1The stable Postfix release is called postfix-2.11.x where 2=major 2release number, 11=minor release number, x=patchlevel. The stable 3release never changes except for patches that address bugs or 4emergencies. Patches change the patchlevel and the release date. 5 6New features are developed in snapshot releases. These are called 7postfix-2.12-yyyymmdd where yyyymmdd is the release date (yyyy=year, 8mm=month, dd=day). Patches are never issued for snapshot releases; 9instead, a new snapshot is released. 10 11The mail_release_date configuration parameter (format: yyyymmdd) 12specifies the release date of a stable release or snapshot release. 13 14If you upgrade from Postfix 2.9 or earlier, read RELEASE_NOTES-2.10 15before proceeding. 16 17Incompatible change with Postfix 2.11.6 18--------------------------------------- 19 20As of the middle of 2015, all supported Postfix releases no longer 21enable "export" grade ciphers for opportunistic TLS, and no longer 22use the deprecated SSLv2 and SSLv3 protocols for mandatory or 23opportunistic TLS. 24 25These changes are very unlikely to cause problems with server-to-server 26communication over the Internet, but they may result in interoperability 27problems with ancient client or server implementations on internal 28networks. To address this problem, you can revert the changes with: 29 30Postfix SMTP client settings: 31 32 lmtp_tls_ciphers = export 33 smtp_tls_ciphers = export 34 lmtp_tls_protocols = !SSLv2 35 smtp_tls_protocols = !SSLv2 36 lmtp_tls_mandatory_protocols = !SSLv2 37 smtp_tls_mandatory_protocols = !SSLv2 38 39Postfix SMTP server settings: 40 41 smtpd_tls_ciphers = export 42 smtpd_tls_protocols = 43 smtpd_tls_mandatory_protocols = !SSLv2 44 45These settings, if put in main.cf, affect all Postfix SMTP client 46or server communication, which may be undesirable. To be more 47selective, use "-o name=value" parameter overrides on specific 48services in master.cf. Execute the command "postfix reload" to make 49the changes effective. 50 51Major changes - tls 52------------------- 53 54[Documentation 20131218] The new FORWARD_SECRECY_README document 55conveniently presents all information about Postfix "perfect" forward 56secrecy support in one place: what forward secrecy is, how to tweak 57settings, and what you can expect to see when Postfix uses ciphers 58with forward secrecy. 59 60[Feature 20130602] Support for PKI-less TLS server certificate 61verification, where the CA public key or the server certificate is 62identified via DNSSEC lookup. 63 64This feature introduces new TLS security levels called "dane" and 65"dane-only" (DNS-based Authentication of Named Entities) that use 66DNSSEC to look up CA or server certificate information. The details 67of DANE core protocols are still evolving, as are the details of 68how DANE should be used in the context of SMTP. Postfix implements 69what appears to be a "rational" subset of the DANE profiles that 70is suitable for SMTP. 71 72The problem with conventional PKI is that there are literally 73hundreds of organizations world-wide that can provide a certificate 74in anyone's name. There have been widely-published incidents in 75recent history where a certificate authority gave out an inappropriate 76certificate (e.g., a certificate in the name of Microsoft to someone 77who did not represent Microsoft), where a CA was compromised (e.g., 78DigiNotar, Comodo), or where a CA made operational mistakes (e.g., 79TURKTRUST). Another concern is that a legitimate CA might be coerced 80to provide a certificate that allows its government to play 81man-in-the-middle on TLS traffic and observe the plaintext. 82 83Major changes - LMDB database support 84------------------------------------- 85 86LMDB is a memory-mapped database that was originally developed as 87part of OpenLDAP. The Postfix LMDB driver was originally contributed 88by Howard Chu, LMDB's creator. 89 90LMDB can be used for all Postfix lookup tables and caches. It is 91the first persistent Postfix database that can be shared among 92multiple writers such as postscreen daemons (Postfix already supported 93shared non-persistent memcached caches). See lmdb_table(5) and 94LMDB_README for further information, including how to access Postfix 95LMDB databases with non-Postfix programs. 96 97Postfix currently requires LMDB version 0.9.11 or later. The minimum 98version may change over time in the light of deployment experience. 99 100Major changes - postscreen whitelisting 101--------------------------------------- 102 103[Feature 20130512] Allow a remote SMTP client to skip postscreen(8) 104tests based on its postscreen_dnsbl_sites score. 105 106Specify a negative "postscreen_dnsbl_whitelist_threshold" value to 107enable this feature. When a client passes the threshold value 108without having failed other tests, all pending or disabled tests 109are flagged as completed. 110 111This feature can mitigate the email delays due to "after 220 greeting" 112protocol tests, which otherwise require that a client reconnects 113before it can deliver mail. Some providers such as Google don't 114retry from the same IP address. This can result in large email 115delivery delays. 116 117Major changes - recipient_delimiter 118----------------------------------- 119 120[Feature 20130405] The recipient_delimiter parameter can now specify 121a set of characters. A user name is now separated from its address 122extension by the first character that matches the recipient_delimiter 123set. 124 125For example, specify "recipient_delimiter = +-" to support both the 126Postfix-style "+" and the qmail-style "-" extension delimiter. 127 128As before, this implementation recognizes one delimiter character 129per email address, and one address extension per email address. 130 131Major changes - smtpd access control 132------------------------------------ 133 134[Feature 20131031] The check_sasl_access feature can be used to 135block hijacked logins. Like other check_mumble_access features it 136queries a lookup table (in this case with the SASL login name), and 137it supports the same actions as any Postfix access(5) table. 138 139[Feature 20130924] The reject_known_sender_login_mismatch feature 140applies reject_sender_login_mismatch only to MAIL FROM addresses 141that are known in $smtpd_sender_login_maps. 142 143Major changes - MacOS X 144----------------------- 145 146[Feature 20130325] Full support for kqueue() event handling which 147scales better with large numbers of file handles, plus a workaround 148for timeout handling on file handles (such as /dev/urandom) that 149still do not correctly support poll(). 150 151Major changes - master 152---------------------- 153 154[Incompat 20131217] The master_service_disable parameter value 155syntax has changed: use "service/type" instead of "service.type". 156The new form is consistent with postconf(1) namespaces for master.cf. 157The old form is still supported to avoid breaking existing 158configurations. 159 160Major changes - milter 161---------------------- 162 163[Feature 20131126] Support for ESMTP parameters "NOTIFY" and "ORCPT" 164in the SMFIR_ADDRCPT_PAR (add recipient with parameters) request. 165Credits: Andrew Ayer. 166 167Major changes - mysql 168--------------------- 169 170[Feature 20131117] MySQL client support for option_file, option_group, 171tls_cert_file, tls_key_file, tls_CAfile, tls_CApath, tls_verify_cert. 172Credits: Gareth Palmer. 173 174Major changes - postconf 175------------------------ 176 177[Feature 20131217] Support for advanced master.cf query and update 178operations. This was implemented primarily to support automated 179system management tools. 180 181The goal is to make all Postfix master.cf details accessible as 182lists of "name=value" pairs, where the names are organized into 183structured name spaces. This allows other programs to query 184information or request updates, without having to worry about the 185exact layout of master.cf files. 186 187Managing master.cf service attributes 188------------------------------------- 189 190First, an example that shows the smtp/inet service in the traditional 191form: 192 193 $ postconf -M smtp/inet 194 smtp inet n - n - - smtpd 195 196Different variants of this command show different amounts of output. 197For example, "postconf -M smtp" enumerates all services that have 198a name "smtp" and any service type ("inet", "unix", etc.), and 199"postconf -M" enumerates all master.cf services. 200 201General rule: each name component that is not present becomes a "*" 202wildcard. 203 204Coming back to the above example, the postconf -F option can now 205enumerate the smtp/inet service fields as follows: 206 207 $ postconf -F smtp/inet 208 smtp/inet/service = smtp 209 smtp/inet/type = inet 210 smtp/inet/private = n 211 smtp/inet/unprivileged = - 212 smtp/inet/chroot = n 213 smtp/inet/wakeup = - 214 smtp/inet/process_limit = - 215 smtp/inet/command = smtpd 216 217This form makes it very easy to change one field in master.cf. 218For example to turn on chroot on the smtp/inet service you use: 219 220 $ postconf -F smtp/inet/chroot=y 221 $ postfix reload 222 223Moreover, with "-F" you can specify "*" for service name or service 224type to get a wild-card match. For example, to turn off chroot on 225all Postfix daemons, use this: 226 227 $ postconf -F '*/*/chroot=n' 228 $ postfix reload 229 230Managing master.cf service "-o parameter=value" settings 231-------------------------------------------------------- 232 233For a second example, let's look at the submission service. This 234service typically has multiple "-o parameter=value" overrides. First 235the traditional view: 236 237 $ postconf -Mf submission 238 submission inet n - n - - smtpd 239 -o smtpd_tls_security_level=encrypt 240 -o smtpd_sasl_auth_enable=yes 241 ... 242 243The postconf -P option can now enumerate these parameters as follows: 244 245 $ postconf -P submission 246 submission/inet/smtpd_sasl_auth_enable = yes 247 submission/inet/smtpd_tls_security_level = encrypt 248 ... 249 250Again, this form makes it very easy to modify one parameter 251setting. For example, to change the smtpd_tls_security_level setting 252for the submission/inet service: 253 254 $ postconf -P 'submission/inet/smtpd_tls_security_level=may' 255 256You can create or remove a parametername=parametervalue setting: 257 258Create: 259 $ postconf -P 'submission/inet/parametername=parametervalue' 260 261Remove: 262 $ postconf -PX submission/inet/parametername 263 264Finally, always execute "postfix reload" after updating master.cf. 265 266Managing master.cf service entries 267---------------------------------- 268 269Finally, adding master.cf entries is possible, but currently this 270does not yet have "advanced" support. It can only be done at the 271level of the traditional master.cf file format. 272 273Suppose that you need to configure a Postfix SMTP client that will 274handle slow email deliveries. To implement this you need to clone 275the smtp/unix service settings and create a new delay/unix service. 276 277First, you would enumerate the smtp/unix service like this: 278 279 $ postconf -M smtp/unix 280 smtp unix - - n - - smtp 281 282Then you would copy those fields (except the first field) by hand 283to create the delay/unix service: 284 285 $ postconf -M delay/unix="delay unix - - n - - smtp" 286 287To combine the above steps in one command: 288 289 $ postconf -M delay/unix="`postconf -M smtp/unix|awk '{$1 = "delay"}'`" 290 291This is perhaps not super-convenient for manual cloning, but it 292should be sufficient for programmatic configuration management. 293 294Again, always execute "postfix reload" after updating master.cf. 295 296Deleting or commenting out master.cf entries 297-------------------------------------------- 298 299The -X (delete entry) and -# (comment out entry) options already 300exist for main.cf, and they now also work work for entire master.cf 301entries: 302 303Remove main.cf or master.cf entry: 304 $ postconf -X parametername 305 $ postconf -MX delay/unix 306 307Comment out main.cf or master.cf entry: 308 $ postconf -# parametername 309 $ postconf -M# delay/unix 310 311As with main.cf, there is no support to "undo" master.cf changes 312that are made with -X or -#. 313 314Again, always execute "postfix reload" after updating master.cf. 315