Viktor Dukhovni via Postfix-users:
> On Tue, Feb 13, 2024 at 12:23:32PM -0500, Wietse Venema via Postfix-users
> wrote:
>
> > Over 25 years, Postfix has accumulated some features that
> > are essentially obsolete.
> >
> > - permit_mx_backup is fundamentally incompatible with recipient
> > address validation. There is no way to work around that with
> > reject_unverified_recipient, because that requires that a domain
> > is reachable, and in that case permit_mx_backup is not needed.
> > Log a deprecation warning with compatibility_levels>=3.9.
> >
> > - masquerade_domains complicates table-driven address validation.
> > Log a deprecation warning with compatibility_levels>=3.9.
> >
> > - disable_dns_lookups can be migrated to smtp_dns_support_level
> > which implements a superset of the functionality. Log a deprecation
> > warning with compatibility_levels>=3.9.
> >
> > What else needs to go?
>
> Obsoleted by TLS security levels:
>
> - lmtp_enforce_tls
> - lmtp_use_tls
> - postscreen_enforce_tls
> - postscreen_use_tls
> - smtp_enforce_tls
> - smtp_use_tls
> - smtpd_enforce_tls
> - smtpd_use_tls
> - tlsproxy_client_enforce_tls
> - tlsproxy_client_use_tls
> - tlsproxy_enforce_tls
> - tlsproxy_use_tls
>
> Obsoleted by TLS policy maps:
>
> - lmtp_tls_per_site
> - smtp_tls_per_site
> - tlsproxy_client_per_site
The above are easy to flag if explicitly set. No risk of breaking
code.
> Obsoleted by automatic negotiation in the SSL code:
>
> - smtpd_tls_dh1024_param_file = auto
> - smtpd_tls_eecdh_grade = auto
>
> [ We could delete the underlying support code for the explicit choices,
> and always use 'auto' with a warning if the configuration specifies
> a different choice. Mind you, automatic DH group negotiation is
> prone to choosing largish > 2048-bit groups, when the server will sign
> with a large RSA private key, but this feels somewhat justifiable. ]
Isn't that TLS version dependent, or have we already lost support for
the old way?
> Perhaps more controversial:
>
> - parent_domains_matches_subdomains
>
> This should IMHO be empty, with all parent-domain rules being explicit.
> Its convenience is offset by not entirely infrequent user confusion
> about where ".domain" is required (transport(5) table) and where it is
> not by default (access(5) table).
That's a lot of code that would have to become compatibility level dependent.
This is likely too invasive for Postfix 3.9.
Wietse
_______________________________________________
Postfix-users mailing list -- [email protected]
To unsubscribe send an email to [email protected]
