Re: egrep deprecation warning (Re: Urgent Postfix stable release 3.7.3 and non-urgent legacy releases 3.6.7, 3.5.17, 3.4.27)

2022-10-10 Thread Wietse Venema
Geert Hendrickx: > On Mon, Oct 10, 2022 at 07:22:18 -0400, Wietse Venema wrote: > > To find out if you have messages flagged as "corrupt", you can > > use the "postfix check" command. > > > > Execute as root: > > > >

Re: monitoring the effectiveness of smtpd processes

2022-10-10 Thread Wietse Venema
Viktor Dukhovni: > On Mon, Oct 10, 2022 at 10:27:37AM +0200, juan smitt wrote: > > > How can one directly monitor the effectiveness of the increased number > > of Postfix SMTP server processes? > > (https://www.postfix.org/STRESS_README.html) > > > > Is it true that this scales up dynamically

Re: monitoring the effectiveness of smtpd processes

2022-10-10 Thread Wietse Venema
juan smitt: > Hi, > > > How can one directly monitor the effectiveness of the increased number > of Postfix SMTP server processes? > (https://www.postfix.org/STRESS_README.html) Each Postfix SMTP server process handles one remote SMTP client at a time. The number of processes can be zero up to

Urgent Postfix stable release 3.7.3 and non-urgent legacy releases 3.6.7, 3.5.17, 3.4.27

2022-10-10 Thread Wietse Venema
[For updated versions of this announcement please see https://www.postfix.org/announcements/postfix-3.7.3.html] Fixed in Postfix 3.7.3: * This fixes a bug where some messages were not delivered after "warning: Unexpected record type 'X'. Such messages were moved to the "corrupt" queue

Re: placing recipient_canonical_maps before/after milters

2022-10-09 Thread Wietse Venema
Matus UHLAR - fantomas: > From what I remember, milter running within instance that does canonical > mapping does NOT see the mapping results, at least for envelope sender > address, so for DKIM-signing outgoing mail via opendkim I've had to > implement anotger instance that takes

Re: placing recipient_canonical_maps before/after milters

2022-10-08 Thread Wietse Venema
Wietse Venema: > Dan Mahoney: > > > > > > > On Oct 8, 2022, at 12:59, Wietse Venema wrote: > > > > > > Dan Mahoney: > > >> Hey there all, > > >> > > >> We have a couple of recipient canonical maps that do t

Re: placing recipient_canonical_maps before/after milters

2022-10-08 Thread Wietse Venema
Dan Mahoney: > > > > On Oct 8, 2022, at 12:59, Wietse Venema wrote: > > > > Dan Mahoney: > >> Hey there all, > >> > >> We have a couple of recipient canonical maps that do things like > >> transform firstname_lastname into username (

Re: placing recipient_canonical_maps before/after milters

2022-10-08 Thread Wietse Venema
Dan Mahoney: > Hey there all, > > We have a couple of recipient canonical maps that do things like > transform firstname_lastname into username (i.e. dan_mahoney --> > dmahoney), also handle things like mapping people's former names > into current names. > > This is useful where a user wants to

Re: placing recipient_canonical_maps before/after milters

2022-10-08 Thread Wietse Venema
Matus UHLAR - fantomas: > On 08.10.22 12:04, Wietse Venema wrote: > >Postfix sends the delivery report as an email message to the envelope > >sender address. The message is generated by a background process, > >so the program that runs "sendmail -bv" would n

Re: placing recipient_canonical_maps before/after milters

2022-10-08 Thread Wietse Venema
On Oct 7, 2022, at 15:08, Wietse Venema wrote: > Envelope or header? On 07.10.22 18:59, Dan Mahoney wrote: > Header, I think. If you mean the bit in the part of the > To: line. DKIM and DMARC are looking at typically from, to, cc, (other > headers too, but less likely to be re

Re: placing recipient_canonical_maps before/after milters

2022-10-08 Thread Wietse Venema
Matus UHLAR - fantomas: > postfix' sendmail page: > > -bvDo not collect or deliver a message. Instead, send an email > re- >port after verifying each recipient address. This is useful > for >testing address rewriting and routing configurations. > >

Re: placing recipient_canonical_maps before/after milters

2022-10-08 Thread Wietse Venema
Dan Mahoney: > >> This is useful where a user wants to have one canonical spamassassin > >> settings folder, which spamass-milter gets by looking at the left > >> hand side of the address. So we clearly want spamass-milter to > >> run after this rewriting happens. > >> > >> On the other

Re: placing recipient_canonical_maps before/after milters

2022-10-07 Thread Wietse Venema
On Oct 7, 2022, at 15:08, Wietse Venema wrote: > > CONTENT_FILTER_README Dan Mahoney: > I assume by that you mean https://www.postfix.org/FILTER_README.html > > CONTENT_FILTER_README yields a 404. My mistake. Wietse

Re: placing recipient_canonical_maps before/after milters

2022-10-07 Thread Wietse Venema
Dan Mahoney: > Hey there all, > > We have a couple of recipient canonical maps that do things like > transform firstname_lastname into username (i.e. dan_mahoney --> > dmahoney), also handle things like mapping people's former names > into current names. Envelope or header? > This is useful

Re: PATCH: Unexpected record type 'X'

2022-10-06 Thread Wietse Venema
Viktor Dukhovni: > On Thu, Oct 06, 2022 at 06:12:19PM -0400, Wietse Venema wrote: > > > This could happen for messages with 500 or more recipients, > > or with fewer recipients on a busy mail server. Problem > > reported by Frank Brendel, reproduced by John A

PATCH: Unexpected record type 'X'

2022-10-06 Thread Wietse Venema
Wietse Venema: > Wietse Venema: > > > So it seems this issue occurs whenever the mail queue total recipient > > > count reaches 5000 > > > addresses. > > > > Thanks, that is very useful. This appears to be a corner-case error, > > and

Re: outbound smtp " warning: DANE TLSA lookup problem" ... problem with my local resolver, or my postfix config?

2022-10-06 Thread Wietse Venema
PGNet Dev: > 2022-10-05T17:30:13.277421-04:00 mx03 postfix/smtp-out-ext/smtp[8484]: > warning: DANE TLSA lookup problem: Host or domain name not found. Name > service error for name=_25._tcp.christopher-ew.state.gov type=TLSA: Host not > found, try again The Postfix SMTP client handles

Re: Unexpected record type 'X'

2022-10-06 Thread Wietse Venema
Wietse Venema: > > So it seems this issue occurs whenever the mail queue total recipient count > > reaches 5000 > > addresses. > > Thanks, that is very useful. This appears to be a corner-case error, > and that would explain why the problem was difficult to repr

Re: Unexpected record type 'X'

2022-10-06 Thread Wietse Venema
John Alex.: > Hi, I encountered the same issue on two FreeBSD 13.1 + Postfix 3.7.2 > installations. It > only occurs when trying to send an email with >4999 recipients (the mail > queue is > otherwise empty). This issue does not happen on another machine with FreeBSD > 13.0 + > Postfix

Re: regulating legitimate mail traffic

2022-10-05 Thread Wietse Venema
juan smitt: [using smtpd_client_connection_count_limit for traffic management] > Unfortunately the service (which is made of 4 servers) is behind a > firewall which hides the real client IPs so these 4 servers see only 1 > client (the firewall) and the expected mail count is 4+ million per > day.

Re: does 'permit_tls_clientcerts' work with self-signed certificates?

2022-10-04 Thread Wietse Venema
Viktor Dukhovni: > > compatibility_level = 3.5 > > The major.minor syntax was introduced with Postfix 3.6, for Postfix 3.5 > use "3". To make forward and reverse migrations easier, the new compatibility_level syntax has been backported in postfix-3.5.11, postfix-3.4.21 and postfix-3.3.18.

Re: symbolic links problem due to do-release-upgrade (postfix 3.6.4) - was: manually build 3.7.2 denies SASL although included in make command

2022-10-03 Thread Wietse Venema
Martin: > HI Wietse, > > yes, I'm afraid that's true, these are the contents of that old > directory All those binaries have mail_version=3.4.13, therefore none will work Postfix 3.6 libraries. > I assume there has been a kind of new configuration between old postfix > version and the 3.6.4

Re: manually build 3.7.2 denies SASL although included in make command

2022-10-03 Thread Wietse Venema
Martin: > > > Hi there, > > I went back to the snapshot before trying to install postfix > from source, did an > apt-get install --reinstall postfix postfiy-mysql > > But still the master executable has an old version: > root@jerakeen:~# objdump -T /usr/libexec/postfix/master | grep >

Re: Reject when delivering to a pipe?

2022-10-02 Thread Wietse Venema
Charles Sprickman: > I think that as long as the script returns the appropriate error > code on failure you don't have to do anything special; from pipe(8): > >In the case of a non-zero exit status, a limited amount of command >output is logged, and reported in a delivery status

Re: postfix 3.6.4 (ubuntu server 22.04 LTS) does not start - manually build 3.7.2 denies SASL although included in make command

2022-10-02 Thread Wietse Venema
Jaroslaw Rafa: > Dnia 2.10.2022 o godz. 17:23:33 Wietse Venema pisze: > > > > If fact it's worse: you can't mix Postfix programs and libraries > > from different Postfix builds, even if they are built from the same > > Postfix source. > > What do you mean here

manually build 3.7.2 denies SASL although included in make command

2022-10-02 Thread Wietse Venema
Martin: > Today I tried to install postfix 3.7.2 manually. I was enable to include > MySQL support > as well as TLS support. But the SASL (sasl2 / cyrus) configuration as > given by page > https://www.postfix.org/SASL_README.html does not work at all. When > trying to > send mails the answer of

Re: postfix 3.6.4 (ubuntu server 22.04 LTS) does not start - manually build 3.7.2 denies SASL although included in make command

2022-10-02 Thread Wietse Venema
Viktor Dukhovni: > On Sun, Oct 02, 2022 at 08:22:39PM +, Martin wrote: > > > [... lots of prose ...] > > > > # postfix stop > > postfix/postfix-script: stopping the Postfix mail system > > Oct 02 16:24:11 derdickehase postfix/postfix-script[3222]: stopping the > > Postfix mail system > >

Re: no shared cipher revisited

2022-10-01 Thread Wietse Venema
Shawn Heisey: > If the way I got the total counts is valid, then most of the connections > are NOT using TLS.? I wonder how many of those are using plaintext > because my cert is 4096 bit and their encryption library cannot use it.? Look for the 'disconnect' logfile record, it will report if

Re: Fwd: postfix service does not start, timeout

2022-10-01 Thread Wietse Venema
Michael: > Wanted to check network related startup timings at this weekend, but: > > Problem disappeared as suddenly as it popped up: postfix service > now needs less than 5 secs to start, as before the issue. No idea > why, probably something on the VPS's host system or the provider's > network

Re: Fwd: postfix service does not start, timeout

2022-09-30 Thread Wietse Venema
Wietse Venema: > Steffen Nurpmeso: > > Steffen Nurpmeso wrote in > > <20220929213725.gar4l%stef...@sdaoden.eu>: > > |Viktor Dukhovni wrote in > > | : > > ||On Thu, Sep 29, 2022 at 07:25:48PM +0200, Steffen Nurpmeso wrote: > > ||> But on FreeBS

Re: Fwd: postfix service does not start, timeout

2022-09-29 Thread Wietse Venema
Steffen Nurpmeso: > Steffen Nurpmeso wrote in > <20220929213725.gar4l%stef...@sdaoden.eu>: > |Viktor Dukhovni wrote in > | : > ||On Thu, Sep 29, 2022 at 07:25:48PM +0200, Steffen Nurpmeso wrote: > ||> But on FreeBSD (only VM here for some years) on fresh install > ||> i always have sendmail

Re: Client Certificate recommended/not-recommended RFCs?

2022-09-29 Thread Wietse Venema
Dan Mahoney: > All, > > Using sendmail, I've been asking for client certs for a long time. > I've always figured "if you configure your sendmail with both a > client cert and a server cert, you might as well use it, after > all, you paid for the thing". (This may have been the sunk-cost >

Re: Fwd: postfix service does not start, timeout

2022-09-29 Thread Wietse Venema
Wietse Venema: > Viktor Dukhovni: > > On Thu, Sep 29, 2022 at 05:14:12PM +0200, michae...@rocketmail.com wrote: > > > > > systemd's start command is > > > > > > ExecStart=/usr/sbin/postfix start > > > > > > .. and

Re: Fwd: postfix service does not start, timeout

2022-09-29 Thread Wietse Venema
Viktor Dukhovni: > On Thu, Sep 29, 2022 at 05:14:12PM +0200, michae...@rocketmail.com wrote: > > > systemd's start command is > > > > ExecStart=/usr/sbin/postfix start > > > > .. and when trying to "postfix -vvv start" at shell, postfix starts! > > > > But takes very, very long. So I'll search

Re: Wrong Domain in Null Client Setup

2022-09-27 Thread Wietse Venema
Viktor Dukhovni: > On Tue, Sep 27, 2022 at 06:15:34PM +, Eddie Rowe wrote: > > > I cannot seem to get the Linux machine's domain name to be used, but > > instead it is using "localdomain". I took over these duties from a > > prior employee whose server was "almost ready" has the same issue.

Re: comments in config files

2022-09-27 Thread Wietse Venema
Viktor Dukhovni: > On Tue, Sep 27, 2022 at 03:31:52PM +0800, Ken Peng wrote: > > > juan smitt wrote: > > > postmaster postmas...@example.com # this is a comment > > > > I have tested that, the section after # will cause no problem. > > Your tests were flawed or were testing something else

Re: comments in config files

2022-09-27 Thread Wietse Venema
juan smitt: > Hi, > > > Can you please confirm that it won't cause any problem if we put > comments at the end of config lines? > > Example: > file: /etc/postfix/virtual > postmaster postmas...@example.com # this is a comment > > We need to know this because of automation reasons. It

Re: Bad command startup on DNS lookup error for auth socket

2022-09-18 Thread Wietse Venema
Wietse Venema: > Sorry, my initial diagnosis was incorrect. > > Stefan Foerster: > > postfix/submission/smtpd[156]: warning: host or service dovecot:12345 not > > found: Name does not resolve > > postfix/submission/smtpd[156]: warning: SASL: Connect to Dovecot aut

Re: Bad command startup on DNS lookup error for auth socket

2022-09-18 Thread Wietse Venema
Sorry, my initial diagnosis was incorrect. Stefan Foerster: > postfix/submission/smtpd[156]: warning: host or service dovecot:12345 not > found: Name does not resolve > postfix/submission/smtpd[156]: warning: SASL: Connect to Dovecot auth socket > 'inet:dovecot:12345' failed: Address not

Re: Bad command startup on DNS lookup error for auth socket

2022-09-18 Thread Wietse Venema
Stefan Foerster: > Hello world, > > in a containerized setup I noticed a bad command startup if the AUTH > socket is not available (i.e. the container is down): > > $ postconf smtpd_sasl_path > smtpd_sasl_path = inet:dovecot:12345 > > #v+ > postfix/submission/smtpd[156]: connect from >

Re: Why sometimes milters don't run?

2022-09-16 Thread Wietse Venema
post...@ptld.com: > > On 09-16-2022 3:16 pm, Wietse Venema wrote: > > If Postfix rejects an SMTP event (connect, ehlo, data, and so on), > > then Postfix will not send that event to the Milters. If it passed > > all SMTP events to Milters, then they would get out

Re: Why sometimes milters don't run?

2022-09-16 Thread Wietse Venema
If Postfix rejects an SMTP event (connect, ehlo, data, and so on), then Postfix will not send that event to the Milters. If it passed all SMTP events to Milters, then they would get out of sync with Postfix. Wietse

Re: Google is at it again

2022-09-16 Thread Wietse Venema
Stephen Satchell: > I have a crontab set up to send me regular reminders on my local mail > account. I've added reminders for a person with a Google mail account. > They haven't been getting the reminders lately. > > By doing some testing, I found that Google was silently rejecting mail >

Re: [Feature-request] Adding a connection identifier to the logs

2022-09-13 Thread Wietse Venema
Christian R??ner: > Hello, > > whenever it comes to debug some e-mail issues, it always is a > little bit hard to aggregate all the log lines together. Therefor > I would wish some kind of identifier that starts at the connect, > is carried over all Postfix services up to the disconnect state.

Re: Postfix.org website

2022-09-09 Thread Wietse Venema
Ralph Seichter: > * Simon Wilson: > > > Pinging postfix-mirror.horus-it.com [65.108.3.114] with 32 bytes of data: > > Reply from 65.108.3.114: bytes=32 time=323ms TTL=48 > > Reply from 65.108.3.114: bytes=32 time=321ms TTL=48 > > > > Yet I cannot open www.postfix.org (either over

Re: Clarification on spf-policy on multiple incoming mail queue.

2022-09-08 Thread Wietse Venema
an...@ursc.gov.in: > Want to run a separate instance of postfix and make 2 incoming queues > (one each for a domain).? The new instance will listen on a new IP on > the same server. > > I have configured, spfpolicy for incoming mails in the already > existing queue (master.cf) and I want to

Re: linux 6 release

2022-09-07 Thread Wietse Venema
Viktor Dukhovni: > On Wed, Sep 07, 2022 at 06:38:40PM +0200, Eray Aslan wrote: > > > Yet another linux major version about to be released (at rc4 currently) > > with "nothing fundamentally different". > > Speaking of Postfix on Linux, I suffered through trying to get Postfix > working on Fedora

Re: linux 6 release

2022-09-07 Thread Wietse Venema
Eray Aslan: > Yet another linux major version about to be released (at rc4 currently) > with "nothing fundamentally different". Thanks. Wietse > diff --git a/makedefs b/makedefs > index 2839f3a..be60de4 100644 > --- a/makedefs > +++ b/makedefs > @@ -627,7 +627,8 @@ EOF >

Re: Save all emails in transit, including envelope data

2022-09-06 Thread Wietse Venema
Jim Popovitch: > On Tue, 2022-09-06 at 09:25 -0400, Viktor Dukhovni wrote: > > On Tue, Sep 06, 2022 at 06:35:05AM -0400, Wietse Venema wrote: > > > > > > Any suggestion? > > > > > > /etc/postfix/main.cf: > > > recipient_bcc_maps =

Re: Save all emails in transit, including envelope data

2022-09-06 Thread Wietse Venema
Massimo Federico Bonfigli: > As per the subject says, is there a way to save all email in transit > through postfix, including the basic envelope info (in particular at least > envelope sender and recipients)? > > I know I could use the pipe daemon to invoke a script and save these info, >

Re: Odd DNS issue requiring reboot.

2022-09-05 Thread Wietse Venema
Viktor Dukhovni: > Perhaps your resolver settings in the chroot jail become stale, and > are fixed when the "init script" resyncs the chroot with the /etc. > You might try running without chroot. To turn off chroot for all Postfix daemons, update master.cf: postconf -F "*/*/chroot = n" postfix

Re: Odd DNS issue requiring reboot.

2022-09-05 Thread Wietse Venema
If it requires a REBOOT, then it is not a POSTFIX problem. Wietse

Re: error_limit

2022-09-03 Thread Wietse Venema
Steffen Nurpmeso: > Wietse Venema wrote in > <4mk3km4jwpzj...@spike.porcupine.org>: > |natan: > |> Hi > |> I have one specific question > |> > |> in main.cf i have: > |> ... > |> smtpd_hard_error_limit = 5 > |> smtpd_soft_error_

Re: error_limit

2022-09-02 Thread Wietse Venema
natan: > Hi > I have one specific question > > in main.cf i have: > ... > smtpd_hard_error_limit = 5 > smtpd_soft_error_limit = 2 > ... > > It is possible to change number *_error_limit for one IP ? This is not per client configurable. I suggest that you use the Postfix defaults. $ postconf

Re: How to send 10 messages, per second, through my relayhost?

2022-09-01 Thread Wietse Venema
Danil Smirnov: > On Thu, Sep 1, 2022 at 1:27 PM Wietse Venema wrote: > > > There is a missing colon: the syntax is randmap:{list...} > > Great! It works now. :) Thank you, Wietse. > > Is it possible to confirm that the approach is working in the postfix logs?

Re: How to send 10 messages, per second, through my relayhost?

2022-09-01 Thread Wietse Venema
Danil Smirnov: > Hi! > > On Wed, Feb 23, 2022 at 7:01 PM Wietse Venema wrote: > > > Short answer: > > > > Use randmap to select from 10 delivery agents. > > > > sender_dependent_default_transport_maps = randmap{smtp1:, smtp2:, ...} There is a

Re: Unexpected record type 'X'

2022-08-31 Thread Wietse Venema
Frank Brendel: > > You really should do something about that, build a table of over- > > quota > > recipients, and tempfail new mail for such users when briefly over > > quota, and ultimately reject if long-term over-quota. > > > but is that possible with remote mailboxes? The Postfix

Re: Unexpected record type 'X'

2022-08-30 Thread Wietse Venema
e-mail. Any unauthorized copying, disclosure or > distribution of the material in this e-mail is strictly forbidden. Am > Dienstag, dem 30.08.2022 um 10:52 -0400 schrieb Wietse Venema: > > Viktor Dukhovni: > > > On Tue, Aug 30, 2022 at 02:25:20PM +, Frank Brendel

Re: Unexpected record type 'X'

2022-08-30 Thread Wietse Venema
Viktor Dukhovni: > On Tue, Aug 30, 2022 at 02:25:20PM +, Frank Brendel wrote: > > > So I can try to reproduce it by simply putting that file into the > > incoming queue? > > Within the same filesystem, yes. > > > Our test system has FreeBSD 13.1 and Postfix 3.7.2 installed. I'd try > > to

Re: Unexpected record type 'X'

2022-08-30 Thread Wietse Venema
Wietse Venema: > Frank Brendel: > > Here's the Postfix log and the queue file. > > > > Aug 30 13:02:23 elvmwlx94.eurolog.com postfix/smtpd[56532] 57850C4DC9: > > client=unknown[194.50.162.68] > > Aug 30 13:02:23 elvmwlx94.eurolog.com postfix/cleanup[55311] > &g

Re: Unexpected record type 'X'

2022-08-30 Thread Wietse Venema
Frank Brendel: > Hi, > > sporadically I get the error > Unexpected record type 'X' at offset ... > and the message is moved to the corrupt queue. > > E.g. > postfix/smtpd[19574] 010EDD6443: client=unknown[1.2.3.4] > postfix/cleanup[98995] 010EDD6443: message-id=<> > postfix/qmgr[63719]

Re: DNS issue in the multi instance

2022-08-29 Thread Wietse Venema
You need to look in your logs. https://www.postfix.org/DEBUG_README.html#logging Wietse

Re: Postfix in DMZ: Really?

2022-08-27 Thread Wietse Venema
lutz.niede...@gmx.net: > Hi. > > Normally, I would say it is a good idea to set up a DMZ, put > relaying postfix in there and the final postfix into the LAN. This > is the design that was planned in the current project and implemented > many times before. But now, some believe that postfix is

Re: Subject encoding; logs not matching header

2022-08-26 Thread Wietse Venema
Viktor Dukhovni: > On Fri, Aug 26, 2022 at 01:26:26PM -0400, post...@ptld.com wrote: > > > > Postfix is NOT unfolding the subject, and so not surprisingly not > > > removing the CRLF (really just LF when presented to header_checks, > > > logs, delivered to unix files, ...). My response was

Re: Subject encoding; logs not matching header

2022-08-26 Thread Wietse Venema
post...@ptld.com: > I know this is minor, just bringing it to light if Wietse feels > it is worth doing something about. I noticed on emails with encoded > subject lines an extra character is being inserted into the logs. Postfix (and Postfix logging) does not alter subject lines. You configure

Re: warning: cannot connect to service private/smtpd

2022-08-25 Thread Wietse Venema
Brad Chandler: > VMware. Is there anything that can be done on the VMware side to prevent this? If a platform causes Postfix watchdog timeouts, then it is not supported. There are tons of web search hits for VMware lost interrupts, and for VMware time keeping. This is for Linux guests:

Re: warning: cannot connect to service private/smtpd

2022-08-25 Thread Wietse Venema
Brad Chandler: > Aug 15 18:51:24 mx03 postfix/smtpd[13552]: fatal: watchdog timeout > Aug 15 18:51:25 mx03 postfix/master[1553]: warning: process > /usr/libexec/postfix/smtpd pid 13552 exit status 1 Wietse: > That is a Postfix safety mechanism for rare infrastructure bugs > that mess up Postfix

Re: warning: cannot connect to service private/smtpd

2022-08-25 Thread Wietse Venema
Brad Chandler: > Aug 15 18:51:24 mx03 postfix/smtpd[13552]: fatal: watchdog timeout > Aug 15 18:51:25 mx03 postfix/master[1553]: warning: process > /usr/libexec/postfix/smtpd pid 13552 exit status 1 That is a Postfix safety mechanism for a rare infrastructure bugs that mess up Postfix event

Re: relayhost per-server wrappermode setting

2022-08-20 Thread Wietse Venema
witcher: > Aug 19 23:02:43 portable-navi postfix/smtp[385223]: 2190C1428ED: > to=, relay=none, delay=585, delays=585/0.11/0/0, > dsn=4.4.3, status=deferred (Host or domain name not found. Name service > error for name=smtp.example.com type=MX: Host not found, try again) That is Postfix. Maybe you

Re: Capture outgoing email

2022-08-17 Thread Wietse Venema
Matus UHLAR - fantomas: > >> >You might work around this by settting > >> > > >> >disable_mime_output_conversion = yes > >> > > >> >in main.cf. > > >Matus UHLAR - fantomas: > >> won't this stop mail from be

Re: Capture outgoing email

2022-08-17 Thread Wietse Venema
Steffen Nurpmeso: > Hello. > > Wietse Venema wrote in > <4m7by01gfjzj...@spike.porcupine.org>: > |Matus UHLAR - fantomas: > |>>Matus UHLAR - fantomas: > |>>> On 17.08.22 13:45, Andy Beverley wrote: > |>>>>This is an interesting point

Re: Capture outgoing email

2022-08-17 Thread Wietse Venema
t message (with the opendkim milter), > >> >and then after the signature has been added that the content is then > >> >altered in order to be delivered as a 7-bit message? > > On 17.08.22 10:49, Wietse Venema wrote: > >This has nothing to do with SMTPUTF8. > >

Re: send mail from the domain directly to the local server without going out to the Internet

2022-08-17 Thread Wietse Venema
Sam R: > Hello to all, > > I have several Postfix servers named MX, SMTP and MAIL on my dmz: > MX is used to receive mails to our "@domain.fr" from Internet > SMTP is used to send mails from "@domain.fr > MAIL is used as a storage server for "@domain.fr" mails > > However, I would like to be

Re: Capture outgoing email

2022-08-17 Thread Wietse Venema
Matus UHLAR - fantomas: > On 17.08.22 13:45, Andy Beverley wrote: > >This is an interesting point that I hadn't thought of. I have > >smtputf8_enable set to yes, but I have just checked the remote server > >and it only shows: > > > >250-AUTH PLAIN LOGIN > >250-STARTTLS > >250 HELP > > > >So are

Re: Protect access to submission services

2022-08-16 Thread Wietse Venema
Jaroslaw Rafa: [IMAP before SMTP] > That's the usual way mail clients work: they first open an IMAP > connection and keep it open all the time, and only when you want > to send mail, they connect to a submission service. > > Only I don't know, is there an easy way to get from Dovecot a list > of

Re: Accept all emails sent to *.example.com

2022-08-16 Thread Wietse Venema
Jonathan S?lea: > > > > > All recipients[1], or only "valid" recipients[2]?? > > > > [1] Makes sense if the mail is NOT delivered. Examples of that are > > spamtraps or honeypots. > > Yes, that is the case here - honeypots/spamtraps. Postfix can do that (bit see suggestion at the end).

Re: postscreen scoring questions

2022-08-15 Thread Wietse Venema
Peter: > On 12/08/22 08:41, Wietse Venema wrote: > > After some delay, I have verified that postscreen_dnsbl_sites works > > as promised: it adds up the scores from all matching patterns. > > > > This verification required some infrastructure to test postscreen

Re: Accept all emails sent to *.example.com

2022-08-14 Thread Wietse Venema
Jonathan S?lea: > Hi, > > Is there a way to configure postfix to accept all emails sent to > *.example.com? All recipients[1], or only "valid" recipients[2]?? [1] Makes sense if the mail is NOT delivered. Examples of that are spamtraps or honeypots. [2] Requires that the Postfix SMTP server

Re: Milter vs. policy protocol

2022-08-12 Thread Wietse Venema
Jaroslaw Rafa: > Dnia 12.08.2022 o godz. 10:09:08 Wietse Venema pisze: > > > By the way: does anybody know of a tool ready to use with Postfix, that > > > does exactly this and only this, ie. allows to define sender/recipient > > > pairs > > > t

Re: Milter vs. policy protocol

2022-08-12 Thread Wietse Venema
Jaroslaw Rafa: > Dnia 12.08.2022 o godz. 13:23:25 Dominik George pisze: > > > > now that I have moved alias expansion to a socketmap service, I was > > wondering what would be best for policy checks (for now, as simple as > > "is address A allowed to send to address B?). > > > > This os

Re: Alias expansion in a milter service?

2022-08-11 Thread Wietse Venema
Dominik George: Checking application/pgp-signature: FAILURE -- Start of PGP signed section. > Hi, > > [ please excuse me if this kind of progress reports for learning ] > [ and feedback are discouraged on this list ] > > On Thu, Aug 11, 2022 at 10:31:00AM +, Claus

Re: postscreen_dnsbl_sites precedence

2022-08-11 Thread Wietse Venema
Matt Saladna: > Hello, > > When specifying a range of responses to ignore in postscreen_dnsbl_sites > it appears that if a weight is zero it is ignored in favor of a non-zero > weight. Coming back to this thread, please ignore my previuous responses about order dependence. They were wrong.

postscreen scoring questions (was: questions about multiple matches)

2022-08-11 Thread Wietse Venema
After some delay, I have verified that postscreen_dnsbl_sites works as promised: it adds up the scores from all matching patterns. This verification required some infrastructure to test postscreen's scoring code outside of postscreen. I have written a half-dozen tests to ensure that future

Re: milter with disable_mime_output_conversion=yes: HOW?

2022-08-11 Thread Wietse Venema
lutz.niede...@gmx.net: > Hi. > > Maybe a simple thing but my head is running in circles. > > I'm integrating rspamd as milter like this: > smtpd_milters = inet:localhost:11332 > > MILTER_README says that one should use disable_mime_output_conversion=yes for > milters and shows an example (in

Re: Postscreen DNSBL do not seem to be working

2022-08-09 Thread Wietse Venema
Dino Edwards: > > > >Let's do some concreate tests. > > >1) What is the output from: > > > dig +short 2.0.0.127.zen.spamhaus.org > > Output is nothing There should be a list of responses, as pointed out by Bill Cole (or an error response if you are using a provider's resolver).

Re: Postscreen DNSBL do not seem to be working

2022-08-09 Thread Wietse Venema
Dino Edwards: > > << I suggest that you start with dig/nslookup and establish that you have > properly working DNS, and that your ISP is not replacing all "not found" > responses with the IP address of some "helpful" website. > > Using local DNS servers and not ISP servers. DNS is working as it

Re: Postscreen DNSBL do not seem to be working

2022-08-09 Thread Wietse Venema
I suggest that you start with dig/nslookup and establish that you have properly working DNS, and that your ISP is not replacing all "not found" responses with the IP address of some "helpful" website. Wietse

Re: SSL decode error/eof

2022-08-09 Thread Wietse Venema
Tom McLoughlin: > Hello, > > Recently started receiving this error and unable to find any solution to > this, any ideas? > > |OpenSSL version: OpenSSL 3.0.4 21 Jun 2022 (Library: OpenSSL 3.0.4 21 > Jun 2022) Postfix version: mail_version = 3.6.4 Dovecot version: > 2.3.19.1 (9b53102964)| > >

Re: Customer getting timeouts - traffic not showing on relays

2022-08-08 Thread Wietse Venema
What is between Postfix and the internet: - A load balancer? - A firewall that inspects TCP sessions? Question 1: were there other SMTP sessions during this time frame, and did they have timeouts or 'unknown' commands? The next one timed out after 306 seconds, where 300s is expected.

Re: Are there forced line breaks?

2022-08-07 Thread Wietse Venema
Massimo Federico Bonfigli: > Just as a clarification, what is exactly the logic followed by Postfix here? The logic is Garbage In, Garbage Out. Email that is not "correct" with respect to a decades old standard cannot be delivered "correctly". Wietse

Re: Where to place spamhaus tests

2022-08-07 Thread Wietse Venema
Linkcheck: > And now, during the past few days, zen has blocked a couple of valid > emails, the IPs of which zen claims to know nothing about. Are you sure that you are using a LOCAL DNS resolver and not relying on some ISP's DNS? Wietse

Re: Are there forced line breaks?

2022-08-06 Thread Wietse Venema
post...@ptld.com: > Does postfix through either smtp or submission (or both) force > line breaks? I am noticing line breaks after every 998 characters > in the body of plain text messages. > > If postfix is the one doing this, is it hard coded or is it a > variable that can be changed? $

Re: AW: postfix/postscreen with proxy protocol?

2022-08-03 Thread Wietse Venema
Viktor Dukhovni: > On Wed, Aug 03, 2022 at 10:39:17PM +0200, Joachim Lindenberg wrote: > > > I do have inet_protocols=ipv4 in main.cf, everything else should > > support ipv6 as mailcow in general does support ipv6, but due my NAT > > setup I decided not to support ipv6 so far, and also I don?t

Re: masquerade_domains map?

2022-08-02 Thread Wietse Venema
lutz.niede...@gmx.net: > Hi! > > I found this from 2018, and I wanted to ask if maps for masquerade_domains > are now supported. > Sorry, this has not happened. The implementation still splits the domain list into an array of domain names instead of using a STRING_LIST based approach that

Re: inet_interfaces & smtp_bind_address behavior on multiple interfaces

2022-08-01 Thread Wietse Venema
post...@ptld.com: > > As you can see above, with "inet_interfaces = all" Postfix will > > LISTEN on all available IPv4 (or IPv6) interface addresses, and it > > will NOT BIND to a specific IPv4 (or IPv6) address. > > Sorry if I'm being slow. > Yes postfix will listen to ALL and bind to 0.0.0.0:25

Re: inet_interfaces & smtp_bind_address behavior on multiple interfaces

2022-08-01 Thread Wietse Venema
Wietse Venema: > post...@ptld.com: > > Just to clarify my understanding: > > > > On a server with two network interfaces, the first interface has one public > > IP, the seconds interface has one private (192.168.x.x) IP. > > > > inet_interf

Re: inet_interfaces & smtp_bind_address behavior on multiple interfaces

2022-08-01 Thread Wietse Venema
post...@ptld.com: > Just to clarify my understanding: > > On a server with two network interfaces, the first interface has one public > IP, the seconds interface has one private (192.168.x.x) IP. > > inet_interfaces = all > inet_protocols = all > #smtp_bind_address = >

Re: post queue hook/filter

2022-08-01 Thread Wietse Venema
Leandro Santiago: Checking application/pgp-signature: FAILURE -- Start of PGP signed section. > I'm using Postfix 3.6.4 on Debian and would like to know if it's > possible to execute some custom code **after** postfix successfully > delivers an email (postfix/smtp status=sent). > > The reason

Re: R: third-level domains

2022-07-27 Thread Wietse Venema
Scappatura Rocco: > Thank you Wietse. > > This is what is set relay_domains on my server: > > relay_domains = proxy:mysql:/etc/postfix/mysql-relay-domains.cf > /etc/postfix/mysql-relay-domains.cf: query = select domain from domain where > domain='%s' and active='1' > > And, obliviously, while

Re: third-level domains

2022-07-27 Thread Wietse Venema
Jaroslaw Rafa: > Dnia 27.07.2022 o godz. 06:41:16 Wietse Venema pisze: > > relay_domains matches all subdomains of the listed domains. This > > is controlled with parent_domain_matches_subdomains. Unfortunately > > the default value is a long list, so edit this carefully. &

<    5   6   7   8   9   10   11   12   13   14   >