[pfx] Re: question for a directive in master.cf

2024-06-21 Thread Jeff Peng via Postfix-users
If you want to enable them, you have to uncomment ALL lines for submission service to work correctly. That's good idea. Thanks Rafa. ___ Postfix-users mailing list -- postfix-users@postfix.org To unsubscribe send an email to

[pfx] Re: question for a directive in master.cf

2024-06-21 Thread Jaroslaw Rafa via Postfix-users
Dnia 21.06.2024 o godz. 07:54:40 Jeff Peng via Postfix-users pisze: > for these options for submission in master.cf: > > submission inet n - y - - smtpd > # -o syslog_name=postfix/submission > # -o smtpd_tls_security_level=encrypt > -o smtpd_sasl_auth_enable=yes

[pfx] Re: SPF hostname and domainname

2024-06-21 Thread Jaroslaw Rafa via Postfix-users
Dnia 21.06.2024 o godz. 18:45:15 Peter via Postfix-users pisze: > SPF/DKIM/DMARC Checklist for (IMO) the best chance of getting your > mail to be accepted: > > 1. HELO banner should pass SPF. > > 2. Envelope Sender should pass SPF. > > 3. Envelope Sender domain should align with the From:

[pfx] Re: question for a directive in master.cf

2024-06-21 Thread Jeff Peng via Postfix-users
The default value is "no", as expected. $ postconf -d smtpd_sasl_auth_enable smtpd_sasl_auth_enable = no Best practice is to enable SASL auth only on the submission ports and NOT on port 25. I have changed the setting for submission to: submission inet n - y -

[pfx] Re: SPF hostname and domainname

2024-06-21 Thread Benny Pedersen via Postfix-users
Peter via Postfix-users skrev den 2024-06-21 08:45: On 21/06/24 07:13, Wietse Venema via Postfix-users wrote: SPF/DKIM/DMARC Checklist for (IMO) the best chance of getting your mail to be accepted: 1. HELO banner should pass SPF. 2. Envelope Sender should pass SPF. 3. Envelope Sender

[pfx] Re: SPF hostname and domainname

2024-06-21 Thread Peter via Postfix-users
On 21/06/24 07:13, Wietse Venema via Postfix-users wrote: Bounces are sent with the null envelope.from address which has no domain. Therefore, SPF applies policy to a surrogate: the hostname in the SMTP client's HELO/EHLO command (as if the envelope.from address was postmaster@helo-argument).

[pfx] Re: question for a directive in master.cf

2024-06-20 Thread Viktor Dukhovni via Postfix-users
On Fri, Jun 21, 2024 at 07:54:40AM +0800, Jeff Peng via Postfix-users wrote: > Hello > > for these options for submission in master.cf: > > submission inet n - y - - smtpd > # -o syslog_name=postfix/submission > # -o smtpd_tls_security_level=encrypt > -o

[pfx] question for a directive in master.cf

2024-06-20 Thread Jeff Peng via Postfix-users
Hello for these options for submission in master.cf: submission inet n - y - - smtpd # -o syslog_name=postfix/submission # -o smtpd_tls_security_level=encrypt -o smtpd_sasl_auth_enable=yes # -o smtpd_tls_auth_only=yes # -o smtpd_reject_unlisted_recipient=no #

[pfx] Re: discard message

2024-06-20 Thread Bill Cole via Postfix-users
On 2024-06-20 at 15:59:25 UTC-0400 (Thu, 20 Jun 2024 15:59:25 -0400 (EDT)) Wietse Venema via Postfix-users is rumored to have said: If you use some Milter like rspamd then you need milter_header_checks. You could do that, but if a milter is handling the filter it can just tell postfix to

[pfx] Re: SPF hostname and domainname

2024-06-20 Thread Emmanuel Fusté via Postfix-users
Le 21/06/2024 à 00:13, John Levine a écrit : It appears that Emmanuel Fusté via Postfix-users said: In the general case (not null sender), HELO SPF validation does not interfere with DMARC as DMARC only use the MAIL FROM identity. There was historically a bug in some DMARC implementation witch

[pfx] Re: discard message

2024-06-20 Thread Jeff Peng via Postfix-users
best is to use a milter to reject spam, such as rspamd or amavisd-milter, no forged header checks then i know rspamd is a milter, but spamassassin not working as milter? thanks. ___ Postfix-users mailing list -- postfix-users@postfix.org To

[pfx] Re: SPF hostname and domainname

2024-06-20 Thread John Levine via Postfix-users
It appears that Emmanuel Fusté via Postfix-users said: >In the general case (not null sender), HELO SPF validation does not >interfere with DMARC as DMARC only use the MAIL FROM identity. >There was historically a bug in some DMARC implementation witch evaluate >whatever SPF identity check that

[pfx] Re: REJECT sending mails to no-reply accounts

2024-06-20 Thread Bastian Blank via Postfix-users
On Thu, Jun 20, 2024 at 01:02:36PM -0400, postfix--- via Postfix-users wrote: > > Then you can not use this e-mail address as envelope sender. People > > will do sender callout and then reject all e-mail with this as sender. > An option is to have noreply@ delivered to /dev/null. It's valid and a

[pfx] Re: discard message

2024-06-20 Thread Benny Pedersen via Postfix-users
Paul Schmehl via Postfix-users skrev den 2024-06-20 21:28: If it’s header_checks, I would probably use something like /^X-Spam-Status: Yes, score=[5-100[/ to catch everything above five. header checks in postfix is done before content filters, so you would love to reject spam on base of

[pfx] Re: discard message

2024-06-20 Thread Wietse Venema via Postfix-users
Paul Schmehl via Postfix-users: > > On Jun 20, 2024, at 7:17?AM, Wietse Venema via Postfix-users > > wrote: > > > > Paul Schmehl via Postfix-users: > >> Is there a place in postfix where I could discard mail if it has > >> a spam score higher than say 4 or 5? I know that postfix hands the > >>

[pfx] Re: discard message

2024-06-20 Thread Noel Jones via Postfix-users
On 6/20/2024 2:28 PM, Paul Schmehl via Postfix-users wrote: On Jun 20, 2024, at 7:17 AM, Wietse Venema via Postfix-users wrote: Paul Schmehl via Postfix-users: Is there a place in postfix where I could discard mail if it has a spam score higher than say 4 or 5? I know that postfix hands the

[pfx] Re: SPF hostname and domainname

2024-06-20 Thread Emmanuel Fusté via Postfix-users
Le 20/06/2024 à 21:13, Wietse Venema via Postfix-users a écrit : Bounces are sent with the null envelope.from address which has no domain. Therefore, SPF applies policy to a surrogate: the hostname in the SMTP client's HELO/EHLO command (as if the envelope.from address was

[pfx] Re: discard message

2024-06-20 Thread Paul Schmehl via Postfix-users
> On Jun 20, 2024, at 7:17 AM, Wietse Venema via Postfix-users > wrote: > > Paul Schmehl via Postfix-users: >> Is there a place in postfix where I could discard mail if it has >> a spam score higher than say 4 or 5? I know that postfix hands the >> mail off to spamassassin for processing and

[pfx] Re: SPF hostname and domainname

2024-06-20 Thread Wietse Venema via Postfix-users
Bounces are sent with the null envelope.from address which has no domain. Therefore, SPF applies policy to a surrogate: the hostname in the SMTP client's HELO/EHLO command (as if the envelope.from address was postmaster@helo-argument). This helo-argument is by default the value of the Postfix

[pfx] Re: SPF hostname and domainname

2024-06-20 Thread postfix--- via Postfix-users
So there's a confusion between the hostname of the mailer and the doamin to be used for the SPF check. Is anybody else seeing this ? Yes, I had to recently add an "a:" record to an SPF (for the sending hostname) as I was seeing some of these I think. Im confused by the language being used.

[pfx] Re: SPF hostname and domainname

2024-06-20 Thread Gilgongo via Postfix-users
On Thu, 20 Jun 2024, 2:01 pm Emmanuel Seyman via Postfix-users, < postfix-users@postfix.org> wrote: > > So there's a confusion between the hostname of the mailer and the > doamin to be used for the SPF check. Is anybody else seeing this ? > Yes, I had to recently add an "a:" record to an SPF

[pfx] Re: REJECT sending mails to no-reply accounts

2024-06-20 Thread postfix--- via Postfix-users
Is an automated/unattended email notifying the user about something, providing proper ways of contacting. As this email is not read in any way, rejecting the mail would be a better way to handle than an automatic response. IMHO. Then you can not use this e-mail address as envelope sender.

[pfx] Re: discard message

2024-06-20 Thread Varadi Gabor via Postfix-users
2024. 06. 20. 14:33 keltezéssel, Michael Grimm via Postfix-users írta: Wietse Venema via Postfix-users wrote: Paul Schmehl via Postfix-users: This is what I could match on: X-Spam-Status: Yes, score=2.1 If the score was higher than some number (e.g >4) than reject the mail. One could try

[pfx] Re: REJECT sending mails to no-reply accounts

2024-06-20 Thread Jaroslaw Rafa via Postfix-users
Dnia 20.06.2024 o godz. 09:08:39 Bastian Blank via Postfix-users pisze: > Then you can not use this e-mail address as envelope sender. People > will do sender callout and then reject all e-mail with this as sender. Sender callout is discouraged now, because it is considered aggressive behavior

[pfx] Re: REJECT sending mails to no-reply accounts

2024-06-20 Thread Jaroslaw Rafa via Postfix-users
Dnia 20.06.2024 o godz. 08:51:33 Alexander Leidinger via Postfix-users pisze: > > This implies that the organization / company is willing to spend > money on having someone available to actually respond / provide > support. For a lot of the use cases I would say even a mail to > ticket system

[pfx] Re: REJECT sending mails to no-reply accounts

2024-06-20 Thread Ralph Seichter via Postfix-users
* Tan Mientras via Postfix-users: > Is an automated/unattended email notifying the user about something, > providing proper ways of contacting. "Proper" is for the recipients of your messages to be able to use the reply function in their MUA, to ask for clarification/assistance in regards to the

[pfx] Re: SPF hostname and domainname

2024-06-20 Thread Bill Cole via Postfix-users
On 2024-06-20 at 09:00:35 UTC-0400 (Thu, 20 Jun 2024 15:00:35 +0200) Emmanuel Seyman via Postfix-users is rumored to have said: Hello, all. Since yesterday, I've started seeing email from my servers getting rejected due to SPF problems. 550 5.7.23 : Sender address rejected: Message rejected

[pfx] SPF hostname and domainname

2024-06-20 Thread Emmanuel Seyman via Postfix-users
Hello, all. Since yesterday, I've started seeing email from my servers getting rejected due to SPF problems. 550 5.7.23 : Sender address rejected: Message rejected due to: SPF fail - not authorized. Please see

[pfx] Re: discard message

2024-06-20 Thread Michael Grimm via Postfix-users
Viktor Dukhovni via Postfix-users wrote: > On Thu, Jun 20, 2024 at 02:33:08PM +0200, Michael Grimm via Postfix-users > wrote: >>> One could try some variant of /^X-Spam-Status: Yes, score=[5-9]/ >> >> Please correct me if I am mistaken, but that won't catch scores >= 10? > > Yes, but easily

[pfx] Re: discard message

2024-06-20 Thread Viktor Dukhovni via Postfix-users
On Thu, Jun 20, 2024 at 02:33:08PM +0200, Michael Grimm via Postfix-users wrote: > > One could try some variant of /^X-Spam-Status: Yes, score=[5-9]/ > > Please correct me if I am mistaken, but that won't catch scores >= 10? Yes, but easily adapted. > But I don't know how such a regex should

[pfx] Re: discard message

2024-06-20 Thread Michael Grimm via Postfix-users
Wietse Venema via Postfix-users wrote: > Paul Schmehl via Postfix-users: >> This is what I could match on: X-Spam-Status: Yes, score=2.1 >> >> If the score was higher than some number (e.g >4) than reject the mail. > > One could try some variant of /^X-Spam-Status: Yes, score=[5-9]/ Please

[pfx] Re: discard message

2024-06-20 Thread Wietse Venema via Postfix-users
Paul Schmehl via Postfix-users: > Is there a place in postfix where I could discard mail if it has > a spam score higher than say 4 or 5? I know that postfix hands the > mail off to spamassassin for processing and then receives it back > for delivery, but I'm unclear what checks could be

[pfx] Re: REJECT sending mails to no-reply accounts

2024-06-20 Thread Matus UHLAR - fantomas via Postfix-users
Then you can not use this e-mail address as envelope sender. People will do sender callout and then reject all e-mail with this as sender. On 20.06.24 11:22, Tan Mientras via Postfix-users wrote: Sorry. Im lost in translation. Could you elaborate/ELI5? This address is not and will never

[pfx] Re: REJECT sending mails to no-reply accounts

2024-06-20 Thread Tan Mientras via Postfix-users
> > Then you can not use this e-mail address as envelope sender. People > will do sender callout and then reject all e-mail with this as sender. > Sorry. Im lost in translation. Could you elaborate/ELI5? This address is not and will never receiveread any messages. Is an automated message to

[pfx] Re: REJECT sending mails to no-reply accounts

2024-06-20 Thread Bastian Blank via Postfix-users
On Thu, Jun 20, 2024 at 07:47:19AM +0200, Tan Mientras via Postfix-users wrote: > @Ralph > Is an automated/unattended email notifying the user about something, > providing proper ways of contacting. As this email is not read in any way, > rejecting the mail would be a better way to handle than an

[pfx] Re: REJECT sending mails to no-reply accounts

2024-06-20 Thread Alexander Leidinger via Postfix-users
Am 2024-06-20 08:21, schrieb Peter via Postfix-users: On 20/06/24 17:47, Tan Mientras via Postfix-users wrote: So many replies! @Ralph Is an automated/unattended email notifying the user about something, providing proper ways of contacting. As this email is not read in any way, rejecting the

[pfx] Re: REJECT sending mails to no-reply accounts

2024-06-20 Thread Peter via Postfix-users
On 20/06/24 17:47, Tan Mientras via Postfix-users wrote: So many replies! @Ralph Is an automated/unattended email notifying the user about something, providing proper ways of contacting. As this email is not read in any way, rejecting the mail would be a better way to handle than an

[pfx] Re: REJECT sending mails to no-reply accounts

2024-06-20 Thread Tan Mientras via Postfix-users
Got some news! When sending emails from my domain (to my domain), rejection IS applied (and message displayed to the client MUA) When sending emails from Office365, rejection is shown in the logs, but message is considered sent for the client (no message) Is this meaningful for you? On Thu,

[pfx] Re: REJECT sending mails to no-reply accounts

2024-06-19 Thread Tan Mientras via Postfix-users
So many replies! @Ralph Is an automated/unattended email notifying the user about something, providing proper ways of contacting. As this email is not read in any way, rejecting the mail would be a better way to handle than an automatic response. IMHO. @Peter My /etc/postfix/no-reply_reject

[pfx] Re: discard message

2024-06-19 Thread Paul Schmehl via Postfix-users
> On Jun 19, 2024, at 7:13 PM, Wietse Venema via Postfix-users > wrote: > > postfix--- via Postfix-users: >>> does smtp have an action "discard"? if so where messages will be discarded? >>> I see smtp code has "reject" while sieve has "discard". So I am asking this >>> question. >> >>

[pfx] Re: discard message

2024-06-19 Thread Wietse Venema via Postfix-users
postfix--- via Postfix-users: > > does smtp have an action "discard"? if so where messages will be discarded? > > I see smtp code has "reject" while sieve has "discard". So I am asking this > > question. > > http://www.postfix.org/header_checks.5.html > There is a DISCARD action. Also in

[pfx] Re: discard message

2024-06-19 Thread postfix--- via Postfix-users
does smtp have an action "discard"? if so where messages will be discarded? I see smtp code has "reject" while sieve has "discard". So I am asking this question. http://www.postfix.org/header_checks.5.html There is a DISCARD action. ___

[pfx] Re: REJECT sending mails to no-reply accounts

2024-06-19 Thread Peter via Postfix-users
On 20/06/24 04:35, John Levine via Postfix-users wrote: It appears that Peter via Postfix-users said: On 19/06/24 18:51, Tan Mientras via Postfix-users wrote: Hi *Trying to setup email REJECT when users try to send to a no-reply email.* There is no such thing as a no-reply email, there is

[pfx] discard message

2024-06-19 Thread Jeff Peng via Postfix-users
Hello does smtp have an action "discard"? if so where messages will be discarded? I see smtp code has "reject" while sieve has "discard". So I am asking this question. Thank you. ___ Postfix-users mailing list -- postfix-users@postfix.org To

[pfx] Re: REJECT sending mails to no-reply accounts

2024-06-19 Thread Wietse Venema via Postfix-users
Ralph Seichter via Postfix-users: > * Ansgar Wiechers via Postfix-users: > > > [...] > > Did I ever send mail to you using the mailing list address you got > barred from targeting, or send mail to you at all from my servers? No, > I did not. > > You tried to initiate communication by sending

[pfx] Re: REJECT sending mails to no-reply accounts

2024-06-19 Thread Ralph Seichter via Postfix-users
* Ansgar Wiechers via Postfix-users: > [...] Did I ever send mail to you using the mailing list address you got barred from targeting, or send mail to you at all from my servers? No, I did not. You tried to initiate communication by sending mail to an address you had no reason to contact, this

[pfx] Re: REJECT sending mails to no-reply accounts

2024-06-19 Thread John Levine via Postfix-users
It appears that Peter via Postfix-users said: >On 19/06/24 18:51, Tan Mientras via Postfix-users wrote: >> Hi >> >> *Trying to setup email REJECT when users try to send to a no-reply email.* > >There is no such thing as a no-reply email, there is no part of the >email specification that allows

[pfx] Re: SASL_README correction

2024-06-19 Thread Wietse Venema via Postfix-users
Rob Sterenborg (Lists) via Postfix-users: > Hi, > > I was reading the SASL_README, "The ldapdb plugin" at: > > https://www.postfix.org/SASL_README.html#auxprop_ldapdb > > [quote] > Tip: [...snip...] Instead, you can use "saslauthd -a ldap" to query the > LDAP database directly, with

[pfx] Re: REJECT sending mails to no-reply accounts

2024-06-19 Thread Ansgar Wiechers via Postfix-users
On 2024-06-19 Ralph Seichter via Postfix-users wrote: > * Bjoern Franke via Postfix-users: > > > From: Ralph Seichter via Postfix-users > > Reply-To: Ralph Seichter > > Dang, blindsided by Mailman 3, sorry. What I wrote about my dislike of > using "nore...@foo.bar" type addresses remains

[pfx] Re: REJECT sending mails to no-reply accounts

2024-06-19 Thread Ralph Seichter via Postfix-users
* Bjoern Franke via Postfix-users: > From: Ralph Seichter via Postfix-users > Reply-To: Ralph Seichter Dang, blindsided by Mailman 3, sorry. What I wrote about my dislike of using "nore...@foo.bar" type addresses remains unchanged, however. If sender A sends mail to recipient B, A needs to be

[pfx] Re: REJECT sending mails to no-reply accounts

2024-06-19 Thread Wietse Venema via Postfix-users
Gary R. Schmidt via Postfix-users: [reply-to header] > He didn't do it - it's being added by Mailman. Whether by default or > deliberately I do not know. This is damage control for DMARC. The mailing list address goes in the From: header, and the poster's email address goes in Reply-To: so that

[pfx] SASL_README correction

2024-06-19 Thread Rob Sterenborg (Lists) via Postfix-users
Hi, I was reading the SASL_README, "The ldapdb plugin" at: https://www.postfix.org/SASL_README.html#auxprop_ldapdb [quote] Tip: [...snip...] Instead, you can use "saslauthd -a ldap" to query the LDAP database directly, with appropriate configuration in saslauthd.conf, as described here.

[pfx] Re: Best practices?

2024-06-19 Thread Cody Millard via Postfix-users
Mornin' |# Error reporting error_notice_recipient = postmaster@email.broker #https://www.postfix.org/postconf.5.html#error_notice_recipient notify_classes = bounce, delay, policy, protocol, resource, software #https://www.postfix.org/postconf.5.html#notify_classes | The above will insure

[pfx] Re: Best practices?

2024-06-19 Thread Ansgar Wiechers via Postfix-users
On 2024-06-19 Jeff Peng via Postfix-users wrote: > On 2024-06-19 17:29, Matt Kinni via Postfix-users wrote: >> On 2024-06-19 02:27, Matt Kinni via Postfix-users wrote: >>> On 2024-06-16 15:21, Cody Millard via Postfix-users wrote: smtpd_helo_restrictions = ...

[pfx] Re: Best practices?

2024-06-19 Thread Jeff Peng via Postfix-users
On 2024-06-19 17:29, Matt Kinni via Postfix-users wrote: On 2024-06-19 02:27, Matt Kinni via Postfix-users wrote: On 2024-06-16 15:21, Cody Millard via Postfix-users wrote: smtpd_helo_restrictions = ... reject_non_fqdn_helo_hostname, ... I've found this to block some legitimate

[pfx] Re: Best practices?

2024-06-19 Thread Matt Kinni via Postfix-users
On 2024-06-19 02:27, Matt Kinni via Postfix-users wrote: > On 2024-06-16 15:21, Cody Millard via Postfix-users wrote: >> smtpd_helo_restrictions = >> ... >> reject_non_fqdn_helo_hostname, >> ... > I've found this to block some legitimate mails in the past Sorry, I meant

[pfx] Re: Best practices?

2024-06-19 Thread Matt Kinni via Postfix-users
On 2024-06-16 15:21, Cody Millard via Postfix-users wrote: > smtpd_helo_restrictions = > ... > reject_non_fqdn_helo_hostname, > ... I've found this to block some legitimate mails in the past from Bank of America, so you may want to grep your logs for "Helo command rejected: Host not

[pfx] Re: Best practices?

2024-06-19 Thread Viktor Dukhovni via Postfix-users
> On 19 Jun 2024, at 4:29 PM, Gilgongo via Postfix-users > wrote: > > > The defaults for those settings, as far as postfix is concerned, are as > > follows: > > > > smtpd_tls_auth_only = no > > Why? Surely, "yes" is the better choice... > > You need to set this to "yes" if you plan to have

[pfx] Re: REJECT sending mails to no-reply accounts

2024-06-19 Thread Gary R. Schmidt via Postfix-users
On 19/06/2024 18:19, Bjoern Franke via Postfix-users wrote: Hi, Personally, I find this type of one-way communication annoying and impolite. The same goes for setting Reply-To to your personal email address after asking for help on a public mailing list. Like you did yourself? From: Ralph

[pfx] Re: REJECT sending mails to no-reply accounts

2024-06-19 Thread Bjoern Franke via Postfix-users
Hi, Personally, I find this type of one-way communication annoying and impolite. The same goes for setting Reply-To to your personal email address after asking for help on a public mailing list. Like you did yourself? From: Ralph Seichter via Postfix-users Reply-To: Ralph Seichter

[pfx] Re: REJECT sending mails to no-reply accounts

2024-06-19 Thread Peter via Postfix-users
On 19/06/24 18:51, Tan Mientras via Postfix-users wrote: Hi *Trying to setup email REJECT when users try to send to a no-reply email.* There is no such thing as a no-reply email, there is no part of the email specification that allows a message to be marked as unable to be replied to. Many

[pfx] Re: REJECT sending mails to no-reply accounts

2024-06-19 Thread Ralph Seichter via Postfix-users
* Tan Mientras via Postfix-users: > Trying to setup email REJECT when users try to send to a no-reply > email. Personally, I find this type of one-way communication annoying and impolite. The same goes for setting Reply-To to your personal email address after asking for help on a public mailing

[pfx] REJECT sending mails to no-reply accounts

2024-06-19 Thread Tan Mientras via Postfix-users
Hi *Trying to setup email REJECT when users try to send to a no-reply email.* AFAIK, this should be configuren on smtpd_recipient_restrictions using check_recipient_access. Please, let me know if I'm wrong. It's not working, so maybe it's because I don't know if rules are applied on first match

[pfx] Re: Best practices?

2024-06-19 Thread Gilgongo via Postfix-users
On Wed, 19 Jun 2024 at 03:57, Viktor Dukhovni via Postfix-users < postfix-users@postfix.org> wrote: > On Tue, Jun 18, 2024 at 04:15:33PM -0500, Cody Millard via Postfix-users > wrote: > > > The defaults for those settings, as far as postfix is concerned, are as > > follows: > > > >

[pfx] Re: Best practices?

2024-06-18 Thread Viktor Dukhovni via Postfix-users
On Tue, Jun 18, 2024 at 10:02:20PM -0500, Cody Millard via Postfix-users wrote: > as for why I set these explicitly, I figured that more random bits means > more secure. > > tls_random_bytes = 64 > tls_daemon_random_bytes = 64 No need to clutter the configuration with overzealous low-level

[pfx] Re: Best practices?

2024-06-18 Thread Cody Millard via Postfix-users
Hi Viktor. Please check my original post. Your comments are on the postfix defaults and not my current settings. as for why I set these explicitly, I figured that more random bits means more secure. tls_random_bytes = 64 tls_daemon_random_bytes = 64 On 6/18/2024 9:56 PM, Viktor Dukhovni

[pfx] Re: Best practices?

2024-06-18 Thread Viktor Dukhovni via Postfix-users
On Tue, Jun 18, 2024 at 04:15:33PM -0500, Cody Millard via Postfix-users wrote: > The defaults for those settings, as far as postfix is concerned, are as > follows: > > smtpd_tls_auth_only = no Why? Surely, "yes" is the better choice... > smtpd_tls_security_level = Why empty? Surely "may" is

[pfx] Re: Best practices?

2024-06-18 Thread Jeff Peng via Postfix-users
On 2024-06-19 05:15, Cody Millard via Postfix-users wrote: I am not sure what SRS or AUC are right now. I saw Dr. Lindenberg has a similar test suite like your site. https://blog.lindenberg.one/EmailSecurityTest ___ Postfix-users mailing list --

[pfx] Re: Rate limiting a group of domains

2024-06-18 Thread Wietse Venema via Postfix-users
785 243 via Postfix-users: > I want to implement rate limiting based on the target server rather > than by recipient domain. Specifically, I want to rate limit email > sent to domains like yahoo.com, ymail.com, aol.com, myyahoo.com, and > verizon.net as a group, since these domains appears to be

[pfx] Rate limiting a group of domains

2024-06-18 Thread 785 243 via Postfix-users
I want to implement rate limiting based on the target server rather than by recipient domain. Specifically, I want to rate limit email sent to domains like yahoo.com, ymail.com, aol.com, myyahoo.com, and verizon.net as a group, since these domains appears to be handled by the same servers. This

[pfx] Re: Best practices?

2024-06-18 Thread Cody Millard via Postfix-users
I am not sure what SRS or AUC are right now. The defaults for those settings, as far as postfix is concerned, are as follows: |smtpd_sasl_auth_enable = no smtpd_sasl_security_options = noanonymous smtpd_sasl_tls_security_options = $smtpd_sasl_security_options smtpd_tls_auth_only = no

[pfx] Re: Resetting the discussion

2024-06-18 Thread Wietse Venema via Postfix-users
Paul Schmehl via Postfix-users: > > On Jun 18, 2024, at 3:33?PM, Wietse Venema via Postfix-users > > wrote: > > > > Paul Schmehl via Postfix-users: > >> [18-Jun-2024 14:53:32 -0500]: PHP Error: SMTP server does not > >> support authentication (POST > >>

[pfx] Re: Resetting the discussion

2024-06-18 Thread Paul Schmehl via Postfix-users
> On Jun 18, 2024, at 3:33 PM, Wietse Venema via Postfix-users > wrote: > > Paul Schmehl via Postfix-users: >> [18-Jun-2024 14:53:32 -0500]: PHP Error: SMTP server does not >> support authentication (POST >> /webmail/?_task=mail&_unlock=loading1718740412272&_framed=1&_action=send) > >

[pfx] Re: Resetting the discussion

2024-06-18 Thread Wietse Venema via Postfix-users
Paul Schmehl via Postfix-users: > [18-Jun-2024 14:53:32 -0500]: PHP Error: SMTP server does not > support authentication (POST > /webmail/?_task=mail&_unlock=loading1718740412272&_framed=1&_action=send) Indeed, you have smtps inet n - n - - smtpd -o

[pfx] Re: Resetting the discussion

2024-06-18 Thread Paul Schmehl via Postfix-users
> On Jun 18, 2024, at 2:45 PM, Noel Jones via Postfix-users > wrote: > > >> On Jun 18, 2024, at 2:30 PM, Paul Schmehl via Postfix-users >> wrote: >> >> So, here is what I now have configued in roundcube: >> >> $config['smtp_host'] = 'tls://mail.stovebolt.com:465'; >>

[pfx] Re: Resetting the discussion

2024-06-18 Thread Paul Schmehl via Postfix-users
> On Jun 18, 2024, at 2:45 PM, Noel Jones via Postfix-users > wrote: > > >> On Jun 18, 2024, at 2:30 PM, Paul Schmehl via Postfix-users >> wrote: >> >> So, here is what I now have configued in roundcube: >> >> $config['smtp_host'] = 'tls://mail.stovebolt.com:465'; >>

[pfx] Re: Resetting the discussion

2024-06-18 Thread Wietse Venema via Postfix-users
What about providing Postfix logs? As long as you can't provide the Postfix perspective, finding help here will be difficult. Wietse ___ Postfix-users mailing list -- postfix-users@postfix.org To unsubscribe send an email to

[pfx] Re: Resetting the discussion

2024-06-18 Thread Noel Jones via Postfix-users
> On Jun 18, 2024, at 2:30 PM, Paul Schmehl via Postfix-users > wrote: > > So, here is what I now have configued in roundcube: > > $config['smtp_host'] = 'tls://mail.stovebolt.com:465'; > $config['smtp_auth_type'] = 'PLAIN'; > $config['smtp_user'] = '%u'; > $config['smtp_pass'] = '%p’; >

[pfx] Resetting the discussion

2024-06-18 Thread Paul Schmehl via Postfix-users
I’ve posted several times about the problems that I’m having getting roundcube to send mail through postfix. I think you can throw out all the previous posts and start anew. In one exchange, Victor pointed out that I did not have -o smtpd_tls_wrappermode=yes set in master. (It was commented

[pfx] always_add_missing_headers / local_header_rewrite_clients

2024-06-18 Thread Wietse Venema via Postfix-users
Viktor Dukhovni via Postfix-users: > 465inet n - n - - smtpd > -o smtpd_tls_wrappermode=yes ... > -o smtpd_milters=$mua_milters > -o always_add_missing_headers=yes Nit: always_add_missing_headers is a cleanup(8) daemon feature.

[pfx] Re: Troubleshooting roundcube connections to postfix

2024-06-18 Thread Benny Pedersen via Postfix-users
Viktor Dukhovni via Postfix-users skrev den 2024-06-18 15:27: On Tue, Jun 18, 2024 at 03:20:46PM +0200, Benny Pedersen via Postfix-users wrote: xpoint@tux ~ $ posttls-finger -w -lsecure -C "www.stovebolt.com:465" "www.stovebolt.com" posttls-finger: Connected to

[pfx] Re: Troubleshooting roundcube connections to postfix

2024-06-18 Thread Benny Pedersen via Postfix-users
Paul Schmehl via Postfix-users skrev den 2024-06-18 08:04: posttls-finger: server certificate verification failed for mail.stovebolt.com[108.174.193.29]:465: num=62:Hostname mismatch This looks like it’s working correctly now, right? hostname mismatch means still need to reissue new cert

[pfx] Re: Troubleshooting roundcube connections to postfix

2024-06-18 Thread Viktor Dukhovni via Postfix-users
On Tue, Jun 18, 2024 at 03:20:46PM +0200, Benny Pedersen via Postfix-users wrote: > xpoint@tux ~ $ posttls-finger -w -lsecure -C "www.stovebolt.com:465" > "www.stovebolt.com" > posttls-finger: Connected to www.stovebolt.com[108.174.193.28]:465 > posttls-finger: server certificate verification

[pfx] Re: Troubleshooting roundcube connections to postfix

2024-06-18 Thread Benny Pedersen via Postfix-users
Paul Schmehl via Postfix-users skrev den 2024-06-18 06:39: On Jun 17, 2024, at 10:14 PM, Cowbay via Postfix-users wrote: On 2024/6/18 10:43, Paul Schmehl via Postfix-users wrote: The problem is neither tls nor ssl worked. No matter what config I used, roundcube would always through an error.

[pfx] Re: Help with reject_sender_login_mismatch

2024-06-18 Thread Benny Pedersen via Postfix-users
Jeff Peng via Postfix-users skrev den 2024-06-18 09:30: smtps inet n - y - - smtpd -o smtpd_sender_restrictions=permit_sasl_authenticated,reject_sender_login_mismatch,reject order matters, first wins -o

[pfx] Re: Troubleshooting roundcube connections to postfix

2024-06-18 Thread Benny Pedersen via Postfix-users
Peter via Postfix-users skrev den 2024-06-18 04:08: On 18/06/24 13:00, Jeff Peng via Postfix-users wrote: On 2024-06-18 07:30, Peter via Postfix-users wrote: On 17/06/2024 17:28, Paul Schmehl wrote: though it's a big offtopic, may I ask that, for roundcube, how to stop users adding their

[pfx] Re: Help with reject_sender_login_mismatch

2024-06-18 Thread Jeff Peng via Postfix-users
Thanks for all the kind helps. I have resolved the issue and wrote a note for it. https://notes.postno.de/how-to-use-reject-sender-login-mismatch-in-postfix.html if you find any issue in this note, please let me know. Thanks. Oh, sorry I didn't see you weren't using

[pfx] Re: Help with reject_sender_login_mismatch

2024-06-18 Thread Gilgongo via Postfix-users
On Tue, 18 Jun 2024 at 08:55, Jeff Peng wrote: > I did have tried this line (with just one value > reject_sender_login_mismatch). > But then I even can't send mail from the valid user (the user who login > into RC). > Oh, sorry I didn't see you weren't using smtpd_sender_login_maps. I'm pretty

[pfx] Re: Help with reject_sender_login_mismatch

2024-06-18 Thread Gilgongo via Postfix-users
On Tue, 18 Jun 2024 at 08:31, Jeff Peng via Postfix-users < postfix-users@postfix.org> wrote: > Hello, > > I have this section in master.cf: > > smtps inet n - y - - smtpd >-o syslog_name=postfix/smtps >-o smtpd_tls_wrappermode=yes >-o

[pfx] Re: Help with reject_sender_login_mismatch

2024-06-18 Thread Jeff Peng via Postfix-users
On 2024-06-18 15:51, Gilgongo wrote: On Tue, 18 Jun 2024 at 08:31, Jeff Peng via Postfix-users < postfix-users@postfix.org> wrote: Hello, I have this section in master.cf: smtps inet n - y - - smtpd -o syslog_name=postfix/smtps -o

[pfx] Help with reject_sender_login_mismatch

2024-06-18 Thread Jeff Peng via Postfix-users
Hello, I have this section in master.cf: smtps inet n - y - - smtpd -o syslog_name=postfix/smtps -o smtpd_tls_wrappermode=yes -o smtpd_sasl_auth_enable=yes -o smtpd_sender_restrictions=permit_sasl_authenticated,reject_sender_login_mismatch,reject

[pfx] Re: Troubleshooting roundcube connections to postfix

2024-06-18 Thread Paul Schmehl via Postfix-users
> On Jun 18, 2024, at 1:34 AM, Viktor Dukhovni via Postfix-users > wrote: > > On Tue, Jun 18, 2024 at 01:04:25AM -0500, Paul Schmehl via Postfix-users > wrote: > >> # posttls-finger -w -lsecure -C "mail.stovebolt.com:465" "www.stovebolt.com" > > Why the "www.stovebolt.com"??? What hostname

[pfx] Re: Troubleshooting roundcube connections to postfix

2024-06-18 Thread Viktor Dukhovni via Postfix-users
On Tue, Jun 18, 2024 at 01:04:25AM -0500, Paul Schmehl via Postfix-users wrote: > >> posttls-finger: warning: TLS library problem: error:1408F10B:SSL > >> routines:ssl3_get_record:wrong version number:ssl/record/ssl3_record.c:332: > > > > Your port 465 "smtps" service is misconfigured, it is

[pfx] Re: Troubleshooting roundcube connections to postfix

2024-06-18 Thread Paul Schmehl via Postfix-users
> On Jun 18, 2024, at 12:38 AM, Viktor Dukhovni via Postfix-users > wrote: > > On Mon, Jun 17, 2024 at 11:39:27PM -0500, Paul Schmehl via Postfix-users > wrote: > >> That might have uncovered a problem. >> >> # posttls-finger -w -lsecure -C "www.stovebolt.com:465" “www.stovebolt.com" >> >>

[pfx] Re: Troubleshooting roundcube connections to postfix

2024-06-17 Thread Viktor Dukhovni via Postfix-users
On Mon, Jun 17, 2024 at 11:39:27PM -0500, Paul Schmehl via Postfix-users wrote: > That might have uncovered a problem. > > # posttls-finger -w -lsecure -C "www.stovebolt.com:465" “www.stovebolt.com" > > posttls-finger: Connected to www.stovebolt.com[108.174.193.28]:465 > posttls-finger:

[pfx] Re: Troubleshooting roundcube connections to postfix

2024-06-17 Thread Paul Schmehl via Postfix-users
> On Jun 17, 2024, at 10:14 PM, Cowbay via Postfix-users > wrote: > > On 2024/6/18 10:43, Paul Schmehl via Postfix-users wrote: > The problem is neither tls nor ssl worked. No matter what config I used, > roundcube would always through an error. If I used $config['smtp_host'] = >

[pfx] Re: Troubleshooting roundcube connections to postfix

2024-06-17 Thread Jeff Peng via Postfix-users
On 2024-06-18 10:40, postfix--- via Postfix-users wrote: To be honest, you still likely want authentication. Keep in mind that you don't need to authenticate as a single user for roundcube but rather you can have roundcube pass authentication through from it's own user login and therefore

[pfx] Re: Troubleshooting roundcube connections to postfix

2024-06-17 Thread Gary R. Schmidt via Postfix-users
On 18/06/2024 12:43, Paul Schmehl via Postfix-users wrote: [SNIP] roundcube would always through an error. If I used $config['smtp_host'] = ‘tls;//www.stovebolt.com'; or I used $config['smtp_host'] = ’ssl;//www.stovebolt.com'; roundcube would error out saying it couldn’t I hope the

[pfx] Re: Troubleshooting roundcube connections to postfix

2024-06-17 Thread Cowbay via Postfix-users
On 2024/6/18 10:43, Paul Schmehl via Postfix-users wrote: On Jun 17, 2024, at 6:30 PM, Peter via Postfix-users wrote: On 17/06/2024 17:28, Paul Schmehl wrote: How do you set up roundcube to not use authentication? I really don’t need it since it’s on the same machine as the mail server.

[pfx] Re: Troubleshooting roundcube connections to postfix

2024-06-17 Thread Peter via Postfix-users
On 18/06/24 14:43, Paul Schmehl via Postfix-users wrote: If I used $config['smtp_host'] = ‘tls;//www.stovebolt.com'; or I used $config['smtp_host'] = ’ssl;//www.stovebolt.com'; roundcube would error out saying it couldn’t connect to the server. It's "tls://..." or "ssl://" with a colon (:)

<    1   2   3   4   5   6   7   8   9   10   >