| 1.1.1.2 |
| 09-May-2026 |
christos | Import postfix 3.11.2 (previous was 3.10.1)
Changes in 3.11.2
Bugfix (defect introduced: Postfix 3.11): the proxymap(8) daemon
dereferenced an uninitialized pointer after a request protocol
error. This daemon is not exposed to local or remote users. Found
by Claude Opus 4.6.
Bugfix (defect introduced: 20260309) a change, to set the service_name
default value to "amnesiac", violated a test that parameter names
in postconf output must match 1:1 with parameter names in the
postlink script.
Changes in 3.11.1
Bugfix (defect introduced: 20260219): alias_maps errors when
default_database_type was not set in main.cf. Fix by Michael Tokarev.
Bugfix (defect introduced: Postfix 3.0): buffer over-read when
Postfix is configured with an enhanced status code not followed by
other text. For example, "5.7.2" without text after the three-number
code, in an access(5) table, header or body checks, or with "$rbl_code
$rbl_text" in rbl_reply_maps or default_rbl_reply. These are all
uncommon configurations. Problem reported by Kamil Frankowicz.
Bugfix (defect introduced: Postfix 3.3): null pointer in nbdb_reindexd(8)
because the "service_name" value was not propagated. Report by
Michael Tokarev.
During Postfix start-up, avoid a spurious error message from
nbdb_reindexd(8), when non_bdb_migration_level disables automatic
re-indexing.
Changes in 3.11.0
Postfix stable release 3.11.0 is available. Postfix 3.7 - 3.10 were
updated a few weeks ago; after that, Postfix 3.7 will no longer be
updated.
The main changes are below. See the RELEASE_NOTES file for further details.
Berkeley DB migration:
Some (Linux) distributions are removing support for BerkeleyDB
databases (In Postfix, this means we lose support for the hash:
and btree: lookup tables). See NON_BERKELEYDB_README for manual
and partially automatic migration from btree: to lmdb:, and from
hash: to lmdb: or cdb:.
The loss of BerkeleyDB affects Mailman versions that want to execute
commands like "postmap hash:/path/to/file" when a mailing list is
added or removed. Postfix provides a way to redirect such commands
to a supported database type.
You don't have to wait until BerkeleyDB support is removed. It can
make sense to migrate while BerkeleyDB support is still available
(mainly, less downtime).
Changes in TLS support:
Default TLS security. The Postfix SMTP client smtp_tls_security_level
default value is "may" if Postfix was built with TLS support, and
the compatibility_level is 3.11 or higher.
Support for the RFC 8689 "REQUIRETLS" verb in ESMTP. This requires
that every SMTP (and LMTP) server in the forward path is strongly
authenticated with DANE, STS, or equivalent, and that every server
announces REQUIRETLS support.
See REQUIRETLS_README for suggestions to carefully enforce REQUIRETLS
without causing massive mail delivery problems.
Logging the TLS security level. This shows the desired and actual
TLS security level enforcement status and, if a message requests
REQUIRETLS, the REQUIRETLS policy enforcement status. For a list
of examples see smtp_log_tls_feature_status
Workaround for an interface mismatch between the Postfix SMTP client
and MTA-STS policy plugins. This introduces a new parameter
smtp_tls_enforce_sts_mx_patterns (default: "yes"). The MTA-STS
plugin configuration needs to enable TLSRPT support, so that it
forwards STS policy attributes to Postfix. Both postfix-tlspol and
postfix-mta-sts-resolver have been updated accordingly.
With this, the Postfix SMTP client will connect to an MX host only
if its name matches any STS policy MX host pattern, and will match
a server certificate against the MX hostname. Otherwise, the old
behavior stays in effect: connect to any MX host listed in DNS,
and match a server certificate against any STS policy MX host
pattern.
Post-quantum cryptography support. With OpenSSL 3.5 and later,
change the tls_eecdh_auto_curves default value to avoid problems
with network infrastructure that mishandles TLS hello messages
larger than one (Ethernet) TCP segment. This problem is more
generally known as "protocol ossification".
Miscellaneous changes:
Deprecation of obsolete parameters. Postfix programs log a warning
that these parameters will be removed. See DEPRECATION_README for
a list of deprecated parameters.
JSON output support with "postconf -j|-jM|-jF|-jP", "postalias
-jq|-js", "postmap -jq|-js", and "postmulti -jl". No support is
planned for JSON input support.
Milter support: improved Milter error handling for messages that
arrive over a long-lived SMTP connection, by changing the default
milter_default_action from "tempfail" to the new "shutdown" action
(i.e. disconnect the remote SMTP client). This was already back-ported
to earlier stable releases.
For more changes in the 3.10 branch see:
https://www.postfix.org/announcements.html
|
| 1.1.1.1 |
| 25-Feb-2025 |
christos | branches: 1.1.1.1.2; 1.1.1.1.4;
Import postfix-3.10.1 (previous was 3.8.4)
Summary:
Postfix 3.9 (July 2022): This release focused on enhancing the TLS
(Transport Layer Security) capabilities of Postfix. It introduced
support for TLSv1.3, allowing for more secure and efficient encrypted
communications. Additionally, improvements were made to the handling
of TLSA records, which are used in DNS-based Authentication of
Named Entities (DANE) to associate TLS certificates with domain
names.
Postfix 3.10 (July 2023): This version brought significant updates
to Postfix's SMTP (Simple Mail Transfer Protocol) functionalities.
It added support for the SMTPUTF8 extension, enabling the use of
UTF-8 encoding in email addresses and headers, which is essential
for internationalization. The release also included performance
optimizations, particularly in the handling of large mail queues,
and introduced new configuration parameters to provide administrators
with finer control over mail processing.
The changes are described more in detail in:
3.10 changes: RELEASE_NOTES
3.9 changes: RELEASE_NOTES_3.9
3.8 changes: RELEASE_NOTES_3.8
|
