Re: smtp helo connection timeouts -- increasing values

2011-10-18 Thread Ralf Hildebrandt
* Edward Morbius dredmorb...@gmail.com: Several of our peer mail systems (outbound) seem to take a while responding to initial SMTP connections. That happens if: * your dns is slow (reverse lookups of the client IP) * all your SMTPD processes are in use Is there any particularly dread

Re: chaining content_filters

2011-10-18 Thread Roland de Lepper
Are you sure? Because nothing is running on that port. The bash script is just a stand-alone script not running on any port. My logs also say: warning: connect to transport private/localhost: Connection refused netstat -tap says: tcp0 0 localhost:10027 *:* LISTEN

postscreen: 550 5.5.1 Protocol error

2011-10-18 Thread Jeetu
Hi, Im using postfix 2.8.5 with postscreen. Im constantly getting this error message Oct 18 08:02:10 inbound-us1 postfix/postscreen[12189]: NOQUEUE: reject: RCPT from [x.x.x.x]:64730: 550 5.5.1 Protocol error; from=newslet...@greetings.info, to=preethin...@mail.in, proto=SMTP,

Re: postscreen: 550 5.5.1 Protocol error

2011-10-18 Thread Ralf Hildebrandt
* Jeetu jeetendr...@directi.com: Hi, Im using postfix 2.8.5 with postscreen. Im constantly getting this error message Oct 18 08:02:10 inbound-us1 postfix/postscreen[12189]: NOQUEUE: reject: RCPT from [x.x.x.x]:64730: 550 5.5.1 Protocol error; from=newslet...@greetings.info,

Re: chaining content_filters

2011-10-18 Thread Roland de Lepper
problem solved by using header_checks. header_checks: if /^TO:/ /^To: .*testvw01@xxx01\.local/ FILTER autoresponder: /^To: .*testhk03@xxx02\.local/ FILTER autoresponder: endif master.cf: smtp inet n - - - - smtpd -o content_filter=dfilt: -o

Using Spamassassin as content filter

2011-10-18 Thread Daniele Nicolodi
Hello, on the web there are several recipes to integrate Spamassassin with Postfix, but no one seems to me to be the definitive recipe. I think that this configuration is quite common (for low volume smtp servers) and would deserve a small space in Postfix official documentation, but maybe it is

Re: chaining content_filters

2011-10-18 Thread Noel Jones
On 10/18/2011 3:01 AM, Roland de Lepper wrote: Are you sure? Because nothing is running on that port. The bash script is just a stand-alone script not running on any port. I didn't say anything about a port. Edit your dfilt script to send its output to the autoresponder script. My logs

Re: postscreen: 550 5.5.1 Protocol error

2011-10-18 Thread Wietse Venema
Jeetu: Hi, Im using postfix 2.8.5 with postscreen. Im constantly getting this error message Oct 18 08:02:10 inbound-us1 postfix/postscreen[12189]: NOQUEUE: reject: RCPT from [x.x.x.x]:64730: 550 5.5.1 Protocol error; from=newslet...@greetings.info, to=preethin...@mail.in, proto=SMTP,

Re: Spammers attempting SASL auth.

2011-10-18 Thread Simon Brereton
On 17 October 2011 19:43, Stan Hoeppner s...@hardwarefreak.com wrote: On 10/17/2011 10:50 AM, Simon Brereton wrote: Does your approach for sending to abuse work for Roadrunner?  I have 1000 pings a day from a host on RR cable and when I tried to email abb...@rr.com, the connection timed out

Message sent per open connection

2011-10-18 Thread Mickael B
Hi, I try to change the source code of postfix to allow postfix to send more than one message per open connection. I want to create a new value like message_per_open_connect= I use the rate delay 0 that for the concurrency limit at 1. I also try to change this setting in source code and

Re: Using Spamassassin as content filter

2011-10-18 Thread Kris Deugau
Daniele Nicolodi wrote: Hello, on the web there are several recipes to integrate Spamassassin with Postfix, but no one seems to me to be the definitive recipe. I think that this configuration is quite common (for low volume smtp servers) and would deserve a small space in Postfix official

Re: Message sent per open connection

2011-10-18 Thread Lst_hoe02
Zitat von Mickael B m...@brainw1.net: Hi, I try to change the source code of postfix to allow postfix to send more than one message per open connection. I want to create a new value like message_per_open_connect= I use the rate delay 0 that for the concurrency limit at 1. I also try to

RE: Message sent per open connection

2011-10-18 Thread Mickael B
Hi, For information in source code the line where concurrency is force at 1 when rate delay is 0 here if (transport-rate_delay 0) transport-dest_concurrency_limit = 1; if (transport-dest_concurrency_limit != 0 transport-dest_concurrency_limit

RE: Message sent per open connection

2011-10-18 Thread Mickael B
I already read this but the cache connection are in time and I prefer to use the cache connection per message If I do that : smtp_connection_cache_on_demand = yes smtp_connection_cache_destinations = hotmail.com And I want to limit to hotmail destination to send per open connection over 10

Re: Message sent per open connection

2011-10-18 Thread Wietse Venema
Mickael B: I try to change the source code of postfix to allow postfix to send more than one message per open connection (while rate-limiting at one per 6 seconds). It is anti-social to keep a remote SMTP connection idle for several seconds. If you need to send lots of email, you must not use

Re: smtp helo connection timeouts -- increasing values

2011-10-18 Thread Viktor Dukhovni
On Mon, Oct 17, 2011 at 07:17:18PM -0700, Edward Morbius wrote: Several of our peer mail systems (outbound) seem to take a while responding to initial SMTP connections. Is there any particularly dread pitfall to watch out for in bumping these values up? 20s for connection, 40s for HELO is

RE: Message sent per open connection

2011-10-18 Thread Mickael B
The ISP ask the social sending method is send message per open connection I just want to keep the connection open to send my message and respect the recommendation of ISP. I'm not sending email from my home user ISP account, I'm sending my newletter from my server with Postfix MTA and webmin Mick

Re: Message sent per open connection

2011-10-18 Thread Wietse Venema
Mickael B: I try to change the source code of postfix to allow postfix to send more than one message per open connection (while rate-limiting at one per 6 seconds). Wietse: It is anti-social to keep a remote SMTP connection idle for several seconds. If you need to send lots of email, you

Re: TLS Issues. certificate unknown: SSL alert number 46:

2011-10-18 Thread Simon Brereton
On 13 October 2011 20:11, Noel Jones njo...@megan.vbhcs.org wrote: The only place you should really care about encryption is if your own clients submit SASL authenticated mail -- the far most common auth mechanisms are PLAIN and LOGIN which really should be protected inside a TLS connection.  

Content filter after DKIM proxy

2011-10-18 Thread Simon Brereton
Hi I expect that this is not recommended practice, but before I implemented DKIM signing, Amavis used to scan ALL mail - incoming and outgoing - and I was happy with that. If I want Amavis to scan and rate the mail after dkim proxy has signed it, is that as simple as adding the content filter

Re: TLS Issues. certificate unknown: SSL alert number 46:

2011-10-18 Thread Charles Marcus
On 2011-10-18 1:04 PM, Simon Brereton simon.brere...@buongiorno.com wrote: Is smtpd_enforce_tls=yes a suitable replacement/substitute for smtpd_tls_auth_only = yes? No, they are two different things. What version of postfix? For current/latest version of postfix I use both:

RE: Message sent per open connection

2011-10-18 Thread Mickael B
If I create specific transport like slow and high Slow_connection_cache_time_limit = 2s High_connection_cache_time_limit = 5s I have to add the value in scache(8) and smtp(8)? == Used in Parameter name and default value

Re: Content filter after DKIM proxy

2011-10-18 Thread Simon Deziel
On 10/18/2011 01:12 PM, Simon Brereton wrote: Hi I expect that this is not recommended practice, but before I implemented DKIM signing, Amavis used to scan ALL mail - incoming and outgoing - and I was happy with that. I don't know if that's would suites you but Amavis is capable of

Re: Content filter after DKIM proxy

2011-10-18 Thread Simon Brereton
On 18 October 2011 13:27, Simon Deziel simon.dez...@gmail.com wrote: On 10/18/2011 01:12 PM, Simon Brereton wrote: Hi I expect that this is not recommended practice, but before I implemented DKIM signing, Amavis used to scan ALL mail - incoming and outgoing - and I was happy with that. I

Re: Content filter after DKIM proxy

2011-10-18 Thread Noel Jones
On 10/18/2011 12:12 PM, Simon Brereton wrote: Hi I expect that this is not recommended practice, but before I implemented DKIM signing, Amavis used to scan ALL mail - incoming and outgoing - and I was happy with that. If I want Amavis to scan and rate the mail after dkim proxy has

Re: TLS Issues. certificate unknown: SSL alert number 46:

2011-10-18 Thread Noel Jones
On 10/18/2011 12:04 PM, Simon Brereton wrote: On 13 October 2011 20:11, Noel Jones njo...@megan.vbhcs.org wrote: The only place you should really care about encryption is if your own clients submit SASL authenticated mail -- the far most common auth mechanisms are PLAIN and LOGIN which really

Re: Content filter after DKIM proxy

2011-10-18 Thread Simon Brereton
On 18 October 2011 13:52, Noel Jones njo...@megan.vbhcs.org wrote: On 10/18/2011 12:12 PM, Simon Brereton wrote: Hi I expect that this is not recommended practice, but before I implemented DKIM signing, Amavis used to scan ALL mail - incoming and outgoing - and I was happy with that. If

Re: TLS Issues. certificate unknown: SSL alert number 46:

2011-10-18 Thread Simon Brereton
On 18 October 2011 14:17, Noel Jones njo...@megan.vbhcs.org wrote: On 10/18/2011 12:04 PM, Simon Brereton wrote: On 13 October 2011 20:11, Noel Jones njo...@megan.vbhcs.org wrote: The only place you should really care about encryption is if your own clients submit SASL authenticated mail --

Re: Content filter after DKIM proxy

2011-10-18 Thread Noel Jones
On 10/18/2011 1:20 PM, Simon Brereton wrote: I already use amavis to do the dkim checking on incoming mails. I'm using dkimproxy to sign outgoing mails (and I confess I only found out about opendkim after I'd set it up, so I'm not keen to change it at the moment - though of course, your vote

Re: Message sent per open connection

2011-10-18 Thread Wietse Venema
Mickael B: If I create specific transport like slow and high Slow_connection_cache_time_limit = 2s High_connection_cache_time_limit = 5s There is no documentation that supports this, therefore these are not Postfix features. I have to add the value in scache(8) and smtp(8)? If you have more

Re: TLS Issues. certificate unknown: SSL alert number 46:

2011-10-18 Thread Noel Jones
On 10/18/2011 1:24 PM, Simon Brereton wrote: smtpd_enforce_tls is obsolete, instead use -o smtpd_tls_security_level=encrypt This setting will reject all mail from unencrypted connections. The encrypt setting must not be used on a public-facing port 25, but is widely used and recommended on

Re: Content filter after DKIM proxy

2011-10-18 Thread Simon Deziel
On 10/18/2011 01:41 PM, Simon Brereton wrote: On 18 October 2011 13:27, Simon Deziel simon.dez...@gmail.com wrote: On 10/18/2011 01:12 PM, Simon Brereton wrote: Hi I expect that this is not recommended practice, but before I implemented DKIM signing, Amavis used to scan ALL mail - incoming

Re: TLS Issues. certificate unknown: SSL alert number 46:

2011-10-18 Thread Viktor Dukhovni
On Tue, Oct 18, 2011 at 01:04:30PM -0400, Simon Brereton wrote: Is smtpd_enforce_tls=yes a suitable replacement/substitute for smtpd_tls_auth_only = yes? With smtpd_tls_security_level=encrypt (or its legacy form) the smtpd_tls_auth_only feature is arguably reduntant, but it is harmless, and

Re: Content filter after DKIM proxy

2011-10-18 Thread Simon Brereton
On 18 October 2011 15:01, Simon Deziel simon.dez...@gmail.com wrote: On 10/18/2011 01:41 PM, Simon Brereton wrote: On 18 October 2011 13:27, Simon Deziel simon.dez...@gmail.com wrote: On 10/18/2011 01:12 PM, Simon Brereton wrote: Hi I expect that this is not recommended practice, but before

Re: smtp helo connection timeouts -- increasing values

2011-10-18 Thread Edward Morbius
Good to know. I think we've addressed the problem, but it's nice to know we've got a lot of headroom to move up. Total traffic is ~40k messages/day, and our big sticking point's been Yahoo though we've been talking with them and may be doing better (hopefully lots better). The slow connections

Re: smtp helo connection timeouts -- increasing values

2011-10-18 Thread Edward Morbius
Ralf: thanks for your response. Our DNS queries seem fine. I tested via telnet connections to the remote sites and confirmed that they were responding slowly to HELO. Even after doing this (e.g.: cached DNS results) postfix was timing out with the old values. At 20/40 for connect/helo, we were

Re: Using Spamassassin as content filter

2011-10-18 Thread Daniele Nicolodi
Hello Kris, thank you for your comments. On 18/10/11 17:03, Kris Deugau wrote: Since you're happy to deliver the spam somewhere, rather than trying to reject it during the SMTP conversation, you're probably best off calling spamc early in your local-delivery rules rather than trying to