Re: How to stop postfix sending emails
Lists: Hi All, We are doing an upgrade on the machine that holds the postboxes (mailenable) during the upgrade the server will need to be rebooted which renders the boxes unreachable. This causes a 550 error to be sent back to our spam catching server (running MailScanner spamassassin and postfix). That is a terrible configuration error. A host outage should never result in 5xx mail rejects. Wietse
Re: How to stop postfix sending emails
Lists: Wietse Venema wrote: Lists: Hi All, We are doing an upgrade on the machine that holds the postboxes (mailenable) during the upgrade the server will need to be rebooted which renders the boxes unreachable. This causes a 550 error to be sent back to our spam catching server (running MailScanner spamassassin and postfix). That is a terrible configuration error. A host outage should never result in 5xx mail rejects. Wietse I don't love it either but it is how MailEnable works when it can't access the box, it responds with - 550 5.7.1 Unable to relay for originallocalsen...@domain.co.nz (in reply to RCPT TO command)) Don't we all love brain-dead systems. I recently added a translation mapping for SMTP server inputs. That was meant to map inputs from brain-dead SMTP clients into something that satisfies basic SMTP syntax rules. Perhaps I should also add a translation mapping for inputs from SMTP servers, so that in the future, one could replace the above reply by a 4xx class reply. Wietse
Re: ??: ????: ????: who know how does initial_destination_concurrency and default_destination_concurrency_limit work?
Dhiraj Chatpar: Hi Sir, If i am selecting this option smtp_destination_rate_delay = 1s Will this reduce delivery to all domains or just one specific domain. Will the actual throughput to the final delivery be reduced to one email per second from my binded IP?.. Please confirm as that is what i am looking for. http://www.postfix.org/QSHAPE_README.html Look at the example with _destination_rate_delay Wietse
Re: Betr.: Re: Betr.: Re: Trim part of the header with header rewriting ?
Noel Jones: On 11/12/2009 12:28 PM, Arjan Melein wrote: Yea I just found that out when I just tried to sed the queue file :-) Any way to limit it to only take out the line on domain X Y and Z ? On a sidenote, its actually the RCPT TO: line and not the normal TO: line ... not sure if that's going to be a problem .. RCPT TO:d...@email.addy ORCPT=rfc822;groupwise-sou...@email.addy;1:1 Thanks for the help so far. That doesn't look like a header. You need to show exact evidence of the error you're getting. As shown below, Postfix 2.7 can fix commands from remote SMTP clients. Meanwhile, I am adding a similar feature to fix replies from remote SMTP servers. In your case the regexp could look like: /^RCPT\s+TO:(.*);1:1$/ RCPT TO:$1 This an incredibly unsafe tool. Wietse smtpd_command_filter (default: empty) A mechanism to substitute incoming SMTP commands. This is a last- resort tool to work around problems with clients that send invalid com- mand syntax that would otherwise be rejected by Postfix. Specify the name of a type:table lookup table. The search string is the SMTP command as received from the SMTP client, except that initial whitespace and the trailing CRLF are removed. The result value is executed by the Postfix SMTP server. Examples: /etc/postfix/main.cf: smtpd_command_filter = pcre:/etc/postfix/command_filter /etc/postfix/command_filter: # Work around clients that send malformed HELO commands. /^HELO\s*$/ HELO domain.invalid # Work around clients that send empty lines. /^\s*$/ NOOP # Work around clients that send RCPT TO:'u...@domain'. # WARNING: do not lose the parameters that follow the address. /^RCPT\s+TO:\s*'([^[:space:]]+)'(.*)/ RCPT TO:$1$2 This feature is available in Postfix 2.7.
Re: Experience with the new speed_adjust feature
Mark Martinec:
For the last couple of days I'm now experimenting with the
2.7-20091105-nonprod with the new speed_adjust experimental feature
turned on at the MX port, along with the postscreen. Seems to work
as advertised: timing reports by a pre-queue proxy content filter confirm
that the content filter is invoked only after data has been received.
Current mail load on our server is not high, so I haven't yet seen
what happens under high mail rate conditions.
Thanks. 20091105-nonprod has a known problem when the temp file
can't be written for some reason (fixed in 20091109).
I speculate that under load, clients will experience delays at a
different point in the conversation.
Assume that the maximal number of filter processes is tuned such
that the machine does not collapse under that load.
Without speed-match, there is exactly one smtpd process for each
filter. As soon as all smtpd processes are busy (whether or not
these sessions rejecting mail early), new tcp connections will get
queued, and clients experience a delay before the 220 welcome
greeting.
With speed-match, there can be more smtpd processes than filters,
Once all filters are busy, clients that complete an SMTP delivery
will experience a delay after sending .. When the load increases
to the point that all smtpd processes are busy, which should happen
later than in the no speed-match scenario, new tcp connections
will get queued and clients experience a delay before the 220
welcome greeting.
As for the second problem, it would help if you could add a missing
sanity check here:
*** ./smtpd_proxy.c-Thu Nov 5 16:48:53 2009
--- ./smtpd_proxy.c Fri Nov 13 08:27:37 2009
***
*** 1027,1032
--- 1027,1038
(p)-a10, (p)-a11, (p))
/*
+ * Sanity check.
+ */
+ if (state-proxy != 0)
+ msg_panic(smtpd_proxy_create: handle still exists);
+
+ /*
* Connect to the before-queue filter immediately.
*/
if ((flags SMTPD_PROXY_FLAG_SPEED_ADJUST) == 0) {
It will help to get closer to the root cause. Meanwhile, I can set
up a null-filter measurement on my tiny site and see if this triggers
something. I thought that every mail transaction ends with truncating
the temporary file, even when the transaction is aborted early.
Two things are on my mind:
1. I'm dearly missing in the postfix log the SMTP response from a
pre-queue content filter (or better, a response that was sent back to a SMTP
client), at least in case of a 5xx or 4xx response. With a post-queue filter
setup the response is clearly logged, unlike in the pre-queue setup where it
is not. It makes it hard to correlate a spartanic postfix log of a rejected
transaction (due to a proxy filter rejection) with a log from a content
filter. Even if the correlation were somehow available, seeing a confirmation
of what was really sent back to the client in a postfix log would contribute
to the confidence in the correctness of operation.
I assumed that the filter will already log the rejects (possible with the
client name/address from xforward), and therefore Postfix would
not need to add to the noise, but this can be changed.
Wietse
Re: status during email life ...
St??phane MERLE: Hi, Wietse Venema a ?crit : St?phane MERLE: I just saw that those mail are sent to n...@localhost : 8652C2E741C6: to=n...@localhost, orig_to=john@distdomain.com, relay=local, delay=0.02, delays=0.01/0/0/0.01, dsn=5.1.1, status=bounced (unknown user: null) surely because I set : bounce_notice_recipient = null in main.cf how can I cancel any notification email ? (I am parsing the log files to get those informations). You don't delete bounce messages. Instead, you fix the problem that causes mail to bounce. Some bounce have no solution ...like spam (false) detection by hotmail Sorry, that is NOT a good reason to throw away rejected mail. When non-spam mail is rejected, the sender needs to know. It is up to the sender to deal with this, not the MTA operator. When people are sending real spam to hotmail, then silencing Postfix is not the proper solution. Wietse
Re: status during email life ...
St?phane MERLE: Wietse Venema a ?crit : Sorry, that is NOT a good reason to throw away rejected mail. When non-spam mail is rejected, the sender needs to know. It is up to the sender to deal with this, not the MTA operator. When people are sending real spam to hotmail, then silencing Postfix is not the proper solution. Wietse Ok, I just get what you meant, here, the sender is a robot, those smtp server are use for mass mailing (subscription mailing like horoscope or daily recipe), so I don't need an actual email to know that a mail is bounced or expired. I am dealing directly with the postfix log files to get this and to react on the database. This is why I'd like to cancel the notification message. But I do understand perfectly that the MTA have to send the notification most of the time, because people who sent mail need to know that the mail is wrong or rejected. I am sorry, I should have made myself clearer from the beginning. I will not post instructions to throw away non-delivery notices. I know that people would mis-use this to cover up their mistakes so that their users don't find out that mail was mis-handled. If you have a specialized need that never needs to deliver NDRs, then it is easy enough to edit the Postfix SMTP client source code and change the SMTP_STATE_DOT reply handler so that it skips the server reply code test. Wietse
Re: Experience with the new speed_adjust feature
Thanks for the logging. If you have time, can you change the code
to print information about the non-zero size? This could be a
filesystem feature where ftruncate() does not reset st_size until
the file is rewritten or closed (in which case my attempt to force
easly release of disk blocks are in vain).
Otherwise, I'll try some experiments over the weekend.
Wietse
*** ./smtpd_proxy.c.origMon Nov 9 19:41:50 2009
--- ./smtpd_proxy.c Fri Nov 13 12:44:46 2009
***
*** 975,983
(void) vstream_fclose(smtpd_proxy_replay_stream);
smtpd_proxy_replay_stream = 0;
} else {
! if (st.st_size 0)
! msg_panic(%s: non-empty before-queue filter speed-adjust log,
! myname);
vstream_clearerr(smtpd_proxy_replay_stream);
if (msg_verbose)
msg_info(%s: reuse speed-adjust stream fd=%d, myname,
--- 975,992
(void) vstream_fclose(smtpd_proxy_replay_stream);
smtpd_proxy_replay_stream = 0;
} else {
! /* This file system does not reset st_size after ftruncate(). */
! if (st.st_size 0) {
! msg_warn(%s: non-zero speed-adjust logfile size: %lu,
!myname, (unsigned long) st.st_size);
! if (ftruncate(vstream_fileno(smtpd_proxy_replay_stream),
(off_t) 0) 0) {
! msg_warn(truncate before-queue filter speed-adjust log:
%m);
! (void) vstream_fclose(smtpd_proxy_replay_stream);
! smtpd_proxy_replay_stream = 0;
! }
! }
! }
! if (smtpd_proxy_replay_stream != 0) {
vstream_clearerr(smtpd_proxy_replay_stream);
if (msg_verbose)
msg_info(%s: reuse speed-adjust stream fd=%d, myname,
Re: Experience with the new speed_adjust feature
Mark Martinec:
On Friday 13 November 2009 18:52:03 Wietse Venema wrote:
Thanks for the logging. If you have time, can you change the code
to print information about the non-zero size? This could be a
filesystem feature where ftruncate() does not reset st_size until
the file is rewritten or closed (in which case my attempt to force
easly release of disk blocks are in vain).
Victor found it (missing fflush before ftruncate). If you can back
out the changes and apply the patch below.
Wietse
*** ./smtpd_proxy.c.origMon Nov 9 19:41:50 2009
--- ./smtpd_proxy.c Fri Nov 13 13:15:25 2009
***
*** 1030,1035
--- 1030,1041
(p)-a10, (p)-a11, (p))
/*
+ * Sanity check.
+ */
+ if (state-proxy != 0)
+ msg_panic(smtpd_proxy_create: handle still exists);
+
+ /*
* Connect to the before-queue filter immediately.
*/
if ((flags SMTPD_PROXY_FLAG_SPEED_ADJUST) == 0) {
***
*** 1126,1132
*/
if (smtpd_proxy_replay_stream == 0)
return;
! if (vstream_ferror(smtpd_proxy_replay_stream)) {
(void) vstream_fclose(smtpd_proxy_replay_stream);
smtpd_proxy_replay_stream = 0;
return;
--- 1132,1139
*/
if (smtpd_proxy_replay_stream == 0)
return;
! if (vstream_fflush(smtpd_proxy_replay_stream)
! || vstream_ferror(smtpd_proxy_replay_stream)) {
(void) vstream_fclose(smtpd_proxy_replay_stream);
smtpd_proxy_replay_stream = 0;
return;
Re: Bug
Dhiraj Chatpar: Dear Sir, I have noticed a bug in the 2.6 version of postfix where it says that cannot find /postmulti folder. Wondering if this is a bug or a installation error on my part. This error happens when i start postfix on centos. Wasn't this fixed recently? Wietse
Re: Bug
Dhiraj Chatpar: Sir, I just did a fresh installation yesterday. and fresh complied the new version of postfix 2.6 on a centos machine and i got this error. I dont know why it came. but it did. This was fixed 20091026, and will be part of Postfix 2.6.6. Wietse
Re: Experience with the new speed_adjust feature
Wietse Venema:
Mark Martinec:
On Friday 13 November 2009 18:52:03 Wietse Venema wrote:
Thanks for the logging. If you have time, can you change the code
to print information about the non-zero size? This could be a
filesystem feature where ftruncate() does not reset st_size until
the file is rewritten or closed (in which case my attempt to force
easly release of disk blocks are in vain).
Victor found it (missing fflush before ftruncate). If you can back
out the changes and apply the patch below.
To be really safe, replace vstream_fflush(stream) by
(vstream_bufstat(stream, VSTREAM_BST_OUT_PEND) vstream_fflush(stream)).
Wietse
*** ./smtpd_proxy.c.origMon Nov 9 19:41:50 2009
--- ./smtpd_proxy.c Fri Nov 13 13:29:55 2009
***
*** 1030,1035
--- 1030,1041
(p)-a10, (p)-a11, (p))
/*
+ * Sanity check.
+ */
+ if (state-proxy != 0)
+ msg_panic(smtpd_proxy_create: handle still exists);
+
+ /*
* Connect to the before-queue filter immediately.
*/
if ((flags SMTPD_PROXY_FLAG_SPEED_ADJUST) == 0) {
***
*** 1126,1132
*/
if (smtpd_proxy_replay_stream == 0)
return;
! if (vstream_ferror(smtpd_proxy_replay_stream)) {
(void) vstream_fclose(smtpd_proxy_replay_stream);
smtpd_proxy_replay_stream = 0;
return;
--- 1132,1140
*/
if (smtpd_proxy_replay_stream == 0)
return;
! if ((vstream_bufstat(smtpd_proxy_replay_stream, VSTREAM_BST_OUT_PEND) 0
! vstream_fflush(smtpd_proxy_replay_stream) != 0)
! || vstream_ferror(smtpd_proxy_replay_stream)) {
(void) vstream_fclose(smtpd_proxy_replay_stream);
smtpd_proxy_replay_stream = 0;
return;
Re: FreeBSD-related patch for src/util/sys_defs.h
Sahil Tandon: +#if (__FreeBSD_version = 702104 __FreeBSD_version = 80) \ + || __FreeBSD_version = 800100 It was initially reported to me as available with __FreeBSD_version = 800098. The above suggests that the feature does not exist with 80 __FreeBSD_version 800100. That shows me that I should only use first-hand information. My build machine has version 800107, so I'll use that as the minimal baseline. Wietse
Re: FreeBSD-related patch for src/util/sys_defs.h
Please do not top-post. See wikipedia for background information. Egoitz Aurrekoetxea Aurre: Hi, Wietse, what do you want to say with this? any problem for running some postfix release on freebsd? Perhaps I have not received the previous mail... El 14/11/2009, a las 14:17, Wietse Venema escribi?: Sahil Tandon: +#if (__FreeBSD_version = 702104 __FreeBSD_version = 80) \ + || __FreeBSD_version = 800100 It was initially reported to me as available with __FreeBSD_version = 800098. The above suggests that the feature does not exist with 80 __FreeBSD_version 800100. That shows me that I should only use first-hand information. My build machine has version 800107, so I'll use that as the minimal baseline. Postfix will assume that closefrom() exists on systems with __FreeBSD_version 800107 and later. With other versions, Postfix will use its own closefrom(), as it has done until now. Wietse
Re: Problem with recipient verification
Jeremy Bowen: I have a prolem with the new domain I added to the server and it is this new domain which is doing verification probes to my ISP. So, you need to add that domain to mydestination= parameter? It's added to my vdomains file as per: virtual_mailbox_domains = /etc/postfix/vdomains If you specify /etc/postfix/vdomains then postmap is not required, and some parts of Postfix never find out that the file has changed until postfix reload. postmap is required with, for example, hash:/etc/postfix/vdomains instead of /etc/postfix/vdomains. Wietse
Re: Problem with recipient verification
Jeremy Bowen: What is the logic behind where the verification probe is sent ? 4 out of 5 domains (all configured identically as far as I can tell) operate correctly and the probe seems to be handled locally. The other domain passes the verification probe to my upstream (relayhost). You configured one domain in a different manner than the four domains. To convince yourself, you could add a sixth domain (such as example.com) and see how Postfix tries to handle it. Wietse
Re: Log per domain
Magnus B?ck: On Mon, November 16, 2009 10:58 am, Jaroslaw Grzabel said: Is there any way to configure postfix to create separate log file for every domain it keeps ? No. Postfix needs to start logging before it even knows to which domain a log message pertains. Besides, one message may have more than one recipient. Wietse
Re: increase queue lifetime
Kammen van, Marco, Springer SBM NL: Hi All, Because of a crashed exchange server we need to queue messages longer on our smarthost then usual. I want to increase the time messages are queued to at least 2 weeks... Is changing the 'maximal_queue_lifetime' in main.cf sufficient to accomplish this? Also: bounce_queue_lifetime. Otherwise you lose delivery status notifications. These may be sent by remote or local systems. Wietse
Re: Backscatter being generated from mail aliased to other servers.
Jim Lang: OK here is the scenario. Spammer sends mail to: u...@myclientsdomain.com from forged address vic...@randomdomain.com If u...@myclientsdomain.com is delivered locally, not a problem, if the address is invalid, postix rejects the mail during the smtp connection. But if u...@myclientsdomain.com is an alias to mycli...@otherserver.com, postfix accepts the mail as deliverable and forwards it to hotmail.com. But if mycli...@otherserver.com can for whatever reason not be delivered, otherserver.com does what it is supposed to do and rejects the mail during the smtp connection, which causes postfix to send out a non-delivery report to vic...@randomdomain.com -- backscatter. Is there a way to stop this? Yes. Don't forward SPAM. Wietse
Re: ERROR in tcp protocol
Dhiraj Chatpar: HI, I am getting this error when i am trying to connect my postfix via transport_maps = tcp:localhost:2525 Nov 16 13:48:34 mail postfix/trivial-rewrite[4403]: fatal: unsupported dictionary type: tcp Use postconf -m to see what types of map are supported. Wietse
Re: Backscatter being generated from mail aliased to other servers.
Jim Lang: But if mycli...@otherserver.com can for whatever reason not be delivered, otherserver.com does what it is supposed to do and rejects the mail during the smtp connection, which causes postfix to send out a non-delivery report to vic...@randomdomain.com -- backscatter. Is there a way to stop this? Yes. Don't forward SPAM. Wietse And how do I do that in this scenario? You use recipient verification. I must have been really inarticulate when I wrote out the scenario. I do use recipient verification on my server. How is it that that is not clear? Do I need to rewrite this post? Recipient verification does not expand a local alias (imagine what would have to be done to verify with addresses in .forward files, or in a mail distribution list). So the best option is to avoid forwarding SPAM, including Victor's suggestion to not forward mail indefinitely for legacy user accounts. Other options get ugly quickly (such as replacing the return address). Wietse
Re: Backscatter being generated from mail aliased to other servers.
Miles Fidelman: Wietse Venema wrote: Recipient verification does not expand a local alias (imagine what would have to be done to verify with addresses in .forward files, or in a mail distribution list). Maybe I'm dense, but what would be the problem with verifying addresses in .forward files? Basically, the problem is the same as with other mechanisms, namely that the expansion may produce multiple results. Address verification would be a lot more complicated if it had do deal with forks and recursion. For list managers, it's a different story - the list manager needs NDNs in order to identify and remove bad addresses. Not all local aliases do or must replace the envelope sender. Wietse
Re: mx fails due to typo on remote dns
Postfix versions 2.3 and later skip a DNS record with a bad name. Unsupported Postfix versions pretend that the lookup failed when the result is invalid. Wietse
Re: mx fails due to typo on remote dns
Laurence Moughan: Ok , I upgraded to 2.6.5 - and still fails, Works for me. I suspect that your LOCAL dns server is making trouble. Wietse
Re: mx fails due to typo on remote dns
Wietse Venema: Laurence Moughan: Ok , I upgraded to 2.6.5 - and still fails, Works for me. I suspect that your LOCAL dns server is making trouble. Logging: Nov 17 06:34:54 spike postfix/qmgr[6861]: 509F61F3EA7: from=wie...@porcupine.org, size=338, nrcpt=1 (queue active) Nov 17 06:34:54 spike postfix/smtp[56957]: warning: valid_hostname: invalid character 92(decimal): cluster8a.eu.messagelabs.com\032 Nov 17 06:34:54 spike postfix/smtp[56957]: warning: malformed domain name in resource data of MX record for eurocommerce.ie: cluster8a.eu.messagelabs.com\032 Nov 17 06:34:55 spike postfix/smtp[56957]: 509F61F3EA7: to=postmas...@eurocommerce.ie, relay=cluster8.eu.messagelabs.com[85.158.140.211]:25, delay=1.4, delays=0.19/0.01/0.82/0.4, dsn=2.0.0, status=deliverable (250 OK) You need to test with a different up-stream DNS server. Wietse
Re: Betr.: Re: Betr.: Re: Trim part of the header with header rewriting ?
Arjan Melein: It's been a few days but i just ran into a little bump in the road.. It looks like the ;1:1 actually changes depending on the number of recipients. How would I change '/^RCPT\s+TO:(.*);1:1$/ RCPT TO:$1' into matching 'domain.tld;#:#' and put the domain.tld back without the ;#:# What does the # stand for? If it is one digit, replace 1 by [0-9], to handle multiple digits, replace 1 by [0-9]+ You can test this with: postmap -q RCPT TO:x.y.z ORCPT=rfc822;a...@b.c;3;4 pcre:/file/name Wietse
Re: How to intercept delivery errors?
Matthias Vill: Hi there, if I configure my /etc/aliases to read: test: |/bin/false, u...@external-server owner-test: u...@external-server I correctly receive E-Mail to test and owner test at u...@external-server, but the error-message which is generated by /bin/false is send back to the original sender. Apparently, owner-foo works for email addresses but not commands. That would be a bug. Wietse If I interpret http://www.postfix.org/aliases.5.html correctly, this should not be possible (and is not desired in my case). The configuration does not seem to contain any way to change the behavior of owner- besides expand_owner_alias and owner_request_special, which both are unrelated to my issue. Can you tell me how I can intercept all error-messages generated by external commands? Regards Matthias
Re: How to intercept delivery errors?
Victor Duchovni: On Tue, Nov 17, 2009 at 01:12:26PM -0500, Wietse Venema wrote: Apparently, owner-foo works for email addresses but not commands. That would be a bug. It is not easy to solve, since bounces are not sent by local(8), so we would need new a queue-file with owner-test as the new sender, but there is no secure mechanism to record a command as the recipient in the queue file. What about using the bounce_one() approach? local(8) already solved the notification problem with mail delivery loops that way. It would be nice to avoid synchronous single-recipient bounces whenever possible. With Delivered-To:, we expect at most one such bounce per current queue file, because the header in question is a message property. With failure reasons other than Delivered-To: loops, I would prefer to stick to indirect bounces. You may stick to indirect bounces. Generally, I think it is a better trade-off if the mail system can solve a problem without exposing it to the user. Fewer mistakes will be made, and the current case is not a hot code path. Wietse So perhaps we can avoid this code-path when the command is the *sole* (unowned) expansion of the original queue-file recipient address. Not sure how expensive it would to keep track of this. I am not a big fan of Sendmail-compatible alias semantics. Whenever possible I arrange for *all* alias expansion to be indirect, by making sure that $myorigin is not a local domain, and only suitably *rewritten* (in virtual(5)) mail is handed to the local transport. Command expansion poses a special problem in this respect, and the solution is typically to wrap-up the command in its own alias, and use its external (non-local) address when delivering mail to the command and other recipients. I do the same for non-command recipients also. So local(8) delivery is always indirect at non-leaf nodes, and most lists are managed on input via virtual alias expansion. -- Viktor. Disclaimer: off-list followups get on-list replies or get ignored. Please do not ignore the Reply-To header. To unsubscribe from the postfix-users list, visit http://www.postfix.org/lists.html or click the link below: mailto:majord...@postfix.org?body=unsubscribe%20postfix-users If my response solves your problem, the best way to thank me is to not send an it worked, thanks follow-up. If you must respond, please put It worked, thanks in the Subject so I can delete these quickly.
Re: Problem re-directing root's email
Nicholas Robinson: Hi I'm trying to re-direct my root email to my external email address. See: http://www.postfix.org/STANDARD_CONFIGURATION_README.html#some_local Wietse
Re: Relayhost to multiple hosts
Dhiraj Chatpar: We have 5 different servers.. all of them are mailing servers for our main company domain, I wish to Balance the mails across these 5 servers. Isn't that what the DNS was invented for? You specify the domain and its servers, and then all standards-compliant mail systems will distribute the load according to MX preferences. Wietse
Re: mx fails due to typo on remote dns
Laurence Moughan: obeml1# dig @resolver1.opendns.com eurocommerce.ie ; DiG 8.3 @resolver1.opendns.com eurocommerce.ie ; (1 server found) ;; res options: init recurs defnam dnsrch ;; got answer: ;; -HEADER- opcode: QUERY, status: NOERROR, id: 6 ;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0 ;; QUERY SECTION: ;; eurocommerce.ie, type = A, class = IN That is the wrong query. You need to ask for the MX record. Wietse
Re: Relayhost to multiple hosts
Dhiraj Chatpar: Yes the DNS is a good idea.. However what will i achieve if i implement the following? The solution is to have multiple MX records in the DNS. All standards-compliant MTAs will spread the load WITHOUT ANY SENDER SIDE CONFIGURATION. Wietse
Re: mx fails due to typo on remote dns
Laurence Moughan: I do ( detailed in the same email ) - and i get timeouts when there is a typo in the record - all correct records come back fine. You are doing one MX lookup that times out. Then, two A lookups for the email domain name, and that is wrong. Instead, you need to do one MX lookup for the email domain, and A lookups for the MX hostnames. Wietse
Re: Attempt MX, fallback to relay in case of error only
cont...@rusanu.com: Thanks Andreas, The reject would be '553 Mail from ... not allowed', so it sounds like a dead end trying to configure postfix to handle this. Suggestions on how to workaround are welcome. This is essentially the same problem as home office sites trying to send direct mail from a residential pool with fall-back to some ISP because their address is listed in zen.spamhaus.org. /etc/postfix/main.cf: smtp_fallback_relay=mail.isp.net /etc/postfix/master.cf: smtp unix - - n - - smtp -o soft_bounce=yes When the direct-to-destination delivery attempt fails, it will be the same Postfix SMTP client process that dumps the message to the fallback host, so 5xx replies will be ignored in both cases, and mail may remain queued forever. Ignoring 5xx responses is not kosher use of SMTP, and there is no enthousiastic support for Postfix to give 5xx replies a treatment that depends on context. Wietse Thanks, ~ Remus On Nov 18, 2009, at 1:12 AM, lst_ho...@kwsoft.de wrote: Zitat von cont...@rusanu.com cont...@rusanu.com: Is there a way to configure postfix to use a relay only if direct delivery is rejected? The case being a web application that has to send notification to subscribers, but some servers reject the connection (app IP originates from AWS EC2). I want those cases to be retried using a paid SMTP relay like authsmtp.com. However I don't want to use the relay for everything since it costs per mail. If it is rejected with a permanent error code (5xx) no retry an no fallback will happen. This is required by RFC. If the reject is with some temporary reject code or the connection is not accepted at all you need the fallback_relay parameter. Regards Andreas
Re: server configuration error
K bharathan: hi all the following is the log from my relay for example.com; this is read receipt which failed; this is happening only with this client domain; Nov 18 20:13:59 relay2 postfix/smtpd[4225]: NOQUEUE: reject: RCPT from ex.2n.cz[90.182.112.11]: 451 4.3.5 Server configuration error; from= to= Postfix sends problem details to the maillog file. http://www.postfix.org/DEBUG_README.html#logging Wietse
Re: Sending from multiple IPs, based on a header?
Ian Duggan: I am trying to configure postfix to work as follows: 1) In a header_check, look for a header X-Vmta: n where n is some number. 2) Based on n, choose an outgoing smtp transport (bound to some ip) Basically I want postfix to choose the outgoing IP based on a header that can be placed within the message. I have configured it thusly, so far, but I am getting a mail loops back to myself error. It means that the recipient domain resolves to a local address. Unfortunately you ignored instructions in the mailing list welcome message, and therefore there is no more concrete answer. Wietse main.cf: header_checks = regexp:/etc/postfix/header_checks header_checks: /^X-Vmta.*1$/ FILTER vmta1: /^X-Vmta.*2$/ FILTER vmta2: /^X-Vmta.*3$/ FILTER vmta3: /^X-Vmta.*4$/ FILTER vmta4: /^X-Vmta.*5$/ FILTER vmta5: master.cf: vmta1 unix - - n - - smtp -o smtp_bind_address=x.x.x.x vmta2 unix - - n - - smtp -o smtp_bind_address=y.y.y.y vmta3 unix - - n - - smtp -o smtp_bind_address=z.z.z.z vmta4 unix - - n - - smtp -o smtp_bind_address=w.w.w.w.w vmta5 unix - - n - - smtp -o smtp_bind_address=v.v.v.v My expectation was that the header_check would tag the mails when readding them to the queue and then they would go out the specified transport, but maybe the loop detection in postfix is defeating me? Is it that the requeued emails also pass through the header_checks? I'm fine with stripping off the header during the check to avoid that, but I don't see how to FILTER and IGNORE the same line based on header_checks(5). Ideas? --Ian
Re: server configuration error
K bharathan: [90.182.112.11] Nov 18 20:06:10 relay1 postfix/smtpd[21876]: NOQUEUE: reject: RCPT from ex.2n.cz[90.182.112.11]: 451 4.3.5 Server configurati Now try: grep 21876 /the/log/file Wietse
Re: Sending from multiple IPs, based on a header?
Ian Duggan: Nov 18 15:19:22 mail01 postfix/smtp[]: D9024B689D2: to=test.scr...@gmail.com, relay=none, delay=0.05, delays=0.05/0/0/0, dsn=5.4.6, status=bounced (mail for mail01.scribd.com loops back to myself) header_checks is here: header_checks: /^X-Vmta.*1$/ FILTER vmta1: /^X-Vmta.*2$/ FILTER vmta2: /^X-Vmta.*3$/ FILTER vmta3: /^X-Vmta.*4$/ FILTER vmta4: /^X-Vmta.*5$/ FILTER vmta5: Could the problem be that FILTER, as documented, expects a destination? FILTER transport:destination Write a content filter request to the queue file, and inspect the next input line. After the complete message is received it will be sent through the specified external content filter. More information about external content filters is in the Post- fix FILTER_README file. The header_checks(5) manpage does not say what happens when the destination is omitted. The access(5) manpage refers to the transports(5) manpage for syntax (the syntax depends on the type of delivery agent). The transports(5) manpage mentions that the destination defaults to the recipient domain. However, the scheduler uses a different default, which appears to be inconsistent. I wonder what would break if this were to be changed. For now, perhaps your header_checks rules can copy the recipient domain to the FILTER command. Wietse
Re: Sending from multiple IPs, based on a header?
Ian Duggan:
On Wed, Nov 18, 2009 at 2:03 PM, Wietse Venema wie...@porcupine.org wrote:
The transports(5) manpage mentions that the destination defaults
to the recipient domain. However, the scheduler uses a different
default, which appears to be inconsistent. I wonder what would
break if this were to be changed.
Yes, this seems to be the issue. I'm depending on, from transport(5):
A non-null transport field with a null nexthop field resets
the nexthop information to the recipient domain.
which doesn't seem to be happening. If you can direct me to the
relevant scheduler code or have a patch I could try, I'd be happy to
test it and see what happens.
The Postfix scheduler uses $myhostname as the default for all
imssing destinations. Transport maps are implemented by a different
program, hence the difference in default policies.
Making changes to the scheduler is non-trivial (i.e. it actually
requires more testing than simply it works) and it is not a good
idea to do this at the end of along day.
Apart from that is the question what existing usage patterns would
break if this default behavior were to be changed almost 10 years
after it was introduced. It is not a win if I piss of lots of
others.
For now, perhaps your header_checks rules can copy the recipient
domain to the FILTER command.
Success! Well, more or less. This is working, but I'm not 100%
satisfied with it since the sender has to specify the domain to send
to twice in the email, making sure the X-Vmta header matches the
recipient domain.
/^X-Vmta.*\s*([0-9]+)(\s*(\S*))?/ FILTER vmta${1}:${3}
So:
X-Vmta: 3 gmail.com maps to vmta3:gmail.com
In smtpd_recipient_restrictions you can have an access(5) map
that uses PREPEND.
/@([...@]+)$/ PREPEND X-Vmta: $1
which can be picked up by header_checks, because thuse happen later.
And that is as far as I am willing to reach out at this time.
Can anyone think of a way to easily grab the recipient domain from the
To: header line and have it available somehow when writing the FILTER
line? I can't envision a way to pass information between lines like
that.
As documented there is no way to pass information from one header/body
action to another header/body action.
My preference is to figure out how to get postfix to do what
transport(5) seems to indicate it should, however.
I think this use case is so peripheral to legitimacy that it's not
a priority for me to find out what things will break when this were
to be changed.
I am suspicious when people try to use Postfix to implement
IP-based reputation tricks.
Wietse
Re: Error in postmulti
Dhiraj Chatpar: r...@campaignindia:/etc# postmulti -I postfix-1 -G mta -e create postfix: warning: dict_open_dlinfo: cannot open /etc/postfix-1/ dynamicmaps.cf. No dynamic maps will be allowed. wondering why am i getting this error That is a DEBIAN extension (also in UBUNTU). I suggest that you file a bugreport THERE. Wietse
Re: lost connection with while receiving the initial server greeting
Pawe? Burzy?ski: (lost connection with orion.put.poznan.pl[150.254.5.4] while receiving the initial server greeting) The TCP-level three-way handshake was completed, but no SMTP-level greeting was received within $smtp_helo_timeout seconds (default: 300s). In other words, an application-layer problem. This could mean that all SMTP *server* processes are busy. Wietse
Re: advice on source route
Ralf Hildebrandt: * Peter S?rensen mas...@sdu.dk: Hi, We use postfix in front of our local email servers where 80% is based on exchange. We have around 25000 users/distlist/emaillist We would like to implement a system where all email addresses are known and which server will handle it. Because this is a heterogeneous environment the system should contain all valid email addresses and the name of destination server for this. I can't use AD for this. I can't use transport maps to do this. I use virtual_alias_maps for that ralf.hildebra...@charite.de -- loginn...@mailboxserver.charite.de Another option would be to implement the mail gateway example in http://www.postfix.org/STANDARD_CONFIGURATION_README.html#firewall To avoid the problem that virtual aliasing changes the recipient address: - List the domain in relay_domains - Use relay_recipient_maps to reject non-existent recipients - Use transports_maps for u...@example.com - smtp:[servername] mapping. (I can't use X is unclear. I read this as I don't know X would solve this problem). Wietse
Re: Sending from multiple IPs, based on a header?
Ian Duggan: On Wed, Nov 18, 2009 at 4:53 PM, Wietse Venema wie...@porcupine.org wrote: In smtpd_recipient_restrictions you can have an access(5) map that uses PREPEND. ? ?/@([...@]+)$/ PREPEND X-Vmta: $1 which can be picked up by header_checks, because thuse happen later. And that is as far as I am willing to reach out at this time. I will think on this more, but that just supplies the domain without the transport number needed to select the IP, and we definitely don't want to randomize it or anything like that. Thank you for your help. Doing this right in Postfix requires either multiple instances (perhaps using sender_dependent_relayhost_maps to do the fan out) or a new built-in mechanism that actually works. I don't think that re-chartering the FILTER command is the right way. As the name suggests, FILTER is designed for content inspection, and for this reason it makes little sense to introduce a FILTER destination that defaults to the recipient's domain (especially considering that I pushed hard for SMTP-based content filters). Changing the default FILTER destination from static to recipient domain would affect performance for sites that use the simple filter (Postfix pipe - command - Postfix sendmail) approach. This currently does not require an explicit destination in the FILTER command, although some examples show a dummy destination. Specifically, this changes simple filter queue scheduling from FIFO message selection (all messages have the same filter destination) into round-robin destination domain selection, and that would introduce anomalous delays for destinations that receive lots of mail. The kind of badness that we eliminated eight years ago. Past attempts at sender-dependent routing have not been successful and their code was removed because it had unexpected failures in corner cases. Postfix code is supposed to do something reasonable no matter what you throw at it (even if this means declining to handle radio-active waste). Wietse
Re: sender_bcc
Magnus B?ck: On Thursday, November 19, 2009 at 20:01 CET, Osmany Goderich Navarro osm...@oc.quimefa.cu wrote: I have a Postfix+Dovecot+MySQL configuration. I want postfix to bcc messages coming from a specific address to a specific domain. I have currently hosting three virtual domains. I have tried to use sender_bcc_maps to do this, but this only copies the messages to certain users regardless of what domain the message was meant to go. Can anyone please help me find out how to tell sender_bcc only to work for one specific domain? Postfix does not support this natively. You need to use either sender_bcc_maps or recipient_bcc_maps and send the messages to a filter or similar that applies the second domain restriction and only passes a subset of the messages. If the bcc'd messages are being delivered locally you should be able to use a delivery agent like procmail to do this. I was going to suggest using a policy daemon that responds with a BCC action, because that is a more natural way to make decisions based on sender and recipient, but I find that the BCC access map action is not marked as ready for stable release. Perhaps this is because people would expect BCC action support in the header/body_checks, too? That was definitely not possible before I added support to add/modify envelopes with Milter applications. Otherwise, the access map code for BCC is a direct rip-off of the code for the FILTER action, so I see no real objection to calling the BCC access map action stable. Wietse
Re: 4KB of disk space burning on a single email
J. Roeleveld: On Friday 20 November 2009 13:42:58 Arora, Sumit wrote: Hi folks, I'm just testing my postfix server for load and disk usage. I'm using content filter on some another server, and I don't feed the email back to postfix. Email data is getting deleted from my postfix server, but I don't know where 4KB of my disk space gone on every email my postfix server receives. If anybody have some idea, please tell me. -Sumit Arora My guess is that the filesystem has a block-size of 4KB. A file is stored over a set of blocks of this size. Which means that if a file is smaller then 4KB, it will still use a 4KB block. As far as I know, only reiserfs has the notailoption which will try to stick multiple smaller files into a single block. 25 Years ago, the UFS file system came with large blocks (typ 8k) and small fragments (typ 1k). The tail fragments from different files could then share the same large block. In the mean time, the 8k blocksize has been replaced by larger blocksizes like 32k but the idea is the same: low fragmentation without wasting space. Wietse Marshall Kirk McKusick, William N. Joy, Samuel J. Leffler and Robert S. Fabry. A Fast File System for UNIX. Technical Report Computer Systems Research Group, Computer Science Division, Department of Electrical Engineering and Computer Science, University of California, Berkeley, Berkeley, CA 94720. http://www.cs.berkeley.edu/~brewer/cs262/FFS.pdf
Re: 4KB of disk space burning on a single email
Arora, Sumit: I've checked the size of maillog It's size is getting increased by 4KB on receiving each email. We know what you believe. Now we would like to see some actual concrete evidence. Wietse
Re: Relay and mynetworks
Jeronimo: I chance the restriction because I want that only messages from mydomain pass through the relay. That is not what the configuration does. In reality, it forwards mail from anyone who sends mail with your domain name in the sender address. So put back the default smtpd_recipient_restrictions, and APPEND your sender access check AFTER reject_unauth_destination. Wietse Thanks 2009/11/20 Victor Duchovni victor.ducho...@morganstanley.com On Fri, Nov 20, 2009 at 05:04:44PM -0200, Jeronimo wrote: Hi, I always think that only hosts in mynetworks can do relay on my server, but... I created the following rule smtpd_recipient_restrictions = check_sender_access hash:/etc/postfix/dominios_permitidos, reject This is a disasterously bad idea and turns you into an open relay. and put this on the dominios_permitidos map meudominio.com.br OK DO NOT do this. Restore smtpd_recipient_restrictions to its correct default value, and then start a new thread where you describe what problem motivated you do do this. If I remove this last three lines the relay becomes close. Anyone knows how to restrict relay and only accept MAIL FROM my domain? Set mynetworks correctly. Do NOTHING else. Postfix works correctly by default. What caused you to change the recipient restrictions? -- Viktor. Disclaimer: off-list followups get on-list replies or get ignored. Please do not ignore the Reply-To header. To unsubscribe from the postfix-users list, visit http://www.postfix.org/lists.html or click the link below: mailto:majord...@postfix.org?body=unsubscribe%20postfix-users If my response solves your problem, the best way to thank me is to not send an it worked, thanks follow-up. If you must respond, please put It worked, thanks in the Subject so I can delete these quickly.
Re: pcre:table client_restrictions
Eugene V. Boontseff: eug...@mail [/usr/local/etc/postfix]# postmap -fq ppp92-100-127-177.pppoe.avangarddsl.ru[92.100.127.177] pcre:exper Use ppp92.. not ppp92... Wietse
Design: sender-dependent default_transport
Recently there have been requests for sending mail with source IP addresses that depend on the envelope sender. Sometimes the request appeared to be related to showshoe spamming, and sometimes it appeared to be a legitimate attempt to protect IP-based domain reputations of different customers. Current solution The current solution that Postfix offers is to use multiple instances: one back-end instance per source IP address, and one front-end instance that uses sender_dependent_relayhost_maps to choose the right back-end instance. That is a heavy solution, even though Postfix 2.6 multi-instance support hides most of the complexity. Past solutions == Attempts to modify existing features for this job make Postfix harder to explain, or have negative performance impact for content inspection as with a recent proposal to change the meaning of a FILTER actions with an empty destination (this would replace FIFO selection by domain-based round-robin selection). Going back in time, the old Postfix sender_dependent_routing feature was withdrawn a few years ago because it replaced ALL mail routing decisions by sender-based routing. That broke deliveries to local recipients, and was therefore not good for a general-purpose MTA. A promising solution The solution is not to make ALL routing decisions dependent on the sender address, but ONLY the routing decisions for mail that leaves the machine. A sender-dependent default_transport would change the meaning of default_transport (namely, giving default_transport a lower precedence than sender_dependent_default_transport_maps) and introduces a few new parameters. (It looks like a sender-dependent default_transport would do the job. It does not seem to make sense to make relay_transport also sender-dependent, because relay_transport is supposed to be used only for domains Postfix is MX host for.) The draft design looks like this: default_transport (default: smtp) The default mail delivery transport and next-hop destination for desti- nations that do not match $mydestination, $inet_interfaces, $proxy_interfaces, $virtual_alias_domains, $virtual_mailbox_domains, or $relay_domains. In order of decreasing precedence, the nexthop desti- nation is taken from $default_transport, $sender_dependent_relay- host_maps, $relayhost, or from the recipient domain. This information can be overruled with the sender_dependent_default_transport_maps parameter and with the transport(5) table. Specify a string of the form transport:nexthop, where transport is the name of a mail delivery transport defined in master.cf. The :nexthop part is optional. For more details see the transport(5) manual page. Example: default_transport = uucp:relayhostname sender_dependent_default_transport_maps (default: empty) A sender-dependent override for the global default_transport parameter setting. The tables are searched by the envelope sender address and @domain. A lookup result of DUNNO terminates the search without over- riding the global default_transport parameter setting. This informa- tion is overruled with the transport(5) table. For safety reasons, this feature does not allow $number substitutions in regular expression maps. This feature is available in Postfix 2.7 and later. empty_address_default_transport_maps_lookup_key (default: ) The sender_dependent_default_transport_maps search string that will be used instead of the null sender address. This feature is available in Postfix 2.7 and later. address_verify_sender_dependent_default_transport_maps (default: empty) Overrides the sender_dependent_default_transport_maps parameter setting for address verification probes. This feature is available in Postfix 2.7 and later. A first stab at some code looks promising. I'll run tests as time is available, but I am currently busy with reviewing research proposals, and that will take most cycles until early December. Wietse
Re: aliases allow_mail_to_files maximum size ?
Ronan REYNAUD: hello I'm using a file in aliases (with allow_mail_to_files set) and it's currently working perfectly. With allow_mail_to_files, Postfix APPENDS mail to a local file. But I'd like to know if there's a limit to the number of mail addresses in this file ? (i'll need about 3,000 addresses in this file.. how aliases will handle this ?) APPENDing is not READing. Wietse
Re: aliases allow_mail_to_files maximum size ?
Ronan REYNAUD: I thought I must add include to allow_mail_to_files = alias,forward,include in main.cf to use include in the aliases As documented, the allow_mail_to_files feature says whether Postfix can deliver mail to external files. The syntax for delivering to file is /file/name. The allow_mail_to_files feature does not control how Postfix reads destinations from an :include: file. My question was about this file.list, how long can it be ? The size of a Postfix queue file is specified with message_size_limit. This limit includes all the recipient addresses. So, you can't have more recipients than fit in a file of size message_size_limit. as I read your answer, I think there's something not clear here.. deliver mail to file is not read recipients from file. Wietse
Re: Tweak Postfix so that it will resend emails after the initial 451 response
jan gestre: us...@former.sample: host webmail.former.sample[210.21x.xx.xx] said: 451 Temporary failure, please try again later. (in reply to DATA command) Postfix always resends after 451, but it stops when the message is too old (the default limits are: maximal_queue_lifetime = 5d and bounce_queue_lifetime = 5d). The maillog file will show how long Postfix has been retrying deliveries. Wietse
Re: How to test server and stop test messages being sent out
Kevin Bailey: Hi, I need to test the move of a mailing list to another server. What I'd like to do is to stop the Postfix server on the new server from sending out any mails but still put them into the queue. I could then test the mail list (which actually only has 43 members) and then see what emails appear in the queue. The I want to be able to delete all those mails - and then re-enable the Postfix server. Any pointers gratefully received. Postfix 2.6 and later: # postconf -e master_service_disable=qmgr # postfix reload Older Postfix: Comment out the queue manager in master.cf and do postfix reload. You didn't say that you want to continue other mail deliveries. Wietse
Re: How to test server and stop test messages being sent out
Wietse Venema: Kevin Bailey: Hi, I need to test the move of a mailing list to another server. What I'd like to do is to stop the Postfix server on the new server from sending out any mails but still put them into the queue. I could then test the mail list (which actually only has 43 members) and then see what emails appear in the queue. The I want to be able to delete all those mails - and then re-enable the Postfix server. Any pointers gratefully received. Postfix 2.6 and later: # postconf -e master_service_disable=qmgr # postfix reload That should be qmgr.fifo, but you get the idea. Wietse Older Postfix: Comment out the queue manager in master.cf and do postfix reload. You didn't say that you want to continue other mail deliveries. Wietse
Re: Multiple Mail domains for reverse ptr records? I'm confused
ML: Hi All, I have some confusion about multiple reverse PTR records per IP. You need only one. The name (from the address-name) lookup must resolve to the address. Wietse Comcast has told me that they can only assign 2 reverse PTR records per IP. So if I have mail.domainA.com and mail.domainB.com this is fine. If the re -verse lookup is done and it is not correct, it will retry and get the second - record and all is well. How do people then run a large mail server with many domains? I have about - 10 domains that need e-mail and I wanted to build a single mail server to h -andle this. But now I guess it can't be done? What is my best way to accomplish this? I dont want a lot of machines clut -tering up my apartment and consuming massive electricity until my startup is - off the ground.. Best, -Jason
Re: Milter's not working on Postfix 2.6.5
Sharma, Ashish: Solved the problem using setting: milter_protocolhttp://www.postfix.org/postconf.5.html#milter_protocol = 2 as mentioned in: http://www.postfix.org/MILTER_README.html in 'main.cf' When in doubt, read the release notes file. [Incompat 20090428] The default milter_protocol setting is increased from 2 to 6; this enables all available features up to and including Sendmail 8.14.0. The new milter_protocol setting may break compatibility with older Milter libraries or applications, and may cause Postfix to log warning messages such as: warning: milter inet:host:port: can't read packet header: Unknown error : 0 warning: milter inet:host:port: can't read packet header: Success warning: milter inet:host:port: can't read SMFIC_DATA reply packet header: No such file or directory To restore compatibility, specify milter_protocol = 2 in main.cf. Wietse
Re: Don't filter the users\
Jordi Espasa Clofent: Hi all, I've a Postfix working with Perl-based filter. All works fine, but I don't want filter the legitimate users (who are authenticated using SASL) when they want to do massive mailing using their e-mail client (ThunderBird, Outlook... and so on). That is easy. Have your users connect to the submission port, and let everyone else connnect to the smtp port. Then, specify =o content_filter=whatever for the smtp port and not for the submission port. If you are taking in all mail on port 25 then you are making mail handling more complicated than it needs to be. Wietse
Re: Don't filter the users
Jordi Espasa Clofent: That is easy. Have your users connect to the submission port, and let everyone else connnect to the smtp port. Then, specify =o content_filter=whatever for the smtp port and not for the submission port. Yes Wietse, I've considered this simple and clean option, but we're a hosting company and the costumers are to lazy to understand and accept an approach like this. You can tell the users that the submission port gets a better level of service than port 25, because they share that port with spammers. As you pointed out in your original email, they would be subject to less filtering, and therefore there would be less delay, less false positives, and so on. Wietse
Re: Rate limiting with anvil
Daniel Ryslink: Hello, I am trying to set rate limits on our smtp relays to prevent abusive (compromised) user hosts from flooding the service with fast, intensive mail floods. I have used the following directives (I can post whole main.cf, but I don't think it's necessary): smtpd_recipient_limit = 100 smtpd_error_sleep_time = 5 smtpd_client_recipient_rate_limit = 60 smtpd_client_connection_rate_limit = 30 smtpd_client_message_rate_limit = 100 smtpd_soft_error_limit = 10 smtpd_hard_error_limit = 20 anvil_rate_time_unit = 300 According to the instructions in the mailing list welcome message, send postconf -n output instead of cut-and-paste. However, these limits do not seem to apply, I have recently experienced a massive flood from a single user that managed to send hundreds of thousands of mails overnight. According to the instructions in the mailing list welcome message, show Postfix LOGGING to demonstrate that the mail actually arrived via the Postfix SMTP SERVER and not via a PHP script that invokes the Postfix SENDMAIL command. Wietse I thought that especially limiting the number of recipients to 60 / 5 minutes will be quite effective against spam floods, but the anvil is probably working in a different way than I thought, please advice. Thank you kindly in advance. Best regards Daniel Ryslink
Re: Rate limiting with anvil
By default, Postfix will exclude clients in mynetworks from smtpd_client_mumble_limits. You may want to specify a separate list for mynetworks (relay control) and for anvil (rate control). http://www.postfix.org/postconf.5.html#smtpd_client_event_limit_exceptions (with Postfix 2.1, this was called smtpd_client_connection_limit_exceptions). Wietse
Re: Postfix/Cyrus Forwarding Question
Dennis Putnam: I'm not sure if this is the right forum for this question but I don't know where else to start. I am running Postfix/Cyrus on the same server that contains user home directories. The forwarding mechanism (.forward) is, of course, working and I understand it. What I don't understand is how this mechanism works, or even if it does, when a user's home directory is on a different server than Postfix/Cyrus. In other words when Postfix/Cyrus does not have access to the user's home directory. Or is there some other delivery mechanism involved that I am missing? Thanks. Can someone explain if this can work and if, so how. If not, what do users do in that case? With Postfix, these files don't have to live in the user's home directory. You can specify an alternate location with the forward_path configuration parameter. Wietse
Re: Postfix/Cyrus Forwarding Question
Victor Duchovni:
On Wed, Nov 25, 2009 at 12:41:37PM -0500, Dennis Putnam wrote:
If I understand this correctly, I can set the forward_path to a directory
No, not a directory a file, and not a file, but a set of files, one
for each user.
For example I remember from historic times something like:
forward_path = /var/forward/$user
With address extensions turned on, it would look like:
forward_path = /var/forward/${user}${recipient_delimiter}${extension},
/var/forward/${user}
But, the latter is untested.
Wietse
Re: Incoming mail archiving with Postfix
Zohan: Hi, I need to archive all incoming mail for my virtual domains (by copying mail to dedicated archive mailbox) and then sort it according to address it has been delivered to. Postfix local/pipe/virtual delivery agents record the delivered to address in the Delivered-To: header. One major drawback of existing milter-based solutions, as well as of virtual aliasing and BCC maps, is that in some cases neither To: header nor envelope-to contain actual recipient address. Postfix local/pipe/virtual delivery agents record the original recipient address in the X-Original-To: header. man 8 local man 8 pipe man 8 virtual Wietse
Re: Impact of SSL renegotiation attacks on SMTP mail
gmx: In-Reply-To-Message-ID: 20091109012901.6d90f1f3...@spike.porcupine.org Hi Wietse and Victor, Thank you very much for your analyses http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3555 . As a practitioner, the following question arises as we are in a business partner context as you describe in http://www.porcupine.org/postfix-mirror/smtp-renegotiate.pdf p. 6: 1) will a) smtpd_tls_ask_ccert, b) smtpd_tls_wrappermode, c) smtpd_use_tls, d) smtpd_enforce_tls still work with the new openssl 0.9.8l http://marc.info/?l=openssl-usersm=125751806022186w=2 ? 2) should I upgrade the openssl on the MTA to that version? They will break if some REMOTE system wants to renegotiate TLS, using a protocol that is not supported by the LOCAL TLS implementation. Note that it says: remote system wants to renegotiate. Postfix does not request renegotiation, as far as I know. 3) on p. 11, you say Wietse and Victor concocted detection mechanisms and workarounds. Some may even end up in Postfix. - will they still be needed with the new openssl that disables renegotiation altogether? These CLIENT-SIDE workarounds detect some attacks when you are talking to servers with vulnerable SSL implementations. Wietse
Re: Re[2]: Incoming mail archiving with Postfix
Zohan: Wietse, thank you, Postfix local/pipe/virtual delivery agents record the delivered to address in the Delivered-To: header That is, the final recipient address after alias processing and forwarding. All mail that is delivered to the same mailbox has the same Delivered-To: address. Postfix local/pipe/virtual delivery agents record the original recipient in the X-Original-To: header. That is, the recipient address before alias processing and forwarding. You can embed the original recipient as an extension to the final recipient address, if you must insist on using the Delivered-To: header. Using pcre-based recipient_bcc_maps: /^(.+)@([...@]+)$/ archive+$1...@example.com Wietse
Re: sender check
Marco Giardini: I have a barracuda server that receives mails, filter them and forward to a linux system running postfix. Both machine have a public IP (static). The linux system is configured to be used as SMTP for sasl authenticated users as well, besides to be used as SMTP for the people on $mynetworks (permit_mynetworks in the smtpd_recipient_restrictions). Unfortunatley, some spammers, have found it and use to spam local recipients using the linux machine, avoiding so to be filtered through the barracuda system. I'm wondering if there is a way to allow OLNY local users or users belonging to the domains hosted by the linux server to use SMTP. To permit only local systems (incl. barracuda box), or users that have a relationship with your server: smtpd_recipient_restrictions = permit_mynetworks permit_sasl_authenticated reject Wietse
Re: sender check
Marco Giardini: * Wietse Venema wie...@porcupine.org [2009-11-26 12:20:19 -0500]: Marco Giardini: I have a barracuda server that receives mails, filter them and forward to a linux system running postfix. Both machine have a public IP (static). The linux system is configured to be used as SMTP for sasl authenticated users as well, besides to be used as SMTP for the people on $mynetworks (permit_mynetworks in the smtpd_recipient_restrictions). Unfortunatley, some spammers, have found it and use to spam local recipients using the linux machine, avoiding so to be filtered through the barracuda system. I'm wondering if there is a way to allow OLNY local users or users belonging to the domains hosted by the linux server to use SMTP. To permit only local systems (incl. barracuda box), or users that have a relationship with your server: smtpd_recipient_restrictions = permit_mynetworks permit_sasl_authenticated reject Wietse i do use: smtpd_recipient_restrictions = permit_mynetworks permit_sasl_authenticated reject_unauth_destination I wrote: vv permit_mynetworks permit_sasl_authenticated reject ^^ Wietse
Re: CMD tool to check if next SMTP hop can use TLS for messages?
Harakiri: I know about all the difficulties with MX lookup etc, the original goal would be - that i have a policy for external domains - and that for certain domains a message should only be sent if TLS is available - if a message to a certain domain is sent which does not support TLS - it should be blocked - i know i could probably In that case, everything you need already exists. 1) Configure the Postfix SMTP client to REQUIRE TLS. smtp_tls_security_level=encrypt 2) Configure the Postfix SMTP server to reject mail that cannot be delivered via SMTP-over-TLS. smtpd_recipient_restrictions = reject_unverified_recipient permit_mynetworks reject_unauth_destination See also: http://www.postfix.org/ADDRESS_VERIFICATION_README.html#recipient http://www.postfix.org/ADDRESS_VERIFICATION_README.html#caching Wietse
Re: Multiple Mail domains for reverse ptr records? I'm confused
Greg A. Woods: There _should_ be one PTR for every _valid_ hostname using a given IP address. Statements such as above remind me of silly knights fighting windmills. There is a difference between right and useful, and it even depends on where they are used - server or client side. Multiple server A records are useful. More in the case of HTTP, less in the case of SMTP which uses indirection via MX records. (For a discussion about domain-in-a-box applications, see some actual measurements that I did earlier this year). One PTR per A record is not useful. The server end will not know what client name to use. On the other hand, it is right when every PTR record has a matching A record that resolves to (among others) the PTR record's address. Wietse
Re: Multiple Mail domains for reverse ptr records? I'm confused
Wietse Venema: Greg A. Woods: There _should_ be one PTR for every _valid_ hostname using a given IP address. Statements such as above remind me of silly knights fighting windmills. There is a difference between right and useful, and it even depends on where they are used - server or client side. Multiple server A records are useful. More in the case of HTTP, less in the case of SMTP which uses indirection via MX records. (For a discussion about domain-in-a-box applications, see some actual measurements that I did earlier this year). One PTR per A record is not useful. The server end will not know what client name to use. That is, one PTR per A record, in the case of multiple A records for the same IP address. On the other hand, it is right when every PTR record has a matching A record that resolves to (among others) the PTR record's address. Wietse
Re: Postfix Deployment
Stan Hoeppner: I'm running my Postfix firewall behind NAT/PAT and the setup didn't require any non-default Postfix settings to make it work. I port forwarded TCP 25 from my router to my internal Postfix host IP and all worked without issue. What settings are you referring to? proxy_interfaces=external-ip-address, which is needed to avoid mail loops to myself errors when you provide backup MX service, and the primary is for some reason not available. Wietse
Re: CMD tool to check if next SMTP hop can use TLS for messages?
Harakiri: 1) Configure the Postfix SMTP client to REQUIRE TLS. ? ? smtp_tls_security_level=encrypt no - as i said, my filer has own rules and can be based on recipient, sender, or a combination of both - postfix cant do this, or at least not without different policy servers 2) Configure the Postfix SMTP server to reject mail that ???cannot be delivered via SMTP-over-TLS. ? ? smtpd_recipient_restrictions = ??? reject_unverified_recipient ??? permit_mynetworks ??? reject_unauth_destination again, doesnt work - as i said i want this policy based in an existing filter - therefor i asked for a CMD app to check the existing of TLS myself Given this: I know about all the difficulties with MX lookup etc, the original goal would be - that i have a policy for external domains - and that for certain domains a message should only be sent if TLS is available - if a message to a certain domain is sent which does not support TLS - it should be blocked - You can configure reject_unverified_recipient to use a message delivery transport that requires TLS, even when normal mail deliveries don't require it: /etc/postfix/main.cf: address_verify_transport_maps = hash:/etc/postfix/verify_transport /etc/postfix/verify_transport: example.com smtp-tls-required: /etc/postfix/master.cf: smtp-tls-required unix - - - - - smtp -o smtp_tls_security_level=encrypt Then, you can invoke reject_unverified_recipient SELECTIVELY for the domains that need TLS. Wietse
Re: Postfix Deployment
Stan Hoeppner: Wietse Venema put forth on 11/27/2009 5:17 PM: Stan Hoeppner: I'm running my Postfix firewall behind NAT/PAT and the setup didn't require any non-default Postfix settings to make it work. I port forwarded TCP 25 from my router to my internal Postfix host IP and all worked without issue. What settings are you referring to? proxy_interfaces=external-ip-address, which is needed to avoid mail loops to myself errors when you provide backup MX service, and the primary is for some reason not available. Thanks for the heads up Wietse. What is the effect of proxy_interfaces on a NAT'd Postfix box if I'm not running a/as backup MX? (I'm not) Any? All features that use $inet_interfaces to decide if an address is local will also use $proxy_interfaces for that same purpose. This includes MX elimination when sending mail via SMTP, canonical/virtual/etc mapping with u...@[ipaddres], accepting u...@[ipaddres] via SMTP, and more. I was referring to FALSE alarms with BACKUP mx hosts that resolve to $proxy_interfaces. I was not referring to TRUE alarms when you tell Postfix to deliver a domain not in mydestination etc. with a PRIMARY mx that resolves to a local IP addres. Wietse
Re: Mail from cron delay
Emmett Culley: For some months I've been noticing on multiple servers that mail from a cron job defined in the root's crontab takes 24 hours to get to it's destination. It finally bugged me enough to have me take a look for the reason. This is what I found in the maillog for each day: Nov 29 03:15:58 den1 postfix/pickup[8219]: B0771588D1B: uid=0 from=root Nov 29 03:15:58 den1 postfix/cleanup[7689]: B0771588D1B: message-id=20091129101558.b0771588...@den1.thisserver.net Nov 29 03:15:58 den1 postfix/qmgr[3361]: B0771588D1B: from=r...@den1.thisserver.net, size=819, nrcpt=1 (queue active) Nov 29 03:15:59 den1 postfix/smtp[7691]: B0771588D1B: to=webmas...@example.com, relay=example.com[123.45.67.89]:25, delay=86457, delays=86457/0/0.36/0.18, dsn=2.0.0, status=sent (250 2.0.0 Ok: queued as 3586C400032) This message is queued on a DIFFERENT mail system example.com[123.45.67.89]:25, meaning it was sent via the SMTP port (port 25) to a mail system on a named example.com with IP address 123.45.67.89. Is the local machine running MacOS? Apple has made some changes such that Postfix is not running all of the time. This is a change that is specific to APPLE, and may explain why mail not picked up as soon as it is enqueued. Is the queue on a file server, and are the client and file server clocks out of sync? Looking at the Received: in your message as delivered, the clocks on those systems are all out of sync. Wietse
Re: Mail from cron delay
Victor Duchovni: On Sun, Nov 29, 2009 at 02:42:14PM -0800, Emmett Culley wrote: For some months I've been noticing on multiple servers that mail from a cron job defined in the root's crontab takes 24 hours to get to it's destination. It finally bugged me enough to have me take a look for the reason. This is what I found in the maillog for each day: Nov 29 03:15:58 den1 postfix/pickup[8219]: B0771588D1B: uid=0 from=root Nov 29 03:15:58 den1 postfix/cleanup[7689]: B0771588D1B: message-id=20091129101558.b0771588...@den1.thisserver.net Nov 29 03:15:58 den1 postfix/qmgr[3361]: B0771588D1B: from=r...@den1.thisserver.net, size=819, nrcpt=1 (queue active) Nov 29 03:15:59 den1 postfix/smtp[7691]: B0771588D1B: to=webmas...@example.com, relay=example.com[123.45.67.89]:25, delay=86457, delays=86457/0/0.36/0.18, dsn=2.0.0, status=sent (250 2.0.0 Ok: queued as 3586C400032) Nov 29 03:15:59 den1 postfix/qmgr[3361]: B0771588D1B: removed Any warnings in your logs matching either of the below regexps? egrep 'message dated [0-9]* seconds into the future' /some/log/file egrep 'message has been queued for [0-9]* days' /some/log/file Some unhelpful systems log warning messages separate from normal activity, so he may have to look in different files. Wietse
Re: Something like address based relay just the other way around
Tobi: Hello I just wonder whether my idea is technically possible to fullfill with Postfix. I already use sender based relaying which works fine. My problem is that I'm running a Postfix Server on my dynamic IP-Address. I would say for 80% of the receivers is no problem to send the emails directly (direct-mx). Some domains or receivers do not accept this due to dynamic IP block. No problem I thought I could set up a receiver-based relay, but unfortunatly I did not find anything about it in Postfix doc (maybe I looked for the wrong keywords). See this URL: http://www.postfix.org/transport.5.html If I am not mistaken, this has precedence over sender-dependent features. Wietse So my question is: Is there a way to conditionally relay emails based on the receivers address/domain? So I could send emails for defined addresses/domains via my ISP mailserver instead of direct-mx. Is there a way to do this in Postfix? Thanks a lot for all tipps/hints Cheers tobi
Re: Something like address based relay just the other way around
tobi: [ Charset ISO-8859-1 unsupported, converting... ] Wietse Venema schrieb: Tobi: Hello I just wonder whether my idea is technically possible to fullfill with Postfix. I already use sender based relaying which works fine. My problem is that I'm running a Postfix Server on my dynamic IP-Address. I would say for 80% of the receivers is no problem to send the emails directly (direct-mx). Some domains or receivers do not accept this due to dynamic IP block. No problem I thought I could set up a receiver-based relay, but unfortunatly I did not find anything about it in Postfix doc (maybe I looked for the wrong keywords). See this URL: http://www.postfix.org/transport.5.html If I am not mistaken, this has precedence over sender-dependent features. I tried according to Wietse's link to the manual and it works 50% ;-) The email is properly forwarded according to receivers domain with the values in transport conf file But now Postfix has no user details to perform a SMTP Authentication at the defined relay server. smtp tries to relay without auth which my providers server don't like. If I'm using sender_dependent_relay then Then you made too many transport map entries. Wietse
Re: A question about Postfix and virus scanning
Stan Hoeppner: Michael Katz put forth on 11/30/2009 2:45 PM: There are many filtering Postfix AV solutions that are far more efficient than Amavisd and many AV scanners that are considerably more scalable than clamav such. A few years ago we did some detailed testing between ClamAV and commercial av scanners and the difference was huge in terms of load reduction and throughput. In our tests we have found that the biggest performance limitation in Postfix for AV/AS scanning, assuming you have removed bottlenecks that amavisd and clamav introduce, is from having to copy messages out of the queue to scan. Some commercial email platforms allow for scanning in memory rather than requiring copying files and these platforms , in our test, far outscale Postfix for filtering over a 100 messages/second. I'm pretty sure I recall Wietse saying that third party software accessing queue files is forbidden, as he provides no supported API for dong so. IIRC, products that do this void the Postfix support warranty, such as Mailscanner. However, I am willing to negotiate an API that would be supported (but I don't recall getting input on that). The closest we have at this point is the Milter protocol which can inspect and update email messages on arrival, without compromising transactional safety, and with only minimal file system overhead (no copying from one file to another). Mike Katz http://mailspect.com The cost of a modern plenty powerful (CPU/memory) 1U server with a couple of fast sata disks is around $1000-2000, paid _once_ with no recurring licensing fees as all the software is FOSS, with minimal power usage, maybe $100/year. What's the license + maintenance cost of any of these commercial A/V solutions for *nix/Postfix? I'm just betting the commercial A/V outlay is probably more than a 2nd box, especially over 3-5 years. No? I think that there is no need to be hostile towards commercial solutions (or, at least, to hold IT solutions to different standards than other all the other things that we are paying for without getting upset). Wietse
Re: A question about Postfix and virus scanning
Ali Majdzadeh: question concerning what Wietse proposed. Does the usage of milter help? I mean, is the milter architecture considered as a way to kill spam load _before_ piping inbound connections to AS/AV content filter daemons? Or, Milter is a way to inspect or update message content without making extra copies of the message. It has some scaling issues 1) it processes mail before-queue, which some will find a feature and 2) all requests are handled by one Milter process; the latter may be addressed by using a third-party multiplexer that spreads requests across multiple milter process instances. As a general rule, the earlier you can block mail, the better. In some countries, the inbound SMTP session is the only place where you can block incoming mail, because mail cannot be discarded. The postscreen program (www.postfix.org/wip.html) takes this a little further by keeping the bots away from the SMTP server. Unfortunately, I can't be of much further help here. 1M users is a thousand times beyond my first-hand experience, and that was before SPAM became a problem. Wietse
Re: A question about Postfix and virus scanning
Ali Majdzadeh: Wietse, Hi Thanks for your reply. I recall that I had read about another filtering option available in Postfix which was called smtpd_proxy_filter (if I spell it correctly) and which filtered messages before queuing. So, is there any difference between the so-called method and using Milter? Thanks again. Both Milter and smtpd_proxy_filter process mail before it is queued. The smtpd_proxy_filter approach is more general (it uses SMTP instead of the Milter protocol). I haven't done performance comparisons. If your performance is inadequate, I suggest that you do a detailed system performance analysis to find out if the limit is CPU, memory, file I/O or perhaps some trivial DNS configuration problem. Wietse
Re: A question about Postfix and virus scanning
Stan Hoeppner: Wietse Venema put forth on 12/1/2009 1:20 PM: If your performance is inadequate, I suggest that you do a detailed system performance analysis to find out if the limit is CPU, memory, file I/O or perhaps some trivial DNS configuration problem. That may be difficult for the OP to provide. From all I've read, his perceived performance degradation is being generated by a synthetic load test application, SPECmail 2009, in a _lab_ environment, so DNS isn't even in the testing. SPECmail 2009 is designed to test internal Surely, mail is injected via SMTP, and therefore, the Postfix SMTP server will attempt to lookup the client hostname and IP address; since they are using SMTP-based content filters, that is another source of name service lookups. All this presents a load on name service. I have seen enough to know that a bad DNS configuration can do wonders for performance. Wietse
Re: A question about Postfix and virus scanning
Stan Hoeppner: Wietse Venema put forth on 12/1/2009 3:47 PM: Surely, mail is injected via SMTP, and therefore, the Postfix SMTP server will attempt to lookup the client hostname and IP address; since they are using SMTP-based content filters, that is another source of name service lookups. All this presents a load on name service. I have seen enough to know that a bad DNS configuration can do wonders for performance. Assuming the test streams are generated by a handful of SPECmail load generator hosts, the hostnames and addresses of those client machines would quickly be cached, no? I can assure you that there is no such caching the Postfix SMTP server before the SMTP-based content filter, and not in the Postfix SMTP server after the SMTP-based content filter. In addition, Postfix and content filters may do other DNS lookups for reputation etc. Ideally, name/address/reputation lookups will have only minimal impact, but I was explicitly not talking about ideal configurations when I wrote: If your performance is inadequate, I suggest that you do a detailed system performance analysis to find out if the limit is CPU, memory, file I/O or perhaps some trivial DNS configuration problem. I would not be so quick to dismiss DNS-related problems out of hand in scenarios that involve synthetic email messages. Wietse
Re: postscreen dnsblog problem
Len Conrad: freebsd 7.2 mail_version = 2.7-20091008 out of 6 postscreen machines, I've got one that every 20 or 30 minutes just halts, port 25 is dead (several monit agents see it dead), then it starts off by itself after a few minutes, dumping a bunch of these in maillog: warning: postscreen_dnsbl_query: connect to dnsblog service: Connection refused How does this machine differ from the other ones? Different OS, different build options, different traffic pattern? Wietse
Re: Force matching envelop MAIL FROM and From header
lst_ho...@kwsoft.de: Hello is it possible to force a matching From header in the mail if reject_sender_login_mismatch is used so the From header is the same as the checked MAIL FROM address? The goal is to prevent spoofing of the From header for SASL authenticated clients. Yes, but only with external software (Milter or content filter). Wietse
Re: sender_dependent_relayhost_maps and ldap with multivalue attribute
Giovanni Mancuso: Hi guys, I'm trying to configure my postfix to use a different relayhost if the sender of the email is in ldap. You must return a result that satisfies the documented syntax. http://www.postfix.org/postconf.html#relayhost Wietse
Re: sender_dependent_relayhost_maps and ldap with multivalue attribute
Wietse: You must return a result that satisfies the documented syntax. http://www.postfix.org/postconf.html#relayhost Giovanni Mancuso: Thanks for answer. But, can i configure ldap search to manage multivalue in entry? See my previous reply, above. Wietse
Re: Snapshot 20091109, queue disk partition sizing
Stefan F?rster: If I understood the release notes correctly, with smtpd_proxy_options = speed_adjust, each smtpd process will keep the message it's currently receiving in a temporary file. That seems to imply that there could be (number of smtpd processes) * message_size_limit bytes of queue space allocated in temporary files. I _think_ that this is not different from a setup without a content filter which would mean I don't have to increase the disk partition keeping the queue - is that assumption correct? By default, the Postfix requires 1.5*message_size_limit of free space before it accepts mail. Right now, the before-proxy scratch files are put in the incoming queue, but that may still chnage. I didn't change the formula (to 2.5*message_size_limit) for that reason. Wietse
Re: postscreen dnsblog problem
Len Conrad: I've got more data. The killer option is when I have this on: postscreen_blacklist_networks = mysql:/usr/local/etc/postfix/mysql-mta_clients_reactive_b.cf I'll mkae a note that postscreen must be used only with low-latency databases such as local files. Wietse
Re: postscreen dnsblog problem
Len Conrad: -- Original Message -- From: wie...@porcupine.org (Wietse Venema) Date: Fri, 4 Dec 2009 14:13:17 -0500 (EST) I'll mkae a note that postscreen must be used only with low-latency databases such as local files. the problem postscreen MX pinging the mysql server on the same switch shows: round-trip min/avg/max/stddev = 0.143/0.227/0.443/0.100 ms 2 non-problem postscreening MXs pinging from South Carolina to Atlanta show: round-trip min/avg/max/stddev = 4.613/4.945/5.249/0.205 ms It's quite confusing to tease where the problem is. Ping measures the kernel-to-kernel latency. postscreen is affected by the application-to-application table lookup latency. Postscreen is a single program that makes a decision on every inbound connection in real time. Having it talk to a mysql server introduces huge latency. While the mysql lookup happens, all of postscreen stalls, meaning it does not take new connections off the input queue. If this happens often enough, postscreen falls behind and reports all ports busy errors. For example, if mysql replies in 10ms, then the entire Postfix system cannot process more than 100 connection requests per second in total, that's all the connections from zombies and good clients combined. With such performance, what was meant to be a zombie killer quickly becomes a self-inflicted DOS. I'm adding extra checks to postscreen than measure table lookup delays, and that log warnings when these delays exceed i.e. a couple milliseconds. btw, what does postscreen send to smtp client when postscreen logs this: egrep -ic all screening ports busy /var2/log/maillog 5615 It sends a 421 reply. Wietse
Re: remote_header_rewrite_domain ignored
Ed W: Hi, I'm using postfix 2.5.7 and having some trouble with the server domain being appended to incomplete sender addresses. I have set # postconf|grep -e rewrite -e append -e myorigin -e mydomain -e local_header append_at_myorigin = yes append_dot_mydomain = no local_header_rewrite_clients = Note: local_***HEADER***_rewrite_clients, a feature that controls how HEADER address are rewritten. mydomain = nippynetworks.com myorigin = $mydomain remote_header_rewrite_domain = rewrite_service_name = rewrite I have amavisd-new installed, but having bumped up the logging I believe this is happening on initial submission and not on the re-injection. Log files show the client connecting, checking the FROM address and then: Dec 4 15:33:54 mail1 postfix/smtpd[22858]: office.mydomain.com[X.X.X.X]: RCPT TO: asdf That is not a HEADER address. Wietse
Re: remote_header_rewrite_domain ignored
Ed W: Wietse Venema wrote: Ed W: Hi, I'm using postfix 2.5.7 and having some trouble with the server domain being appended to incomplete sender addresses. I have set # postconf|grep -e rewrite -e append -e myorigin -e mydomain -e local_header append_at_myorigin = yes append_dot_mydomain = no local_header_rewrite_clients = Note: local_***HEADER***_rewrite_clients, a feature that controls how HEADER address are rewritten. Fair enough - can you please help correct my config given the original goal of avoiding incomplete email addresses having a domain automatically appended? If an address has no domain, then by definition it delivers to the same destination as when the default domain were appended. Therefore, both address forms are equivalent. Therefore, Postfix uses the same address form for both, instead of doubling the number of configuration options (and code) for address forms that are by definition equivalent. Wietse
Re: remote_header_rewrite_domain ignored
Ed W: To clarify the question - the goal is if someone connects via the network (not local sendmail command) and the transcript says RCPT TO: asdf that this is subsequently bounced as being an invalid To summarize my other response, by definition an address without domain delivers to the same mailbox as an address with the default domain. Wietse
Re: remote_header_rewrite_domain ignored
Ed W: Wietse Venema wrote: Ed W: To clarify the question - the goal is if someone connects via the network (not local sendmail command) and the transcript says RCPT TO: asdf that this is subsequently bounced as being an invalid To summarize my other response, by definition an address without domain delivers to the same mailbox as an address with the default domain. Understood - but, how can I change this please..? (and if there are hidden implications, please summarise so that I can test for breakage?) If you don't want to receive mail for domain-less addresses then say so, instead of coming up with the wrong solution for the wrong problem. Use the reject_non_fqdn_mumble to stop bare addresses. Wietse
PATCH: smtpd_proxy logging (was: Snapshot 20091109, queue disk partition ...)
On Fri, Dec 04, 2009 at 08:54:01PM +0100, Stefan F??rster wrote:
Now, about logging - I'd be really grateful if the existing logging
functionality could be extended in a way so that the pre-queue
content filter's response is logged.
I know that it is actually the content filter's job to log what it did
during an ESMTP transaction, but I think if Postfix logged the
filter's response, correlating logs would be much easier.
Like this?
Dec 5 20:15:25 server postfix/smtpd[16712]: proxy-accept:
END-OF-MESSAGE: 250 2.0.0 Ok: queued as 91BE3547AFE;
from=sen...@example.com to=recipi...@example.com proto=ESMTP
helo=client.example.com
(with the same form for proxy-reject at END-OF-MESSAGE; the format
of the reject message would be consistent with other Postfix reject
messages.)
Wietse
diff --exclude=man --exclude=html --exclude=README_FILES --exclude=.indent.pro
--exclude=Makefile.in -r -cr /var/tmp/postfix-2.7-20091115/src/smtpd/smtpd.c
./smtpd.c
*** /var/tmp/postfix-2.7-20091115/src/smtpd/smtpd.c Sun Nov 15 10:34:24 2009
--- ./smtpd.c Sat Dec 5 20:16:33 2009
***
*** 1353,1358
--- 1353,1379
#endif
+ /* smtpd_whatsup - gather available evidence for logging */
+
+ static const char *smtpd_whatsup(SMTPD_STATE *state)
+ {
+ static VSTRING *buf = 0;
+
+ if (buf == 0)
+ buf = vstring_alloc(100);
+ else
+ VSTRING_RESET(buf);
+ if (state-sender)
+ vstring_sprintf_append(buf, from=%s, state-sender);
+ if (state-recipient)
+ vstring_sprintf_append(buf, to=%s, state-recipient);
+ if (state-protocol)
+ vstring_sprintf_append(buf, proto=%s, state-protocol);
+ if (state-helo_name)
+ vstring_sprintf_append(buf, helo=%s, state-helo_name);
+ return (STR(buf));
+ }
+
/* collapse_args - put arguments together again */
static void collapse_args(int argc, SMTPD_TOKEN *argv)
***
*** 3097,3102
--- 3103,3116
}
/*
+ * By popular command: the proxy's end-of-data reply.
+ */
+ if (proxy)
+ msg_info(proxy-%s: %s: %s;%s,
+(state-err == CLEANUP_STAT_OK) ? accept : reject,
+state-where, STR(proxy-buffer), smtpd_whatsup(state));
+
+ /*
* Cleanup. The client may send another MAIL command.
*/
saved_err = state-err;
Re: remote_header_rewrite_domain ignored
Ed W: Wietse Venema wrote: If you don't want to receive mail for domain-less addresses then say so, instead of coming up with the wrong solution for the wrong problem. OK, I want to accept most emails over smtp and then later bounce emails with domain-less addresses That will not be supported. Adding a separate code path for domain-less envelope adresses would open a giant hole in the defenses. Instead, you can try to 1) configure Postfix smtpd to use an invalid myorigin value, 2) configure Postfix smtpd with a non-default rewrite_service_name setting that invokes a trivial-rewrite server that also uses that invalid myorigin value and no transport map, 3) configure the normal trivial-rewrite server with a transport map that routes mail for the invalid domain to error: pebcak. Wietse
Re: ldap-Trouble
Jan Luehr: Hello, I've some trouble using ldap aliases. My settings are: server_host = localhost search_base = dc=oknw bind_dn = uid=postfix,cn=staff,dc=oknw bind_pw = XXX version = 3 query_filter = ((mail=%s)(objectClass=mailAccount)) result_attribute = forward Postfix is: 2.5.5 (Debian GNU/Linux) My itention is, that all valid mail aliases have mail=%s set. Furthermore forward: points to its destination. Lets assume there is test.forw...@v50993.topnetworks.de http://pastie.org/730216 If I try to write an E-Mail to him, it bounces. slapd / postfix logs: http://pastie.org/730229 Dec 6 13:55:07 v50993 slapd[30414]: conn=34 op=11 SRCH base=dc=oknw scope=2 deref=0 filter=((mail=test.forw...@v50993.topnetworks.de)(objectClass=mailAccount)) The LDAP server found a record for test.forw...@v50993.topnetworks.de. Dec 6 13:57:33 v50993 postfix/local[31444]: B8BA7E38564: to=test.forw...@v50993.topnetworks.de, relay=local, delay=184, delays=184/0.11/0/0.02, dsn=5.1.1, status=bounced (unknown user: test.forward) The LDAP server found no record for test.forward. Wietse
Re: rejecting an invalid return path
Raffael Schmid: Hi list Do you know whether there is a possibility to reject invalid return paths in postfix? The problem is, that we get spam with a header-line like the following and would like to reject those messages: Return-Path: MAILER-DEAMON AFAIK the return-path above is invalid, as there is only the following formats allowed: Return-Path: john@example.org Return-Path: As I did not find a option in postfix to reject those mails, i could write a header check with pcre. But before I will do this, I'd like to verify whether there is really no option in postfix to set this? Postfix has no enforce RFC 100% option. In particular, the address parser must tolerate errors. Unlike a compiler such as GCC, Postfix cannot abort on incorrect syntax, or throw away all the input that it can't understand, therefore it cannot be implemented with a parser that strictly goes by the rules of the grammar. Adding a check for every possible violation is not practical, therefore Postfix has explicit checks only for the most common violations. Wietse
Re: LDAP configuration issue
Javier Henderson: Greetings, I am trying to configure Postfix to gracefully deal with the failure of the LDAP server it uses for alias resolution. It's working fine, using the LDAP server to resolve u...@domain.com to u...@somehost.domain.com, but if the LDAP server dies or becomes unreachable for whatever reason, Postfix replies with 5xx error codes about the user being invalid. Is there a way to configure it to return 4xx codes so the remote end tries later? If your LDAP lookup goes through nsswitch.conf, then there is a 10+ year old bug where LDAP lookup failure causes the SYSTEM LIBRARY function getpwnam() and friends to return that the user does not exist. Postfix cannot distinguish between false and true error results. Wietse
Re: header_checks not working correctly
Christopher Adams: Thank you for your helpful reply. So, now I have this in main.cf: smtpd_sender_restrictions = check_sender_access hash:/etc/postfix/sender_blacklist I have a file sender_blacklist: m...@somplace.org/ REJECT I issued the command 'postmap hash:/etc/postfix/sender_blacklist' I issued the command: 'postfix reload' If I send from the address m...@somplace.org, it is not rejected. Now is a good time to stop posting fragments, and follow the instructions in the mailing list welcome message. Wietse TO REPORT A PROBLEM see http://www.postfix.org/DEBUG_README.html#mail TO (UN)SUBSCRIBE see http://www.postfix.org/lists.html Thank you for using Postfix.
Re: postscreen ps_cache fatal
Len Conrad: mail_version = 2.7-20091008 fbsd 7.2 we're seeing one of these each time we stop postfix Dec 8 00:09:06 mx6 postfix/postscreen[49918]: fatal: close database /var/db/postfix/ps_cache.db: No such file or directory The Berkeley DB close() function returns an ENOENT error code. but mx6# ll /var/db/postfix/ps_cache.db -rw--- 1 postfix wheel - 93761536 Dec 8 14:31 /var/db/postfix/ps_cache.db Berkeley DB returns ENOENT for some other reason. Perhaps you have a corrupted database. Are you using a hash or btree file? I use btree for tables that change frequently. Wietse No functional impact afaics. Len
