Re: DMARC in postfix ?

2022-04-13 Thread Benny Pedersen
On 2022-04-14 08:39, Erwan David wrote: I stopped rspamd because of too many false positive, too many rules that you cannot disable (I disabled RBL & SPF checks which lead to erros). rspamd is for pilots only, that know ucl is much more simple then well supported xml files, with plenty of sup

Re: DMARC in postfix ?

2022-04-13 Thread Erwan David
Le 14/04/2022 à 07:58, Aban Dokht a écrit : P V Anthony wrote: Rspamd is really powerful and fast. Give it a go. You will be very pleased. P.V.Anthony I also prefer rspamd over other solutions, because it implemets DMARC out of the box. Also other features, like ARC, HA ready and the nice

Re: DMARC in postfix ?

2022-04-13 Thread Aban Dokht
P V Anthony wrote: Rspamd is really powerful and fast. Give it a go. You will be very pleased. P.V.Anthony I also prefer rspamd over other solutions, because it implemets DMARC out of the box. Also other features, like ARC, HA ready and the nice UI make it worth to give it a try. Regar

Re: match empty sender in hash: sender access map?

2022-04-13 Thread raf
On Thu, Apr 14, 2022 at 01:22:03AM -0400, Viktor Dukhovni wrote: > On Thu, Apr 14, 2022 at 12:25:11AM -0400, Greg Klanderman wrote: > > > > This is naturally documented in access(5), and also in postconf(5) > > > under: > > > > > > smtpd_null_access_lookup_key (default: <>) > > >The

Re: match empty sender in hash: sender access map?

2022-04-13 Thread Viktor Dukhovni
On Thu, Apr 14, 2022 at 12:25:11AM -0400, Greg Klanderman wrote: > > This is naturally documented in access(5), and also in postconf(5) > > under: > > > > smtpd_null_access_lookup_key (default: <>) > >The lookup key to be used in SMTP access(5) tables instead of the > >null sen

Re: DMARC in postfix ?

2022-04-13 Thread P V Anthony
On 14/4/2022 8:18 am, raf wrote: I too like rspamd. I've read that it was not maintained, someone took over it ? Jeff I think you read wrong. The original author put out a release 5 days ago. And there were 8 new contributors for that release. The release before that was last November. chee

Re: match empty sender in hash: sender access map?

2022-04-13 Thread Greg Klanderman
> On April 10, 2022 Viktor Dukhovni wrote: > On Sun, Apr 10, 2022 at 02:27:33PM -0400, Greg Klanderman wrote: >> Quick question, what is the correct syntax to match an empty sender in >> a hash: sender access map (i.e. check_sender_access)? > This is naturally documented in access(5), and al

Re: match empty sender in hash: sender access map?

2022-04-13 Thread Greg Klanderman
> On April 13, 2022 Matus UHLAR <- fantomas > wrote: >>> On April 10, 2022 Bill Cole >>> wrote: >>> Right, because you do not need to run 'postmap' on regex or pcre maps. The >>> text >>> format ios what Postfix uses for those types. > On 12.04.22 23:06, Greg Klanderman wrote: >> T

Re: DMARC in postfix ?

2022-04-13 Thread raf
On Thu, Apr 14, 2022 at 02:11:55AM +0200, Jean-François Bachelet wrote: > Hello ^^) > > Le 13/04/2022 à 17:28, P V Anthony a écrit : > > On 13/4/2022 3:24 pm, Juri Haberland wrote: > > > > > There is rspamd. It does more than just DMARC, but seems to be in better > > > shape than OpenDMARC. >

Re: connection timeout ?

2022-04-13 Thread Viktor Dukhovni
On Wed, Apr 13, 2022 at 10:04:59PM -0400, John Levine wrote: > >in other words if a domain is nullMx postfix still reject it, aswell for > >senders > > Not all MTAs work the same. Not even Postfix :-) By default mail is accepted from NullMX envelope sender domains, to reject it one must elect

Re: connection timeout ?

2022-04-13 Thread John Levine
It appears that Benny Pedersen said: gmail.dk. 300 IN MX 0 . >>> >>> if nullMX is added then spf and dmarc can be removed >> >> You need both the null MX and the SPF. Null MX says you >> don't receive mail, SPF -all says you don't send mail. > >why is spf needed

Re: connection timeout ?

2022-04-13 Thread Benny Pedersen
On 2022-04-14 02:40, John Levine wrote: It appears that Benny Pedersen said: On 2022-04-13 19:27, Matus UHLAR - fantomas wrote: however, they miss the nullmx record: gmail.dk. 300 IN MX 0 . if nullMX is added then spf and dmarc can be removed You need both the

Re: connection timeout ?

2022-04-13 Thread John Levine
It appears that Benny Pedersen said: >On 2022-04-13 19:27, Matus UHLAR - fantomas wrote: > >> however, they miss the nullmx record: >> >> gmail.dk. 300 IN MX 0 . > >if nullMX is added then spf and dmarc can be removed You need both the null MX and the SPF. Null MX sa

Re: DMARC in postfix ?

2022-04-13 Thread Jean-François Bachelet
Hello ^^) Le 13/04/2022 à 17:28, P V Anthony a écrit : On 13/4/2022 3:24 pm, Juri Haberland wrote: There is rspamd. It does more than just DMARC, but seems to be in better shape than OpenDMARC. I too like rspamd. I've read that it was not maintained, someone took over it ? Jeff

Re: connection timeout ?

2022-04-13 Thread Benny Pedersen
On 2022-04-13 19:27, Matus UHLAR - fantomas wrote: however, they miss the nullmx record: gmail.dk. 300 IN MX 0 . if nullMX is added then spf and dmarc can be removed i have localy added nullMX to bind9 here for gmail.dk posttls -l dane plantmarknaden.com one mor

Re: connection timeout ?

2022-04-13 Thread Matus UHLAR - fantomas
On 2022-04-13 18:46, Wietse Venema wrote: Benny Pedersen: i recently begin to see domains give connection timeout posttls-finger -l none gmail.dk According to my DNS, gmail.dk has no MX record. Is that expected? On 13.04.22 19:01, Benny Pedersen wrote: in what way its not a nullMX domain

Re: connection timeout ?

2022-04-13 Thread Benny Pedersen
On 2022-04-13 18:46, Wietse Venema wrote: Benny Pedersen: i recently begin to see domains give connection timeout posttls-finger -l none gmail.dk According to my DNS, gmail.dk has no MX record. Is that expected? in what way its not a nullMX domain ? postfix deliver mail to A/ aswell i

Re: connection timeout ?

2022-04-13 Thread Wietse Venema
Benny Pedersen: > > i recently begin to see domains give connection timeout > > posttls-finger -l none gmail.dk According to my DNS, gmail.dk has no MX record. Is that expected? Wietse

connection timeout ?

2022-04-13 Thread Benny Pedersen
i recently begin to see domains give connection timeout posttls-finger -l none gmail.dk i use -l none here in case it was just openssl problem, in gentoo last openssl is compiled without weak-ssl-ciphers postfix version 3.6.5 with default smtp_* for ciphers is others see same problems ?

Re: DMARC in postfix ?

2022-04-13 Thread P V Anthony
On 13/4/2022 3:24 pm, Juri Haberland wrote: There is rspamd. It does more than just DMARC, but seems to be in better shape than OpenDMARC. I too like rspamd. P.V.Anthony

Re: Pre- or post-queue filter for authenticated submission

2022-04-13 Thread Matus UHLAR - fantomas
On 13/04/2022 13:29, Jesper Dybdal wrote: I use amavisd-new for the smtpd instances that receive authenticated submission. Are there any significant pros and cons in doing this as a pre-queue filter (proxy) compared to doing it as a post-queue content filter? I suspect that it doesn't really ma

Re: DMARC in postfix ?

2022-04-13 Thread postfix
> There is rspamd. It does more than just DMARC, but seems to be in better > shape than OpenDMARC. I use OpenDMARC and have not noticed any issues. More than one person has said it has issues, what are the problems with it?

Re: Pre- or post-queue filter for authenticated submission

2022-04-13 Thread Dominic Raferd
On 13/04/2022 13:29, Jesper Dybdal wrote: I use amavisd-new for the smtpd instances that receive authenticated submission. Are there any significant pros and cons in doing this as a pre-queue filter (proxy) compared to doing it as a post-queue content filter? I suspect that it doesn't really ma

Re: Pre- or post-queue filter for authenticated submission

2022-04-13 Thread Jesper Dybdal
On 2022-04-13 15:24, Wietse Venema wrote: Jesper Dybdal: I use amavisd-new for the smtpd instances that receive authenticated submission. Are there any significant pros and cons in doing this as a pre-queue filter (proxy) compared to doing it as a post-queue content filter? Doing what as a fil

Re: Pre- or post-queue filter for authenticated submission

2022-04-13 Thread Wietse Venema
Jesper Dybdal: > I use amavisd-new for the smtpd instances that receive authenticated > submission. > > Are there any significant pros and cons in doing this as a pre-queue > filter (proxy) compared to doing it as a post-queue content filter? Doing what as a filter? Pro is that you have the o

Pre- or post-queue filter for authenticated submission

2022-04-13 Thread Jesper Dybdal
I use amavisd-new for the smtpd instances that receive authenticated submission. Are there any significant pros and cons in doing this as a pre-queue filter (proxy) compared to doing it as a post-queue content filter? I suspect that it doesn't really matter for a low-volume server like mine,

Re: match empty sender in hash: sender access map?

2022-04-13 Thread Matus UHLAR - fantomas
On April 10, 2022 Bill Cole wrote: Right, because you do not need to run 'postmap' on regex or pcre maps. The text format ios what Postfix uses for those types. On 12.04.22 23:06, Greg Klanderman wrote: Thank you Bill! Knowing that now, I see where postmap(1) states: | The postmap(1) comman

Re: DMARC in postfix ?

2022-04-13 Thread PGNet Dev
On 4/12/22 11:31 PM, John Levine wrote: For doing DMARC validation, I know about the opendmarc milter. Is that what everyone uses? Is there anything else used in pratice? for inbound validation, i use https://github.com/fastmail/authentication_milter usable as milter or smtp filter integ

Re: DMARC in postfix ?

2022-04-13 Thread Juri Haberland
On 13/04/2022 05:31, John Levine wrote: > For doing DMARC validation, I know about the opendmarc milter. Is that what > everyone uses? Is there anything else used in pratice? > > I know about perl and python libraries but they don't seem to have > milters or other ready to use integrations into

Re: Announcement: LetsDNS release 1.0 is now available

2022-04-13 Thread Matthias Fechner
Am 13.04.22 um 10:26 schrieb Damian: https://mail.sys4.de/mailman/listinfo/dane-users does not work? thanks, that information was missing. Gruß, Matthias -- "Programming today is a race between software engineers striving to build bigger and better idiot-proof programs, and the universe tryi

Re: Announcement: LetsDNS release 1.0 is now available

2022-04-13 Thread Jürgen Echter
Am Mittwoch, April 13, 2022 10:22 CEST, schrieb Matthias Fechner : > Am 12.04.2022 um 19:15 schrieb Ralph Seichter: > > I'm happy to usedane-us...@sys4.de if you don't mind it. I consider > > that one pretty much*your* mailing list and did not mean to just barge > > in, although I had obviously

Re: Announcement: LetsDNS release 1.0 is now available

2022-04-13 Thread Damian
how can I sub-scr1be to this list? Sorry to write it this way, but there is a stupid filter in place that blocks the email. https://mail.sys4.de/mailman/listinfo/dane-users does not work?

Re: Announcement: LetsDNS release 1.0 is now available

2022-04-13 Thread Matthias Fechner
Am 12.04.2022 um 19:15 schrieb Ralph Seichter: I'm happy to usedane-us...@sys4.de if you don't mind it. I consider that one pretty much*your* mailing list and did not mean to just barge in, although I had obviously hoped for your input in particular. how can I sub-scr1be to this list? Sorry t