Re: Bad command startup on DNS lookup error for auth socket

* Matus UHLAR - fantomas : On 18.09.22 14:00, Stefan Foerster wrote: [...] postfix/submission/smtpd[156]: warning: SASL: Connect to Dovecot auth socket 'inet:dovecot:12345' failed: Address not available this looks like "dovecot" host is not resolvable. Yes, that's exactly wh

Re: Bad command startup on DNS lookup error for auth socket

that one. Thanks for reminding me. Regards Stefan

Bad command startup on DNS lookup error for auth socket

the service could accept mails without needing to contact dovecot at all, so perhaps a runtime error would be a better bet here. Kind regards Stefan

Re: attempt to open lmdb:postscreen_cache with both "open" lock and "access" lock

* Wietse Venema : Stefan Foerster: Mar 17 13:24:40 servername postfix/proxymap[166]: panic: dict_open: attempt to open lmdb:/var/lib/postfix/postscreen_cache with both "open" lock and "access" lock ... postscreen_cache_map = proxy:lmdb:$data_directory/postscreen

Re: attempt to open lmdb:postscreen_cache with both "open" lock and "access" lock

Hello Wietse, * Wietse Venema : Stefan F?rster: Mar 17 13:24:40 servername postfix/proxymap[166]: panic: dict_open: attempt to open lmdb:/var/lib/postfix/postscreen_cache with both "open" lock and "access" lock Please do not open the postscreen cache through the proxym

attempt to open lmdb:postscreen_cache with both "open" lock and "access" lock

without persistence for the postscreen cache. However, if there is another fix, I'd be glad to hear about that. Thanks, Stefan address_verify_map = proxy:lmdb:${data_directory}/verify_cache alias_database = lmdb:/etc/postfix/maps/aliases alias_maps = lmdb:/etc/postfix/maps/aliases allow_pe

AW: Postfix 3.4.14 - Dovecot SASL - strange/buggy behavior in combination with compatibility_level

nks Wietse! Best regards Stefan smime.p7s Description: S/MIME cryptographic signature

Postfix 3.4.14 - Dovecot SASL - strange/buggy behavior in combination with compatibility_level

anything related in the release notes of newer versions). Best regards Stefan Podskubka smime.p7s Description: S/MIME cryptographic signature

Re: Managing allow/block list for outbound traffic

r. It is a privacy service and hopefully should not be abused much, but I need the option so that users of such allowed domains have the ability to send me a block request, in case they no longer want to receive email(s) from my service, due to possible abuse etc. Regards Stefan

Managing allow/block list for outbound traffic

be blocked from receiving email from my domain, due to abuse of my service, would be a simple REJECT of his email address in the same transport map list be sufficient, or does postfix may get confused? Regards Stefan

How to start a script for every outgoing email?

had a look at the before-queue filter, but as far as I understand the documentation, this filter only deals with mails coming from external. Does anyone has an idea how I could solve this? Thanks for any hints or suggestions, Stefan

Re: modifying outbound email headers

t; > /etc/postfix/master.cf: > > > newsgateway unix - - n - - smtp > > > -o header_checks=pcre:/etc/postfix/news-header-checks.pcre > > That should be smtp_header_checks (make changes while delivering), > not header_checks (make changes while receiving). Thanks for the correction! Best regards Stefan -- Signal (Desktop) +4915172173279 https://keybase.io/stefan_claas

Re: modifying outbound email headers

Wietse Venema wrote: > Stefan Claas: > > Wietse Venema wrote: > > > > > Stefan Claas: > > > > Hi, > > > > > > > > my postfix mail server works perfectly so far. > > > > > > > > However, I am now fac

Re: modifying outbound email headers

think. > > > I must admit that I am not an expert, but what I have seen so far, it > > looks to me that procmail is used for inbound mail. Hope that I am > > wrong with that. > > Procmail can be used for Outbound mail as well. Thanks, didn't know that. Regards Stefan -- Signal (Desktop) +4915172173279 https://keybase.io/stefan_claas

Re: modifying outbound email headers

Gregory Heytings wrote: > > Stefan Claas: > > > > postfix should modify outgoing email headers that *only* go to mail2news > > gateways, using the email gateway addresses for parsing, so that the > > right part of the message ID, after the @ charachter, will b

Re: modifying outbound email headers

Matus UHLAR - fantomas wrote: > On 06.04.20 11:01, Stefan Claas wrote: > >my postfix mail server works perfectly so far. > > > >However, I am now facing the following problem and have tried as best as I > >can to find a solution to this. > > > >I run a

Re: modifying outbound email headers

Franck MAHE wrote: > Hi Stefan, > > > I would like to achieve the following: > > > > postfix should modify outgoing email headers that *only* go to > > mail2news > > gateways, using the email gateway addresses for parsing, so that the > &g

modifying outbound email headers

for regular emails. I would be very grateful for your help! Greetings Stefan -- Signal (Desktop) +4915172173279 https://keybase.io/stefan_claas

Re: encoding issue with header_checks Windows-1252

kind of Outlooks, entering postfix via office 365. Am Samstag, 20. Juli 2019 schrieb Wietse Venema : > Stefan Bauer: >> I dont get it. Testing the above correctly shows >> >> Subject: >> =?Windows-1252?Q?[Cleartext]_Webinar_=84Noch_keine_55_und_ab_in_die_GKV=93?= >>

Re: encoding issue with header_checks Windows-1252

wrong with encoding. Am Do., 18. Juli 2019 um 16:27 Uhr schrieb Wietse Venema < wie...@porcupine.org>: > Stefan Bauer: > > Hi, > > > > header_checks = regexp:/etc/postfix/headerstring > > /^Subject: .*\[cleartext\].*/ FILTER cleartext: > > > >

Re: encoding issue with header_checks Windows-1252

only this single filter is present - no other filters. Unfortunately thats not enough to trigger the filter. Am Do., 18. Juli 2019 um 14:00 Uhr schrieb pasvon : > What does the complete file /etc/postfix/headerstring look like? > Does another line match a filter action and override the desired

Re: encoding issue with header_checks Windows-1252

man 5 header_checks By default, regexp <http://www.postfix.org/regexp_table.5.html>: and pcre <http://www.postfix.org/pcre_table.5.html>: patterns are case *insensitive*. Am Do., 18. Juli 2019 um 13:40 Uhr schrieb Matus UHLAR - fantomas < uh...@fantomas.sk>: > On 1

encoding issue with header_checks Windows-1252

ideas? Stefan

Re: best practice lookup table perormance - non hashed file

Thank you for your answer, but this brings in another piece of software. Want to keep it simple. Am Di., 25. Juni 2019 um 13:34 Uhr schrieb Matus UHLAR - fantomas < uh...@fantomas.sk>: > On 24.06.19 21:42, Stefan Bauer wrote: > >we're publishing lookup tables through our c

best practice lookup table perormance - non hashed file

recommend? Thank you. Stefan

Re: Stats recommendations?

we're pulling all kind of logs and graph them in fancy ways with zabbix. zabbix has a small client with tiny footprint and can do encrypted transfer of logs/data to server. Am Mo., 17. Juni 2019 um 22:20 Uhr schrieb PGNet Dev : > I'm aware of the list of stats tools > >

Re: authenticate o365 users with postfix without smtp auth

As microsoft ofers DKIM-singing for outgoing mails at no extra cost, i will validate this information as 3rd authentication token. Looks much clearer and several addons for postfix exist to do so. Am Mo., 17. Juni 2019 um 21:31 Uhr schrieb Wietse Venema < wie...@porcupine.org>: > > The latter is

Re: authenticate o365 users with postfix without smtp auth

Emmanuel, thank you. That was of great help to see, that others have same isses with o365. Do you have any more infos how you do the experimental certificate matching part with postifx? thank you in advance Stefan Am Mo., 17. Juni 2019 um 12:05 Uhr schrieb Emmanuel Fusté < emmanuel

Re: authenticate o365 users with postfix without smtp auth

rieb Viktor Dukhovni < postfix-us...@dukhovni.org>: > On Sun, Jun 16, 2019 at 05:46:52PM +0200, Stefan Bauer wrote: > > > Some of our users use o365 but would like to use our service for outgoing > > mails. We are offering smtp sending services. Integrating our service >

Re: authenticate o365 users with postfix without smtp auth

Bill, yes thats the question. i would consider the two factors as reliable. MS is signing mails. i just like clear user authentication instead of rely on volatile ips/blocks, microsoft publishes/changes. what i need to check is also, whether MS allows spoofing of sender address. i need to make

Re: authenticate o365 users with postfix without smtp auth

MS is publishing source ips/ranges. sasl_exeptions_networks seems an option but i still dont like the lack of authentication. Am Sonntag, 16. Juni 2019 schrieb Wietse Venema : > Stefan Bauer: >> its like the first: >> >> end-user client -> microsoft server -> postfix

Re: authenticate o365 users with postfix without smtp auth

its like the first: end-user client -> microsoft server -> postfix server -> remote recipient Am Sonntag, 16. Juni 2019 schrieb Wietse Venema : > Stefan Bauer: >> our users send/receive via o365. the last mile o365->recipient should go >> through our service li

Re: authenticate o365 users with postfix without smtp auth

our users send/receive via o365. the last mile o365->recipient should go through our service like o365->postfix->recipient here, o365 does not offer smtp auth against postfix. Am Sonntag, 16. Juni 2019 schrieb @lbutlr : > On 16 Jun2019, at 09:46, Stefan Bauer wrote: >> som

Re: authenticate o365 users with postfix without smtp auth

. Juni 2019 schrieb Viktor Dukhovni < postfix-us...@dukhovni.org>: > On Sun, Jun 16, 2019 at 04:00:38PM +0200, Stefan Bauer wrote: > >> We are running a small smtp relay service with postfix for authenticated >> users. Unfortunately office 365 does not offer any smtp authenti

authenticate o365 users with postfix without smtp auth

from MS ip ranges with valid sender address could relay through our service. i dont like to open our service 'blind' to MS ip ranges. Ideas/Thoughts are very welcome. Stefan

Re: re-route mails on demand during block of ip address

7000-8000 mails / day. Stefan Am Fr., 31. Mai 2019 um 18:37 Uhr schrieb Noel Jones : > On 5/31/2019 1:48 AM, Stefan Bauer wrote: > > Hi, > > > > I'm running a pair of postfix-servers in different data-centers > > (different ip networks) for outgoing-only delivery. once i

re-route mails on demand during block of ip address

that is not visible to my users and only fairly with dummy mails used to keep reputation up and good. Howto re-route traffic on demand with postfix in case, ip-networks get blocked again? How do others handle this? Thank you. Stefan

retrigger MX lookup for undeliverable mails in mailqueue

which makes also sense. Are there workarounds available to re-initiate another MX-lookup for a recipient in mailqueue when it is undeliverable? any other help is also great. thank you. Stefan

disable logging of header_checks FILTER action

simply do not want to have sensitive informations (subject) in postfix logs. Stefan

smtp_tls_security_level = dane but have encrypt as fallback

, Always use at least encrypt 2, When TLSA-records are found and valid, use only this to encrypt 3, When no TLSA-records are found or the ones found can not be used, fall back to encrypt, if not possible, fail. *Stefan*

Re: address_verify_negative_refresh_time = 30m is ignored

Thank you Wietse for taking the time to explain things. I really appreciate this. now all is clear. Am Freitag, 25. Januar 2019 schrieb Wietse Venema : > Stefan Bauer: >> thank you. seems to be that >> >> if address_verify_negative_refresh_time = 30m, the next attempt t

Re: address_verify_negative_refresh_time = 30m is ignored

porcupine.org>: > Stefan Bauer: > > Jan 25 15:31:14 mx2 postfix/smtpd[10117]: NOQUEUE: reject: RCPT from > > opsmail.colo.comodo.com[91.209.196.133]: 550 5.1.1 > > > address: host IP[IP] said: 550 5.1.1 > address rejected: User unknown in virtual mailbox table (in reply to

address_verify_negative_refresh_time = 30m is ignored

hi, we have address_verify_negative_refresh_time = 30m active (root@mx2:/var/lib/postfix# postconf -n | grep verify address_verify_negative_refresh_time = 30m) but the verify behavior is strange. Jan 23 21:15:21 mx2 postfix/postscreen[Jan 25 15:31:14 mx2 postfix/smtpd[10119]: NOQUEUE: reject:

Re: detecting TLS issues in delivery - Cannot start TLS: handshake failure

"Some sites may blacklist you when you are probing them too often (a probe is an SMTP session that does not deliver mail), or when you are probing them too often for a non-existent address. This is one reason why you should use sender address verification sparingly, if at all, when your site

Re: detecting TLS issues in delivery - Cannot start TLS: handshake failure

reject_unverified_recipient is no option as remote sites don't like probing/verify requests. After rechecking, i had a typo in my regex. Damn! It was working as documented. Sorry. Am Mi., 16. Jan. 2019 um 13:17 Uhr schrieb Wietse Venema < wie...@porcupine.org>: > Stefan Baue

detecting TLS issues in delivery - Cannot start TLS: handshake failure

. thank you. Stefan

Re: tls_high_cipherlist with !SEED is ignored

now i got it. sorry and thank you for your help. Am Dienstag, 15. Januar 2019 schrieb Viktor Dukhovni < postfix-us...@dukhovni.org>: >> On Jan 15, 2019, at 8:39 AM, Stefan Bauer wrote: >> >> -o smtpd_tls_mandatory_ciphers=high >> -o tls_preempt_cipherlist=yes

Re: tls_high_cipherlist with !SEED is ignored

I just want to set allowed ciphers but can not enforce encryption generally. this seems to be a limitation and not possible right? Am Dienstag, 15. Januar 2019 schrieb Viktor Dukhovni < postfix-us...@dukhovni.org>: >> On Jan 15, 2019, at 8:39 AM, Stefan Bauer wrot

tls_high_cipherlist with !SEED is ignored

Nessus reports for example TLS_RSA_WITH_SEED_CBC_SHA as weak on our submission port. So i was using the following to disable all SEED ciphers on submission port but it has no effect: -o smtpd_tls_mandatory_ciphers=high -o tls_preempt_cipherlist=yes -o

Re: DSN behavior unclear - clarification needed

Awesome. Thank you. That did the trick. Am Di., 15. Jan. 2019 um 13:22 Uhr schrieb Wietse Venema < wie...@porcupine.org>: > Stefan Bauer: > > Hi, > > > > i would like that postfix always sends DSN, when requested by client and > > mail got forwarded to next-hop

DSN behavior unclear - clarification needed

ke to only present our users our custom DSN text. Thank you. Stefan

Re: bypass policy server in recipient_restrictions when subject contains string

Thank you. That explains it! Am Sa., 5. Jan. 2019 um 15:03 Uhr schrieb Benny Pedersen : > Stefan Bauer skrev den 2019-01-05 14:08: > > > tls_whitelist_check unix- - n - - > > smtp > >-o header_checks= > >-o

Re: bypass policy server in recipient_restrictions when subject contains string

=ESMTP helo=: tls_whitelist_check: mail gets delivered, but policy service is not used/called. What am i missing? Am Sa., 5. Jan. 2019 um 11:05 Uhr schrieb Stefan Bauer < cubew...@googlemail.com>: > Understood. Would it be possible to have header_checks in main.cf that > send mails

Re: bypass policy server in recipient_restrictions when subject contains string

with special subject. Am Freitag, 4. Januar 2019 schrieb Bill Cole < postfixlists-070...@billmail.scconsult.com>: > On 4 Jan 2019, at 10:36, Stefan Bauer wrote: > >> Would it be possible to have FILTER as action in policy server > > Yes, but FILTER behaves as documented i

Re: policy server, TLS only exeptions and restrictions

great idea, but recipient verification is not something, remote servers like.really like. Am Freitag, 4. Januar 2019 schrieb Viktor Dukhovni < postfix-us...@dukhovni.org>: >> On Jan 4, 2019, at 9:10 AM, Matus UHLAR - fantomas wrote: >> >> this looks to me that you search for connection between

Re: bypass policy server in recipient_restrictions when subject contains string

Jan 2019, at 9:36, Stefan Bauer wrote: > > > is there a way to bypass policy server in smtp_recipient_restrictions, > > in > > case, subject contains special string? > > No. As documented, smtp_recipient_restrictions is evaluated for each > RCPT command, all of whi

bypass policy server in recipient_restrictions when subject contains string

but seems to kick in too late :/ Stefan

Re: policy server, TLS only exeptions and restrictions

Understood. Thank you. Am Fr., 4. Jan. 2019 um 15:11 Uhr schrieb Matus UHLAR - fantomas < uh...@fantomas.sk>: > On 04.01.19 14:44, Stefan Bauer wrote: > >we have enforced TLS to all remote sites and have appropriate tls policy > >server, that checks if TLS is avail b

policy server, TLS only exeptions and restrictions

re ignored. Howto work around this? thank you. Stefan

Re: detect fake mx, tls security encrypt

Hi Robert, thanks. already saw that but i dont want to bother remote sites with a 'full verify'. still like the policy server approach. should be no big thing for a coder - familiar with perl. Am Samstag, 22. Dezember 2018 schrieb Robert Schetterer : > Am 22.12.18 um 07:55 schrieb Stefan Ba

Re: detect fake mx, tls security encrypt

org>: >> On Dec 20, 2018, at 1:25 PM, Stefan Bauer wrote: >> >> I'm aware of such exceptions but I don't like to set them. Our policy is safe or not at all via mail. > > That policy has a cost. You don't like the cost, but there it is... > >> I would like to

Re: detect fake mx, tls security encrypt

thats a nice approach! thank you. will test. Am Donnerstag, 20. Dezember 2018 schrieb Viktor Dukhovni < postfix-us...@dukhovni.org>: >> On Dec 20, 2018, at 1:25 PM, Stefan Bauer wrote: >> >> I'm aware of such exceptions but I don't like to set them. Our policy is saf

Re: detect fake mx, tls security encrypt

Donnerstag, 20. Dezember 2018 schrieb Viktor Dukhovni < postfix-us...@dukhovni.org>: >> On Dec 20, 2018, at 12:42 PM, Stefan Bauer wrote: >> >> I use smtp_tls_security_level = encrypt > > The cost of that choice is that you must also have: > > main.cf: >

detect fake mx, tls security encrypt

lifetime but in general thats bad for real systems with temp issues. how do you handle this? Stefan

Re: dnsbl postscreen - not blocking

the threshold is at default, so 1. but the dns timeout, Wietse mentioned, might be the real cause. gonna check manuals, if this is configurable. Thank you. Am Mittwoch, 19. Dezember 2018 schrieb Viktor Dukhovni < postfix-us...@dukhovni.org>: > On Wed, Dec 19, 2018 at 02:00:34PM +010

Re: ignore SASL/Auth to specific server (internal exchange relay)

ior you need for the exchange > transport is no sasl: > exchange unix - - n - - smtp > -o smtp_sender_dependent_authentication=no > > Daniel > > > On 12/11/2018 1:40 PM, Stefan Bauer wrote: > > thank you for your help! > > I

Re: ignore SASL/Auth to specific server (internal exchange relay)

org>: > > On Dec 11, 2018, at 4:40 PM, Stefan Bauer > wrote: > > > > exchange unix - - n - - smtp > > -o smtp_sender_dependent_authentication=no > > -o transport_maps=hash:/etc/postfix/transport_internal > > No the "t

Re: ignore SASL/Auth to specific server (internal exchange relay)

org>: > > On Dec 11, 2018, at 3:41 PM, Stefan Bauer > wrote: > > > > Can you recommend appropriate manual(s)? I dont understand what you mean > with separate transport. > > http://www.postfix.org/master.5.html > http://www.postfix.org/tr

Re: ignore SASL/Auth to specific server (internal exchange relay)

te transport for the relay(s) in question, > with "smtp_sender_dependent_authentication = no" for that > transport. > > > On Dec 11, 2018, at 2:37 PM, Stefan Bauer > wrote: > > > > I dont see a way to have AUTH to all of our relayhosts but not for > this

Re: ignore SASL/Auth to specific server (internal exchange relay)

not use AUTH at all to 192.168.124.5:2525 ? Am Di., 11. Dez. 2018 um 20:32 Uhr schrieb Wietse Venema < wie...@porcupine.org>: > Stefan Bauer: > > Hi, > > > > we receive mails from $world and forward them to internal exchange > server. > > > > Exchange

ignore SASL/Auth to specific server (internal exchange relay)

Hi, we receive mails from $world and forward them to internal exchange server. Exchange is offering STARTTLS and AUTH root@gate01:~# telnet 192.168.124.5 2525 Trying 192.168.124.5... Connected to 192.168.124.5. Escape character is '^]'. 220 ex01 Microsoft ESMTP MAIL Service ready at Tue, 11 Dec

Re: Best practice - concurrent delivery to remote sites

wie...@porcupine.org>: > Stefan Bauer: > > stuff/best practice that makes the process more effective. > > > > i'm certain that remote sites prefer one way over the other. > > I don't think that there is a 'standard' policy that 'works' for > delivery from every site to every

Re: Best practice - concurrent delivery to remote sites

that remote sites prefer one way over the other. Stefan Am Donnerstag, 6. Dezember 2018 schrieb Andrey Repin : > Greetings, Stefan Bauer! > > >>> we're running a small relay-service and looking for best practice to > >>> deliver mails to remote sites regard

Re: Best practice - concurrent delivery to remote sites

Its no user issue. Its a real and legal use case that customers send several mails / second to same recipient over a long period (software tests whatever). Am Do., 6. Dez. 2018 um 12:50 Uhr schrieb Andrey Repin : > Greetings, Stefan Bauer! > > > Hi, > > > > we're runni

Best practice - concurrent delivery to remote sites

Hi, we're running a small relay-service and looking for best practice to deliver mails to remote sites regarding concurrent delivery and so on. Sometimes, we have customers that are sending several mails per second to same recipients. What is best practice to handle this? We would like to

Re: forwarding mail like before queue filtering to remote mta

The use case is only for mx service so there will be only incoming mail for same domain in same smtp session. I assume that remote mail servers will not combine mail delivery in same smtp session when destination domains differ (even though they have same mx) Stefan Am Mittwoch, 28. November

forwarding mail like before queue filtering to remote mta

to privacy reasons. Stefan

Re: cisco pix TLS is required, but was not offere STARTTLS issue

' is set by default. Am Mo., 26. Nov. 2018 um 11:21 Uhr schrieb Stefan Bauer < cubew...@googlemail.com>: > Hi, > > log shows: > > enabling PIX workarounds: disable_esmtp delay_dotcrlf for mx0.esb.de > > But the specific workaround 'disable_esmtp' looks like to be t

Re: cisco pix TLS is required, but was not offere STARTTLS issue

: > * Stefan Bauer : > > Dear Users, > > > > we trying to deliver mail to remote party with enforced encrcyption. > > > > 63FFB80805: TLS is required, but was not offered by host mx0.esb.de > > [194.77.230.138] > > > > But looks like, remote device is ann

cisco pix TLS is required, but was not offere STARTTLS issue

Dear Users, we trying to deliver mail to remote party with enforced encrcyption. 63FFB80805: TLS is required, but was not offered by host mx0.esb.de [194.77.230.138] But looks like, remote device is announcing TLS and can handle it: # telnet mx0.esb.de 25 Trying 194.77.230.138... Connected to

Re: sender_dependent_relayhost_maps with different credentials for same relayhost

Found it. Was required to modify smtp_auth to customer1.de user1:password customer2.de user2:password. Am Do., 22. Nov. 2018 um 10:22 Uhr schrieb Stefan Bauer < cubew...@googlemail.com>: > After setting > > smtp_sender_dependent_authentication = yes > > and adding a

Re: sender_dependent_relayhost_maps with different credentials for same relayhost

ietse Venema < wie...@porcupine.org>: > Stefan Bauer: > > Hi, > > > > i have: > > sender_dependent_relayhost_maps = hash:/etc/postfix/relayhost_maps > > smtp_sasl_password_maps = hash:/etc/postfix/smtp_auth > > > > more /etc/postfix/relayhost_maps >

Re: Best way of synchronizing configs for multiple relay servers?

i have similar case and set the first relayseever inmy pool as the one on which changes ar eonly allowed. then i do scp + service restart to the others with bash oneliner on demand. for the future i plan to check in config from any host to central svn/git repo and check frequently for changes

Re: sender_dependent_relayhost_maps with different credentials for same relayhost

Thank you! Am Montag, 5. November 2018 schrieb Wietse Venema : > Stefan Bauer: >> Hi, >> >> i have: >> sender_dependent_relayhost_maps = hash:/etc/postfix/relayhost_maps >> smtp_sasl_password_maps = hash:/etc/postfix/smtp_auth >> >> more /etc/postfix/

sender_dependent_relayhost_maps with different credentials for same relayhost

mydomain:mydomainpass How can i specify different credentials for same relayhost? mails from my2domain.de should be relayed through 1und1 but with its own credentials. Thank you. Stefan

Thank you Wietse, supporters and contributors for Postfix

relayhosts by sender domain but having the option to define individual transport ways. This is awesome to give the user/administrator a way to do a very fine grained mail routing. We're a "small" postfix uers (< 100.000 mails / month) but are very happy with postfix. Thank you. Stefan

Re: Monitoring amount of smtpd processes

We simply monitor established tcp sessions to smtpd port. if client flies away, tcp session does as well: lsof -i tcp:25 | grep ESTABLISHED | wc -l Am Samstag, 20. Oktober 2018 schrieb Peer Heinlein : > > > > Hi, > > we're monitoring the amount of active smtpd processes to make sure, that > we

Re: best practice - integrating spamassassin/clamav in postfix - amavis yes/no?

and finally a recipient verification. i'm happy now - looks like a sane setup. Cant wait to see first spammers ;) Stefan Am Freitag, 19. Oktober 2018 schrieb Andreas Schamanek : > > On Fri, 19 Oct 2018, at 10:57, Olivier wrote: > >> So, rejecting spam during smtp-dialog is risky, t

Re: best practice - integrating spamassassin/clamav in postfix - amavis yes/no?

Thank you. So it makes sense to have all smtpd_recipient_restrictions in place, and _only if_ the client passes all checks, clamav or spamasassin is having data available to do a check. If the client fails a check, clamav/spamasassin have nothing to process. Did i get it correctly? :) Stefan Am

Re: best practice - integrating spamassassin/clamav in postfix - amavis yes/no?

er and recipient. > > Have a look to amavis-milter (+spamassassin+clamav) or even rspamd. > > > Carsten > > On 19.10.18 07:15, Stefan Bauer wrote: > > Thank you for your feedback. Seems like smtpd_milters are also used > > before any other check_*_access and rbl checks

Re: best practice - integrating spamassassin/clamav in postfix - amavis yes/no?

Thank you for your feedback. Seems like smtpd_milters are also used before any other check_*_access and rbl checks/header checks etc., so it's expensive this way, to pipe every mail through virus scan. I'm just testing if i could plug in clamav by check_policy_service. Am Fr., 19. Okt. 2018 um

best practice - integrating spamassassin/clamav in postfix - amavis yes/no?

is your opinion? thank you. Stefan

Re: making unverified_recipient_reject_code safe for temp errors

Yes, that's it. Thank you! Am Fr., 12. Okt. 2018 um 14:27 Uhr schrieb Wietse Venema < wie...@porcupine.org>: > That's the probe's 421 result: > > > Oct 11 17:19:13 kop01 postfix/lmtp[5711]: E759E301412: > to=, > > relay=127.0.0.1[127.0.0.1]:2003, delay=13, delays=0/0.01/13/0, dsn=4.0.0, > >

Re: making unverified_recipient_reject_code safe for temp errors

d. Am Do., 11. Okt. 2018 um 22:12 Uhr schrieb Wietse Venema < wie...@porcupine.org>: > Stefan Bauer: > > We just noticed, that senders got several "550 5.1.0 Address rejected" > > bounces even though postfix logs no permanent errors. > > > > Oct

Re: making unverified_recipient_reject_code safe for temp errors

127.0.0.1[127.0.0.1] refused to talk to me: 421 internal error: OpenResolveAddrFolder failed) Isn't status=undeliverable a 5xx reject? Am Do., 11. Okt. 2018 um 19:14 Uhr schrieb Wietse Venema < wie...@porcupine.org>: > Stefan Bauer: > > Dear Users, > > >

Re: Authenticating 'From' header to match envelope

Johannes, did you double check if your planned setup will not break other things? Have similar needs but am not yet deep enough into mail to see possible pitfalls. Stefan Am Dienstag, 2. Oktober 2018 schrieb Johannes Bauer : > Hi list, > > I'm having an issue with my Postfix conf

check if envelope from and from is the same

sites. Is this a good idea to check if envelope from and from matches and if so, howto do it in postfix? thank you Stefan

Re: empty MAIL FROM and check_sender_access

25, 2018, at 10:13 AM, Stefan Bauer > wrote: > > > > I was more asking if it's even a good idea to add the null entry to the > table? i would like to be a good postmaster but not want to relax policies > for allowed sender addresses. > > You need to allow mail wi

empty MAIL FROM and check_sender_access

I was more asking if it's even a good idea to add the null entry to the table? i would like to be a good postmaster but not want to relax policies for allowed sender addresses. Am Di., 25. Sep. 2018 um 13:26 Uhr schrieb Wietse Venema < wie...@porcupine.org>: > > Stefan Bauer: > &g

empty MAIL FROM and check_sender_access

Hi, I'm using smtpd_sender_restrictions = check_sender_access hash:/etc/postfix/allowed_sender to make sure, my senders only send out with pre-defined and allowed domains. Now i noticed, that if my users acknowledge "read confirmations" in clients, mails in the following form arrive at postfix:

  1   2   3   4   >