 . RFC 6698 TLSA sha256 . TLSA . Postfix 2.11 . tls_dane_trust_anchor_digest_enable (default: yes) DNS RFC 6698 (DANE TLSA) (trust-anchor) "2". . Postfix 2.11 3.1 . Postfix 3.2 TLSA . Postfix 3.2 "yes" . tls_disable_workarounds (default: see postconf -d output) (bit-mask) OpenSSL . OpenSSL SSL/TLS . Postfix OpenSSL . . OpenSSL OpenSSL . . "0x" SSL_OP_ALL (openssl/ssl.h SSL_CTX_set_options(3) ). SSL_OP_ALL . 0xFFFFFFFF . OpenSSL . . OpenSSL Postfix . CRYPTOPRO_TLSEXT_BUG GOST OpenSSL 1.0.0. DONT_INSERT_EMPTY_FRAGMENTS : SSL_CTX_set_options(3) LEGACY_SERVER_CONNECT : SSL_CTX_set_options(3) MICROSOFT_BIG_SSLV3_BUFFER : SSL_CTX_set_options(3) MICROSOFT_SESS_ID_BUG : SSL_CTX_set_options(3) MSIE_SSLV2_RSA_PADDING CVE-2005-2969 . Postfix 2.8 OpenSSL . OpenSSL 0.9.7h OpenSSL 0.9.8a . NETSCAPE_CHALLENGE_BUG : SSL_CTX_set_options(3) NETSCAPE_REUSE_CIPHER_CHANGE_BUG CVE-2010-4180 . Postfix 2.8 OpenSSL . OpenSSL 0.9.8q OpenSSL 1.0.0c . SSLEAY_080_CLIENT_DH_BUG : SSL_CTX_set_options(3) SSLREF2_REUSE_CERT_TYPE_BUG : SSL_CTX_set_options(3) TLS_BLOCK_PADDING_BUG : SSL_CTX_set_options(3) TLS_D5_BUG : SSL_CTX_set_options(3) TLS_ROLLBACK_BUG : SSL_CTX_set_options(3). OpenSSL 0.9.7 . 0.9.6 ! TLSEXT_PADDING Postfix >= 3.4. : SSL_CTX_set_options(3). Postfix 2.8 . tls_eecdh_auto_curves (default: see postconf -d output) SMTP Postfix . OpenSSL << >> TLS (RFC8422 RFC8446 RFC8447). <> <> ( OpenSSL <> <>) . . << >> (keyshare) TLS 1.3 . TLS HelloRetryRequest (HRR) . Postfix OpenSSL . <<>> <<>> . Postfix 3.10 OpenSSL 3.0 <<>> (KEM) / <<>> (provider) ( tls_config_file ) . <> FFDHE TLS 1.3 . Postfix 3.8 OpenSSL 3.0 . : OpenSSL 3.5 Postfix . OpenSSL 3.5 Postfix OpenSSL X25519MLKEM768 . SMTP Client Hello TLS . Postfix 3.6.17 3.7.13 3.8.8 3.9.2 tls_eecdh_auto_curves tls_ffdhe_auto_groups OpenSSL . tls_config_file . Postfix 3.2 OpenSSL 1.0.2 EC . tls_eecdh_strong_curve (default: prime256v1) SMTP Postfix ECDH . SMTP Postfix "smtpd_tls_eecdh_grade = strong" . << >> . OpenSSL ( ecparam(1) <<-list_curves>> ) 5.1.1 RFC 8422 . . SMTP EECDH . <<>> . Postfix 3.6 . . <> NSA Suite B SECRET . : . X9.62 <> SECG <> OpenSSL . (forward secrecy) Getting started FORWARD_SECRECY_README . Postfix <<>> : Postfix . Postfix 2.6 OpenSSL 1.0.0 EC . tls_eecdh_ultra_curve (default: secp384r1) SMTP Postfix ECDH . SMTP Postfix "smtpd_tls_eecdh_grade = ultra" . << >> . "smtpd_tls_eecdh_grade = strong" . OpenSSL ( ecparam(1) <<-list_curves>> ) 5.1.1 RFC 8422 . . SMTP EECDH . <<>> . Postfix 3.6 . . <> NSA Suite B TOP SECRET . Getting started FORWARD_SECRECY_README . Postfix <<>> : Postfix . Postfix 2.6 OpenSSL 1.0.0 EC . tls_export_cipherlist (default: see postconf -d output) (cipherlist) OpenSSL <> . Postfix 3.8 . Postfix <> smtpd_tls_ciphers smtpd_tls_mandatory_ciphers smtp_tls_ciphers smtp_tls_mandatory_ciphers lmtp_tls_ciphers lmtp_tls_mandatory_ciphers . . Postfix 2.3 . tls_fast_shutdown_enable (default: yes) TLS Postfix (timeout) . Postfix TLS <> TLS . TLSv1.0 . tls_ffdhe_auto_groups (default: see postconf -d output) - (FFDHE) SMTP Postfix. OpenSSL 3.0 FFDHE TLS 1.3 . OpenSSL 1.1.1 TLS 1.3 . <> FFDHE Postfix OpenSSL 3.0 . Postfix OpenSSL . FFDHE Postfix OpenSSL 3.0 . FFDHE EC . Postfix OpenSSL . FFDHE EC EC . FFDHE TLS 1.3 FFDHE <> <> OpenSSL 3.5 . <<->> . FFDHE TLS 1.2 <> (cipherlist) . <> EC TLS 1.3 OpenSSL 3.0 . Postfix <> OpenSSL . <> <> . ECDHE DHE <> . Postfix 3.8 OpenSSL 3.0 . tls_high_cipherlist (default: see postconf -d output) (cipherlist) OpenSSL <>. <> smtpd_tls_ciphers smtpd_tls_mandatory_ciphers smtp_tls_ciphers smtp_tls_mandatory_ciphers lmtp_tls_ciphers lmtp_tls_mandatory_ciphers . . Postfix 2.3 . tls_legacy_public_key_fingerprints (default: no) Postfix 2.9.0..2.9.5 . Postfix 2.2 . Postfix 2.9.0..2.9.5 Postfix 2.9.6 "tls_legacy_public_key_fingerprints = yes" . TLS_README . Postfix 2.9.6 3.10 . Postfix 3.9.0 Postfix 3.11.0 . tls_low_cipherlist (default: see postconf -d output) (cipherlist) OpenSSL <> . Postfix 3.8 . Postfix <> smtpd_tls_ciphers smtpd_tls_mandatory_ciphers smtp_tls_ciphers smtp_tls_mandatory_ciphers lmtp_tls_ciphers lmtp_tls_mandatory_ciphers . . Postfix 2.3 . tls_medium_cipherlist (default: see postconf -d output) (cipherlist) OpenSSL <> . <> smtpd_tls_ciphers smtpd_tls_mandatory_ciphers smtp_tls_ciphers smtp_tls_mandatory_ciphers lmtp_tls_ciphers lmtp_tls_mandatory_ciphers . TLS TLS ( ). TLS (opportunistic TLS) Postfix . . Postfix 2.3 . tls_null_cipherlist (default: eNULL:!aNULL) (cipherlist) OpenSSL <> . <> smtpd_tls_mandatory_ciphers smtp_tls_mandatory_ciphers lmtp_tls_mandatory_ciphers . . Postfix 2.3 . tls_preempt_cipherlist (default: no) SSLv3 SMTP Postfix . OpenSSL . SSLv3 () . "tls_preempt_cipherlist = yes" . . SSL . . Microsoft Exchange Windows 2003 DES-CBC3-SHA OpenSSL RC4-SHA . Microsoft Exchange Windows 2003 . Postfix 2.8 OpenSSL 0.9.7 . tls_random_bytes (default: 32) tlsmgr(8) () (PRNG) $tls_random_source . ( ) . EGD . Postfix 2.2 . tls_random_exchange_name (default: see postconf -d output) (PRNG) tlsmgr(8) . . 2.5 Postfix (root) ${config_directory}/prng_exch ${data_directory}/prng_exch . Postfix data_directory Postfix . Postfix 2.2 . tls_random_prng_update_period (default: 3600s) tlsmgr(8) (PRNG) $tls_random_exchange_name. ( ) . : s () m () h () d () w (). s () . Postfix 2.2 . tls_random_reseed_period (default: 3600s) tlsmgr(8) (PRNG) . PRNG . ( ) . : s () m () h () d () w (). s () . Postfix 2.2 . tls_random_source (default: see postconf -d output) (PRNG) tlsmgr(8). (non-blocking) . : egd:/path/to/egd_socket EGD dev:/path/to/device . : OpenBSD dev:/dev/urandom (timeout) dev:/dev/arandom . Postfix 2.2 . tls_required_enable (default: yes) <> RFC 8689. TLS . TLS TLS SMTP Postfix <> SMTP TLS (plaintext) . <> Postfix . : ESMTP REQUIRETLS <> . Postfix 3.10 . tls_server_sni_maps (default: empty) SMTP TLS Server Name Indication (SNI) . TLS Postfix smtpd(8) SMTP tlsproxy(8) . SMTP Postfix SNI SNI (log) . SNI . SNI . A-label IDNA 2008 ( TLS SNI ). smtp_tls_chain_files ( ) TLS SNI . : /etc/postfix/main.cf: # # The indexed SNI table must be created with "postmap -F" # indexed = ${default_database_type}:${config_directory}/ tls_server_sni_maps = ${indexed}sni /etc/postfix/sni: # # The example.com domain has both an RSA and ECDSA certificate # chain. The chain files MUST start with the private key, # with the certificate chain next, starting with the leaf # (server) certificate, and then the issuer certificates. # example.com /etc/postfix/sni-chains/rsa2048.example.com.pem, /etc/postfix/sni-chains/ecdsa-p256.example.com.pem # # The example.net domain has a wildcard certificate, and two # additional DNS names. So its certificate chain is also used # with any subdomain, plus the additional names. # example.net /etc/postfix/sni-chains/example.net.pem .example.net /etc/postfix/sni-chains/example.net.pem example.info /etc/postfix/sni-chains/example.net.pem example.org /etc/postfix/sni-chains/example.net.pem SNI () SMTP Postfix . TLS SNI SMTP SMTP Postfix SMTP Postfix SNI . SMTP Postfix SNI SNI . SNI . <> <> <> postmap(1) . postmap(1) -F base64 . postmap -Fq base64 . <> <> <> <> <> . Postfix LDAP MySQL PostgreSQL socketmap tcp PEM base64 . ( ) Postfix . <> <> SNI . LDAP SQL TLS . <<>> (leaf) CA . ( RSA ECDSA RSA ECDSA Ed25519) . Postfix 3.4 . tls_session_ticket_cipher (default: Postfix >= 3.0: aes-256-cbc, Postfix < 3.0: aes-128-cbc) TLS RFC5077. CBC . aes-256-cbc . . SMTP Postfix . tls_ssl_options . Postfix 3.0 . tls_ssl_options (default: empty) OpenSSL . OpenSSL OpenSSL . () . tls_disable_workarounds SSL OpenSSL . . ( ) tls_ssl_options . . . ssl.h SSL_OP_ . OpenSSL Postfix . ( ). Postfix . . Postfix OpenSSL . <<0x>> ( openssl/ssl.h SSL_CTX_set_options(3) ). Postfix . . 0xFFFFFFFF . . : ENABLE_MIDDLEBOX_COMPAT Postfix >= 3.4. SSL_CTX_set_options(3) . LEGACY_SERVER_CONNECT SSL_CTX_set_options(3) . NO_TICKET Postfix >= 2.7 . Postfix >= 2.11 TLS (TLS session resumption) . . SSL_CTX_set_options(3) . NO_COMPRESSION SSL OpenSSL . . NO_RENEGOTIATION Postfix >= 3.4. (CPU exhaustion) . SSL_CTX_set_options(3) . NO_SESSION_RESUMPTION_ON_RENEGOTIATION Postfix >= 3.4. SSL_CTX_set_options(3) . PRIORITIZE_CHACHA Postfix >= 3.4. SSL_CTX_set_options(3) . Postfix 2.11 . tls_wildcard_matches_multiple_labels (default: yes) DNS <<*>> (wildcard). TLS . MX example.com example.net : example.com. IN MX 0 example.com.mx1.example.net. example.com. IN MX 0 example.com.mx2.example.net. TLS <<*.example.net>> . <<*>> . . : o <<*>> . o Postfix ( 2.11 ) <<*>> . o Postfix <> . Postfix 2.11 . tlsmgr_service_name (default: tlsmgr) tlsmgr(8) master.cf. TLS TLS . Postfix 2.11 . tlsproxy_client_CAfile (default: $smtp_tls_CAfile) CA CA TLS CA . smtp_tls_CAfile . Postfix 3.4 . tlsproxy_client_CApath (default: $smtp_tls_CApath) (CA) PEM tlsproxy(8) Postfix TLS . smtp_tls_CApath . Postfix 3.4 . tlsproxy_client_cert_file (default: $smtp_tls_cert_file) RSA tlsproxy(8) Postfix PEM. smtp_tls_cert_file . tlsproxy <> . Postfix 3.4 . tlsproxy_client_chain_files (default: $smtp_tls_chain_files) tlsproxy(8) Postfix PEM. smtp_tls_chain_files . Postfix 3.4 . tlsproxy_client_dcert_file (default: $smtp_tls_dcert_file) DSA tlsproxy(8) Postfix PEM. smtp_tls_dcert_file . DSA . Postfix 3.4 . tlsproxy_client_dkey_file (default: $smtp_tls_dkey_file) DSA tlsproxy(8) Postfix PEM. smtp_tls_dkey_file . DSA . Postfix 3.4 . tlsproxy_client_eccert_file (default: $smtp_tls_eccert_file) ECDSA tlsproxy(8) Postfix PEM. smtp_tls_eccert_file . tlsproxy <> . Postfix 3.4 . tlsproxy_client_eckey_file (default: $smtp_tls_eckey_file) ECDSA tlsproxy(8) Postfix PEM. smtp_tls_eckey_file . tlsproxy <> . Postfix 3.4 . tlsproxy_client_enforce_tls (default: $smtp_enforce_tls) : SMTP TLS. smtp_enforce_tls . tlsproxy_client_security_level . Postfix 3.9 . tlsproxy_client_security_level . Postfix 3.4 . tlsproxy_client_fingerprint_digest (default: $smtp_tls_fingerprint_digest) TLS . smtp_tls_fingerprint_digest . Postfix 3.4 . tlsproxy_client_key_file (default: $smtp_tls_key_file) RSA tlsproxy(8) Postfix PEM. smtp_tls_key_file . tlsproxy <> . Postfix 3.4 . tlsproxy_client_level (default: $smtp_tls_security_level) TLS tlsproxy(8) Postfix. smtp_tls_security_level . Postfix 3.4 3.6 . Postfix 3.7 tlsproxy_client_security_level . tlsproxy_client_loglevel (default: $smtp_tls_loglevel) TLS tlsproxy(8) Postfix. smtp_tls_loglevel . Postfix 3.4 . tlsproxy_client_loglevel_parameter (default: smtp_tls_loglevel) tlsproxy_client_loglevel . Postfix 3.4 . tlsproxy_client_per_site (default: $smtp_tls_per_site) TLS tlsproxy(8) Postfix TLS . smtp_tls_per_site . Postfix 3.9 . tlsproxy_client_policy_maps . Postfix 3.4 . tlsproxy_client_policy (default: $smtp_tls_policy_maps) TLS tlsproxy(8) (next-hop). smtp_tls_policy_maps . Postfix 3.4 3.6 . Postfix 3.7 tlsproxy_client_policy_maps . tlsproxy_client_policy_maps (default: $smtp_tls_policy_maps) TLS tlsproxy(8) (next-hop). smtp_tls_policy_maps . Postfix 3.7 . tlsproxy_client_policy . tlsproxy_client_scert_verifydepth (default: $smtp_tls_scert_verifydepth) TLS . smtp_tls_scert_verifydepth . Postfix 3.4 . tlsproxy_client_security_level (default: $smtp_tls_security_level) TLS tlsproxy(8) . smtp_tls_security_level . Postfix 3.7 . tlsproxy_client_level . tlsproxy_client_use_tls (default: $smtp_use_tls) : TLS TLS . smtp_use_tls . tlsproxy_client_security_level . Postfix 3.9 . tlsproxy_client_security_level . Postfix 3.4 . tlsproxy_enforce_tls (default: $smtpd_enforce_tls) TLS : STARTTLS SMTP TLS. smtpd_enforce_tls . tlsproxy_tls_security_level . Postfix 3.9 . tlsproxy_tls_security_level . Postfix 2.8 . tlsproxy_service_name (default: tlsproxy) tlsproxy(8) master.cf. <=> TLS . Postfix 2.8 . tlsproxy_tls_CAfile (default: $smtpd_tls_CAfile) CA ( PEM) SMTP CA . smtpd_tls_CAfile . Postfix 2.8 . tlsproxy_tls_CApath (default: $smtpd_tls_CApath) CA ( PEM) SMTP CA . smtpd_tls_CApath . Postfix 2.8 . tlsproxy_tls_always_issue_session_ids (default: $smtpd_tls_always_issue_session_ids) tlsproxy(8) TLS TLS . smtpd_tls_always_issue_session_ids . Postfix 2.8 . tlsproxy_tls_ask_ccert (default: $smtpd_tls_ask_ccert) SMTP . smtpd_tls_ask_ccert . Postfix 2.8 . tlsproxy_tls_ccert_verifydepth (default: $smtpd_tls_ccert_verifydepth) SMTP . CA CA 1 . smtpd_tls_ccert_verifydepth . Postfix 2.8 . tlsproxy_tls_cert_file (default: $smtpd_tls_cert_file) RSA tlsproxy(8) PEM. RSA tlsproxy(8) . smtpd_tls_cert_file . Postfix 3.4 tlsproxy "tlsproxy_tls_chain_files" . Postfix 2.8 . tlsproxy_tls_chain_files (default: $smtpd_tls_chain_files) tlsproxy(8) PEM. smtpd_tls_chain_files . Postfix 3.4 . tlsproxy_tls_ciphers (default: $smtpd_tls_ciphers) TLS tlsproxy(8) TLS . smtpd_tls_ciphers . Postfix 2.8 . tlsproxy_tls_dcert_file (default: $smtpd_tls_dcert_file) DSA tlsproxy(8) PEM. DSA tlsproxy(8) . DSA . smtpd_tls_dcert_file . Postfix 2.8 . tlsproxy_tls_dh1024_param_file (default: $smtpd_tls_dh1024_param_file) DH tlsproxy(8) EDH . smtpd_tls_dh1024_param_file . Postfix 3.9 . . Postfix 2.8 . tlsproxy_tls_dh512_param_file (default: $smtpd_tls_dh512_param_file) DH tlsproxy(8) EDH . smtpd_tls_dh512_param_file . SMTP Postfix 2015 "medium" . Postfix >= 3.6 Diffie-Hellman . Postfix 2.8 . tlsproxy_tls_dkey_file (default: $smtpd_tls_dkey_file) DSA tlsproxy(8) PEM. DSA tlsproxy(8) $smtpd_tls_dcert_file . DSA . smtpd_tls_dkey_file . Postfix 2.8 . tlsproxy_tls_eccert_file (default: $smtpd_tls_eccert_file) ECDSA tlsproxy(8) PEM. ECDSA tlsproxy(8) . smtpd_tls_eccert_file . Postfix >= 3.4 tlsproxy "tlsproxy_tls_chain_files" . Postfix 2.8 . tlsproxy_tls_eckey_file (default: $smtpd_tls_eckey_file) ECDSA tlsproxy(8) PEM. ECDSA tlsproxy(8) $smtpd_tls_eccert_file . smtpd_tls_eckey_file . Postfix >= 3.4 tlsproxy "tlsproxy_tls_chain_files" . Postfix 2.8 . tlsproxy_tls_eecdh_grade (default: $smtpd_tls_eecdh_grade) tlsproxy(8) - (EECDH). smtpd_tls_eecdh_grade . Postfix 3.6 . . Postfix 2.8 . tlsproxy_tls_enable_rpk (default: $smtpd_tls_enable_rpk) RFC7250 X.509 SMTP . $smtpd_tls_enable_rpk . Postfix 3.9 . tlsproxy_tls_exclude_ciphers (default: $smtpd_tls_exclude_ciphers) tlsproxy(8) TLS . smtpd_tls_exclude_ciphers . Postfix 2.8 . tlsproxy_tls_fingerprint_digest (default: $smtpd_tls_fingerprint_digest) SMTP . smtpd_tls_fingerprint_digest . Postfix 2.8 . tlsproxy_tls_key_file (default: $smtpd_tls_key_file) RSA tlsproxy(8) PEM. RSA tlsproxy(8) $smtpd_tls_cert_file . smtpd_tls_key_file . Postfix >= 3.4 tlsproxy "tlsproxy_tls_chain_files" . Postfix 2.8 . tlsproxy_tls_loglevel (default: $smtpd_tls_loglevel) tlsproxy(8) TLS. . smtpd_tls_loglevel . Postfix 2.8 . tlsproxy_tls_mandatory_ciphers (default: $smtpd_tls_mandatory_ciphers) TLS tlsproxy(8) TLS . smtpd_tls_mandatory_ciphers . Postfix 2.8 . tlsproxy_tls_mandatory_exclude_ciphers (default: $smtpd_tls_mandatory_exclude_ciphers) tlsproxy(8) TLS . smtpd_tls_mandatory_exclude_ciphers . Postfix 2.8 . tlsproxy_tls_mandatory_protocols (default: $smtpd_tls_mandatory_protocols) SSL/TLS tlsproxy(8) TLS . SSL/TLS . smtpd_tls_mandatory_protocols . Postfix 2.8 . tlsproxy_tls_protocols (default: $smtpd_tls_protocols) TLS tlsproxy(8) TLS . smtpd_tls_protocols . Postfix 2.8 . tlsproxy_tls_req_ccert (default: $smtpd_tls_req_ccert) TLS SMTP TLS. smtpd_tls_req_ccert . Postfix 2.8 . tlsproxy_tls_security_level (default: $smtpd_tls_security_level) TLS SMTP tlsproxy(8) smtpd_use_tls smtpd_enforce_tls . smtpd_tls_security_level . Postfix 2.8 . tlsproxy_tls_session_cache_timeout (default: $smtpd_tls_session_cache_timeout) TLS tlsproxy(8) . smtpd(8) tlsmgr(8) SMTP smtpd_tls_session_cache_timeout. Postfix 2.8 2.10 . tlsproxy_use_tls (default: $smtpd_use_tls) TLS : STARTTLS SMTP TLS. smtpd_use_tls . tlsproxy_tls_security_level . Postfix 3.9 . tlsproxy_tls_security_level . Postfix 2.8 . tlsproxy_watchdog_timeout (default: 10s) / tlsproxy(8) (watchdog) . tlsproxy(8) Postfix . 10s . ( ). : s () m () h () d () w (). s () . Postfix 2.8 . trace_service_name (default: trace) (trace). bounce(8) "sendmail -v" . Postfix 2.1 . transport_delivery_slot_cost (default: $default_delivery_slot_cost) default_delivery_slot_cost transport master.cf . : transport_delivery_slot_cost Postfix 2.9 "postconf" . master.cf ( : "_delivery_slot_cost"). transport_delivery_slot_discount (default: $default_delivery_slot_discount) default_delivery_slot_discount transport master.cf . : transport_delivery_slot_discount Postfix 2.9 "postconf" . master.cf ( : "_delivery_slot_discount"). transport_delivery_slot_loan (default: $default_delivery_slot_loan) default_delivery_slot_loan transport master.cf . : transport_delivery_slot_loan Postfix 2.9 "postconf" . master.cf ( : "_delivery_slot_loan"). transport_destination_concurrency_failed_cohort_limit (default: $default_destination_concurrency_failed_cohort_limit) default_destination_concurrency_failed_cohort_limit transport master.cf . : transport_destination_concurrency_failed_cohort_limit Postfix 2.9 "postconf" . master.cf ( : "_destination_concurrency_failed_cohort_limit"). Postfix 2.5 . transport_destination_concurrency_limit (default: $default_destination_concurrency_limit) default_destination_concurrency_limit transport master.cf . : transport_destination_concurrency_limit Postfix 2.9 "postconf" . master.cf ( : "_destination_concurrency_limit"). transport_destination_concurrency_negative_feedback (default: $default_destination_concurrency_negative_feedback) default_destination_concurrency_negative_feedback transport master.cf . : transport_destination_concurrency_negative_feedback Postfix 2.9 "postconf" . master.cf ( : "_destination_concurrency_negative_feedback"). Postfix 2.5 . transport_destination_concurrency_positive_feedback (default: $default_destination_concurrency_positive_feedback) default_destination_concurrency_positive_feedback transport master.cf . : transport_destination_concurrency_positive_feedback Postfix 2.9 "postconf" . master.cf ( : "_destination_concurrency_positive_feedback"). Postfix 2.5 . transport_destination_rate_delay (default: $default_destination_rate_delay) default_destination_rate_delay transport master.cf . : transport_destination_rate_delay Postfix 2.9 "postconf" . master.cf ( : "_destination_rate_delay"). Postfix 2.5 . transport_destination_recipient_limit (default: $default_destination_recipient_limit) default_destination_recipient_limit transport master.cf . : transport_destination_recipient_limit Postfix 2.9 "postconf" . master.cf ( : "_destination_recipient_limit"). transport_extra_recipient_limit (default: $default_extra_recipient_limit) default_extra_recipient_limit transport master.cf . : transport_extra_recipient_limit Postfix 2.9 "postconf" . master.cf ( : "_extra_recipient_limit"). transport_initial_destination_concurrency (default: $initial_destination_concurrency) initial_destination_concurrency transport master.cf . : transport_initial_destination_concurrency Postfix 2.9 "postconf" . master.cf ( : "_initial_destination_concurrency"). Postfix 2.5 . transport_maps (default: empty) ( /next-hop). transport(5) . / $local_transport $virtual_transport $relay_transport $default_transport $sender_dependent_relayhost_maps $relayhost $sender_dependent_default_transport_maps . "type:table" . . "transport_maps" parent_domain_matches_subdomains . Postfix 2.3 $number . : transport_maps = lmdb:/etc/postfix/transport lmdb: cdb: hash: dbm: . transport "postmap /etc/postfix/transport" () . "postmap type:/etc/postfix/transport" . default_database_type . "postconf -m" . . "postfix reload" . transport_minimum_delivery_slots (default: $default_minimum_delivery_slots) default_minimum_delivery_slots transport master.cf . : transport_minimum_delivery_slots Postfix 2.9 "postconf" . master.cf ( : "_minimum_delivery_slots"). transport_recipient_limit (default: $default_recipient_limit) default_recipient_limit transport master.cf . : transport_recipient_limit Postfix 2.9 "postconf" . master.cf ( : "_recipient_limit"). transport_recipient_refill_delay (default: $default_recipient_refill_delay) default_recipient_refill_delay transport master.cf . : transport_recipient_refill_delay Postfix 2.9 "postconf" . master.cf ( : "_recipient_refill_delay"). Postfix 2.4 . transport_recipient_refill_limit (default: $default_recipient_refill_limit) default_recipient_refill_limit transport master.cf . : transport_recipient_refill_limit Postfix 2.9 "postconf" . master.cf ( : "_recipient_refill_limit"). Postfix 2.4 . transport_retry_time (default: 60s) Postfix . ( ). : s () m () h () d () w (). s () . transport_time_limit (default: $command_time_limit) command_time_limit transport master.cf . ( ). : s () m () h () d () w (). s () . : transport_time_limit Postfix 2.9 "postconf" . master.cf ( : "_time_limit"). transport_transport_rate_delay (default: $default_transport_rate_delay) default_transport_rate_delay transport master.cf . ( ). : s () m () h () d () w (). s () . : transport_transport_rate_delay Postfix 2.9 "postconf" . master.cf ( : "_transport_rate_delay"). trigger_timeout (default: 10s) (trigger) Postfix ( pickup(8) qmgr(8)). . ( ). : s () m () h () d () w (). s () . undisclosed_recipients_header (default: see postconf -d output) cleanup(8) To: Cc: . Postfix 2.8 . Postfix 2.4-2.7 . : # Default value before Postfix 2.8. # Note: the ":" and ";" are both required. undisclosed_recipients_header = To: undisclosed-recipients:; unknown_address_reject_code (default: 450) SMTP . reject_unknown_sender_domain reject_unknown_recipient_domain . RFC 5321. unknown_address_tempfail_action (default: $reject_tempfail_action) SMTP reject_unknown_sender_domain reject_unknown_recipient_domain . SMTP "defer" . "defer_if_permit" SMTP . Postfix 2.6 . unknown_client_reject_code (default: 450) SMTP address <=> name reject_unknown_client_hostname . SMTP 450 . RFC 5321. unknown_helo_hostname_tempfail_action (default: $reject_tempfail_action) SMTP reject_unknown_helo_hostname . SMTP "defer" . "defer_if_permit" SMTP . Postfix 2.6 . unknown_hostname_reject_code (default: 450) SMTP HELO EHLO reject_unknown_helo_hostname. RFC 5321. unknown_local_recipient_reject_code (default: 550) SMTP $local_recipient_maps . $mydestination $proxy_interfaces $inet_interfaces . 550 ( ) 450 ( ) local_recipient_maps . : unknown_local_recipient_reject_code = 450 Postfix 2.0 . unknown_relay_recipient_reject_code (default: 550) SMTP $relay_domains relay_recipient_maps . Postfix 2.0 . unknown_virtual_alias_reject_code (default: 550) SMTP $virtual_alias_domains $virtual_alias_maps . Postfix 2.0 . unknown_virtual_mailbox_reject_code (default: 550) SMTP $virtual_mailbox_domains $virtual_mailbox_maps . Postfix 2.0 . unverified_recipient_defer_code (default: 450) SMTP (probe) . Postfix 250 . RFC 5321. Postfix 2.6 . unverified_recipient_reject_code (default: 450) SMTP reject_unverified_recipient . Postfix 250 . RFC 5321. Postfix 2.1 . unverified_recipient_reject_reason (default: empty) SMTP reject_unverified_recipient. SMTP . . : unverified_recipient_reject_reason = Recipient address lookup failed Postfix 2.6 . unverified_recipient_tempfail_action (default: $reject_tempfail_action) SMTP reject_unverified_recipient . "defer" SMTP . "defer_if_permit" SMTP . Postfix 2.6 . unverified_sender_defer_code (default: 450) SMTP . Postfix 250 . RFC 5321. Postfix 2.6 . unverified_sender_reject_code (default: 450) SMTP reject_unverified_sender . Postfix 250 . RFC 5321. Postfix 2.1 . unverified_sender_reject_reason (default: empty) SMTP reject_unverified_sender. SMTP . . : unverified_sender_reject_reason = Sender address lookup failed Postfix 2.6 . unverified_sender_tempfail_action (default: $reject_tempfail_action) SMTP reject_unverified_sender . "defer" SMTP . "defer_if_permit" . Postfix 2.6 . use_srv_lookup (default: empty) () DNS SRV . "use_srv_lookup = submission" "relayhost = example.com:submission" SMTP DNS SRV _submission._tcp.example.com (relay) . RFC 2782 . . services(5) submission submissions ( : smtp) . SRV use_srv_lookup "[]" IP SRV . : MUA MTA SRV "submission" "example.com". SMTP STARTTLS SRV "_submission._tcp.example.com" . /etc/postfix/main.cf: use_srv_lookup = submission relayhost = example.com:submission smtp_tls_security_level = may ...see SASL_README for sasl configuration... : MUA MTA SRV "submissions" "example.org". SMTP smtp-wraptls tls_wrappermode SRV "_submissions._tcp.example.org" . : DNS SRV "_smtps._tcp.example.org" "_submissions._tcp.example.org" "smtps" . /etc/postfix/main.cf: use_srv_lookup = submissions default_transport = smtp-wraptls:example.org:submissions ...see SASL_README for sasl configuration... /etc/postfix/master.cf: smtp-wraptls unix ... ... ... ... ... smtp -o { smtp_tls_wrappermode = yes } -o { smtp_tls_security_level = encrypt } : MUA MTA. SRV IP "smtp-relay.example.net" "smtp-relay.other.example" . "_smtps._tcp.example.org" "submissions" "smtps" . /etc/postfix/main.cf: use_srv_lookup = submission, submissions sender_dependent_default_transport_maps = inline:{ # Destinations that support SRV record lookup. { user1@example.com = smtp:example.com:submission } { user2@example.org = smtp-wraptls:example.org:submissions } # Use [destination] to force IP address lookups. { user3@example.net = smtp:[smtp-relay.example.net]:submission } { user4@other.example = smtp-wraptls:[smtp-relay.other.example]:submissions } } ...see SASL_README for sasl configuration... : (MTA MTA) SRV SMTP. Postfix . /etc/postfix/main.cf: use_srv_lookup = smtp # Fall back to MX record lookup when SRV records are unavailable. #allow_srv_lookup_fallback = yes #ignore_srv_lookup_error = yes Postfix 3.8 . verp_delimiter_filter (default: -=+) Postfix VERP sendmail(1) SMTP . Postfix 1.1 . virtual_alias_address_length_limit (default: 1000) (virtual alias). . Postfix 3.0 . virtual_alias_domains (default: $virtual_alias_maps) Postfix . SMTP $virtual_alias_maps . virtual alias domain class ADDRESS_CLASS_README . Postfix 2.0 . Postfix 1.1 . $virtual_alias_maps . ( -> ) ( ) . "/file/name" "type:table" / . "/file/name" "type:table" ( ). . "!pattern" . "!/file/name" Postfix 2.4 . VIRTUAL_README ADDRESS_CLASS_README . : virtual_alias_domains = virtual1.tld virtual2.tld virtual_alias_expansion_limit (default: 1000) . Postfix 2.1 . virtual_alias_maps (default: $virtual_maps) ( ) : local(8) alias_maps ( ) local(8) . virtual_alias_maps virtual(5) . Postfix ADDRESS_REWRITING_README . Postfix 2.0 . Postfix 1.1 . "type:name" . . : (recursive) . : virtual_alias_maps = lmdb:/etc/postfix/virtual lmdb: cdb: hash: dbm: . virtual "postmap /etc/postfix/virtual" () . "postmap type:/etc/postfix/virtual" . default_database_type . "postconf -m" . . "postfix reload" . virtual_alias_recursion_limit (default: 1000) . . . Postfix 2.1 . virtual_delivery_status_filter (default: $default_delivery_status_filter) virtual(8) . default_delivery_status_filter . Postfix 3.0 . virtual_destination_concurrency_limit (default: $default_destination_concurrency_limit) virtual. (queue manager) . master.cf . virtual_destination_recipient_limit (default: $default_destination_recipient_limit) virtual. . master.cf . 1 virtual_destination_concurrency_limit . virtual_gid_maps (default: empty) (GID) virtual(8). virtual(8) . . "type:name" . . "@domain.tld" "user@domain.tld" . (user+foo@domain.tld) virtual(8) (user@domain.tld) . : virtual(8) $1 . : virtual(8) proxymap(8) . 2.2 Postfix virtual(8) . virtual_mailbox_base (default: empty) virtual(8) $virtual_mailbox_maps . . virtual_mailbox_base "/" . virtual(8) . . : virtual_mailbox_base = /var/mail virtual_mailbox_domains (default: $virtual_mailbox_maps) Postfix $virtual_transport . virtual(8) Postfix . SMTP $virtual_mailbox_maps . virtual mailbox domain class ADDRESS_CLASS_README . mydestination . Postfix 2.0 . Postfix 1.1 . virtual_mailbox_limit (default: 51200000) maildir virtual(8) ( ). virtual(8) . . virtual_mailbox_lock (default: see postconf -d output) virtual(8) . "postconf -l" . virtual(8) . . maildir . : dotlock UID GID . : . virtual_mailbox_maps (default: empty) $virtual_mailbox_domains . "type:name" . . "@domain.tld" "user@domain.tld" . "virtual_mailbox_domains = $virtual_mailbox_maps" virtual_mailbox_domain "domain.tld" ( ). virtual(8) . . virtual(8) maildir . ("/") maildir . $virtual_mailbox_base . (user+foo@domain.tld) virtual(8) (user@domain.tld) . : virtual(8) $1 . : virtual(8) proxymap(8) . 2.2 Postfix virtual(8) . virtual_maps (default: empty) ) ) . 2.0 Postfix . 2.0 virtual_alias_domains virtual_alias_maps . virtual_minimum_uid (default: 100) (UID) virtual(8) $virtual_uid_maps . (deferred). virtual(8) . . virtual_transport (default: virtual) (next-hop) $virtual_mailbox_domains. transport(5) . transport:nexthop transport master.cf . :nexthop . Postfix 2.0 . virtual_uid_maps (default: empty) (UID) virtual(8) . virtual(8) . . "type:name" . . "@domain.tld" "user@domain.tld" . (user+foo@domain.tld) virtual(8) (user@domain.tld) . : virtual(8) $1 . : virtual(8) proxymap(8) . 2.2 Postfix virtual(8) . (SEE ALSO) postconf(1), Postfix master(5), Postfix (LICENSE) Secure Mailer . (AUTHORS) Wietse Venema IBM T.J. Watson Research P.O. Box 704 Yorktown Heights, NY 10598, USA Wietse Venema Google, Inc. 111 8th Avenue New York, NY 10011, USA Viktor Dukhovni POSTCONF(5)