Re: qname-minimization-and-privacy breaks dnsbl in postfix

2019-11-06 Thread Viktor Dukhovni
> On Nov 6, 2019, at 11:45 PM, Benny Pedersen wrote: > > can other confirm it ? > > _ is not an ip This could well happen, since RBL DNS servers are custom software that does not necessarily handle empty-non-terminals. There are more reasons to avoid qname-minimization on MTAs, I don't

Re: qname-minimization-and-privacy breaks dnsbl in postfix

2019-11-06 Thread Benny Pedersen
Benny Pedersen skrev den 2019-11-07 05:45: can other confirm it ? _ is not an ip forgot its on https://www.isc.org/blogs/qname-minimization-and-privacy/

qname-minimization-and-privacy breaks dnsbl in postfix

2019-11-06 Thread Benny Pedersen
can other confirm it ? _ is not an ip

Re: Postfix with DKIM for a mail relay

2019-11-06 Thread Benny Pedersen
Richard James Salts skrev den 2019-11-07 02:03: email address in their outgoing mail you're going to have some collateral damage from p=reject. sure dmarc breaks dkim :(

Re: Postfix with DKIM for a mail relay

2019-11-06 Thread Richard James Salts
On Thursday, 7 November 2019 4:23:20 AM AEDT Dominic Raferd wrote: > ... > The main problem with DMARC is that some mailing lists (not this one, > I believe) mess it up, so I would suggest not to use it with > p=quarantine or p=reject on any domain where users are likely to post > to mailing

Re: Postfix with DKIM for a mail relay

2019-11-06 Thread Benny Pedersen
Roberto Carna skrev den 2019-11-06 17:11: Is it possible to implement DKIM only in my Postfix server for all the outgoing @example.com [1] mails ??? Or doing this I affect the outgoing mails from my Exchange server because it sends @example.com [1] mails withouth DKIM mechanism ??? is this

Re: Disabling TLS 1.0/1.1, is it advisable?

2019-11-06 Thread Bryan K. Walton
On Wed, Nov 06, 2019 at 11:16:17AM -0600, Blake Hudson wrote: > > On port 25 server to server connections, I agree with the sentiments of > others on this thread and think disabling TLS1.0/1.1 is a bit premature at > this time for most organizations. Thanks, Victor and Blake! Your replies

Re: Postfix with DKIM for a mail relay

2019-11-06 Thread Dominic Raferd
On Wed, 6 Nov 2019 at 17:04, Roberto Carna wrote: > El mié., 6 nov. 2019 a las 13:48, Dominic Raferd () > escribió: >> >> On Wed, 6 Nov 2019 at 16:12, Roberto Carna wrote: >> > My cooperative mail server is an Exchange which does not implement DKIM at >> > all. >> > But also I have a Postfix

Re: Disabling TLS 1.0/1.1, is it advisable?

2019-11-06 Thread Blake Hudson
I found that when clients are using common software like Windows 7 and Windows Live Mail, Outlook 2013, or recent versions of Thunderbird you are still likely to see TLS 1.0 connections. If your mail server only serves an organization where you control the client software you could probably

Re: Postfix with DKIM for a mail relay

2019-11-06 Thread Roberto Carna
Dear Dominic, thanks for your interesting comments. I administrate the Postfix mail server, not the Exchange, so I can't do anything to implement DKIM in the second one. In my Postfix mail server I've just have SPF implemented for outgoing mails.Maybe it's better to add DKIM + DMARC in place

Re: Postfix with DKIM for a mail relay

2019-11-06 Thread Dominic Raferd
On Wed, 6 Nov 2019 at 16:12, Roberto Carna wrote: > My cooperative mail server is an Exchange which does not implement DKIM at > all. > But also I have a Postfix mail relay for the "example.com" domain. > Is it possible to implement DKIM only in my Postfix server for all the > outgoing

Re: Disabling TLS 1.0/1.1, is it advisable?

2019-11-06 Thread Viktor Dukhovni
> On Nov 6, 2019, at 10:17 AM, Bastian Blank > wrote: > >> Now, I know that what is good for web servers/browsers, isn't >> necessarily the same for SMTP servers. For example, I've learned from >> this mailing list that public facing MTAs should not require >> super-strong ciphers because that

Postfix with DKIM for a mail relay

2019-11-06 Thread Roberto Carna
Dear, my domain is "example.com". My cooperative mail server is an Exchange which does not implement DKIM at all. But also I have a Postfix mail relay for the "example.com" domain. Is it possible to implement DKIM only in my Postfix server for all the outgoing @example.com mails ??? Or doing

Re: Disabling TLS 1.0/1.1, is it advisable?

2019-11-06 Thread Bastian Blank
On Wed, Nov 06, 2019 at 08:54:17AM -0600, Bryan K. Walton wrote: > Apple, Google, Microsoft, and Mozilla have all announced that they will > be deprecating TLS 1.0 and 1.1 in March 2020, in their web browsers. Mail is not a web browser. > Similarly, SSL Labs has announced that they will be

Disabling TLS 1.0/1.1, is it advisable?

2019-11-06 Thread Bryan K. Walton
Apple, Google, Microsoft, and Mozilla have all announced that they will be deprecating TLS 1.0 and 1.1 in March 2020, in their web browsers. Similarly, SSL Labs has announced that they will be downgrading web server scores to a maximum of B, starting in January 2020, if that webserver supports TLS

Re: redirect HOLD queue to alternate MTA??

2019-11-06 Thread Benny Pedersen
Matus UHLAR - fantomas skrev den 2019-11-06 10:26: this looks like a job for spam filter, not opendmarc. opendmarc is not spam, its forged protection i have posted how to avoid dmarc reject on maillist

Re: redirect HOLD queue to alternate MTA??

2019-11-06 Thread Benny Pedersen
Chi Min Wang skrev den 2019-11-06 03:30: Benny Pedersen wrote: why have you configured opendmarc to put anything on hold based on dmarc when you now ask how to do something with it ? The OpenDMARC just informs Postfix to put the suspicious mail into its HOLD queue(Postfix's quarantine)

Re: redirect HOLD queue to alternate MTA??

2019-11-06 Thread Matus UHLAR - fantomas
Benny Pedersen wrote: why have you configured opendmarc to put anything on hold based on dmarc when you now ask how to do something with it ? On 06.11.19 10:30, Chi Min Wang wrote: The OpenDMARC just informs Postfix to put the suspicious mail into its HOLD queue(Postfix's