[pfx] Re: Recommendation for dkim signing

2023-11-05 Thread Noel Butler via Postfix-users
sys4.de are not removing original DKIM sigs just adding postfix.org's, which also fails for some reason, but ohh looky that - SPF passes :D Decided to have a look ater lunch, that looks like it would be because sys4 adds footers, where previously Wietse did not, again if they configured

[pfx] Re: Recommendation for dkim signing

2023-11-05 Thread Noel Butler via Postfix-users
On 05/11/2023 20:02, Benny Pedersen via Postfix-users wrote: DKIM, was a problem, but for several years now mailman can do the right thing by stripping out the original DKIM headers and rewrites sender (although you need to know where to add the former) - but only if the admins set those

[pfx] Re: Recommendation for dkim signing

2023-11-05 Thread Noel Butler via Postfix-users
On 06/11/2023 02:48, Fred Morris via Postfix-users wrote: Let's step out of the echo chamber or petri dish or whatever. On Sun, 5 Nov 2023, Jaroslaw Rafa via Postfix-users wrote: Dnia 5.11.2023 o godz. 13:53:46 Noel Butler via Postfix-users pisze: If correctly forwarded it does not break

[pfx] Re: Multiple cascaded lookup tables for check_recipient_access possible?

2023-11-05 Thread Wietse Venema via Postfix-users
r.barclay--- via Postfix-users: > Hello, > > Does Postfix support specifying multiple lookup tables for > check_recipient_access? > (If there's no match in the first table, look up in the next one.) > > smtpd_recipient_restrictions = > reject_unauth_pipelining, >

[pfx] Multiple cascaded lookup tables for check_recipient_access possible?

2023-11-05 Thread r.barclay--- via Postfix-users
Hello, Does Postfix support specifying multiple lookup tables for check_recipient_access? (If there's no match in the first table, look up in the next one.) smtpd_recipient_restrictions = reject_unauth_pipelining, reject_invalid_helo_hostname,

[pfx] Re: When using LDAP over socket, „smtpd_sender_login_maps“ requires an LDAP socket relative to chroot in contrast to other map configurations (potential bug?)

2023-11-05 Thread Viktor Dukhovni via Postfix-users
On Sun, Nov 05, 2023 at 12:13:17PM +, Matthias Nagel via Postfix-users wrote: > Viktor, you recommend to use proxymap in combination with LDAP, Yes. > especially if all LDAP lookups use the same connection. Regardless of whether the connection settings are the same across all tables. But

[pfx] Re: resolv.conf in chroot

2023-11-05 Thread Jesper Dybdal via Postfix-users
On 2023-11-05 17:51, Wietse Venema via Postfix-users wrote: Jesper Dybdal via Postfix-users: To avoid using a public name server for DNSBL lookups, I would like the DNSBL checks to be done using only the name server running on localhost. But I would like the rest of the system to have for

[pfx] Re: resolv.conf in chroot

2023-11-05 Thread Wietse Venema via Postfix-users
Jesper Dybdal via Postfix-users: > To avoid using a public name server for DNSBL lookups, I would like the > DNSBL checks to be done using only the name server running on localhost. > But I would like the rest of the system to have for instance Google as a > secondary name server. > > I do not

[pfx] Re: Recommendation for dkim signing

2023-11-05 Thread Fred Morris via Postfix-users
Let's step out of the echo chamber or petri dish or whatever. On Sun, 5 Nov 2023, Jaroslaw Rafa via Postfix-users wrote: Dnia 5.11.2023 o godz. 13:53:46 Noel Butler via Postfix-users pisze: If correctly forwarded it does not break SPF, since correctly forwarding rewrites the sender It's a

[pfx] Re: When using LDAP over socket, „smtpd_sender_login_maps“ requires an LDAP socket relative to chroot in contrast to other map configurations (potential bug?)

2023-11-05 Thread Wietse Venema via Postfix-users
As Viktor mentions, best practice is to: - Share the LDAP socket handle among the three tables that connect to the same LDAP endpoint (i.e. delay the bind with bind=no in the three *cf files). - Open LDAP tables from outside the chroot, by configuring LDAP tables as proxy:ldap:/path/to/file, and

[pfx] Re: resolv.conf in chroot

2023-11-05 Thread Jesper Dybdal via Postfix-users
On 2023-11-05 15:41, Matus UHLAR - fantomas via Postfix-users wrote: Jesper Dybdal via Postfix-users skrev den 2023-11-05 13:48: To avoid using a public name server for DNSBL lookups, I would like the DNSBL checks to be done using only the name server running on localhost. But I would like the

[pfx] Re: Recommendation for dkim signing

2023-11-05 Thread Jaroslaw Rafa via Postfix-users
Dnia 5.11.2023 o godz. 13:53:46 Noel Butler via Postfix-users pisze: > If correctly forwarded it does not break SPF, since correctly > forwarding rewrites the sender, I was an early adopter of SPF and > always used hard-fail, no lists have rejected my posts from SPF > (trust me, if they did, I

[pfx] Re: resolv.conf in chroot

2023-11-05 Thread Benny Pedersen via Postfix-users
Matus UHLAR - fantomas via Postfix-users skrev den 2023-11-05 15:41: Jesper Dybdal via Postfix-users skrev den 2023-11-05 13:48: To avoid using a public name server for DNSBL lookups, I would like the DNSBL checks to be done using only the name server running on localhost. But I would like the

[pfx] Re: resolv.conf in chroot

2023-11-05 Thread Matus UHLAR - fantomas via Postfix-users
Jesper Dybdal via Postfix-users skrev den 2023-11-05 13:48: To avoid using a public name server for DNSBL lookups, I would like the DNSBL checks to be done using only the name server running on localhost. But I would like the rest of the system to have for instance Google as a secondary name

[pfx] Re: resolv.conf in chroot

2023-11-05 Thread Benny Pedersen via Postfix-users
Jesper Dybdal via Postfix-users skrev den 2023-11-05 13:48: To avoid using a public name server for DNSBL lookups, I would like the DNSBL checks to be done using only the name server running on localhost. But I would like the rest of the system to have for instance Google as a secondary name

[pfx] resolv.conf in chroot

2023-11-05 Thread Jesper Dybdal via Postfix-users
To avoid using a public name server for DNSBL lookups, I would like the DNSBL checks to be done using only the name server running on localhost. But I would like the rest of the system to have for instance Google as a secondary name server. I do not use postscreen. If I place a resolv.conf

[pfx] Re: When using LDAP over socket, „smtpd_sender_login_maps“ requires an LDAP socket relative to chroot in contrast to other map configurations (potential bug?)

2023-11-05 Thread Matthias Nagel via Postfix-users
Dear Viktor, dear Wietse, Viktor, you recommend to use proxymap in combination with LDAP, especially if all LDAP lookups use the same connection. Indeed, this is the case for my setup. The LDAP server, the bind DN and bind passwd are the same. Only the search base, the query filter and the

[pfx] Re: Recommendation for dkim signing

2023-11-05 Thread Benny Pedersen via Postfix-users
Noel Butler via Postfix-users skrev den 2023-11-05 04:53: On 03/11/2023 10:22, Steffen Nurpmeso via Postfix-users wrote: - SPF breaks all hosts which have users that effectively want their email to be forwarded to a different address. This is basically any campus, and much, much more. FUD...