1The stable Postfix release is called postfix-2.10.x where 2=major 2release number, 10=minor release number, x=patchlevel. The stable 3release never changes except for patches that address bugs or 4emergencies. Patches change the patchlevel and the release date. 5 6New features are developed in snapshot releases. These are called 7postfix-2.11-yyyymmdd where yyyymmdd is the release date (yyyy=year, 8mm=month, dd=day). Patches are never issued for snapshot releases; 9instead, a new snapshot is released. 10 11The mail_release_date configuration parameter (format: yyyymmdd) 12specifies the release date of a stable release or snapshot release. 13 14If you upgrade from Postfix 2.8 or earlier, read RELEASE_NOTES-2.9 15before proceeding. 16 17Major changes - laptop-friendliness 18----------------------------------- 19 20[Incompat 20120924] Postfix no longer uses FIFOs to emulate UNIX-domain 21sockets on Solaris 9 (Vintage 2002!) and later. If you install 22Postfix for the first time on an older Solaris system, edit the 23master.cf file and replace "unix" with "fifo" for the pickup and 24qmgr services. 25 26[Feature 20120924] the default master.cf file now uses "unix" instead 27of "fifo" for the pickup and qmgr services. This avoids periodic 28disk drive spin-up. 29 30Major changes - permit logging 31------------------------------ 32 33[Feature 20120303] [Feature 20120303] New control for "permit" 34logging in smtpd_mumble_restrictions (by default, the SMTP server 35logs "reject" actions but not "permit" actions). Specify 36"smtpd_log_access_permit_actions = static:all" to log all "permit"-style 37actions, or specify a list of explicit action names. More details 38are in the postconf(5) manpage. 39 40Major changes - postconf 41------------------------ 42 43[Incompat 20121224] The postconf command produces more warnings: 44 45- An attempt to modify a read-only parameter (process_name, process_id) 46 in main.cf or master.cf. 47 48- An undefined $name in a parameter value in main.cf or master.cf 49 (except for backwards-compatibility parameters such as $virtual_maps). 50 51[Feature 20121224] The postconf command has been updated to make 52trouble-shooting (and support) easier. In summary, use "postconf 53-Mxf" and "postconf -nxf" to review master.cf and main.cf parameter 54settings with expanded parameter values. 55 56- "postconf -x" now expands $name in main.cf and master.cf parameter 57 values. 58 59- postconf warns about attempts to modify a read-only parameter 60 (process_name, process_id) in main.cf or master.cf. 61 62- postconf warns about an undefined $name in a parameter value in 63 main.cf or master.cf (except for backwards-compatibility parameters 64 such as $virtual_maps). 65 66[Feature 20121227] 67 68- "postconf -o name=value" overrides main.cf parameter settings. 69 This can be used, for example, to examine stress-dependent settings 70 with "postconf -x -o stress=yes". 71 72Major changes - postscreen 73-------------------------- 74 75[Incompat 20121123] The postscreen deep protocol tests now log the 76last command before a protocol error ("UNIMPLEMENTED" when the last 77command is not implemented, "CONNECT" when there was no prior 78command). The changed logfile messages are: 79 80NON-SMTP COMMAND from [address]:port after command: text 81BARE NEWLINE from [address]:port after command 82COMMAND TIME LIMIT from [address]:port after command 83COMMAND COUNT LIMIT from [address]:port after command 84COMMAND LENGTH LIMIT from [address]:port after command 85 86Major changes - load-balancer support 87------------------------------------- 88 89[Incompat 20120625] The postscreen(8)-to-smtpd(8) protocol has 90changed. To avoid "cannot receive connection attributes" warnings 91and dropped connections, execute the command "postfix reload". No 92mail will be lost as long as the remote SMTP client tries again 93later. 94 95[Feature 20120625] Support for upstream proxy agent in the postscreen(8) 96and smtpd(8) daemons. To enable the haproxy protocol, specify one 97of the following: 98 99 postscreen_upstream_proxy_protocol = haproxy 100 smtpd_upstream_proxy_protocol = haproxy 101 102Note 1: smtpd_upstream_proxy_protocol can't be used in smtpd processes 103that are behind postscreen. Configure postscreen_upstream_proxy_protocol 104instead. 105 106Note 2: To use the nginx proxy with smtpd(8), enable the XCLIENT 107protocol with smtpd_authorized_xclient_hosts. This supports SASL 108authentication in the proxy agent (Postfix 2.9 and later). 109 110Major changes - relay safety 111---------------------------- 112 113[Incompat 20130613] New smtpd_relay_restrictions parameter built-in 114default settings: 115 116 smtpd_relay_restrictions = 117 permit_mynetworks 118 permit_sasl_authenticated 119 defer_unauth_destination 120 121This safety net prevents open relay problems due to mistakes 122with spam filter rules in smtpd_recipient_restrictions. 123 124If your site has a complex mail relay policy configured under 125smtpd_recipient_restrictions, this safety net may defer mail that 126Postfix should accept. 127 128To fix this safety net, take one of the following actions: 129 130- Set smtpd_relay_restrictions empty, and keep using the existing 131 mail relay authorization policy in smtpd_recipient_restrictions. 132 133- Copy the existing mail relay authorization policy from 134 smtpd_recipient_restrictions to smtpd_relay_restrictions. 135 136There is no need to change the value of smtpd_recipient_restrictions. 137 138[Feature 20130613] This version introduces the smtpd_relay_restrictions 139feature for mail relay control. The new built-in default settings 140are: 141 142 smtpd_relay_restrictions = 143 permit_mynetworks 144 permit_sasl_authenticated 145 defer_unauth_destination 146 147 smtpd_recipient_restrictions = 148 ( optional spam blocking rules would go here ) 149 150For comparison, this is the Postfix before 2.10 default: 151 152 smtpd_recipient_restrictions = 153 permit_mynetworks 154 reject_unauth_destination 155 ( optional spam blocking rules would go here ) 156 157With Postfix versions before 2.10, the mail relay policy and spam 158blocking policy were combined under smtpd_recipient_restrictions, 159resulting in error-prone configuration. 160 161As of Postfix 2.10, the mail relay policy is preferably implemented 162with smtpd_relay_restrictions, so that a permissive spam blocking 163policy under smtpd_recipient_restrictions will not unexpectedly 164result in a permissive mail relay policy. 165 166As of Postfix 2.10.0 the smtpd_relay_restrictions parameter built-in 167default settings are: 168 169 smtpd_relay_restrictions = 170 permit_mynetworks 171 permit_sasl_authenticated 172 defer_unauth_destination 173 174If your site has a complex mail relay policy configured under 175smtpd_recipient_restrictions, this safety net may defer mail that 176Postfix should accept. 177 178To migrate from an earlier Postfix release with the least amount 179of pain: 180 181- Set smtpd_relay_restrictions empty, and keep using the existing 182 mail relay authorization policy in smtpd_recipient_restrictions. 183 184- There is no need to change the value of smtpd_recipient_restrictions. 185 186To take advantage of the new smtpd_relay_restrictions feature: 187 188- Copy the existing mail relay authorization policy from 189 smtpd_recipient_restrictions to smtpd_relay_restrictions. 190 191- There is no need to change the value of smtpd_recipient_restrictions. 192 193Major changes - start-up 194------------------------ 195 196[Feature 20120306] New master "-w" option, to wait for master daemon 197process initialization to complete. This feature returns an error 198exit status if master daemon initialization fails, or if it does 199not complete in a reasonable amount of time. The exit status is 200used by "postfix start" to provide more accurate information to 201system start-up scripts. 202 203Major changes - tls 204------------------- 205 206[Incompat 20130203] Thanks to OpenSSL documentation, the Postfix 2072.9.0..2.9.5 SMTP client and server server used an incorrect procedure 208to compute TLS certificate PUBLIC-KEY fingerprints (these may be 209used in the check_ccert_access and in smtp_tls_policy_maps features). 210Support for certificate PUBLIC-KEY finger prints was introduced 211with Postfix 2.9; there is no known problem with the certificate 212fingerprint algorithms available since Postfix 2.2. 213 214Certificate PUBLIC-KEY finger prints may be used in the Postfix 215SMTP server (with "check_ccert_access") and in the Postfix SMTP 216client (with the "fingerprint" security level). 217 218Specify "tls_legacy_public_key_fingerprints = yes" temporarily, 219pending a migration from configuration files with incorrect Postfix 2202.9.0..2.9.5 certificate PUBLIC-KEY finger prints, to the correct 221fingerprints used by Postfix 2.9.6 and later. 222 223To compute the correct PUBLIC-KEY finger prints: 224 225# OpenSSL 1.0 with all certificates and SHA-1 fingerprints. 226$ openssl x509 -in cert.pem -noout -pubkey | \ 227 openssl pkey -pubin -outform DER | \ 228 openssl dgst -sha1 -c 229 230# OpenSSL 0.9.8 with RSA certificates and MD5 fingerprints. 231$ openssl x509 -in cert.pem -noout -pubkey | \ 232 openssl rsa -pubin -outform DER | \ 233 openssl dgst -md5 -c 234 235[Feature 20120422] This release adds support to turn off the TLSv1.1 236and TLSv1.2 protocols. Introduced with OpenSSL version 1.0.1, these 237are known to cause inter-operability problems with for example 238hotmail. 239 240The radical workaround is to temporarily turn off problematic 241protocols globally: 242 243/etc/postfix/main.cf: 244 smtp_tls_protocols = !SSLv2, !TLSv1.1, !TLSv1.2 245 smtp_tls_mandatory_protocols = !SSLv2, !TLSv1.1, !TLSv1.2 246 247 smtpd_tls_protocols = !SSLv2, !TLSv1.1, !TLSv1.2 248 smtpd_tls_mandatory_protocols = !SSLv2, !TLSv1.1, !TLSv1.2 249 250However, it may be better to temporarily turn off problematic 251protocols for broken sites only: 252 253/etc/postfix/main.cf: 254 smtp_tls_policy_maps = hash:/etc/postfix/tls_policy 255 256/etc/postfix/tls_policy: 257 example.com may protocols=!SSLv2:!TLSv1.1:!TLSv1.2 258 259Important: 260 261- Note the use of ":" instead of comma or space. Also, note that 262 there is NO space around the "=" in "protocols=". 263 264- The smtp_tls_policy_maps lookup key must match the "next-hop" 265 destination that is given to the Postfix SMTP client. If you 266 override the next-hop destination with transport_maps, relayhost, 267 sender_dependent_relayhost_maps, or otherwise, you need to specify 268 the same destination for the smtp_tls_policy_maps lookup key. 269