1<!doctype html public "-//W3C//DTD HTML 4.01 Transitional//EN" 2 "http://www.w3.org/TR/html4/loose.dtd"> 3<html> <head> 4<meta http-equiv="Content-Type" content="text/html; charset=utf-8"> 5<link rel='stylesheet' type='text/css' href='postfix-doc.css'> 6<title> Postfix manual - smtpd(8) </title> 7</head> <body> <pre> 8SMTPD(8) SMTPD(8) 9 10<b>NAME</b> 11 smtpd - Postfix SMTP server 12 13<b>SYNOPSIS</b> 14 <b>smtpd</b> [generic Postfix daemon options] 15 16 <b>sendmail -bs</b> 17 18<b>DESCRIPTION</b> 19 The SMTP server accepts network connection requests and performs zero 20 or more SMTP transactions per connection. Each received message is 21 piped through the <a href="cleanup.8.html"><b>cleanup</b>(8)</a> daemon, and is placed into the <b>incoming</b> 22 queue as one single queue file. For this mode of operation, the pro- 23 gram expects to be run from the <a href="master.8.html"><b>master</b>(8)</a> process manager. 24 25 Alternatively, the SMTP server be can run in stand-alone mode; this is 26 traditionally obtained with "<b>sendmail -bs</b>". When the SMTP server runs 27 stand-alone with non $<b><a href="postconf.5.html#mail_owner">mail_owner</a></b> privileges, it receives mail even 28 while the mail system is not running, deposits messages directly into 29 the <b>maildrop</b> queue, and disables the SMTP server's access policies. As 30 of Postfix version 2.3, the SMTP server refuses to receive mail from 31 the network when it runs with non $<b><a href="postconf.5.html#mail_owner">mail_owner</a></b> privileges. 32 33 The SMTP server implements a variety of policies for connection 34 requests, and for parameters given to <b>HELO, ETRN, MAIL FROM, VRFY</b> and 35 <b>RCPT TO</b> commands. They are detailed below and in the <a href="postconf.5.html"><b>main.cf</b></a> configura- 36 tion file. 37 38<b>SECURITY</b> 39 The SMTP server is moderately security-sensitive. It talks to SMTP 40 clients and to DNS servers on the network. The SMTP server can be run 41 chrooted at fixed low privilege. 42 43<b>STANDARDS</b> 44 <a href="https://tools.ietf.org/html/rfc821">RFC 821</a> (SMTP protocol) 45 <a href="https://tools.ietf.org/html/rfc1123">RFC 1123</a> (Host requirements) 46 <a href="https://tools.ietf.org/html/rfc1652">RFC 1652</a> (8bit-MIME transport) 47 <a href="https://tools.ietf.org/html/rfc1869">RFC 1869</a> (SMTP service extensions) 48 <a href="https://tools.ietf.org/html/rfc1870">RFC 1870</a> (Message size declaration) 49 <a href="https://tools.ietf.org/html/rfc1985">RFC 1985</a> (ETRN command) 50 <a href="https://tools.ietf.org/html/rfc2034">RFC 2034</a> (SMTP enhanced status codes) 51 <a href="https://tools.ietf.org/html/rfc2554">RFC 2554</a> (AUTH command) 52 <a href="https://tools.ietf.org/html/rfc2821">RFC 2821</a> (SMTP protocol) 53 <a href="https://tools.ietf.org/html/rfc2920">RFC 2920</a> (SMTP pipelining) 54 <a href="https://tools.ietf.org/html/rfc3030">RFC 3030</a> (CHUNKING without BINARYMIME) 55 <a href="https://tools.ietf.org/html/rfc3207">RFC 3207</a> (STARTTLS command) 56 <a href="https://tools.ietf.org/html/rfc3461">RFC 3461</a> (SMTP DSN extension) 57 <a href="https://tools.ietf.org/html/rfc3463">RFC 3463</a> (Enhanced status codes) 58 <a href="https://tools.ietf.org/html/rfc3848">RFC 3848</a> (ESMTP transmission types) 59 <a href="https://tools.ietf.org/html/rfc4409">RFC 4409</a> (Message submission) 60 <a href="https://tools.ietf.org/html/rfc4954">RFC 4954</a> (AUTH command) 61 <a href="https://tools.ietf.org/html/rfc5321">RFC 5321</a> (SMTP protocol) 62 <a href="https://tools.ietf.org/html/rfc6531">RFC 6531</a> (Internationalized SMTP) 63 <a href="https://tools.ietf.org/html/rfc6533">RFC 6533</a> (Internationalized Delivery Status Notifications) 64 <a href="https://tools.ietf.org/html/rfc7505">RFC 7505</a> ("Null MX" No Service Resource Record) 65 66<b>DIAGNOSTICS</b> 67 Problems and transactions are logged to <b>syslogd</b>(8) or <a href="postlogd.8.html"><b>postlogd</b>(8)</a>. 68 69 Depending on the setting of the <b><a href="postconf.5.html#notify_classes">notify_classes</a></b> parameter, the postmas- 70 ter is notified of bounces, protocol problems, policy violations, and 71 of other trouble. 72 73<b>CONFIGURATION PARAMETERS</b> 74 Changes to <a href="postconf.5.html"><b>main.cf</b></a> are picked up automatically, as <a href="smtpd.8.html"><b>smtpd</b>(8)</a> processes 75 run for only a limited amount of time. Use the command "<b>postfix reload</b>" 76 to speed up a change. 77 78 The text below provides only a parameter summary. See <a href="postconf.5.html"><b>postconf</b>(5)</a> for 79 more details including examples. 80 81<b>COMPATIBILITY CONTROLS</b> 82 The following parameters work around implementation errors in other 83 software, and/or allow you to override standards in order to prevent 84 undesirable use. 85 86 <b><a href="postconf.5.html#broken_sasl_auth_clients">broken_sasl_auth_clients</a> (no)</b> 87 Enable interoperability with remote SMTP clients that implement 88 an obsolete version of the AUTH command (<a href="https://tools.ietf.org/html/rfc4954">RFC 4954</a>). 89 90 <b><a href="postconf.5.html#disable_vrfy_command">disable_vrfy_command</a> (no)</b> 91 Disable the SMTP VRFY command. 92 93 <b><a href="postconf.5.html#smtpd_noop_commands">smtpd_noop_commands</a> (empty)</b> 94 List of commands that the Postfix SMTP server replies to with 95 "250 Ok", without doing any syntax checks and without changing 96 state. 97 98 <b><a href="postconf.5.html#strict_rfc821_envelopes">strict_rfc821_envelopes</a> (no)</b> 99 Require that addresses received in SMTP MAIL FROM and RCPT TO 100 commands are enclosed with <>, and that those addresses do not 101 contain <a href="https://tools.ietf.org/html/rfc822">RFC 822</a> style comments or phrases. 102 103 Available in Postfix version 2.1 and later: 104 105 <b><a href="postconf.5.html#smtpd_reject_unlisted_sender">smtpd_reject_unlisted_sender</a> (no)</b> 106 Request that the Postfix SMTP server rejects mail from unknown 107 sender addresses, even when no explicit <a href="postconf.5.html#reject_unlisted_sender">reject_unlisted_sender</a> 108 access restriction is specified. 109 110 <b><a href="postconf.5.html#smtpd_sasl_exceptions_networks">smtpd_sasl_exceptions_networks</a> (empty)</b> 111 What remote SMTP clients the Postfix SMTP server will not offer 112 AUTH support to. 113 114 Available in Postfix version 2.2 and later: 115 116 <b><a href="postconf.5.html#smtpd_discard_ehlo_keyword_address_maps">smtpd_discard_ehlo_keyword_address_maps</a> (empty)</b> 117 Lookup tables, indexed by the remote SMTP client address, with 118 case insensitive lists of EHLO keywords (pipelining, starttls, 119 auth, etc.) that the Postfix SMTP server will not send in the 120 EHLO response to a remote SMTP client. 121 122 <b><a href="postconf.5.html#smtpd_discard_ehlo_keywords">smtpd_discard_ehlo_keywords</a> (empty)</b> 123 A case insensitive list of EHLO keywords (pipelining, starttls, 124 auth, etc.) that the Postfix SMTP server will not send in the 125 EHLO response to a remote SMTP client. 126 127 <b><a href="postconf.5.html#smtpd_delay_open_until_valid_rcpt">smtpd_delay_open_until_valid_rcpt</a> (yes)</b> 128 Postpone the start of an SMTP mail transaction until a valid 129 RCPT TO command is received. 130 131 Available in Postfix version 2.3 and later: 132 133 <b><a href="postconf.5.html#smtpd_tls_always_issue_session_ids">smtpd_tls_always_issue_session_ids</a> (yes)</b> 134 Force the Postfix SMTP server to issue a TLS session id, even 135 when TLS session caching is turned off (<a href="postconf.5.html#smtpd_tls_session_cache_database">smtpd_tls_ses</a>- 136 <a href="postconf.5.html#smtpd_tls_session_cache_database">sion_cache_database</a> is empty). 137 138 Available in Postfix version 2.6 and later: 139 140 <b><a href="postconf.5.html#tcp_windowsize">tcp_windowsize</a> (0)</b> 141 An optional workaround for routers that break TCP window scal- 142 ing. 143 144 Available in Postfix version 2.7 and later: 145 146 <b><a href="postconf.5.html#smtpd_command_filter">smtpd_command_filter</a> (empty)</b> 147 A mechanism to transform commands from remote SMTP clients. 148 149 Available in Postfix version 2.9 - 3.6: 150 151 <b><a href="postconf.5.html#smtpd_per_record_deadline">smtpd_per_record_deadline</a> (normal: no, overload: yes)</b> 152 Change the behavior of the <a href="postconf.5.html#smtpd_timeout">smtpd_timeout</a> and <a href="postconf.5.html#smtpd_starttls_timeout">smtpd_start</a>- 153 <a href="postconf.5.html#smtpd_starttls_timeout">tls_timeout</a> time limits, from a time limit per read or write 154 system call, to a time limit to send or receive a complete 155 record (an SMTP command line, SMTP response line, SMTP message 156 content line, or TLS protocol message). 157 158 Available in Postfix version 3.0 and later: 159 160 <b><a href="postconf.5.html#smtpd_dns_reply_filter">smtpd_dns_reply_filter</a> (empty)</b> 161 Optional filter for Postfix SMTP server DNS lookup results. 162 163 Available in Postfix 3.5 and later: 164 165 <b><a href="postconf.5.html#info_log_address_format">info_log_address_format</a> (external)</b> 166 The email address form that will be used in non-debug logging 167 (info, warning, etc.). 168 169 Available in Postfix version 3.6 and later: 170 171 <b><a href="postconf.5.html#smtpd_relay_before_recipient_restrictions">smtpd_relay_before_recipient_restrictions</a> (see 'postconf -d' output)</b> 172 Evaluate <a href="postconf.5.html#smtpd_relay_restrictions">smtpd_relay_restrictions</a> before <a href="postconf.5.html#smtpd_recipient_restrictions">smtpd_recipi</a>- 173 <a href="postconf.5.html#smtpd_recipient_restrictions">ent_restrictions</a>. 174 175 <b><a href="postconf.5.html#known_tcp_ports">known_tcp_ports</a> (lmtp=24, smtp=25, smtps=submissions=465, submis-</b> 176 <b>sion=587)</b> 177 Optional setting that avoids lookups in the <b>services</b>(5) data- 178 base. 179 180 Available in Postfix version 3.7 and later: 181 182 <b><a href="postconf.5.html#smtpd_per_request_deadline">smtpd_per_request_deadline</a> (normal: no, overload: yes)</b> 183 Change the behavior of the <a href="postconf.5.html#smtpd_timeout">smtpd_timeout</a> and <a href="postconf.5.html#smtpd_starttls_timeout">smtpd_start</a>- 184 <a href="postconf.5.html#smtpd_starttls_timeout">tls_timeout</a> time limits, from a time limit per plaintext or TLS 185 read or write call, to a combined time limit for receiving a 186 complete SMTP request and for sending a complete SMTP response. 187 188 <b><a href="postconf.5.html#smtpd_min_data_rate">smtpd_min_data_rate</a> (500)</b> 189 The minimum plaintext data transfer rate in bytes/second for 190 DATA and BDAT requests, when deadlines are enabled with 191 <a href="postconf.5.html#smtpd_per_request_deadline">smtpd_per_request_deadline</a>. 192 193<b>ADDRESS REWRITING CONTROLS</b> 194 See the <a href="ADDRESS_REWRITING_README.html">ADDRESS_REWRITING_README</a> document for a detailed discussion of 195 Postfix address rewriting. 196 197 <b><a href="postconf.5.html#receive_override_options">receive_override_options</a> (empty)</b> 198 Enable or disable recipient validation, built-in content filter- 199 ing, or address mapping. 200 201 Available in Postfix version 2.2 and later: 202 203 <b><a href="postconf.5.html#local_header_rewrite_clients">local_header_rewrite_clients</a> (<a href="postconf.5.html#permit_inet_interfaces">permit_inet_interfaces</a>)</b> 204 Rewrite or add message headers in mail from these clients, 205 updating incomplete addresses with the domain name in $<a href="postconf.5.html#myorigin">myorigin</a> 206 or $<a href="postconf.5.html#mydomain">mydomain</a>, and adding missing headers. 207 208<b>BEFORE-SMTPD PROXY AGENT</b> 209 Available in Postfix version 2.10 and later: 210 211 <b><a href="postconf.5.html#smtpd_upstream_proxy_protocol">smtpd_upstream_proxy_protocol</a> (empty)</b> 212 The name of the proxy protocol used by an optional before-smtpd 213 proxy agent. 214 215 <b><a href="postconf.5.html#smtpd_upstream_proxy_timeout">smtpd_upstream_proxy_timeout</a> (5s)</b> 216 The time limit for the proxy protocol specified with the 217 <a href="postconf.5.html#smtpd_upstream_proxy_protocol">smtpd_upstream_proxy_protocol</a> parameter. 218 219<b>AFTER QUEUE EXTERNAL CONTENT INSPECTION CONTROLS</b> 220 As of version 1.0, Postfix can be configured to send new mail to an 221 external content filter AFTER the mail is queued. This content filter 222 is expected to inject mail back into a (Postfix or other) MTA for fur- 223 ther delivery. See the <a href="FILTER_README.html">FILTER_README</a> document for details. 224 225 <b><a href="postconf.5.html#content_filter">content_filter</a> (empty)</b> 226 After the message is queued, send the entire message to the 227 specified <i>transport:destination</i>. 228 229<b>BEFORE QUEUE EXTERNAL CONTENT INSPECTION CONTROLS</b> 230 As of version 2.1, the Postfix SMTP server can be configured to send 231 incoming mail to a real-time SMTP-based content filter BEFORE mail is 232 queued. This content filter is expected to inject mail back into Post- 233 fix. See the <a href="SMTPD_PROXY_README.html">SMTPD_PROXY_README</a> document for details on how to config- 234 ure and operate this feature. 235 236 <b><a href="postconf.5.html#smtpd_proxy_filter">smtpd_proxy_filter</a> (empty)</b> 237 The hostname and TCP port of the mail filtering proxy server. 238 239 <b><a href="postconf.5.html#smtpd_proxy_ehlo">smtpd_proxy_ehlo</a> ($<a href="postconf.5.html#myhostname">myhostname</a>)</b> 240 How the Postfix SMTP server announces itself to the proxy fil- 241 ter. 242 243 <b><a href="postconf.5.html#smtpd_proxy_options">smtpd_proxy_options</a> (empty)</b> 244 List of options that control how the Postfix SMTP server commu- 245 nicates with a before-queue content filter. 246 247 <b><a href="postconf.5.html#smtpd_proxy_timeout">smtpd_proxy_timeout</a> (100s)</b> 248 The time limit for connecting to a proxy filter and for sending 249 or receiving information. 250 251<b>BEFORE QUEUE MILTER CONTROLS</b> 252 As of version 2.3, Postfix supports the Sendmail version 8 Milter (mail 253 filter) protocol. These content filters run outside Postfix. They can 254 inspect the SMTP command stream and the message content, and can 255 request modifications before mail is queued. For details see the <a href="MILTER_README.html">MIL</a>- 256 <a href="MILTER_README.html">TER_README</a> document. 257 258 <b><a href="postconf.5.html#smtpd_milters">smtpd_milters</a> (empty)</b> 259 A list of Milter (mail filter) applications for new mail that 260 arrives via the Postfix <a href="smtpd.8.html"><b>smtpd</b>(8)</a> server. 261 262 <b><a href="postconf.5.html#milter_protocol">milter_protocol</a> (6)</b> 263 The mail filter protocol version and optional protocol exten- 264 sions for communication with a Milter application; prior to 265 Postfix 2.6 the default protocol is 2. 266 267 <b><a href="postconf.5.html#milter_default_action">milter_default_action</a> (tempfail)</b> 268 The default action when a Milter (mail filter) response is 269 unavailable (for example, bad Postfix configuration or Milter 270 failure). 271 272 <b><a href="postconf.5.html#milter_macro_daemon_name">milter_macro_daemon_name</a> ($<a href="postconf.5.html#myhostname">myhostname</a>)</b> 273 The {daemon_name} macro value for Milter (mail filter) applica- 274 tions. 275 276 <b><a href="postconf.5.html#milter_macro_v">milter_macro_v</a> ($<a href="postconf.5.html#mail_name">mail_name</a> $<a href="postconf.5.html#mail_version">mail_version</a>)</b> 277 The {v} macro value for Milter (mail filter) applications. 278 279 <b><a href="postconf.5.html#milter_connect_timeout">milter_connect_timeout</a> (30s)</b> 280 The time limit for connecting to a Milter (mail filter) applica- 281 tion, and for negotiating protocol options. 282 283 <b><a href="postconf.5.html#milter_command_timeout">milter_command_timeout</a> (30s)</b> 284 The time limit for sending an SMTP command to a Milter (mail 285 filter) application, and for receiving the response. 286 287 <b><a href="postconf.5.html#milter_content_timeout">milter_content_timeout</a> (300s)</b> 288 The time limit for sending message content to a Milter (mail 289 filter) application, and for receiving the response. 290 291 <b><a href="postconf.5.html#milter_connect_macros">milter_connect_macros</a> (see 'postconf -d' output)</b> 292 The macros that are sent to Milter (mail filter) applications 293 after completion of an SMTP connection. 294 295 <b><a href="postconf.5.html#milter_helo_macros">milter_helo_macros</a> (see 'postconf -d' output)</b> 296 The macros that are sent to Milter (mail filter) applications 297 after the SMTP HELO or EHLO command. 298 299 <b><a href="postconf.5.html#milter_mail_macros">milter_mail_macros</a> (see 'postconf -d' output)</b> 300 The macros that are sent to Milter (mail filter) applications 301 after the SMTP MAIL FROM command. 302 303 <b><a href="postconf.5.html#milter_rcpt_macros">milter_rcpt_macros</a> (see 'postconf -d' output)</b> 304 The macros that are sent to Milter (mail filter) applications 305 after the SMTP RCPT TO command. 306 307 <b><a href="postconf.5.html#milter_data_macros">milter_data_macros</a> (see 'postconf -d' output)</b> 308 The macros that are sent to version 4 or higher Milter (mail 309 filter) applications after the SMTP DATA command. 310 311 <b><a href="postconf.5.html#milter_unknown_command_macros">milter_unknown_command_macros</a> (see 'postconf -d' output)</b> 312 The macros that are sent to version 3 or higher Milter (mail 313 filter) applications after an unknown SMTP command. 314 315 <b><a href="postconf.5.html#milter_end_of_header_macros">milter_end_of_header_macros</a> (see 'postconf -d' output)</b> 316 The macros that are sent to Milter (mail filter) applications 317 after the end of the message header. 318 319 <b><a href="postconf.5.html#milter_end_of_data_macros">milter_end_of_data_macros</a> (see 'postconf -d' output)</b> 320 The macros that are sent to Milter (mail filter) applications 321 after the message end-of-data. 322 323 Available in Postfix version 3.1 and later: 324 325 <b><a href="postconf.5.html#milter_macro_defaults">milter_macro_defaults</a> (empty)</b> 326 Optional list of <i>name=value</i> pairs that specify default values 327 for arbitrary macros that Postfix may send to Milter applica- 328 tions. 329 330 Available in Postfix version 3.2 and later: 331 332 <b><a href="postconf.5.html#smtpd_milter_maps">smtpd_milter_maps</a> (empty)</b> 333 Lookup tables with Milter settings per remote SMTP client IP 334 address. 335 336<b>GENERAL CONTENT INSPECTION CONTROLS</b> 337 The following parameters are applicable for both built-in and external 338 content filters. 339 340 Available in Postfix version 2.1 and later: 341 342 <b><a href="postconf.5.html#receive_override_options">receive_override_options</a> (empty)</b> 343 Enable or disable recipient validation, built-in content filter- 344 ing, or address mapping. 345 346<b>EXTERNAL CONTENT INSPECTION CONTROLS</b> 347 The following parameters are applicable for both before-queue and 348 after-queue content filtering. 349 350 Available in Postfix version 2.1 and later: 351 352 <b><a href="postconf.5.html#smtpd_authorized_xforward_hosts">smtpd_authorized_xforward_hosts</a> (empty)</b> 353 What remote SMTP clients are allowed to use the XFORWARD fea- 354 ture. 355 356<b>SASL AUTHENTICATION CONTROLS</b> 357 Postfix SASL support (<a href="https://tools.ietf.org/html/rfc4954">RFC 4954</a>) can be used to authenticate remote SMTP 358 clients to the Postfix SMTP server, and to authenticate the Postfix 359 SMTP client to a remote SMTP server. See the <a href="SASL_README.html">SASL_README</a> document for 360 details. 361 362 <b><a href="postconf.5.html#broken_sasl_auth_clients">broken_sasl_auth_clients</a> (no)</b> 363 Enable interoperability with remote SMTP clients that implement 364 an obsolete version of the AUTH command (<a href="https://tools.ietf.org/html/rfc4954">RFC 4954</a>). 365 366 <b><a href="postconf.5.html#smtpd_sasl_auth_enable">smtpd_sasl_auth_enable</a> (no)</b> 367 Enable SASL authentication in the Postfix SMTP server. 368 369 <b><a href="postconf.5.html#smtpd_sasl_local_domain">smtpd_sasl_local_domain</a> (empty)</b> 370 The name of the Postfix SMTP server's local SASL authentication 371 realm. 372 373 <b><a href="postconf.5.html#smtpd_sasl_security_options">smtpd_sasl_security_options</a> (noanonymous)</b> 374 Postfix SMTP server SASL security options; as of Postfix 2.3 the 375 list of available features depends on the SASL server implemen- 376 tation that is selected with <b><a href="postconf.5.html#smtpd_sasl_type">smtpd_sasl_type</a></b>. 377 378 <b><a href="postconf.5.html#smtpd_sender_login_maps">smtpd_sender_login_maps</a> (empty)</b> 379 Optional lookup table with the SASL login names that own the 380 sender (MAIL FROM) addresses. 381 382 Available in Postfix version 2.1 and later: 383 384 <b><a href="postconf.5.html#smtpd_sasl_exceptions_networks">smtpd_sasl_exceptions_networks</a> (empty)</b> 385 What remote SMTP clients the Postfix SMTP server will not offer 386 AUTH support to. 387 388 Available in Postfix version 2.1 and 2.2: 389 390 <b><a href="postconf.5.html#smtpd_sasl_application_name">smtpd_sasl_application_name</a> (smtpd)</b> 391 The application name that the Postfix SMTP server uses for SASL 392 server initialization. 393 394 Available in Postfix version 2.3 and later: 395 396 <b><a href="postconf.5.html#smtpd_sasl_authenticated_header">smtpd_sasl_authenticated_header</a> (no)</b> 397 Report the SASL authenticated user name in the <a href="smtpd.8.html"><b>smtpd</b>(8)</a> Received 398 message header. 399 400 <b><a href="postconf.5.html#smtpd_sasl_path">smtpd_sasl_path</a> (smtpd)</b> 401 Implementation-specific information that the Postfix SMTP server 402 passes through to the SASL plug-in implementation that is 403 selected with <b><a href="postconf.5.html#smtpd_sasl_type">smtpd_sasl_type</a></b>. 404 405 <b><a href="postconf.5.html#smtpd_sasl_type">smtpd_sasl_type</a> (cyrus)</b> 406 The SASL plug-in type that the Postfix SMTP server should use 407 for authentication. 408 409 Available in Postfix version 2.5 and later: 410 411 <b><a href="postconf.5.html#cyrus_sasl_config_path">cyrus_sasl_config_path</a> (empty)</b> 412 Search path for Cyrus SASL application configuration files, cur- 413 rently used only to locate the $<a href="postconf.5.html#smtpd_sasl_path">smtpd_sasl_path</a>.conf file. 414 415 Available in Postfix version 2.11 and later: 416 417 <b><a href="postconf.5.html#smtpd_sasl_service">smtpd_sasl_service</a> (smtp)</b> 418 The service name that is passed to the SASL plug-in that is 419 selected with <b><a href="postconf.5.html#smtpd_sasl_type">smtpd_sasl_type</a></b> and <b><a href="postconf.5.html#smtpd_sasl_path">smtpd_sasl_path</a></b>. 420 421 Available in Postfix version 3.4 and later: 422 423 <b><a href="postconf.5.html#smtpd_sasl_response_limit">smtpd_sasl_response_limit</a> (12288)</b> 424 The maximum length of a SASL client's response to a server chal- 425 lenge. 426 427 Available in Postfix 3.6 and later: 428 429 <b><a href="postconf.5.html#smtpd_sasl_mechanism_filter">smtpd_sasl_mechanism_filter</a> (!external, <a href="DATABASE_README.html#types">static</a>:rest)</b> 430 If non-empty, a filter for the SASL mechanism names that the 431 Postfix SMTP server will announce in the EHLO response. 432 433<b>STARTTLS SUPPORT CONTROLS</b> 434 Detailed information about STARTTLS configuration may be found in the 435 <a href="TLS_README.html">TLS_README</a> document. 436 437 <b><a href="postconf.5.html#smtpd_tls_security_level">smtpd_tls_security_level</a> (empty)</b> 438 The SMTP TLS security level for the Postfix SMTP server; when a 439 non-empty value is specified, this overrides the obsolete param- 440 eters <a href="postconf.5.html#smtpd_use_tls">smtpd_use_tls</a> and <a href="postconf.5.html#smtpd_enforce_tls">smtpd_enforce_tls</a>. 441 442 <b><a href="postconf.5.html#smtpd_sasl_tls_security_options">smtpd_sasl_tls_security_options</a> ($<a href="postconf.5.html#smtpd_sasl_security_options">smtpd_sasl_security_options</a>)</b> 443 The SASL authentication security options that the Postfix SMTP 444 server uses for TLS encrypted SMTP sessions. 445 446 <b><a href="postconf.5.html#smtpd_starttls_timeout">smtpd_starttls_timeout</a> (see 'postconf -d' output)</b> 447 The time limit for Postfix SMTP server write and read operations 448 during TLS startup and shutdown handshake procedures. 449 450 <b><a href="postconf.5.html#smtpd_tls_CAfile">smtpd_tls_CAfile</a> (empty)</b> 451 A file containing (PEM format) CA certificates of root CAs 452 trusted to sign either remote SMTP client certificates or inter- 453 mediate CA certificates. 454 455 <b><a href="postconf.5.html#smtpd_tls_CApath">smtpd_tls_CApath</a> (empty)</b> 456 A directory containing (PEM format) CA certificates of root CAs 457 trusted to sign either remote SMTP client certificates or inter- 458 mediate CA certificates. 459 460 <b><a href="postconf.5.html#smtpd_tls_always_issue_session_ids">smtpd_tls_always_issue_session_ids</a> (yes)</b> 461 Force the Postfix SMTP server to issue a TLS session id, even 462 when TLS session caching is turned off (<a href="postconf.5.html#smtpd_tls_session_cache_database">smtpd_tls_ses</a>- 463 <a href="postconf.5.html#smtpd_tls_session_cache_database">sion_cache_database</a> is empty). 464 465 <b><a href="postconf.5.html#smtpd_tls_ask_ccert">smtpd_tls_ask_ccert</a> (no)</b> 466 Ask a remote SMTP client for a client certificate. 467 468 <b><a href="postconf.5.html#smtpd_tls_auth_only">smtpd_tls_auth_only</a> (no)</b> 469 When TLS encryption is optional in the Postfix SMTP server, do 470 not announce or accept SASL authentication over unencrypted con- 471 nections. 472 473 <b><a href="postconf.5.html#smtpd_tls_ccert_verifydepth">smtpd_tls_ccert_verifydepth</a> (9)</b> 474 The verification depth for remote SMTP client certificates. 475 476 <b><a href="postconf.5.html#smtpd_tls_cert_file">smtpd_tls_cert_file</a> (empty)</b> 477 File with the Postfix SMTP server RSA certificate in PEM format. 478 479 <b><a href="postconf.5.html#smtpd_tls_exclude_ciphers">smtpd_tls_exclude_ciphers</a> (empty)</b> 480 List of ciphers or cipher types to exclude from the SMTP server 481 cipher list at all TLS security levels. 482 483 <b><a href="postconf.5.html#smtpd_tls_dcert_file">smtpd_tls_dcert_file</a> (empty)</b> 484 File with the Postfix SMTP server DSA certificate in PEM format. 485 486 <b><a href="postconf.5.html#smtpd_tls_dh1024_param_file">smtpd_tls_dh1024_param_file</a> (empty)</b> 487 File with DH parameters that the Postfix SMTP server should use 488 with non-export EDH ciphers. 489 490 <b><a href="postconf.5.html#smtpd_tls_dh512_param_file">smtpd_tls_dh512_param_file</a> (empty)</b> 491 File with DH parameters that the Postfix SMTP server should use 492 with export-grade EDH ciphers. 493 494 <b><a href="postconf.5.html#smtpd_tls_dkey_file">smtpd_tls_dkey_file</a> ($<a href="postconf.5.html#smtpd_tls_dcert_file">smtpd_tls_dcert_file</a>)</b> 495 File with the Postfix SMTP server DSA private key in PEM format. 496 497 <b><a href="postconf.5.html#smtpd_tls_key_file">smtpd_tls_key_file</a> ($<a href="postconf.5.html#smtpd_tls_cert_file">smtpd_tls_cert_file</a>)</b> 498 File with the Postfix SMTP server RSA private key in PEM format. 499 500 <b><a href="postconf.5.html#smtpd_tls_loglevel">smtpd_tls_loglevel</a> (0)</b> 501 Enable additional Postfix SMTP server logging of TLS activity. 502 503 <b><a href="postconf.5.html#smtpd_tls_mandatory_ciphers">smtpd_tls_mandatory_ciphers</a> (medium)</b> 504 The minimum TLS cipher grade that the Postfix SMTP server will 505 use with mandatory TLS encryption. 506 507 <b><a href="postconf.5.html#smtpd_tls_mandatory_exclude_ciphers">smtpd_tls_mandatory_exclude_ciphers</a> (empty)</b> 508 Additional list of ciphers or cipher types to exclude from the 509 Postfix SMTP server cipher list at mandatory TLS security lev- 510 els. 511 512 <b><a href="postconf.5.html#smtpd_tls_mandatory_protocols">smtpd_tls_mandatory_protocols</a> (see 'postconf -d' output)</b> 513 TLS protocols accepted by the Postfix SMTP server with mandatory 514 TLS encryption. 515 516 <b><a href="postconf.5.html#smtpd_tls_received_header">smtpd_tls_received_header</a> (no)</b> 517 Request that the Postfix SMTP server produces Received: message 518 headers that include information about the protocol and cipher 519 used, as well as the remote SMTP client CommonName and client 520 certificate issuer CommonName. 521 522 <b><a href="postconf.5.html#smtpd_tls_req_ccert">smtpd_tls_req_ccert</a> (no)</b> 523 With mandatory TLS encryption, require a trusted remote SMTP 524 client certificate in order to allow TLS connections to proceed. 525 526 <b><a href="postconf.5.html#smtpd_tls_wrappermode">smtpd_tls_wrappermode</a> (no)</b> 527 Run the Postfix SMTP server in TLS "wrapper" mode, instead of 528 using the STARTTLS command. 529 530 <b><a href="postconf.5.html#tls_daemon_random_bytes">tls_daemon_random_bytes</a> (32)</b> 531 The number of pseudo-random bytes that an <a href="smtp.8.html"><b>smtp</b>(8)</a> or <a href="smtpd.8.html"><b>smtpd</b>(8)</a> 532 process requests from the <a href="tlsmgr.8.html"><b>tlsmgr</b>(8)</a> server in order to seed its 533 internal pseudo random number generator (PRNG). 534 535 <b><a href="postconf.5.html#tls_high_cipherlist">tls_high_cipherlist</a> (see 'postconf -d' output)</b> 536 The OpenSSL cipherlist for "high" grade ciphers. 537 538 <b><a href="postconf.5.html#tls_medium_cipherlist">tls_medium_cipherlist</a> (see 'postconf -d' output)</b> 539 The OpenSSL cipherlist for "medium" or higher grade ciphers. 540 541 <b><a href="postconf.5.html#tls_null_cipherlist">tls_null_cipherlist</a> (eNULL:!aNULL)</b> 542 The OpenSSL cipherlist for "NULL" grade ciphers that provide 543 authentication without encryption. 544 545 Available in Postfix version 2.3..3.7: 546 547 <b><a href="postconf.5.html#tls_low_cipherlist">tls_low_cipherlist</a> (see 'postconf -d' output)</b> 548 The OpenSSL cipherlist for "low" or higher grade ciphers. 549 550 <b><a href="postconf.5.html#tls_export_cipherlist">tls_export_cipherlist</a> (see 'postconf -d' output)</b> 551 The OpenSSL cipherlist for "export" or higher grade ciphers. 552 553 Available in Postfix version 2.5 and later: 554 555 <b><a href="postconf.5.html#smtpd_tls_fingerprint_digest">smtpd_tls_fingerprint_digest</a> (see 'postconf -d' output)</b> 556 The message digest algorithm to construct remote SMTP 557 client-certificate fingerprints or public key fingerprints 558 (Postfix 2.9 and later) for <b><a href="postconf.5.html#check_ccert_access">check_ccert_access</a></b> and <b>per-</b> 559 <b>mit_tls_clientcerts</b>. 560 561 Available in Postfix version 2.6 and later: 562 563 <b><a href="postconf.5.html#smtpd_tls_protocols">smtpd_tls_protocols</a> (see postconf -d output)</b> 564 TLS protocols accepted by the Postfix SMTP server with oppor- 565 tunistic TLS encryption. 566 567 <b><a href="postconf.5.html#smtpd_tls_ciphers">smtpd_tls_ciphers</a> (medium)</b> 568 The minimum TLS cipher grade that the Postfix SMTP server will 569 use with opportunistic TLS encryption. 570 571 <b><a href="postconf.5.html#smtpd_tls_eccert_file">smtpd_tls_eccert_file</a> (empty)</b> 572 File with the Postfix SMTP server ECDSA certificate in PEM for- 573 mat. 574 575 <b><a href="postconf.5.html#smtpd_tls_eckey_file">smtpd_tls_eckey_file</a> ($<a href="postconf.5.html#smtpd_tls_eccert_file">smtpd_tls_eccert_file</a>)</b> 576 File with the Postfix SMTP server ECDSA private key in PEM for- 577 mat. 578 579 <b><a href="postconf.5.html#smtpd_tls_eecdh_grade">smtpd_tls_eecdh_grade</a> (see 'postconf -d' output)</b> 580 The Postfix SMTP server security grade for ephemeral ellip- 581 tic-curve Diffie-Hellman (EECDH) key exchange. 582 583 <b><a href="postconf.5.html#tls_eecdh_strong_curve">tls_eecdh_strong_curve</a> (prime256v1)</b> 584 The elliptic curve used by the Postfix SMTP server for sensibly 585 strong ephemeral ECDH key exchange. 586 587 <b><a href="postconf.5.html#tls_eecdh_ultra_curve">tls_eecdh_ultra_curve</a> (secp384r1)</b> 588 The elliptic curve used by the Postfix SMTP server for maximally 589 strong ephemeral ECDH key exchange. 590 591 Available in Postfix version 2.8 and later: 592 593 <b><a href="postconf.5.html#tls_preempt_cipherlist">tls_preempt_cipherlist</a> (no)</b> 594 With SSLv3 and later, use the Postfix SMTP server's cipher pref- 595 erence order instead of the remote client's cipher preference 596 order. 597 598 <b><a href="postconf.5.html#tls_disable_workarounds">tls_disable_workarounds</a> (see 'postconf -d' output)</b> 599 List or bit-mask of OpenSSL bug work-arounds to disable. 600 601 Available in Postfix version 2.11 and later: 602 603 <b><a href="postconf.5.html#tlsmgr_service_name">tlsmgr_service_name</a> (tlsmgr)</b> 604 The name of the <a href="tlsmgr.8.html"><b>tlsmgr</b>(8)</a> service entry in <a href="master.5.html">master.cf</a>. 605 606 Available in Postfix version 3.0 and later: 607 608 <b><a href="postconf.5.html#tls_session_ticket_cipher">tls_session_ticket_cipher</a> (Postfix</b> ><b>= 3.0: aes-256-cbc, Postfix</b> < <b>3.0:</b> 609 <b>aes-128-cbc)</b> 610 Algorithm used to encrypt <a href="https://tools.ietf.org/html/rfc5077">RFC5077</a> TLS session tickets. 611 612 Available in Postfix version 3.2 and later: 613 614 <b><a href="postconf.5.html#tls_eecdh_auto_curves">tls_eecdh_auto_curves</a> (see 'postconf -d' output)</b> 615 The prioritized list of elliptic curves supported by the Postfix 616 SMTP client and server. 617 618 Available in Postfix version 3.4 and later: 619 620 <b><a href="postconf.5.html#smtpd_tls_chain_files">smtpd_tls_chain_files</a> (empty)</b> 621 List of one or more PEM files, each holding one or more private 622 keys directly followed by a corresponding certificate chain. 623 624 <b><a href="postconf.5.html#tls_server_sni_maps">tls_server_sni_maps</a> (empty)</b> 625 Optional lookup tables that map names received from remote SMTP 626 clients via the TLS Server Name Indication (SNI) extension to 627 the appropriate keys and certificate chains. 628 629 Available in Postfix 3.5, 3.4.6, 3.3.5, 3.2.10, 3.1.13 and later: 630 631 <b><a href="postconf.5.html#tls_fast_shutdown_enable">tls_fast_shutdown_enable</a> (yes)</b> 632 A workaround for implementations that hang Postfix while shut- 633 ting down a TLS session, until Postfix times out. 634 635 Available in Postfix version 3.8 and later: 636 637 <b><a href="postconf.5.html#tls_ffdhe_auto_groups">tls_ffdhe_auto_groups</a> (see 'postconf -d' output)</b> 638 The prioritized list of finite-field Diffie-Hellman ephemeral 639 (FFDHE) key exchange groups supported by the Postfix SMTP client 640 and server. 641 642 Available in Postfix 3.9, 3.8.1, 3.7.6, 3.6.10, 3.5.20 and later: 643 644 <b><a href="postconf.5.html#tls_config_file">tls_config_file</a> (default)</b> 645 Optional configuration file with baseline OpenSSL settings. 646 647 <b><a href="postconf.5.html#tls_config_name">tls_config_name</a> (empty)</b> 648 The application name passed by Postfix to OpenSSL library ini- 649 tialization functions. 650 651<b>OBSOLETE STARTTLS CONTROLS</b> 652 The following configuration parameters exist for compatibility with 653 Postfix versions before 2.3. Support for these will be removed in a 654 future release. 655 656 <b><a href="postconf.5.html#smtpd_use_tls">smtpd_use_tls</a> (no)</b> 657 Opportunistic TLS: announce STARTTLS support to remote SMTP 658 clients, but do not require that clients use TLS encryption. 659 660 <b><a href="postconf.5.html#smtpd_enforce_tls">smtpd_enforce_tls</a> (no)</b> 661 Mandatory TLS: announce STARTTLS support to remote SMTP clients, 662 and require that clients use TLS encryption. 663 664 <b><a href="postconf.5.html#smtpd_tls_cipherlist">smtpd_tls_cipherlist</a> (empty)</b> 665 Obsolete Postfix < 2.3 control for the Postfix SMTP server TLS 666 cipher list. 667 668<b>SMTPUTF8 CONTROLS</b> 669 Preliminary SMTPUTF8 support is introduced with Postfix 3.0. 670 671 <b><a href="postconf.5.html#smtputf8_enable">smtputf8_enable</a> (yes)</b> 672 Enable preliminary SMTPUTF8 support for the protocols described 673 in <a href="https://tools.ietf.org/html/rfc6531">RFC 6531</a>, <a href="https://tools.ietf.org/html/rfc6532">RFC 6532</a>, and <a href="https://tools.ietf.org/html/rfc6533">RFC 6533</a>. 674 675 <b><a href="postconf.5.html#strict_smtputf8">strict_smtputf8</a> (no)</b> 676 Enable stricter enforcement of the SMTPUTF8 protocol. 677 678 <b><a href="postconf.5.html#smtputf8_autodetect_classes">smtputf8_autodetect_classes</a> (sendmail, verify)</b> 679 Detect that a message requires SMTPUTF8 support for the speci- 680 fied mail origin classes. 681 682 Available in Postfix version 3.2 and later: 683 684 <b><a href="postconf.5.html#enable_idna2003_compatibility">enable_idna2003_compatibility</a> (no)</b> 685 Enable 'transitional' compatibility between IDNA2003 and 686 IDNA2008, when converting UTF-8 domain names to/from the ASCII 687 form that is used for DNS lookups. 688 689<b>VERP SUPPORT CONTROLS</b> 690 With VERP style delivery, each recipient of a message receives a cus- 691 tomized copy of the message with his/her own recipient address encoded 692 in the envelope sender address. The <a href="VERP_README.html">VERP_README</a> file describes config- 693 uration and operation details of Postfix support for variable envelope 694 return path addresses. VERP style delivery is requested with the SMTP 695 XVERP command or with the "sendmail -V" command-line option and is 696 available in Postfix version 1.1 and later. 697 698 <b><a href="postconf.5.html#default_verp_delimiters">default_verp_delimiters</a> (+=)</b> 699 The two default VERP delimiter characters. 700 701 <b><a href="postconf.5.html#verp_delimiter_filter">verp_delimiter_filter</a> (-=+)</b> 702 The characters Postfix accepts as VERP delimiter characters on 703 the Postfix <a href="sendmail.1.html"><b>sendmail</b>(1)</a> command line and in SMTP commands. 704 705 Available in Postfix version 1.1 and 2.0: 706 707 <b><a href="postconf.5.html#authorized_verp_clients">authorized_verp_clients</a> ($<a href="postconf.5.html#mynetworks">mynetworks</a>)</b> 708 What remote SMTP clients are allowed to specify the XVERP com- 709 mand. 710 711 Available in Postfix version 2.1 and later: 712 713 <b><a href="postconf.5.html#smtpd_authorized_verp_clients">smtpd_authorized_verp_clients</a> ($<a href="postconf.5.html#authorized_verp_clients">authorized_verp_clients</a>)</b> 714 What remote SMTP clients are allowed to specify the XVERP com- 715 mand. 716 717<b>TROUBLE SHOOTING CONTROLS</b> 718 The <a href="DEBUG_README.html">DEBUG_README</a> document describes how to debug parts of the Postfix 719 mail system. The methods vary from making the software log a lot of 720 detail, to running some daemon processes under control of a call tracer 721 or debugger. 722 723 <b><a href="postconf.5.html#debug_peer_level">debug_peer_level</a> (2)</b> 724 The increment in verbose logging level when a nexthop destina- 725 tion, remote client or server name or network address matches a 726 pattern given with the <a href="postconf.5.html#debug_peer_list">debug_peer_list</a> parameter. 727 728 <b><a href="postconf.5.html#debug_peer_list">debug_peer_list</a> (empty)</b> 729 Optional list of nexthop destination, remote client or server 730 name or network address patterns that, if matched, cause the 731 verbose logging level to increase by the amount specified in 732 $<a href="postconf.5.html#debug_peer_level">debug_peer_level</a>. 733 734 <b><a href="postconf.5.html#error_notice_recipient">error_notice_recipient</a> (postmaster)</b> 735 The recipient of postmaster notifications about mail delivery 736 problems that are caused by policy, resource, software or proto- 737 col errors. 738 739 <b><a href="postconf.5.html#internal_mail_filter_classes">internal_mail_filter_classes</a> (empty)</b> 740 What categories of Postfix-generated mail are subject to 741 before-queue content inspection by <a href="postconf.5.html#non_smtpd_milters">non_smtpd_milters</a>, 742 <a href="postconf.5.html#header_checks">header_checks</a> and <a href="postconf.5.html#body_checks">body_checks</a>. 743 744 <b><a href="postconf.5.html#notify_classes">notify_classes</a> (resource, software)</b> 745 The list of error classes that are reported to the postmaster. 746 747 <b><a href="postconf.5.html#smtpd_reject_footer">smtpd_reject_footer</a> (empty)</b> 748 Optional information that is appended after each Postfix SMTP 749 server 4XX or 5XX response. 750 751 <b><a href="postconf.5.html#soft_bounce">soft_bounce</a> (no)</b> 752 Safety net to keep mail queued that would otherwise be returned 753 to the sender. 754 755 Available in Postfix version 2.1 and later: 756 757 <b><a href="postconf.5.html#smtpd_authorized_xclient_hosts">smtpd_authorized_xclient_hosts</a> (empty)</b> 758 What remote SMTP clients are allowed to use the XCLIENT feature. 759 760 Available in Postfix version 2.10 and later: 761 762 <b><a href="postconf.5.html#smtpd_log_access_permit_actions">smtpd_log_access_permit_actions</a> (empty)</b> 763 Enable logging of the named "permit" actions in SMTP server 764 access lists (by default, the SMTP server logs "reject" actions 765 but not "permit" actions). 766 767<b>KNOWN VERSUS UNKNOWN RECIPIENT CONTROLS</b> 768 As of Postfix version 2.0, the SMTP server rejects mail for unknown 769 recipients. This prevents the mail queue from clogging up with undeliv- 770 erable MAILER-DAEMON messages. Additional information on this topic is 771 in the <a href="LOCAL_RECIPIENT_README.html">LOCAL_RECIPIENT_README</a> and <a href="ADDRESS_CLASS_README.html">ADDRESS_CLASS_README</a> documents. 772 773 <b><a href="postconf.5.html#show_user_unknown_table_name">show_user_unknown_table_name</a> (yes)</b> 774 Display the name of the recipient table in the "User unknown" 775 responses. 776 777 <b><a href="postconf.5.html#canonical_maps">canonical_maps</a> (empty)</b> 778 Optional address mapping lookup tables for message headers and 779 envelopes. 780 781 <b><a href="postconf.5.html#recipient_canonical_maps">recipient_canonical_maps</a> (empty)</b> 782 Optional address mapping lookup tables for envelope and header 783 recipient addresses. 784 785 <b><a href="postconf.5.html#sender_canonical_maps">sender_canonical_maps</a> (empty)</b> 786 Optional address mapping lookup tables for envelope and header 787 sender addresses. 788 789 Parameters concerning known/unknown local recipients: 790 791 <b><a href="postconf.5.html#mydestination">mydestination</a> ($<a href="postconf.5.html#myhostname">myhostname</a>, localhost.$<a href="postconf.5.html#mydomain">mydomain</a>, localhost)</b> 792 The list of domains that are delivered via the $<a href="postconf.5.html#local_transport">local_transport</a> 793 mail delivery transport. 794 795 <b><a href="postconf.5.html#inet_interfaces">inet_interfaces</a> (all)</b> 796 The local network interface addresses that this mail system 797 receives mail on. 798 799 <b><a href="postconf.5.html#proxy_interfaces">proxy_interfaces</a> (empty)</b> 800 The remote network interface addresses that this mail system 801 receives mail on by way of a proxy or network address transla- 802 tion unit. 803 804 <b><a href="postconf.5.html#inet_protocols">inet_protocols</a> (see 'postconf -d output')</b> 805 The Internet protocols Postfix will attempt to use when making 806 or accepting connections. 807 808 <b><a href="postconf.5.html#local_recipient_maps">local_recipient_maps</a> (<a href="proxymap.8.html">proxy</a>:unix:passwd.byname $<a href="postconf.5.html#alias_maps">alias_maps</a>)</b> 809 Lookup tables with all names or addresses of local recipients: a 810 recipient address is local when its domain matches $<a href="postconf.5.html#mydestination">mydestina</a>- 811 <a href="postconf.5.html#mydestination">tion</a>, $<a href="postconf.5.html#inet_interfaces">inet_interfaces</a> or $<a href="postconf.5.html#proxy_interfaces">proxy_interfaces</a>. 812 813 <b><a href="postconf.5.html#unknown_local_recipient_reject_code">unknown_local_recipient_reject_code</a> (550)</b> 814 The numerical Postfix SMTP server response code when a recipient 815 address is local, and $<a href="postconf.5.html#local_recipient_maps">local_recipient_maps</a> specifies a list of 816 lookup tables that does not match the recipient. 817 818 Parameters concerning known/unknown recipients of relay destinations: 819 820 <b><a href="postconf.5.html#relay_domains">relay_domains</a> (Postfix</b> ><b>= 3.0: empty, Postfix</b> < <b>3.0: $<a href="postconf.5.html#mydestination">mydestination</a>)</b> 821 What destination domains (and subdomains thereof) this system 822 will relay mail to. 823 824 <b><a href="postconf.5.html#relay_recipient_maps">relay_recipient_maps</a> (empty)</b> 825 Optional lookup tables with all valid addresses in the domains 826 that match $<a href="postconf.5.html#relay_domains">relay_domains</a>. 827 828 <b><a href="postconf.5.html#unknown_relay_recipient_reject_code">unknown_relay_recipient_reject_code</a> (550)</b> 829 The numerical Postfix SMTP server reply code when a recipient 830 address matches $<a href="postconf.5.html#relay_domains">relay_domains</a>, and <a href="postconf.5.html#relay_recipient_maps">relay_recipient_maps</a> speci- 831 fies a list of lookup tables that does not match the recipient 832 address. 833 834 Parameters concerning known/unknown recipients in virtual alias 835 domains: 836 837 <b><a href="postconf.5.html#virtual_alias_domains">virtual_alias_domains</a> ($<a href="postconf.5.html#virtual_alias_maps">virtual_alias_maps</a>)</b> 838 Postfix is the final destination for the specified list of vir- 839 tual alias domains, that is, domains for which all addresses are 840 aliased to addresses in other local or remote domains. 841 842 <b><a href="postconf.5.html#virtual_alias_maps">virtual_alias_maps</a> ($<a href="postconf.5.html#virtual_maps">virtual_maps</a>)</b> 843 Optional lookup tables that alias specific mail addresses or 844 domains to other local or remote addresses. 845 846 <b><a href="postconf.5.html#unknown_virtual_alias_reject_code">unknown_virtual_alias_reject_code</a> (550)</b> 847 The Postfix SMTP server reply code when a recipient address 848 matches $<a href="postconf.5.html#virtual_alias_domains">virtual_alias_domains</a>, and $<a href="postconf.5.html#virtual_alias_maps">virtual_alias_maps</a> speci- 849 fies a list of lookup tables that does not match the recipient 850 address. 851 852 Parameters concerning known/unknown recipients in virtual mailbox 853 domains: 854 855 <b><a href="postconf.5.html#virtual_mailbox_domains">virtual_mailbox_domains</a> ($<a href="postconf.5.html#virtual_mailbox_maps">virtual_mailbox_maps</a>)</b> 856 Postfix is the final destination for the specified list of 857 domains; mail is delivered via the $<a href="postconf.5.html#virtual_transport">virtual_transport</a> mail 858 delivery transport. 859 860 <b><a href="postconf.5.html#virtual_mailbox_maps">virtual_mailbox_maps</a> (empty)</b> 861 Optional lookup tables with all valid addresses in the domains 862 that match $<a href="postconf.5.html#virtual_mailbox_domains">virtual_mailbox_domains</a>. 863 864 <b><a href="postconf.5.html#unknown_virtual_mailbox_reject_code">unknown_virtual_mailbox_reject_code</a> (550)</b> 865 The Postfix SMTP server reply code when a recipient address 866 matches $<a href="postconf.5.html#virtual_mailbox_domains">virtual_mailbox_domains</a>, and $<a href="postconf.5.html#virtual_mailbox_maps">virtual_mailbox_maps</a> 867 specifies a list of lookup tables that does not match the recip- 868 ient address. 869 870<b>RESOURCE AND RATE CONTROLS</b> 871 The following parameters limit resource usage by the SMTP server and/or 872 control client request rates. 873 874 <b><a href="postconf.5.html#line_length_limit">line_length_limit</a> (2048)</b> 875 Upon input, long lines are chopped up into pieces of at most 876 this length; upon delivery, long lines are reconstructed. 877 878 <b><a href="postconf.5.html#queue_minfree">queue_minfree</a> (0)</b> 879 The minimal amount of free space in bytes in the queue file sys- 880 tem that is needed to receive mail. 881 882 <b><a href="postconf.5.html#message_size_limit">message_size_limit</a> (10240000)</b> 883 The maximal size in bytes of a message, including envelope 884 information. 885 886 <b><a href="postconf.5.html#smtpd_recipient_limit">smtpd_recipient_limit</a> (1000)</b> 887 The maximal number of recipients that the Postfix SMTP server 888 accepts per message delivery request. 889 890 <b><a href="postconf.5.html#smtpd_timeout">smtpd_timeout</a> (normal: 300s, overload: 10s)</b> 891 When the Postfix SMTP server wants to send an SMTP server 892 response, how long the Postfix SMTP server will wait for an 893 underlying network write operation to complete; and when the 894 Postfix SMTP server Postfix wants to receive an SMTP client 895 request, how long the Postfix SMTP server will wait for an 896 underlying network read operation to complete. 897 898 <b><a href="postconf.5.html#smtpd_history_flush_threshold">smtpd_history_flush_threshold</a> (100)</b> 899 The maximal number of lines in the Postfix SMTP server command 900 history before it is flushed upon receipt of EHLO, RSET, or end 901 of DATA. 902 903 Available in Postfix version 2.3 and later: 904 905 <b><a href="postconf.5.html#smtpd_peername_lookup">smtpd_peername_lookup</a> (yes)</b> 906 Attempt to look up the remote SMTP client hostname, and verify 907 that the name matches the client IP address. 908 909 The per SMTP client connection count and request rate limits are imple- 910 mented in co-operation with the <a href="anvil.8.html"><b>anvil</b>(8)</a> service, and are available in 911 Postfix version 2.2 and later. 912 913 <b><a href="postconf.5.html#smtpd_client_connection_count_limit">smtpd_client_connection_count_limit</a> (50)</b> 914 How many simultaneous connections any client is allowed to make 915 to this service. 916 917 <b><a href="postconf.5.html#smtpd_client_connection_rate_limit">smtpd_client_connection_rate_limit</a> (0)</b> 918 The maximal number of connection attempts any client is allowed 919 to make to this service per time unit. 920 921 <b><a href="postconf.5.html#smtpd_client_message_rate_limit">smtpd_client_message_rate_limit</a> (0)</b> 922 The maximal number of message delivery requests that any client 923 is allowed to make to this service per time unit, regardless of 924 whether or not Postfix actually accepts those messages. 925 926 <b><a href="postconf.5.html#smtpd_client_recipient_rate_limit">smtpd_client_recipient_rate_limit</a> (0)</b> 927 The maximal number of recipient addresses that any client is 928 allowed to send to this service per time unit, regardless of 929 whether or not Postfix actually accepts those recipients. 930 931 <b><a href="postconf.5.html#smtpd_client_event_limit_exceptions">smtpd_client_event_limit_exceptions</a> ($<a href="postconf.5.html#mynetworks">mynetworks</a>)</b> 932 Clients that are excluded from smtpd_client_*_count/rate_limit 933 restrictions. 934 935 Available in Postfix version 2.3 and later: 936 937 <b><a href="postconf.5.html#smtpd_client_new_tls_session_rate_limit">smtpd_client_new_tls_session_rate_limit</a> (0)</b> 938 The maximal number of new (i.e., uncached) TLS sessions that a 939 remote SMTP client is allowed to negotiate with this service per 940 time unit. 941 942 Available in Postfix version 2.9 - 3.6: 943 944 <b><a href="postconf.5.html#smtpd_per_record_deadline">smtpd_per_record_deadline</a> (normal: no, overload: yes)</b> 945 Change the behavior of the <a href="postconf.5.html#smtpd_timeout">smtpd_timeout</a> and <a href="postconf.5.html#smtpd_starttls_timeout">smtpd_start</a>- 946 <a href="postconf.5.html#smtpd_starttls_timeout">tls_timeout</a> time limits, from a time limit per read or write 947 system call, to a time limit to send or receive a complete 948 record (an SMTP command line, SMTP response line, SMTP message 949 content line, or TLS protocol message). 950 951 Available in Postfix version 3.1 and later: 952 953 <b><a href="postconf.5.html#smtpd_client_auth_rate_limit">smtpd_client_auth_rate_limit</a> (0)</b> 954 The maximal number of AUTH commands that any client is allowed 955 to send to this service per time unit, regardless of whether or 956 not Postfix actually accepts those commands. 957 958 Available in Postfix version 3.7 and later: 959 960 <b><a href="postconf.5.html#smtpd_per_request_deadline">smtpd_per_request_deadline</a> (normal: no, overload: yes)</b> 961 Change the behavior of the <a href="postconf.5.html#smtpd_timeout">smtpd_timeout</a> and <a href="postconf.5.html#smtpd_starttls_timeout">smtpd_start</a>- 962 <a href="postconf.5.html#smtpd_starttls_timeout">tls_timeout</a> time limits, from a time limit per plaintext or TLS 963 read or write call, to a combined time limit for receiving a 964 complete SMTP request and for sending a complete SMTP response. 965 966 <b><a href="postconf.5.html#smtpd_min_data_rate">smtpd_min_data_rate</a> (500)</b> 967 The minimum plaintext data transfer rate in bytes/second for 968 DATA and BDAT requests, when deadlines are enabled with 969 <a href="postconf.5.html#smtpd_per_request_deadline">smtpd_per_request_deadline</a>. 970 971 <b><a href="postconf.5.html#header_from_format">header_from_format</a> (standard)</b> 972 The format of the Postfix-generated <b>From:</b> header. 973 974 Available in Postfix version 3.8 and later: 975 976 <b><a href="postconf.5.html#smtpd_client_ipv4_prefix_length">smtpd_client_ipv4_prefix_length</a> (32)</b> 977 Aggregate smtpd_client_*_count and smtpd_client_*_rate statis- 978 tics by IPv4 network blocks with the specified network prefix. 979 980 <b><a href="postconf.5.html#smtpd_client_ipv6_prefix_length">smtpd_client_ipv6_prefix_length</a> (84)</b> 981 Aggregate smtpd_client_*_count and smtpd_client_*_rate statis- 982 tics by IPv6 network blocks with the specified network prefix. 983 984 Available in Postfix 3.9, 3.8.1, 3.7.6, 3.6.10, 3.5.20 and later: 985 986 <b><a href="postconf.5.html#smtpd_forbid_unauth_pipelining">smtpd_forbid_unauth_pipelining</a> (Postfix</b> ><b>= 3.9: yes)</b> 987 Disconnect remote SMTP clients that violate <a href="https://tools.ietf.org/html/rfc2920">RFC 2920</a> (or 5321) 988 command pipelining constraints. 989 990 Available in Postfix 3.9, 3.8.4, 3.7.9, 3.6.13, 3.5.23 and later: 991 992 <b><a href="postconf.5.html#smtpd_forbid_bare_newline">smtpd_forbid_bare_newline</a> (Postfix</b> < <b>3.9: no)</b> 993 Reply with "Error: bare <LF> received" and disconnect when a 994 remote SMTP client sends a line ending in <LF>, violating the 995 <a href="https://tools.ietf.org/html/rfc5321">RFC 5321</a> requirement that lines must end in <CR><LF>. 996 997 <b><a href="postconf.5.html#smtpd_forbid_bare_newline_exclusions">smtpd_forbid_bare_newline_exclusions</a> ($<a href="postconf.5.html#mynetworks">mynetworks</a>)</b> 998 Exclude the specified clients from <a href="postconf.5.html#smtpd_forbid_bare_newline">smtpd_forbid_bare_newline</a> 999 enforcement. 1000 1001<b>TARPIT CONTROLS</b> 1002 When a remote SMTP client makes errors, the Postfix SMTP server can 1003 insert delays before responding. This can help to slow down run-away 1004 software. The behavior is controlled by an error counter that counts 1005 the number of errors within an SMTP session that a client makes without 1006 delivering mail. 1007 1008 <b><a href="postconf.5.html#smtpd_error_sleep_time">smtpd_error_sleep_time</a> (1s)</b> 1009 With Postfix version 2.1 and later: the SMTP server response 1010 delay after a client has made more than $<a href="postconf.5.html#smtpd_soft_error_limit">smtpd_soft_error_limit</a> 1011 errors, and fewer than $<a href="postconf.5.html#smtpd_hard_error_limit">smtpd_hard_error_limit</a> errors, without 1012 delivering mail. 1013 1014 <b><a href="postconf.5.html#smtpd_soft_error_limit">smtpd_soft_error_limit</a> (10)</b> 1015 The number of errors a remote SMTP client is allowed to make 1016 without delivering mail before the Postfix SMTP server slows 1017 down all its responses. 1018 1019 <b><a href="postconf.5.html#smtpd_hard_error_limit">smtpd_hard_error_limit</a> (normal: 20, overload: 1)</b> 1020 The maximal number of errors a remote SMTP client is allowed to 1021 make without delivering mail. 1022 1023 <b><a href="postconf.5.html#smtpd_junk_command_limit">smtpd_junk_command_limit</a> (normal: 100, overload: 1)</b> 1024 The number of junk commands (NOOP, VRFY, ETRN or RSET) that a 1025 remote SMTP client can send before the Postfix SMTP server 1026 starts to increment the error counter with each junk command. 1027 1028 Available in Postfix version 2.1 and later: 1029 1030 <b><a href="postconf.5.html#smtpd_recipient_overshoot_limit">smtpd_recipient_overshoot_limit</a> (1000)</b> 1031 The number of recipients that a remote SMTP client can send in 1032 excess of the limit specified with $<a href="postconf.5.html#smtpd_recipient_limit">smtpd_recipient_limit</a>, 1033 before the Postfix SMTP server increments the per-session error 1034 count for each excess recipient. 1035 1036<b>ACCESS POLICY DELEGATION CONTROLS</b> 1037 As of version 2.1, Postfix can be configured to delegate access policy 1038 decisions to an external server that runs outside Postfix. See the 1039 file <a href="SMTPD_POLICY_README.html">SMTPD_POLICY_README</a> for more information. 1040 1041 <b><a href="postconf.5.html#smtpd_policy_service_max_idle">smtpd_policy_service_max_idle</a> (300s)</b> 1042 The time after which an idle SMTPD policy service connection is 1043 closed. 1044 1045 <b><a href="postconf.5.html#smtpd_policy_service_max_ttl">smtpd_policy_service_max_ttl</a> (1000s)</b> 1046 The time after which an active SMTPD policy service connection 1047 is closed. 1048 1049 <b><a href="postconf.5.html#smtpd_policy_service_timeout">smtpd_policy_service_timeout</a> (100s)</b> 1050 The time limit for connecting to, writing to, or receiving from 1051 a delegated SMTPD policy server. 1052 1053 Available in Postfix version 3.0 and later: 1054 1055 <b><a href="postconf.5.html#smtpd_policy_service_default_action">smtpd_policy_service_default_action</a> (451 4.3.5 Server configuration</b> 1056 <b>problem)</b> 1057 The default action when an SMTPD policy service request fails. 1058 1059 <b><a href="postconf.5.html#smtpd_policy_service_request_limit">smtpd_policy_service_request_limit</a> (0)</b> 1060 The maximal number of requests per SMTPD policy service connec- 1061 tion, or zero (no limit). 1062 1063 <b><a href="postconf.5.html#smtpd_policy_service_try_limit">smtpd_policy_service_try_limit</a> (2)</b> 1064 The maximal number of attempts to send an SMTPD policy service 1065 request before giving up. 1066 1067 <b><a href="postconf.5.html#smtpd_policy_service_retry_delay">smtpd_policy_service_retry_delay</a> (1s)</b> 1068 The delay between attempts to resend a failed SMTPD policy ser- 1069 vice request. 1070 1071 Available in Postfix version 3.1 and later: 1072 1073 <b><a href="postconf.5.html#smtpd_policy_service_policy_context">smtpd_policy_service_policy_context</a> (empty)</b> 1074 Optional information that the Postfix SMTP server specifies in 1075 the "policy_context" attribute of a policy service request 1076 (originally, to share the same service endpoint among multiple 1077 <a href="postconf.5.html#check_policy_service">check_policy_service</a> clients). 1078 1079<b>ACCESS CONTROLS</b> 1080 The <a href="SMTPD_ACCESS_README.html">SMTPD_ACCESS_README</a> document gives an introduction to all the SMTP 1081 server access control features. 1082 1083 <b><a href="postconf.5.html#smtpd_delay_reject">smtpd_delay_reject</a> (yes)</b> 1084 Wait until the RCPT TO command before evaluating 1085 $<a href="postconf.5.html#smtpd_client_restrictions">smtpd_client_restrictions</a>, $<a href="postconf.5.html#smtpd_helo_restrictions">smtpd_helo_restrictions</a> and 1086 $<a href="postconf.5.html#smtpd_sender_restrictions">smtpd_sender_restrictions</a>, or wait until the ETRN command 1087 before evaluating $<a href="postconf.5.html#smtpd_client_restrictions">smtpd_client_restrictions</a> and 1088 $<a href="postconf.5.html#smtpd_helo_restrictions">smtpd_helo_restrictions</a>. 1089 1090 <b><a href="postconf.5.html#parent_domain_matches_subdomains">parent_domain_matches_subdomains</a> (see 'postconf -d' output)</b> 1091 A list of Postfix features where the pattern "example.com" also 1092 matches subdomains of example.com, instead of requiring an 1093 explicit ".example.com" pattern. 1094 1095 <b><a href="postconf.5.html#smtpd_client_restrictions">smtpd_client_restrictions</a> (empty)</b> 1096 Optional restrictions that the Postfix SMTP server applies in 1097 the context of a client connection request. 1098 1099 <b><a href="postconf.5.html#smtpd_helo_required">smtpd_helo_required</a> (no)</b> 1100 Require that a remote SMTP client introduces itself with the 1101 HELO or EHLO command before sending the MAIL command or other 1102 commands that require EHLO negotiation. 1103 1104 <b><a href="postconf.5.html#smtpd_helo_restrictions">smtpd_helo_restrictions</a> (empty)</b> 1105 Optional restrictions that the Postfix SMTP server applies in 1106 the context of a client HELO command. 1107 1108 <b><a href="postconf.5.html#smtpd_sender_restrictions">smtpd_sender_restrictions</a> (empty)</b> 1109 Optional restrictions that the Postfix SMTP server applies in 1110 the context of a client MAIL FROM command. 1111 1112 <b><a href="postconf.5.html#smtpd_recipient_restrictions">smtpd_recipient_restrictions</a> (see 'postconf -d' output)</b> 1113 Optional restrictions that the Postfix SMTP server applies in 1114 the context of a client RCPT TO command, after 1115 <a href="postconf.5.html#smtpd_relay_restrictions">smtpd_relay_restrictions</a>. 1116 1117 <b><a href="postconf.5.html#smtpd_etrn_restrictions">smtpd_etrn_restrictions</a> (empty)</b> 1118 Optional restrictions that the Postfix SMTP server applies in 1119 the context of a client ETRN command. 1120 1121 <b><a href="postconf.5.html#allow_untrusted_routing">allow_untrusted_routing</a> (no)</b> 1122 Forward mail with sender-specified routing 1123 (user[@%!]remote[@%!]site) from untrusted clients to destina- 1124 tions matching $<a href="postconf.5.html#relay_domains">relay_domains</a>. 1125 1126 <b><a href="postconf.5.html#smtpd_restriction_classes">smtpd_restriction_classes</a> (empty)</b> 1127 User-defined aliases for groups of access restrictions. 1128 1129 <b><a href="postconf.5.html#smtpd_null_access_lookup_key">smtpd_null_access_lookup_key</a> (</b><><b>)</b> 1130 The lookup key to be used in SMTP <a href="access.5.html"><b>access</b>(5)</a> tables instead of 1131 the null sender address. 1132 1133 <b><a href="postconf.5.html#permit_mx_backup_networks">permit_mx_backup_networks</a> (empty)</b> 1134 Restrict the use of the <a href="postconf.5.html#permit_mx_backup">permit_mx_backup</a> SMTP access feature to 1135 only domains whose primary MX hosts match the listed networks. 1136 1137 Available in Postfix version 2.0 and later: 1138 1139 <b><a href="postconf.5.html#smtpd_data_restrictions">smtpd_data_restrictions</a> (empty)</b> 1140 Optional access restrictions that the Postfix SMTP server 1141 applies in the context of the SMTP DATA command. 1142 1143 <b><a href="postconf.5.html#smtpd_expansion_filter">smtpd_expansion_filter</a> (see 'postconf -d' output)</b> 1144 What characters are allowed in $name expansions of RBL reply 1145 templates. 1146 1147 Available in Postfix version 2.1 and later: 1148 1149 <b><a href="postconf.5.html#smtpd_reject_unlisted_sender">smtpd_reject_unlisted_sender</a> (no)</b> 1150 Request that the Postfix SMTP server rejects mail from unknown 1151 sender addresses, even when no explicit <a href="postconf.5.html#reject_unlisted_sender">reject_unlisted_sender</a> 1152 access restriction is specified. 1153 1154 <b><a href="postconf.5.html#smtpd_reject_unlisted_recipient">smtpd_reject_unlisted_recipient</a> (yes)</b> 1155 Request that the Postfix SMTP server rejects mail for unknown 1156 recipient addresses, even when no explicit 1157 <a href="postconf.5.html#reject_unlisted_recipient">reject_unlisted_recipient</a> access restriction is specified. 1158 1159 Available in Postfix version 2.2 and later: 1160 1161 <b><a href="postconf.5.html#smtpd_end_of_data_restrictions">smtpd_end_of_data_restrictions</a> (empty)</b> 1162 Optional access restrictions that the Postfix SMTP server 1163 applies in the context of the SMTP END-OF-DATA command. 1164 1165 Available in Postfix version 2.10 and later: 1166 1167 <b><a href="postconf.5.html#smtpd_relay_restrictions">smtpd_relay_restrictions</a> (<a href="postconf.5.html#permit_mynetworks">permit_mynetworks</a>, <a href="postconf.5.html#permit_sasl_authenticated">permit_sasl_authenticated</a>,</b> 1168 <b><a href="postconf.5.html#defer_unauth_destination">defer_unauth_destination</a>)</b> 1169 Access restrictions for mail relay control that the Postfix SMTP 1170 server applies in the context of the RCPT TO command, before 1171 <a href="postconf.5.html#smtpd_recipient_restrictions">smtpd_recipient_restrictions</a>. 1172 1173<b>SENDER AND RECIPIENT ADDRESS VERIFICATION CONTROLS</b> 1174 Postfix version 2.1 introduces sender and recipient address verifica- 1175 tion. This feature is implemented by sending probe email messages that 1176 are not actually delivered. This feature is requested via the 1177 <a href="postconf.5.html#reject_unverified_sender">reject_unverified_sender</a> and <a href="postconf.5.html#reject_unverified_recipient">reject_unverified_recipient</a> access 1178 restrictions. The status of verification probes is maintained by the 1179 <a href="verify.8.html"><b>verify</b>(8)</a> server. See the file <a href="ADDRESS_VERIFICATION_README.html">ADDRESS_VERIFICATION_README</a> for infor- 1180 mation about how to configure and operate the Postfix sender/recipient 1181 address verification service. 1182 1183 <b><a href="postconf.5.html#address_verify_poll_count">address_verify_poll_count</a> (normal: 3, overload: 1)</b> 1184 How many times to query the <a href="verify.8.html"><b>verify</b>(8)</a> service for the completion 1185 of an address verification request in progress. 1186 1187 <b><a href="postconf.5.html#address_verify_poll_delay">address_verify_poll_delay</a> (3s)</b> 1188 The delay between queries for the completion of an address veri- 1189 fication request in progress. 1190 1191 <b><a href="postconf.5.html#address_verify_sender">address_verify_sender</a> ($<a href="postconf.5.html#double_bounce_sender">double_bounce_sender</a>)</b> 1192 The sender address to use in address verification probes; prior 1193 to Postfix 2.5 the default was "postmaster". 1194 1195 <b><a href="postconf.5.html#unverified_sender_reject_code">unverified_sender_reject_code</a> (450)</b> 1196 The numerical Postfix SMTP server response code when a recipient 1197 address is rejected by the <a href="postconf.5.html#reject_unverified_sender">reject_unverified_sender</a> restriction. 1198 1199 <b><a href="postconf.5.html#unverified_recipient_reject_code">unverified_recipient_reject_code</a> (450)</b> 1200 The numerical Postfix SMTP server response when a recipient 1201 address is rejected by the <a href="postconf.5.html#reject_unverified_recipient">reject_unverified_recipient</a> restric- 1202 tion. 1203 1204 Available in Postfix version 2.6 and later: 1205 1206 <b><a href="postconf.5.html#unverified_sender_defer_code">unverified_sender_defer_code</a> (450)</b> 1207 The numerical Postfix SMTP server response code when a sender 1208 address probe fails due to a temporary error condition. 1209 1210 <b><a href="postconf.5.html#unverified_recipient_defer_code">unverified_recipient_defer_code</a> (450)</b> 1211 The numerical Postfix SMTP server response when a recipient 1212 address probe fails due to a temporary error condition. 1213 1214 <b><a href="postconf.5.html#unverified_sender_reject_reason">unverified_sender_reject_reason</a> (empty)</b> 1215 The Postfix SMTP server's reply when rejecting mail with 1216 <a href="postconf.5.html#reject_unverified_sender">reject_unverified_sender</a>. 1217 1218 <b><a href="postconf.5.html#unverified_recipient_reject_reason">unverified_recipient_reject_reason</a> (empty)</b> 1219 The Postfix SMTP server's reply when rejecting mail with 1220 <a href="postconf.5.html#reject_unverified_recipient">reject_unverified_recipient</a>. 1221 1222 <b><a href="postconf.5.html#unverified_sender_tempfail_action">unverified_sender_tempfail_action</a> ($<a href="postconf.5.html#reject_tempfail_action">reject_tempfail_action</a>)</b> 1223 The Postfix SMTP server's action when <a href="postconf.5.html#reject_unverified_sender">reject_unverified_sender</a> 1224 fails due to a temporary error condition. 1225 1226 <b><a href="postconf.5.html#unverified_recipient_tempfail_action">unverified_recipient_tempfail_action</a> ($<a href="postconf.5.html#reject_tempfail_action">reject_tempfail_action</a>)</b> 1227 The Postfix SMTP server's action when <a href="postconf.5.html#reject_unverified_recipient">reject_unverified_recipi</a>- 1228 <a href="postconf.5.html#reject_unverified_recipient">ent</a> fails due to a temporary error condition. 1229 1230 Available with Postfix 2.9 and later: 1231 1232 <b><a href="postconf.5.html#address_verify_sender_ttl">address_verify_sender_ttl</a> (0s)</b> 1233 The time between changes in the time-dependent portion of 1234 address verification probe sender addresses. 1235 1236<b>ACCESS CONTROL RESPONSES</b> 1237 The following parameters control numerical SMTP reply codes and/or text 1238 responses. 1239 1240 <b><a href="postconf.5.html#access_map_reject_code">access_map_reject_code</a> (554)</b> 1241 The numerical Postfix SMTP server response code for an <a href="access.5.html"><b>access</b>(5)</a> 1242 map "reject" action. 1243 1244 <b><a href="postconf.5.html#defer_code">defer_code</a> (450)</b> 1245 The numerical Postfix SMTP server response code when a remote 1246 SMTP client request is rejected by the "defer" restriction. 1247 1248 <b><a href="postconf.5.html#invalid_hostname_reject_code">invalid_hostname_reject_code</a> (501)</b> 1249 The numerical Postfix SMTP server response code when the client 1250 HELO or EHLO command parameter is rejected by the 1251 <a href="postconf.5.html#reject_invalid_helo_hostname">reject_invalid_helo_hostname</a> restriction. 1252 1253 <b><a href="postconf.5.html#maps_rbl_reject_code">maps_rbl_reject_code</a> (554)</b> 1254 The numerical Postfix SMTP server response code when a remote 1255 SMTP client request is blocked by the <a href="postconf.5.html#reject_rbl_client">reject_rbl_client</a>, 1256 <a href="postconf.5.html#reject_rhsbl_client">reject_rhsbl_client</a>, <a href="postconf.5.html#reject_rhsbl_reverse_client">reject_rhsbl_reverse_client</a>, 1257 <a href="postconf.5.html#reject_rhsbl_sender">reject_rhsbl_sender</a> or <a href="postconf.5.html#reject_rhsbl_recipient">reject_rhsbl_recipient</a> restriction. 1258 1259 <b><a href="postconf.5.html#non_fqdn_reject_code">non_fqdn_reject_code</a> (504)</b> 1260 The numerical Postfix SMTP server reply code when a client 1261 request is rejected by the <a href="postconf.5.html#reject_non_fqdn_helo_hostname">reject_non_fqdn_helo_hostname</a>, 1262 <a href="postconf.5.html#reject_non_fqdn_sender">reject_non_fqdn_sender</a> or <a href="postconf.5.html#reject_non_fqdn_recipient">reject_non_fqdn_recipient</a> restriction. 1263 1264 <b><a href="postconf.5.html#plaintext_reject_code">plaintext_reject_code</a> (450)</b> 1265 The numerical Postfix SMTP server response code when a request 1266 is rejected by the <b><a href="postconf.5.html#reject_plaintext_session">reject_plaintext_session</a></b> restriction. 1267 1268 <b><a href="postconf.5.html#reject_code">reject_code</a> (554)</b> 1269 The numerical Postfix SMTP server response code when a remote 1270 SMTP client request is rejected by the "reject" restriction. 1271 1272 <b><a href="postconf.5.html#relay_domains_reject_code">relay_domains_reject_code</a> (554)</b> 1273 The numerical Postfix SMTP server response code when a client 1274 request is rejected by the <a href="postconf.5.html#reject_unauth_destination">reject_unauth_destination</a> recipient 1275 restriction. 1276 1277 <b><a href="postconf.5.html#unknown_address_reject_code">unknown_address_reject_code</a> (450)</b> 1278 The numerical response code when the Postfix SMTP server rejects 1279 a sender or recipient address because its domain is unknown. 1280 1281 <b><a href="postconf.5.html#unknown_client_reject_code">unknown_client_reject_code</a> (450)</b> 1282 The numerical Postfix SMTP server response code when a client 1283 without valid address <=> name mapping is rejected by the 1284 <a href="postconf.5.html#reject_unknown_client_hostname">reject_unknown_client_hostname</a> restriction. 1285 1286 <b><a href="postconf.5.html#unknown_hostname_reject_code">unknown_hostname_reject_code</a> (450)</b> 1287 The numerical Postfix SMTP server response code when the host- 1288 name specified with the HELO or EHLO command is rejected by the 1289 <a href="postconf.5.html#reject_unknown_helo_hostname">reject_unknown_helo_hostname</a> restriction. 1290 1291 Available in Postfix version 2.0 and later: 1292 1293 <b><a href="postconf.5.html#default_rbl_reply">default_rbl_reply</a> (see 'postconf -d' output)</b> 1294 The default Postfix SMTP server response template for a request 1295 that is rejected by an RBL-based restriction. 1296 1297 <b><a href="postconf.5.html#multi_recipient_bounce_reject_code">multi_recipient_bounce_reject_code</a> (550)</b> 1298 The numerical Postfix SMTP server response code when a remote 1299 SMTP client request is blocked by the <a href="postconf.5.html#reject_multi_recipient_bounce">reject_multi_recipi</a>- 1300 <a href="postconf.5.html#reject_multi_recipient_bounce">ent_bounce</a> restriction. 1301 1302 <b><a href="postconf.5.html#rbl_reply_maps">rbl_reply_maps</a> (empty)</b> 1303 Optional lookup tables with RBL response templates. 1304 1305 Available in Postfix version 2.6 and later: 1306 1307 <b><a href="postconf.5.html#access_map_defer_code">access_map_defer_code</a> (450)</b> 1308 The numerical Postfix SMTP server response code for an <a href="access.5.html"><b>access</b>(5)</a> 1309 map "defer" action, including "<a href="postconf.5.html#defer_if_permit">defer_if_permit</a>" or 1310 "<a href="postconf.5.html#defer_if_reject">defer_if_reject</a>". 1311 1312 <b><a href="postconf.5.html#reject_tempfail_action">reject_tempfail_action</a> (<a href="postconf.5.html#defer_if_permit">defer_if_permit</a>)</b> 1313 The Postfix SMTP server's action when a reject-type restriction 1314 fails due to a temporary error condition. 1315 1316 <b><a href="postconf.5.html#unknown_helo_hostname_tempfail_action">unknown_helo_hostname_tempfail_action</a> ($<a href="postconf.5.html#reject_tempfail_action">reject_tempfail_action</a>)</b> 1317 The Postfix SMTP server's action when <a href="postconf.5.html#reject_unknown_helo_hostname">reject_unknown_helo_host</a>- 1318 <a href="postconf.5.html#reject_unknown_helo_hostname">name</a> fails due to a temporary error condition. 1319 1320 <b><a href="postconf.5.html#unknown_address_tempfail_action">unknown_address_tempfail_action</a> ($<a href="postconf.5.html#reject_tempfail_action">reject_tempfail_action</a>)</b> 1321 The Postfix SMTP server's action when 1322 <a href="postconf.5.html#reject_unknown_sender_domain">reject_unknown_sender_domain</a> or <a href="postconf.5.html#reject_unknown_recipient_domain">reject_unknown_recipient_domain</a> 1323 fail due to a temporary error condition. 1324 1325<b>MISCELLANEOUS CONTROLS</b> 1326 <b><a href="postconf.5.html#config_directory">config_directory</a> (see 'postconf -d' output)</b> 1327 The default location of the Postfix <a href="postconf.5.html">main.cf</a> and <a href="master.5.html">master.cf</a> con- 1328 figuration files. 1329 1330 <b><a href="postconf.5.html#daemon_timeout">daemon_timeout</a> (18000s)</b> 1331 How much time a Postfix daemon process may take to handle a 1332 request before it is terminated by a built-in watchdog timer. 1333 1334 <b><a href="postconf.5.html#command_directory">command_directory</a> (see 'postconf -d' output)</b> 1335 The location of all postfix administrative commands. 1336 1337 <b><a href="postconf.5.html#double_bounce_sender">double_bounce_sender</a> (double-bounce)</b> 1338 The sender address of postmaster notifications that are gener- 1339 ated by the mail system. 1340 1341 <b><a href="postconf.5.html#ipc_timeout">ipc_timeout</a> (3600s)</b> 1342 The time limit for sending or receiving information over an 1343 internal communication channel. 1344 1345 <b><a href="postconf.5.html#mail_name">mail_name</a> (Postfix)</b> 1346 The mail system name that is displayed in Received: headers, in 1347 the SMTP greeting banner, and in bounced mail. 1348 1349 <b><a href="postconf.5.html#mail_owner">mail_owner</a> (postfix)</b> 1350 The UNIX system account that owns the Postfix queue and most 1351 Postfix daemon processes. 1352 1353 <b><a href="postconf.5.html#max_idle">max_idle</a> (100s)</b> 1354 The maximum amount of time that an idle Postfix daemon process 1355 waits for an incoming connection before terminating voluntarily. 1356 1357 <b><a href="postconf.5.html#max_use">max_use</a> (100)</b> 1358 The maximal number of incoming connections that a Postfix daemon 1359 process will service before terminating voluntarily. 1360 1361 <b><a href="postconf.5.html#myhostname">myhostname</a> (see 'postconf -d' output)</b> 1362 The internet hostname of this mail system. 1363 1364 <b><a href="postconf.5.html#mynetworks">mynetworks</a> (see 'postconf -d' output)</b> 1365 The list of "trusted" remote SMTP clients that have more privi- 1366 leges than "strangers". 1367 1368 <b><a href="postconf.5.html#myorigin">myorigin</a> ($<a href="postconf.5.html#myhostname">myhostname</a>)</b> 1369 The domain name that locally-posted mail appears to come from, 1370 and that locally posted mail is delivered to. 1371 1372 <b><a href="postconf.5.html#process_id">process_id</a> (read-only)</b> 1373 The process ID of a Postfix command or daemon process. 1374 1375 <b><a href="postconf.5.html#process_name">process_name</a> (read-only)</b> 1376 The process name of a Postfix command or daemon process. 1377 1378 <b><a href="postconf.5.html#queue_directory">queue_directory</a> (see 'postconf -d' output)</b> 1379 The location of the Postfix top-level queue directory. 1380 1381 <b><a href="postconf.5.html#recipient_delimiter">recipient_delimiter</a> (empty)</b> 1382 The set of characters that can separate an email address local- 1383 part, user name, or a .forward file name from its extension. 1384 1385 <b><a href="postconf.5.html#smtpd_banner">smtpd_banner</a> ($<a href="postconf.5.html#myhostname">myhostname</a> ESMTP $<a href="postconf.5.html#mail_name">mail_name</a>)</b> 1386 The text that follows the 220 status code in the SMTP greeting 1387 banner. 1388 1389 <b><a href="postconf.5.html#syslog_facility">syslog_facility</a> (mail)</b> 1390 The syslog facility of Postfix logging. 1391 1392 <b><a href="postconf.5.html#syslog_name">syslog_name</a> (see 'postconf -d' output)</b> 1393 A prefix that is prepended to the process name in syslog 1394 records, so that, for example, "smtpd" becomes "prefix/smtpd". 1395 1396 Available in Postfix version 2.2 and later: 1397 1398 <b><a href="postconf.5.html#smtpd_forbidden_commands">smtpd_forbidden_commands</a> (CONNECT GET POST <a href="regexp_table.5.html">regexp</a>:{{/^[^A-Z]/ Bogus}})</b> 1399 List of commands that cause the Postfix SMTP server to immedi- 1400 ately terminate the session with a 221 code. 1401 1402 Available in Postfix version 2.5 and later: 1403 1404 <b><a href="postconf.5.html#smtpd_client_port_logging">smtpd_client_port_logging</a> (no)</b> 1405 Enable logging of the remote SMTP client port in addition to the 1406 hostname and IP address. 1407 1408 Available in Postfix 3.3 and later: 1409 1410 <b><a href="postconf.5.html#service_name">service_name</a> (read-only)</b> 1411 The <a href="master.5.html">master.cf</a> service name of a Postfix daemon process. 1412 1413 Available in Postfix 3.4 and later: 1414 1415 <b><a href="postconf.5.html#smtpd_reject_footer_maps">smtpd_reject_footer_maps</a> (empty)</b> 1416 Lookup tables, indexed by the complete Postfix SMTP server 4xx 1417 or 5xx response, with reject footer templates. 1418 1419<b>SEE ALSO</b> 1420 <a href="anvil.8.html">anvil(8)</a>, connection/rate limiting 1421 <a href="cleanup.8.html">cleanup(8)</a>, message canonicalization 1422 <a href="tlsmgr.8.html">tlsmgr(8)</a>, TLS session and PRNG management 1423 <a href="trivial-rewrite.8.html">trivial-rewrite(8)</a>, address resolver 1424 <a href="verify.8.html">verify(8)</a>, address verification service 1425 <a href="postconf.5.html">postconf(5)</a>, configuration parameters 1426 <a href="master.5.html">master(5)</a>, generic daemon options 1427 <a href="master.8.html">master(8)</a>, process manager 1428 <a href="postlogd.8.html">postlogd(8)</a>, Postfix logging 1429 syslogd(8), system logging 1430 1431<b>README FILES</b> 1432 <a href="ADDRESS_CLASS_README.html">ADDRESS_CLASS_README</a>, blocking unknown hosted or relay recipients 1433 <a href="ADDRESS_REWRITING_README.html">ADDRESS_REWRITING_README</a>, Postfix address manipulation 1434 <a href="BDAT_README.html">BDAT_README</a>, Postfix CHUNKING support 1435 <a href="FILTER_README.html">FILTER_README</a>, external after-queue content filter 1436 <a href="LOCAL_RECIPIENT_README.html">LOCAL_RECIPIENT_README</a>, blocking unknown local recipients 1437 <a href="MILTER_README.html">MILTER_README</a>, before-queue mail filter applications 1438 <a href="SMTPD_ACCESS_README.html">SMTPD_ACCESS_README</a>, built-in access policies 1439 <a href="SMTPD_POLICY_README.html">SMTPD_POLICY_README</a>, external policy server 1440 <a href="SMTPD_PROXY_README.html">SMTPD_PROXY_README</a>, external before-queue content filter 1441 <a href="SASL_README.html">SASL_README</a>, Postfix SASL howto 1442 <a href="TLS_README.html">TLS_README</a>, Postfix STARTTLS howto 1443 <a href="VERP_README.html">VERP_README</a>, Postfix XVERP extension 1444 <a href="XCLIENT_README.html">XCLIENT_README</a>, Postfix XCLIENT extension 1445 <a href="XFORWARD_README.html">XFORWARD_README</a>, Postfix XFORWARD extension 1446 1447<b>LICENSE</b> 1448 The Secure Mailer license must be distributed with this software. 1449 1450<b>AUTHOR(S)</b> 1451 Wietse Venema 1452 IBM T.J. Watson Research 1453 P.O. Box 704 1454 Yorktown Heights, NY 10598, USA 1455 1456 Wietse Venema 1457 Google, Inc. 1458 111 8th Avenue 1459 New York, NY 10011, USA 1460 1461 SASL support originally by: 1462 Till Franke 1463 SuSE Rhein/Main AG 1464 65760 Eschborn, Germany 1465 1466 TLS support originally by: 1467 Lutz Jaenicke 1468 BTU Cottbus 1469 Allgemeine Elektrotechnik 1470 Universitaetsplatz 3-4 1471 D-03044 Cottbus, Germany 1472 1473 Revised TLS support by: 1474 Victor Duchovni 1475 Morgan Stanley 1476 1477 SMTPD(8) 1478</pre> </body> </html> 1479