1 <!doctype html public "-//W3C//DTD HTML 4.01 Transitional//EN" 2 "https://www.w3.org/TR/html4/loose.dtd"> 3 <html> <head> 4 <meta http-equiv="Content-Type" content="text/html; charset=utf-8"> 5 <link rel='stylesheet' type='text/css' href='postfix-doc.css'> 6 <title> Postfix manual - smtp(8) </title> 7 </head> <body> <pre> 8 SMTP(8) SMTP(8) 9 10 <b><a name="name">NAME</a></b> 11 smtp, lmtp - Postfix SMTP+LMTP client 12 13 <b><a name="synopsis">SYNOPSIS</a></b> 14 <b>smtp</b> [generic Postfix daemon options] [flags=DORX] 15 16 <b>lmtp</b> [generic Postfix daemon options] [flags=DORX] 17 18 <b><a name="description">DESCRIPTION</a></b> 19 The Postfix SMTP+LMTP client implements the SMTP and LMTP mail delivery 20 protocols. It processes message delivery requests from the queue man- 21 ager. Each request specifies a queue file, a sender address, a domain 22 or host to deliver to, and recipient information. This program expects 23 to be run from the <a href="master.8.html"><b>master</b>(8)</a> process manager. The process name, <b>smtp</b> or 24 <b>lmtp</b>, controls the protocol, and the names of the configuration parame- 25 ters that will be used. 26 27 The SMTP+LMTP client updates the queue file and marks recipients as 28 finished, or it informs the queue manager that delivery should be tried 29 again at a later time. Delivery status reports are sent to the 30 <a href="bounce.8.html"><b>bounce</b>(8)</a>, <a href="defer.8.html"><b>defer</b>(8)</a> or <a href="trace.8.html"><b>trace</b>(8)</a> daemon as appropriate. 31 32 The server lookup strategy is different for SMTP and LMTP, as described 33 in the sections "SMTP SERVER LOOKUP" and "LMTP SERVER LOOKUP". 34 35 After a successful mail transaction, a connection may be saved to the 36 <a href="scache.8.html"><b>scache</b>(8)</a> connection cache server, so that it may be used by any 37 SMTP+LMTP client for a subsequent transaction. 38 39 By default, connection caching is enabled temporarily for destinations 40 that have a high volume of mail in the <a href="QSHAPE_README.html#active_queue">active queue</a>. Connection caching 41 can be enabled permanently for specific destinations. 42 43 <b><a name="smtp_server_lookup">SMTP SERVER LOOKUP</a></b> 44 The Postfix SMTP client supports multiple destinations separated by 45 comma or whitespace (Postfix 3.5 and later). Each destination is tried 46 in the specified order. 47 48 SMTP destinations have the following form: 49 50 <i>domainname</i> 51 52 <i>domainname</i>:<i>service</i> 53 Look up the mail exchangers for the specified domain, and con- 54 nect to the specified service (default: <b>smtp</b>). Optionally, mail 55 exchangers may be looked up with SRV queries instead of MX; this 56 requires that <i>service</i> is given in symbolic form. 57 58 [<i>hostname</i>] 59 60 [<i>hostname</i>]:<i>service</i> 61 Look up the address(es) for the specified host, and connect to 62 the specified service (default: <b>smtp</b>). 63 64 [<i>address</i>] 65 66 [<i>address</i>]:<i>service</i> 67 Connect to the host at the specified address, and connect to the 68 specified service (default: <b>smtp</b>). An IPv6 address must be for- 69 matted as [<b>ipv6</b>:<i>address</i>]. 70 71 <b><a name="lmtp_server_lookup">LMTP SERVER LOOKUP</a></b> 72 The Postfix LMTP client supports multiple destinations separated by 73 comma or whitespace (Postfix 3.5 and later). Each destination is tried 74 in the specified order. 75 76 LMTP destinations have the following form: 77 78 <b>unix</b>:<i>pathname</i> 79 Connect to the local UNIX-domain server that is bound to the 80 specified <i>pathname</i>. If the process runs chrooted, an absolute 81 pathname is interpreted relative to the Postfix queue directory. 82 83 <b>inet</b>:<i>domainname</i> 84 85 <b>inet</b>:<i>domainname</i>:<i>service</i> 86 Look up the LMTP servers for the specified domain and service 87 (default: <b>lmtp</b>). This form is supported when SRV lookups are 88 enabled, and requires that <i>service</i> is in symbolic form. 89 90 <b>inet</b>:<i>hostname</i> 91 92 <b>inet</b>:<i>hostname</i>:<i>service</i> 93 Look up the address(es) for the specified host, and connect to 94 the specified service (default: <b>lmtp</b>). When SRV lookups are 95 enabled, use the form <b>[</b><i>hostname</i><b>]</b> to force address lookups. 96 97 <b>inet</b>:[<i>address</i>] 98 99 <b>inet</b>:[<i>address</i>]:<i>service</i> 100 Connect to the specified local or remote host and service 101 (default: <b>lmtp</b>). An IPv6 address must be formatted as 102 [<b>ipv6</b>:<i>address</i>]. 103 104 <b><a name="single-recipient_delivery">SINGLE-RECIPIENT DELIVERY</a></b> 105 By default, the Postfix SMTP+LMTP client delivers mail to multiple 106 recipients per delivery request. This is undesirable when prepending a 107 <b>Delivered-to:</b> or <b>X-Original-To:</b> message header. To prevent Postfix from 108 sending multiple recipients per delivery request, specify 109 110 <b><a href="postconf.5.html#transport_destination_recipient_limit"><i>transport</i>_destination_recipient_limit</a> = 1</b> 111 112 in the Postfix <a href="postconf.5.html"><b>main.cf</b></a> file, where <i>transport</i> is the name in the first 113 column of the Postfix <a href="master.5.html"><b>master.cf</b></a> entry for this mail delivery service. 114 115 <b><a name="command_attribute_syntax">COMMAND ATTRIBUTE SYNTAX</a></b> 116 <b>flags=DORX</b> (optional) 117 Optional message processing flags. 118 119 <b>D</b> Prepend a "<b>Delivered-To:</b> <i>recipient</i>" message header with 120 the envelope recipient address. Note: for this to work, 121 the <b><a href="postconf.5.html#transport_destination_recipient_limit"><i>transport</i>_destination_recipient_limit</a></b> must be 1 (see 122 SINGLE-RECIPIENT DELIVERY above for details). 123 124 The <b>D</b> flag also enforces loop detection: if a message 125 already contains a <b>Delivered-To:</b> header with the same 126 recipient address, then the message is returned as unde- 127 liverable. The address comparison is case insensitive. 128 129 This feature is available as of Postfix 3.5. 130 131 <b>O</b> Prepend an "<b>X-Original-To:</b> <i>recipient</i>" message header with 132 the recipient address as given to Postfix. Note: for this 133 to work, the <b><a href="postconf.5.html#transport_destination_recipient_limit"><i>transport</i>_destination_recipient_limit</a></b> must 134 be 1 (see SINGLE-RECIPIENT DELIVERY above for details). 135 136 This feature is available as of Postfix 3.5. 137 138 <b>R</b> Prepend a "<b>Return-Path:</b> <<i>sender</i>>" message header with the 139 envelope sender address. 140 141 This feature is available as of Postfix 3.5. 142 143 <b>X</b> Indicates that the delivery is final. This flag affects 144 the status reported in "success" DSN (delivery status 145 notification) messages, and changes it from "relayed" 146 into "delivered". 147 148 This feature is available as of Postfix 3.5. 149 150 <b><a name="security">SECURITY</a></b> 151 The SMTP+LMTP client is moderately security-sensitive. It talks to SMTP 152 or LMTP servers and to DNS servers on the network. The SMTP+LMTP client 153 can be run chrooted at fixed low privilege. 154 155 <b><a name="standards">STANDARDS</a></b> 156 <a href="https://tools.ietf.org/html/rfc821">RFC 821</a> (SMTP protocol) 157 <a href="https://tools.ietf.org/html/rfc822">RFC 822</a> (ARPA Internet Text Messages) 158 <a href="https://tools.ietf.org/html/rfc1651">RFC 1651</a> (SMTP service extensions) 159 <a href="https://tools.ietf.org/html/rfc1652">RFC 1652</a> (8bit-MIME transport) 160 <a href="https://tools.ietf.org/html/rfc1870">RFC 1870</a> (Message Size Declaration) 161 <a href="https://tools.ietf.org/html/rfc2033">RFC 2033</a> (LMTP protocol) 162 <a href="https://tools.ietf.org/html/rfc2034">RFC 2034</a> (SMTP Enhanced Error Codes) 163 <a href="https://tools.ietf.org/html/rfc2045">RFC 2045</a> (MIME: Format of Internet Message Bodies) 164 <a href="https://tools.ietf.org/html/rfc2046">RFC 2046</a> (MIME: Media Types) 165 <a href="https://tools.ietf.org/html/rfc2554">RFC 2554</a> (AUTH command) 166 <a href="https://tools.ietf.org/html/rfc2821">RFC 2821</a> (SMTP protocol) 167 <a href="https://tools.ietf.org/html/rfc2782">RFC 2782</a> (SRV resource records) 168 <a href="https://tools.ietf.org/html/rfc2920">RFC 2920</a> (SMTP Pipelining) 169 <a href="https://tools.ietf.org/html/rfc3207">RFC 3207</a> (STARTTLS command) 170 <a href="https://tools.ietf.org/html/rfc3461">RFC 3461</a> (SMTP DSN Extension) 171 <a href="https://tools.ietf.org/html/rfc3463">RFC 3463</a> (Enhanced Status Codes) 172 <a href="https://tools.ietf.org/html/rfc4954">RFC 4954</a> (AUTH command) 173 <a href="https://tools.ietf.org/html/rfc5321">RFC 5321</a> (SMTP protocol) 174 <a href="https://tools.ietf.org/html/rfc6531">RFC 6531</a> (Internationalized SMTP) 175 <a href="https://tools.ietf.org/html/rfc6533">RFC 6533</a> (Internationalized Delivery Status Notifications) 176 <a href="https://tools.ietf.org/html/rfc7672">RFC 7672</a> (SMTP security via opportunistic DANE TLS) 177 <a href="https://tools.ietf.org/html/rfc8689">RFC 8689</a> (SMTP REQUIRETLS extension, TLS-Required header) 178 179 <b><a name="diagnostics">DIAGNOSTICS</a></b> 180 Problems and transactions are logged to <b>syslogd</b>(8) or <a href="postlogd.8.html"><b>postlogd</b>(8)</a>. 181 Corrupted message files are marked so that the queue manager can move 182 them to the <b>corrupt</b> queue for further inspection. 183 184 Depending on the setting of the <b><a href="postconf.5.html#notify_classes">notify_classes</a></b> parameter, the postmas- 185 ter is notified of bounces, protocol problems, and of other trouble. 186 187 <b><a name="bugs">BUGS</a></b> 188 SMTP and LMTP connection reuse for TLS (without closing the SMTP or 189 LMTP connection) is not supported before Postfix 3.4. 190 191 SMTP and LMTP connection reuse assumes that SASL credentials are valid 192 for all destinations that map onto the same IP address and TCP port. 193 194 <b><a name="configuration_parameters">CONFIGURATION PARAMETERS</a></b> 195 Postfix versions 2.3 and later implement the SMTP and LMTP client with 196 the same program, and choose the protocol and configuration parameters 197 based on the process name, <b>smtp</b> or <b>lmtp</b>. 198 199 Most smtp_<i>xxx</i> configuration parameters have an lmtp_<i>xxx</i> "mirror" param- 200 eter for the equivalent LMTP feature. This document describes only 201 those LMTP-related parameters that aren't simply "mirror" parameters. 202 203 Changes to <a href="postconf.5.html"><b>main.cf</b></a> are picked up automatically, as <a href="smtp.8.html"><b>smtp</b>(8)</a> processes 204 run for only a limited amount of time. Use the command "<b>postfix reload</b>" 205 to speed up a change. 206 207 The text below provides only a parameter summary. See <a href="postconf.5.html"><b>postconf</b>(5)</a> for 208 more details including examples. 209 210 <b><a name="compatibility_controls">COMPATIBILITY CONTROLS</a></b> 211 <b><a href="postconf.5.html#ignore_mx_lookup_error">ignore_mx_lookup_error</a> (no)</b> 212 Ignore DNS MX lookups that produce no response. 213 214 <b><a href="postconf.5.html#smtp_always_send_ehlo">smtp_always_send_ehlo</a> (yes)</b> 215 Always send EHLO at the start of an SMTP session. 216 217 <b><a href="postconf.5.html#smtp_never_send_ehlo">smtp_never_send_ehlo</a> (no)</b> 218 Never send EHLO at the start of an SMTP session. 219 220 <b><a href="postconf.5.html#smtp_defer_if_no_mx_address_found">smtp_defer_if_no_mx_address_found</a> (no)</b> 221 Defer mail delivery when no MX record resolves to an IP address. 222 223 <b><a href="postconf.5.html#smtp_line_length_limit">smtp_line_length_limit</a> (998)</b> 224 The maximal length of message header and body lines that Postfix 225 will send via SMTP. 226 227 <b><a href="postconf.5.html#smtp_pix_workaround_delay_time">smtp_pix_workaround_delay_time</a> (10s)</b> 228 How long the Postfix SMTP client pauses before sending 229 ".<CR><LF>" in order to work around the PIX firewall 230 "<CR><LF>.<CR><LF>" bug. 231 232 <b><a href="postconf.5.html#smtp_pix_workaround_threshold_time">smtp_pix_workaround_threshold_time</a> (500s)</b> 233 How long a message must be queued before the Postfix SMTP client 234 turns on the PIX firewall "<CR><LF>.<CR><LF>" bug workaround for 235 delivery through firewalls with "smtp fixup" mode turned on. 236 237 <b><a href="postconf.5.html#smtp_pix_workarounds">smtp_pix_workarounds</a> (disable_esmtp, delay_dotcrlf)</b> 238 A list that specifies zero or more workarounds for CISCO PIX 239 firewall bugs. 240 241 <b><a href="postconf.5.html#smtp_pix_workaround_maps">smtp_pix_workaround_maps</a> (empty)</b> 242 Lookup tables, indexed by the remote SMTP server address, with 243 per-destination workarounds for CISCO PIX firewall bugs. 244 245 <b><a href="postconf.5.html#smtp_quote_rfc821_envelope">smtp_quote_rfc821_envelope</a> (yes)</b> 246 Quote addresses in Postfix SMTP client MAIL FROM and RCPT TO 247 commands as required by <a href="https://tools.ietf.org/html/rfc5321">RFC 5321</a>. 248 249 <b><a href="postconf.5.html#smtp_reply_filter">smtp_reply_filter</a> (empty)</b> 250 A mechanism to transform replies from remote SMTP servers one 251 line at a time. 252 253 <b><a href="postconf.5.html#smtp_skip_5xx_greeting">smtp_skip_5xx_greeting</a> (yes)</b> 254 Skip remote SMTP servers that greet with a 5XX status code. 255 256 <b><a href="postconf.5.html#smtp_skip_quit_response">smtp_skip_quit_response</a> (yes)</b> 257 Do not wait for the response to the SMTP QUIT command. 258 259 Available in Postfix version 2.0 and earlier: 260 261 <b><a href="postconf.5.html#smtp_skip_4xx_greeting">smtp_skip_4xx_greeting</a> (yes)</b> 262 Skip SMTP servers that greet with a 4XX status code (go away, 263 try again later). 264 265 Available in Postfix version 2.2 and later: 266 267 <b><a href="postconf.5.html#smtp_discard_ehlo_keyword_address_maps">smtp_discard_ehlo_keyword_address_maps</a> (empty)</b> 268 Lookup tables, indexed by the remote SMTP server address, with 269 case insensitive lists of EHLO keywords (pipelining, starttls, 270 auth, etc.) that the Postfix SMTP client will ignore in the EHLO 271 response from a remote SMTP server. 272 273 <b><a href="postconf.5.html#smtp_discard_ehlo_keywords">smtp_discard_ehlo_keywords</a> (empty)</b> 274 A case insensitive list of EHLO keywords (pipelining, starttls, 275 auth, etc.) that the Postfix SMTP client will ignore in the EHLO 276 response from a remote SMTP server. 277 278 <b><a href="postconf.5.html#smtp_generic_maps">smtp_generic_maps</a> (empty)</b> 279 Optional lookup tables that perform address rewriting in the 280 Postfix SMTP client, typically to transform a locally valid 281 address into a globally valid address when sending mail across 282 the Internet. 283 284 Available in Postfix version 2.2.9 and later: 285 286 <b><a href="postconf.5.html#smtp_cname_overrides_servername">smtp_cname_overrides_servername</a> (version dependent)</b> 287 When the remote SMTP servername is a DNS CNAME, replace the 288 servername with the result from CNAME expansion for the purpose 289 of logging, SASL password lookup, TLS policy decisions, or TLS 290 certificate verification. 291 292 Available in Postfix version 2.3 and later: 293 294 <b><a href="postconf.5.html#lmtp_discard_lhlo_keyword_address_maps">lmtp_discard_lhlo_keyword_address_maps</a> (empty)</b> 295 Lookup tables, indexed by the remote LMTP server address, with 296 case insensitive lists of LHLO keywords (pipelining, starttls, 297 auth, etc.) that the Postfix LMTP client will ignore in the LHLO 298 response from a remote LMTP server. 299 300 <b><a href="postconf.5.html#lmtp_discard_lhlo_keywords">lmtp_discard_lhlo_keywords</a> (empty)</b> 301 A case insensitive list of LHLO keywords (pipelining, starttls, 302 auth, etc.) that the Postfix LMTP client will ignore in the LHLO 303 response from a remote LMTP server. 304 305 Available in Postfix version 2.4.4 and later: 306 307 <b><a href="postconf.5.html#send_cyrus_sasl_authzid">send_cyrus_sasl_authzid</a> (no)</b> 308 When authenticating to a remote SMTP or LMTP server with the 309 default setting "no", send no SASL authoriZation ID (authzid); 310 send only the SASL authentiCation ID (authcid) plus the auth- 311 cid's password. 312 313 Available in Postfix version 2.5 and later: 314 315 <b><a href="postconf.5.html#smtp_header_checks">smtp_header_checks</a> (empty)</b> 316 Restricted <a href="header_checks.5.html"><b>header_checks</b>(5)</a> tables for the Postfix SMTP client. 317 318 <b><a href="postconf.5.html#smtp_mime_header_checks">smtp_mime_header_checks</a> (empty)</b> 319 Restricted <b><a href="postconf.5.html#mime_header_checks">mime_header_checks</a></b>(5) tables for the Postfix SMTP 320 client. 321 322 <b><a href="postconf.5.html#smtp_nested_header_checks">smtp_nested_header_checks</a> (empty)</b> 323 Restricted <b><a href="postconf.5.html#nested_header_checks">nested_header_checks</a></b>(5) tables for the Postfix SMTP 324 client. 325 326 <b><a href="postconf.5.html#smtp_body_checks">smtp_body_checks</a> (empty)</b> 327 Restricted <a href="header_checks.5.html"><b>body_checks</b>(5)</a> tables for the Postfix SMTP client. 328 329 Available in Postfix version 2.6 and later: 330 331 <b><a href="postconf.5.html#tcp_windowsize">tcp_windowsize</a> (0)</b> 332 An optional workaround for routers that break TCP window scal- 333 ing. 334 335 Available in Postfix version 2.8 and later: 336 337 <b><a href="postconf.5.html#smtp_dns_resolver_options">smtp_dns_resolver_options</a> (empty)</b> 338 DNS Resolver options for the Postfix SMTP client. 339 340 Available in Postfix version 2.9 - 3.6: 341 342 <b><a href="postconf.5.html#smtp_per_record_deadline">smtp_per_record_deadline</a> (no)</b> 343 Change the behavior of the smtp_*_timeout time limits, from a 344 time limit per read or write system call, to a time limit to 345 send or receive a complete record (an SMTP command line, SMTP 346 response line, SMTP message content line, or TLS protocol mes- 347 sage). 348 349 Available in Postfix version 2.9 and later: 350 351 <b><a href="postconf.5.html#smtp_send_dummy_mail_auth">smtp_send_dummy_mail_auth</a> (no)</b> 352 Whether or not to append the "AUTH=<>" option to the MAIL FROM 353 command in SASL-authenticated SMTP sessions. 354 355 Available in Postfix version 2.11 and later: 356 357 <b><a href="postconf.5.html#smtp_dns_support_level">smtp_dns_support_level</a> (empty)</b> 358 Level of DNS support in the Postfix SMTP client. 359 360 Available in Postfix version 3.0 and later: 361 362 <b><a href="postconf.5.html#smtp_delivery_status_filter">smtp_delivery_status_filter</a> ($<a href="postconf.5.html#default_delivery_status_filter">default_delivery_status_filter</a>)</b> 363 Optional filter for the <a href="smtp.8.html"><b>smtp</b>(8)</a> delivery agent to change the 364 delivery status code or explanatory text of successful or unsuc- 365 cessful deliveries. 366 367 <b><a href="postconf.5.html#smtp_dns_reply_filter">smtp_dns_reply_filter</a> (empty)</b> 368 Optional filter for Postfix SMTP client DNS lookup results. 369 370 Available in Postfix version 3.3 and later: 371 372 <b><a href="postconf.5.html#smtp_balance_inet_protocols">smtp_balance_inet_protocols</a> (yes)</b> 373 When a remote destination resolves to a combination of IPv4 and 374 IPv6 addresses, ensure that the Postfix SMTP client can try both 375 address types before it runs into the <a href="postconf.5.html#smtp_mx_address_limit">smtp_mx_address_limit</a>. 376 377 Available in Postfix 3.5 and later: 378 379 <b><a href="postconf.5.html#info_log_address_format">info_log_address_format</a> (external)</b> 380 The email address form that will be used in non-debug logging 381 (info, warning, etc.). 382 383 Available in Postfix 3.6 and later: 384 385 <b><a href="postconf.5.html#dnssec_probe">dnssec_probe</a> (ns:.)</b> 386 The DNS query type (default: "ns") and DNS query name (default: 387 ".") that Postfix may use to determine whether DNSSEC validation 388 is available. 389 390 <b><a href="postconf.5.html#known_tcp_ports">known_tcp_ports</a> (lmtp=24, smtp=25, smtps=submissions=465, submis-</b> 391 <b>sion=587)</b> 392 Optional setting that avoids lookups in the <b>services</b>(5) data- 393 base. 394 395 Available in Postfix version 3.7 and later: 396 397 <b><a href="postconf.5.html#smtp_per_request_deadline">smtp_per_request_deadline</a> (no)</b> 398 Change the behavior of the smtp_*_timeout time limits, from a 399 time limit per plaintext or TLS read or write call, to a com- 400 bined time limit for sending a complete SMTP request and for 401 receiving a complete SMTP response. 402 403 <b><a href="postconf.5.html#smtp_min_data_rate">smtp_min_data_rate</a> (500)</b> 404 The minimum plaintext data transfer rate in bytes/second for 405 DATA requests, when deadlines are enabled with 406 <a href="postconf.5.html#smtp_per_request_deadline">smtp_per_request_deadline</a>. 407 408 <b><a href="postconf.5.html#header_from_format">header_from_format</a> (standard)</b> 409 The format of the Postfix-generated <b>From:</b> header. 410 411 Available in Postfix version 3.8 and later: 412 413 <b><a href="postconf.5.html#use_srv_lookup">use_srv_lookup</a> (empty)</b> 414 Enables discovery for the specified service(s) using DNS SRV 415 records. 416 417 <b><a href="postconf.5.html#ignore_srv_lookup_error">ignore_srv_lookup_error</a> (no)</b> 418 When SRV record lookup fails, fall back to MX or IP address 419 lookup as if SRV record lookup was not enabled. 420 421 <b><a href="postconf.5.html#allow_srv_lookup_fallback">allow_srv_lookup_fallback</a> (no)</b> 422 When SRV record lookup fails or no SRV record exists, fall back 423 to MX or IP address lookup as if SRV record lookup was not 424 enabled. 425 426 <b><a name="mime_processing_controls">MIME PROCESSING CONTROLS</a></b> 427 Available in Postfix version 2.0 and later: 428 429 <b><a href="postconf.5.html#disable_mime_output_conversion">disable_mime_output_conversion</a> (no)</b> 430 Disable the conversion of 8BITMIME format to 7BIT format. 431 432 <b><a href="postconf.5.html#mime_boundary_length_limit">mime_boundary_length_limit</a> (2048)</b> 433 The maximal length of MIME multipart boundary strings. 434 435 <b><a href="postconf.5.html#mime_nesting_limit">mime_nesting_limit</a> (100)</b> 436 The maximal recursion level that the MIME processor will handle. 437 438 <b><a name="external_content_inspection_controls">EXTERNAL CONTENT INSPECTION CONTROLS</a></b> 439 Available in Postfix version 2.1 and later: 440 441 <b><a href="postconf.5.html#smtp_send_xforward_command">smtp_send_xforward_command</a> (no)</b> 442 Send the non-standard XFORWARD command when the Postfix SMTP 443 server EHLO response announces XFORWARD support. 444 445 <b><a name="sasl_authentication_controls">SASL AUTHENTICATION CONTROLS</a></b> 446 <b><a href="postconf.5.html#smtp_sasl_auth_enable">smtp_sasl_auth_enable</a> (no)</b> 447 Enable SASL authentication in the Postfix SMTP client. 448 449 <b><a href="postconf.5.html#smtp_sasl_password_maps">smtp_sasl_password_maps</a> (empty)</b> 450 Optional Postfix SMTP client lookup tables with one user- 451 name:password entry per sender, remote hostname or next-hop 452 domain. 453 454 <b><a href="postconf.5.html#smtp_sasl_security_options">smtp_sasl_security_options</a> (noplaintext, noanonymous)</b> 455 Postfix SMTP client SASL security options; as of Postfix 2.3 the 456 list of available features depends on the SASL client implemen- 457 tation that is selected with <b><a href="postconf.5.html#smtp_sasl_type">smtp_sasl_type</a></b>. 458 459 Available in Postfix version 2.2 and later: 460 461 <b><a href="postconf.5.html#smtp_sasl_mechanism_filter">smtp_sasl_mechanism_filter</a> (empty)</b> 462 If non-empty, a Postfix SMTP client filter for the remote SMTP 463 server's list of offered SASL mechanisms. 464 465 Available in Postfix version 2.3 and later: 466 467 <b><a href="postconf.5.html#smtp_sender_dependent_authentication">smtp_sender_dependent_authentication</a> (no)</b> 468 Enable sender-dependent authentication in the Postfix SMTP 469 client; this is available only with SASL authentication, and 470 disables SMTP connection caching to ensure that mail from dif- 471 ferent senders will use the appropriate credentials. 472 473 <b><a href="postconf.5.html#smtp_sasl_path">smtp_sasl_path</a> (empty)</b> 474 Implementation-specific information that the Postfix SMTP client 475 passes through to the SASL plug-in implementation that is 476 selected with <b><a href="postconf.5.html#smtp_sasl_type">smtp_sasl_type</a></b>. 477 478 <b><a href="postconf.5.html#smtp_sasl_type">smtp_sasl_type</a> (cyrus)</b> 479 The SASL plug-in type that the Postfix SMTP client should use 480 for authentication. 481 482 Available in Postfix version 2.5 and later: 483 484 <b><a href="postconf.5.html#smtp_sasl_auth_cache_name">smtp_sasl_auth_cache_name</a> (empty)</b> 485 An optional table to prevent repeated SASL authentication fail- 486 ures with the same remote SMTP server hostname, username and 487 password. 488 489 <b><a href="postconf.5.html#smtp_sasl_auth_cache_time">smtp_sasl_auth_cache_time</a> (90d)</b> 490 The maximal age of an <a href="postconf.5.html#smtp_sasl_auth_cache_name">smtp_sasl_auth_cache_name</a> entry before it 491 is removed. 492 493 <b><a href="postconf.5.html#smtp_sasl_auth_soft_bounce">smtp_sasl_auth_soft_bounce</a> (yes)</b> 494 When a remote SMTP server rejects a SASL authentication request 495 with a 535 reply code, defer mail delivery instead of returning 496 mail as undeliverable. 497 498 Available in Postfix version 2.9 and later: 499 500 <b><a href="postconf.5.html#smtp_send_dummy_mail_auth">smtp_send_dummy_mail_auth</a> (no)</b> 501 Whether or not to append the "AUTH=<>" option to the MAIL FROM 502 command in SASL-authenticated SMTP sessions. 503 504 Available in Postfix version 3.9 and later: 505 506 <b><a href="postconf.5.html#smtp_sasl_password_result_delimiter">smtp_sasl_password_result_delimiter</a> (:)</b> 507 The delimiter between username and password in sasl_passwd_maps 508 lookup results. 509 510 <b><a name="tls_support_controls">TLS SUPPORT CONTROLS</a></b> 511 Detailed information about STARTTLS configuration may be found in the 512 <a href="TLS_README.html">TLS_README</a> document. 513 514 <b><a href="postconf.5.html#smtp_tls_security_level">smtp_tls_security_level</a> (Postfix</b> ><b>= 3.11: may; Postfix</b> < <b>3.11: empty)</b> 515 The default SMTP TLS security level for the Postfix SMTP client. 516 517 <b><a href="postconf.5.html#smtp_sasl_tls_security_options">smtp_sasl_tls_security_options</a> ($<a href="postconf.5.html#smtp_sasl_security_options">smtp_sasl_security_options</a>)</b> 518 The SASL authentication security options that the Postfix SMTP 519 client uses for TLS encrypted SMTP sessions. 520 521 <b><a href="postconf.5.html#smtp_starttls_timeout">smtp_starttls_timeout</a> (300s)</b> 522 Time limit for Postfix SMTP client write and read operations 523 during TLS startup and shutdown handshake procedures. 524 525 <b><a href="postconf.5.html#smtp_tls_CAfile">smtp_tls_CAfile</a> (empty)</b> 526 A file containing CA certificates of root CAs trusted to sign 527 either remote SMTP server certificates or intermediate CA cer- 528 tificates. 529 530 <b><a href="postconf.5.html#smtp_tls_CApath">smtp_tls_CApath</a> (empty)</b> 531 Directory with PEM format Certification Authority certificates 532 that the Postfix SMTP client uses to verify a remote SMTP server 533 certificate. 534 535 <b><a href="postconf.5.html#smtp_tls_cert_file">smtp_tls_cert_file</a> (empty)</b> 536 File with the Postfix SMTP client RSA certificate in PEM format. 537 538 <b><a href="postconf.5.html#smtp_tls_mandatory_ciphers">smtp_tls_mandatory_ciphers</a> (medium)</b> 539 The minimum TLS cipher grade that the Postfix SMTP client will 540 use with mandatory TLS encryption. 541 542 <b><a href="postconf.5.html#smtp_tls_exclude_ciphers">smtp_tls_exclude_ciphers</a> (empty)</b> 543 List of ciphers or cipher types to exclude from the Postfix SMTP 544 client cipher list at all TLS security levels. 545 546 <b><a href="postconf.5.html#smtp_tls_mandatory_exclude_ciphers">smtp_tls_mandatory_exclude_ciphers</a> (empty)</b> 547 Additional list of ciphers or cipher types to exclude from the 548 Postfix SMTP client cipher list at mandatory TLS security lev- 549 els. 550 551 <b><a href="postconf.5.html#smtp_tls_dcert_file">smtp_tls_dcert_file</a> (empty)</b> 552 File with the Postfix SMTP client DSA certificate in PEM format. 553 554 <b><a href="postconf.5.html#smtp_tls_dkey_file">smtp_tls_dkey_file</a> ($<a href="postconf.5.html#smtp_tls_dcert_file">smtp_tls_dcert_file</a>)</b> 555 File with the Postfix SMTP client DSA private key in PEM format. 556 557 <b><a href="postconf.5.html#smtp_tls_key_file">smtp_tls_key_file</a> ($<a href="postconf.5.html#smtp_tls_cert_file">smtp_tls_cert_file</a>)</b> 558 File with the Postfix SMTP client RSA private key in PEM format. 559 560 <b><a href="postconf.5.html#smtp_tls_loglevel">smtp_tls_loglevel</a> (0)</b> 561 Enable additional Postfix SMTP client logging of TLS activity. 562 563 <b><a href="postconf.5.html#smtp_tls_note_starttls_offer">smtp_tls_note_starttls_offer</a> (no)</b> 564 Log the hostname of a remote SMTP server that offers STARTTLS, 565 when TLS is not already enabled for that server. 566 567 <b><a href="postconf.5.html#smtp_tls_policy_maps">smtp_tls_policy_maps</a> (empty)</b> 568 Optional lookup tables with the Postfix SMTP client TLS security 569 policy by next-hop destination; when a non-empty value is speci- 570 fied, this overrides the obsolete <a href="postconf.5.html#smtp_tls_per_site">smtp_tls_per_site</a> parameter. 571 572 <b><a href="postconf.5.html#smtp_tls_mandatory_protocols">smtp_tls_mandatory_protocols</a> (see 'postconf -d' output)</b> 573 TLS protocols that the Postfix SMTP client will use with manda- 574 tory TLS encryption. 575 576 <b><a href="postconf.5.html#smtp_tls_scert_verifydepth">smtp_tls_scert_verifydepth</a> (9)</b> 577 The verification depth for remote SMTP server certificates. 578 579 <b><a href="postconf.5.html#smtp_tls_secure_cert_match">smtp_tls_secure_cert_match</a> (nexthop, dot-nexthop)</b> 580 How the Postfix SMTP client verifies the server certificate 581 peername for the "secure" TLS security level. 582 583 <b><a href="postconf.5.html#smtp_tls_session_cache_database">smtp_tls_session_cache_database</a> (empty)</b> 584 Name of the file containing the optional Postfix SMTP client TLS 585 session cache. 586 587 <b><a href="postconf.5.html#smtp_tls_session_cache_timeout">smtp_tls_session_cache_timeout</a> (3600s)</b> 588 The expiration time of Postfix SMTP client TLS session cache 589 information. 590 591 <b><a href="postconf.5.html#smtp_tls_verify_cert_match">smtp_tls_verify_cert_match</a> (hostname)</b> 592 How the Postfix SMTP client verifies the server certificate 593 peername for the "verify" TLS security level. 594 595 <b><a href="postconf.5.html#tls_daemon_random_bytes">tls_daemon_random_bytes</a> (32)</b> 596 The number of pseudo-random bytes that an <a href="smtp.8.html"><b>smtp</b>(8)</a> or <a href="smtpd.8.html"><b>smtpd</b>(8)</a> 597 process requests from the <a href="tlsmgr.8.html"><b>tlsmgr</b>(8)</a> server in order to seed its 598 internal pseudo random number generator (PRNG). 599 600 <b><a href="postconf.5.html#tls_high_cipherlist">tls_high_cipherlist</a> (see 'postconf -d' output)</b> 601 The OpenSSL cipherlist for "high" grade ciphers. 602 603 <b><a href="postconf.5.html#tls_medium_cipherlist">tls_medium_cipherlist</a> (see 'postconf -d' output)</b> 604 The OpenSSL cipherlist for "medium" or higher grade ciphers. 605 606 <b><a href="postconf.5.html#tls_null_cipherlist">tls_null_cipherlist</a> (eNULL:!aNULL)</b> 607 The OpenSSL cipherlist for "NULL" grade ciphers that provide 608 authentication without encryption. 609 610 Available in in Postfix version 2.3..3.7: 611 612 <b><a href="postconf.5.html#tls_low_cipherlist">tls_low_cipherlist</a> (see 'postconf -d' output)</b> 613 The OpenSSL cipherlist for "low" or higher grade ciphers. 614 615 <b><a href="postconf.5.html#tls_export_cipherlist">tls_export_cipherlist</a> (see 'postconf -d' output)</b> 616 The OpenSSL cipherlist for "export" or higher grade ciphers. 617 618 Available in Postfix version 2.4 and later: 619 620 <b><a href="postconf.5.html#smtp_sasl_tls_verified_security_options">smtp_sasl_tls_verified_security_options</a> ($<a href="postconf.5.html#smtp_sasl_tls_security_options">smtp_sasl_tls_secu</a>-</b> 621 <b><a href="postconf.5.html#smtp_sasl_tls_security_options">rity_options</a>)</b> 622 The SASL authentication security options that the Postfix SMTP 623 client uses for TLS encrypted SMTP sessions with a verified 624 server certificate. 625 626 Available in Postfix version 2.5 and later: 627 628 <b><a href="postconf.5.html#smtp_tls_fingerprint_cert_match">smtp_tls_fingerprint_cert_match</a> (empty)</b> 629 List of acceptable remote SMTP server certificate fingerprints 630 for the "fingerprint" TLS security level (<b><a href="postconf.5.html#smtp_tls_security_level">smtp_tls_secu</a>-</b> 631 <b><a href="postconf.5.html#smtp_tls_security_level">rity_level</a></b> = fingerprint). 632 633 <b><a href="postconf.5.html#smtp_tls_fingerprint_digest">smtp_tls_fingerprint_digest</a> (see 'postconf -d' output)</b> 634 The message digest algorithm used to construct remote SMTP 635 server certificate fingerprints. 636 637 Available in Postfix version 2.6 and later: 638 639 <b><a href="postconf.5.html#smtp_tls_protocols">smtp_tls_protocols</a> (see 'postconf -d' output)</b> 640 TLS protocols that the Postfix SMTP client will use with oppor- 641 tunistic TLS encryption. 642 643 <b><a href="postconf.5.html#smtp_tls_ciphers">smtp_tls_ciphers</a> (medium)</b> 644 The minimum TLS cipher grade that the Postfix SMTP client will 645 use with opportunistic TLS encryption. 646 647 <b><a href="postconf.5.html#smtp_tls_eccert_file">smtp_tls_eccert_file</a> (empty)</b> 648 File with the Postfix SMTP client ECDSA certificate in PEM for- 649 mat. 650 651 <b><a href="postconf.5.html#smtp_tls_eckey_file">smtp_tls_eckey_file</a> ($<a href="postconf.5.html#smtp_tls_eccert_file">smtp_tls_eccert_file</a>)</b> 652 File with the Postfix SMTP client ECDSA private key in PEM for- 653 mat. 654 655 Available in Postfix version 2.7 and later: 656 657 <b><a href="postconf.5.html#smtp_tls_block_early_mail_reply">smtp_tls_block_early_mail_reply</a> (no)</b> 658 Try to detect a mail hijacking attack based on a TLS protocol 659 vulnerability (CVE-2009-3555), where an attacker prepends mali- 660 cious HELO, MAIL, RCPT, DATA commands to a Postfix SMTP client 661 TLS session. 662 663 Available in Postfix version 2.8 and later: 664 665 <b><a href="postconf.5.html#tls_disable_workarounds">tls_disable_workarounds</a> (see 'postconf -d' output)</b> 666 List or bit-mask of OpenSSL bug work-arounds to disable. 667 668 Available in Postfix version 2.11-3.1: 669 670 <b><a href="postconf.5.html#tls_dane_digest_agility">tls_dane_digest_agility</a> (on)</b> 671 Configure <a href="https://tools.ietf.org/html/rfc7671">RFC7671</a> DANE TLSA digest algorithm agility. 672 673 <b><a href="postconf.5.html#tls_dane_trust_anchor_digest_enable">tls_dane_trust_anchor_digest_enable</a> (yes)</b> 674 Enable support for <a href="https://tools.ietf.org/html/rfc6698">RFC 6698</a> (DANE TLSA) DNS records that contain 675 digests of trust-anchors with certificate usage "2". 676 677 Available in Postfix version 2.11 and later: 678 679 <b><a href="postconf.5.html#smtp_tls_trust_anchor_file">smtp_tls_trust_anchor_file</a> (empty)</b> 680 Zero or more PEM-format files with trust-anchor certificates 681 and/or public keys. 682 683 <b><a href="postconf.5.html#smtp_tls_force_insecure_host_tlsa_lookup">smtp_tls_force_insecure_host_tlsa_lookup</a> (no)</b> 684 Lookup the associated DANE TLSA RRset even when a hostname is 685 not an alias and its address records lie in an unsigned zone. 686 687 <b><a href="postconf.5.html#tlsmgr_service_name">tlsmgr_service_name</a> (tlsmgr)</b> 688 The name of the <a href="tlsmgr.8.html"><b>tlsmgr</b>(8)</a> service entry in <a href="master.5.html">master.cf</a>. 689 690 Available in Postfix version 3.0 and later: 691 692 <b><a href="postconf.5.html#smtp_tls_wrappermode">smtp_tls_wrappermode</a> (no)</b> 693 Request that the Postfix SMTP client connects using the SUBMIS- 694 SIONS (formerly called SMTPS) protocol instead of using the 695 STARTTLS command. 696 697 Available in Postfix version 3.1 and later: 698 699 <b><a href="postconf.5.html#smtp_tls_dane_insecure_mx_policy">smtp_tls_dane_insecure_mx_policy</a> (dane)</b> 700 The TLS policy for MX hosts with "secure" TLSA records when the 701 nexthop destination security level is <b>dane</b>, but the MX record 702 was found via an "insecure" MX lookup. 703 704 Available in Postfix version 3.2 and later: 705 706 <b><a href="postconf.5.html#tls_eecdh_auto_curves">tls_eecdh_auto_curves</a> (see 'postconf -d' output)</b> 707 The prioritized list of elliptic curves, that should be enabled 708 in the Postfix SMTP client and server. 709 710 Available in Postfix version 3.4 and later: 711 712 <b><a href="postconf.5.html#smtp_tls_connection_reuse">smtp_tls_connection_reuse</a> (no)</b> 713 Try to make multiple deliveries per TLS-encrypted connection. 714 715 <b><a href="postconf.5.html#smtp_tls_chain_files">smtp_tls_chain_files</a> (empty)</b> 716 List of one or more PEM files, each holding one or more private 717 keys directly followed by a corresponding certificate chain. 718 719 <b><a href="postconf.5.html#smtp_tls_servername">smtp_tls_servername</a> (empty)</b> 720 Optional name to send to the remote SMTP server in the TLS 721 Server Name Indication (SNI) extension. 722 723 Available in Postfix 3.5, 3.4.6, 3.3.5, 3.2.10, 3.1.13 and later: 724 725 <b><a href="postconf.5.html#tls_fast_shutdown_enable">tls_fast_shutdown_enable</a> (yes)</b> 726 A workaround for implementations that hang Postfix while shut- 727 ting down a TLS session, until Postfix times out. 728 729 Available in Postfix version 3.8 and later: 730 731 <b><a href="postconf.5.html#tls_ffdhe_auto_groups">tls_ffdhe_auto_groups</a> (see 'postconf -d' output)</b> 732 The prioritized list of finite-field Diffie-Hellman ephemeral 733 (FFDHE) key exchange groups supported by the Postfix SMTP client 734 and server. 735 736 Available in Postfix 3.9, 3.8.1, 3.7.6, 3.6.10, 3.5.20 and later: 737 738 <b><a href="postconf.5.html#tls_config_file">tls_config_file</a> (default)</b> 739 Optional configuration file with baseline OpenSSL settings. 740 741 <b><a href="postconf.5.html#tls_config_name">tls_config_name</a> (empty)</b> 742 The application name passed by Postfix to OpenSSL library ini- 743 tialization functions. 744 745 Available in Postfix version 3.9 and later: 746 747 <b><a href="postconf.5.html#smtp_tls_enable_rpk">smtp_tls_enable_rpk</a> (no)</b> 748 Request that remote SMTP servers send an <a href="https://tools.ietf.org/html/rfc7250">RFC7250</a> raw public key 749 instead of an X.509 certificate. 750 751 Available in Postfix version 3.10 and later: 752 753 <b><a href="postconf.5.html#smtp_tlsrpt_enable">smtp_tlsrpt_enable</a> (no)</b> 754 Enable support for <a href="https://tools.ietf.org/html/rfc8460">RFC 8460</a> TLSRPT notifications. 755 756 <b><a href="postconf.5.html#smtp_tlsrpt_socket_name">smtp_tlsrpt_socket_name</a> (empty)</b> 757 The pathname of a UNIX-domain datagram socket that is managed by 758 a local TLSRPT reporting service. 759 760 <b><a href="postconf.5.html#smtp_tlsrpt_skip_reused_handshakes">smtp_tlsrpt_skip_reused_handshakes</a> (Postfix</b> ><b>= 3.11: no, Postfix 3.10:</b> 761 <b>yes)</b> 762 When set to "yes", report the TLSRPT status only for "new" TLS 763 sessions. 764 765 <b><a href="postconf.5.html#tls_required_enable">tls_required_enable</a> (yes)</b> 766 Enable support for the "TLS-Required: no" message header, 767 defined in <a href="https://tools.ietf.org/html/rfc8689">RFC 8689</a>. 768 769 Available in Postfix version 3.10.5 and later: 770 771 <b><a href="postconf.5.html#smtp_tls_enforce_sts_mx_patterns">smtp_tls_enforce_sts_mx_patterns</a> (yes)</b> 772 Transform the TLS policy from an STS policy plugin: connect to 773 an MX host only if its name matches any STS policy MX host pat- 774 tern, and match the server certificate against the MX hostname. 775 776 Available in Postfix version 3.11 and later: 777 778 <b><a href="postconf.5.html#requiretls_enable">requiretls_enable</a> (yes)</b> 779 Enable support for the ESMTP verb "REQUIRETLS" in the "MAIL 780 FROM" command. 781 782 <b><a href="postconf.5.html#smtp_requiretls_policy">smtp_requiretls_policy</a> (see 'postconf -d <a href="postconf.5.html#smtp_requiretls_policy">smtp_requiretls_policy</a>' out-</b> 783 <b>put)</b> 784 How the Postfix SMTP and LMTP client will enforce REQUIRETLS for 785 messages received with the REQUIRETLS option. 786 787 <b><a href="postconf.5.html#smtp_log_tls_feature_status">smtp_log_tls_feature_status</a> (yes)</b> 788 Enable logging of TLS feature information in delivery status 789 logging. 790 791 <b><a name="obsolete_tls_controls">OBSOLETE TLS CONTROLS</a></b> 792 The following configuration parameters exist for compatibility with 793 Postfix versions before 2.3. Support for these will be removed in a 794 future release. 795 796 <b><a href="postconf.5.html#smtp_use_tls">smtp_use_tls</a> (no)</b> 797 Opportunistic mode: use TLS when a remote SMTP server announces 798 STARTTLS support, otherwise send the mail in the clear. 799 800 <b><a href="postconf.5.html#smtp_enforce_tls">smtp_enforce_tls</a> (no)</b> 801 Enforcement mode: require that remote SMTP servers use TLS 802 encryption, and never send mail in the clear. 803 804 <b><a href="postconf.5.html#smtp_tls_enforce_peername">smtp_tls_enforce_peername</a> (yes)</b> 805 With mandatory TLS encryption, require that the remote SMTP 806 server hostname matches the information in the remote SMTP 807 server certificate. 808 809 <b><a href="postconf.5.html#smtp_tls_per_site">smtp_tls_per_site</a> (empty)</b> 810 Optional lookup tables with the Postfix SMTP client TLS usage 811 policy by next-hop destination and by remote SMTP server host- 812 name. 813 814 <b><a href="postconf.5.html#smtp_tls_cipherlist">smtp_tls_cipherlist</a> (empty)</b> 815 Obsolete Postfix < 2.3 control for the Postfix SMTP client TLS 816 cipher list. 817 818 <b><a name="resource_and_rate_controls">RESOURCE AND RATE CONTROLS</a></b> 819 <b><a href="postconf.5.html#smtp_connect_timeout">smtp_connect_timeout</a> (30s)</b> 820 The Postfix SMTP client time limit for completing a TCP connec- 821 tion, or zero (use the operating system built-in time limit). 822 823 <b><a href="postconf.5.html#smtp_helo_timeout">smtp_helo_timeout</a> (300s)</b> 824 The Postfix SMTP client time limit for sending the HELO or EHLO 825 command, and for receiving the initial remote SMTP server 826 response. 827 828 <b><a href="postconf.5.html#lmtp_lhlo_timeout">lmtp_lhlo_timeout</a> (300s)</b> 829 The Postfix LMTP client time limit for sending the LHLO command, 830 and for receiving the initial remote LMTP server response. 831 832 <b><a href="postconf.5.html#smtp_xforward_timeout">smtp_xforward_timeout</a> (300s)</b> 833 The Postfix SMTP client time limit for sending the XFORWARD com- 834 mand, and for receiving the remote SMTP server response. 835 836 <b><a href="postconf.5.html#smtp_mail_timeout">smtp_mail_timeout</a> (300s)</b> 837 The Postfix SMTP client time limit for sending the MAIL FROM 838 command, and for receiving the remote SMTP server response. 839 840 <b><a href="postconf.5.html#smtp_rcpt_timeout">smtp_rcpt_timeout</a> (300s)</b> 841 The Postfix SMTP client time limit for sending the SMTP RCPT TO 842 command, and for receiving the remote SMTP server response. 843 844 <b><a href="postconf.5.html#smtp_data_init_timeout">smtp_data_init_timeout</a> (120s)</b> 845 The Postfix SMTP client time limit for sending the SMTP DATA 846 command, and for receiving the remote SMTP server response. 847 848 <b><a href="postconf.5.html#smtp_data_xfer_timeout">smtp_data_xfer_timeout</a> (180s)</b> 849 The Postfix SMTP client time limit for sending the SMTP message 850 content. 851 852 <b><a href="postconf.5.html#smtp_data_done_timeout">smtp_data_done_timeout</a> (600s)</b> 853 The Postfix SMTP client time limit for sending the SMTP ".", and 854 for receiving the remote SMTP server response. 855 856 <b><a href="postconf.5.html#smtp_quit_timeout">smtp_quit_timeout</a> (300s)</b> 857 The Postfix SMTP client time limit for sending the QUIT command, 858 and for receiving the remote SMTP server response. 859 860 Available in Postfix version 2.1 and later: 861 862 <b><a href="postconf.5.html#smtp_mx_address_limit">smtp_mx_address_limit</a> (5)</b> 863 The maximal number of MX (mail exchanger) IP addresses that can 864 result from Postfix SMTP client mail exchanger lookups, or zero 865 (no limit). 866 867 <b><a href="postconf.5.html#smtp_mx_session_limit">smtp_mx_session_limit</a> (2)</b> 868 The maximal number of SMTP sessions per delivery request before 869 the Postfix SMTP client gives up or delivers to a fall-back 870 <a href="postconf.5.html#relayhost">relay host</a>, or zero (no limit). 871 872 <b><a href="postconf.5.html#smtp_rset_timeout">smtp_rset_timeout</a> (20s)</b> 873 The Postfix SMTP client time limit for sending the RSET command, 874 and for receiving the remote SMTP server response. 875 876 Available in Postfix version 2.2 and earlier: 877 878 <b><a href="postconf.5.html#lmtp_cache_connection">lmtp_cache_connection</a> (yes)</b> 879 Keep Postfix LMTP client connections open for up to $<a href="postconf.5.html#max_idle">max_idle</a> 880 seconds. 881 882 Available in Postfix version 2.2 and later: 883 884 <b><a href="postconf.5.html#smtp_connection_cache_destinations">smtp_connection_cache_destinations</a> (empty)</b> 885 Permanently enable SMTP connection caching for the specified 886 destinations. 887 888 <b><a href="postconf.5.html#smtp_connection_cache_on_demand">smtp_connection_cache_on_demand</a> (yes)</b> 889 Temporarily enable SMTP connection caching while a destination 890 has a high volume of mail in the <a href="QSHAPE_README.html#active_queue">active queue</a>. 891 892 <b><a href="postconf.5.html#smtp_connection_reuse_time_limit">smtp_connection_reuse_time_limit</a> (300s)</b> 893 The amount of time during which Postfix will use an SMTP connec- 894 tion repeatedly. 895 896 <b><a href="postconf.5.html#smtp_connection_cache_time_limit">smtp_connection_cache_time_limit</a> (2s)</b> 897 When SMTP connection caching is enabled, the amount of time that 898 an unused SMTP client socket is kept open before it is closed. 899 900 Available in Postfix version 2.3 and later: 901 902 <b><a href="postconf.5.html#connection_cache_protocol_timeout">connection_cache_protocol_timeout</a> (5s)</b> 903 Time limit for connection cache connect, send or receive opera- 904 tions. 905 906 Available in Postfix version 2.9 - 3.6: 907 908 <b><a href="postconf.5.html#smtp_per_record_deadline">smtp_per_record_deadline</a> (no)</b> 909 Change the behavior of the smtp_*_timeout time limits, from a 910 time limit per read or write system call, to a time limit to 911 send or receive a complete record (an SMTP command line, SMTP 912 response line, SMTP message content line, or TLS protocol mes- 913 sage). 914 915 Available in Postfix version 2.11 and later: 916 917 <b><a href="postconf.5.html#smtp_connection_reuse_count_limit">smtp_connection_reuse_count_limit</a> (0)</b> 918 When SMTP connection caching is enabled, the number of times 919 that an SMTP session may be reused before it is closed, or zero 920 (no limit). 921 922 Available in Postfix version 3.4 and later: 923 924 <b><a href="postconf.5.html#smtp_tls_connection_reuse">smtp_tls_connection_reuse</a> (no)</b> 925 Try to make multiple deliveries per TLS-encrypted connection. 926 927 Available in Postfix version 3.7 and later: 928 929 <b><a href="postconf.5.html#smtp_per_request_deadline">smtp_per_request_deadline</a> (no)</b> 930 Change the behavior of the smtp_*_timeout time limits, from a 931 time limit per plaintext or TLS read or write call, to a com- 932 bined time limit for sending a complete SMTP request and for 933 receiving a complete SMTP response. 934 935 <b><a href="postconf.5.html#smtp_min_data_rate">smtp_min_data_rate</a> (500)</b> 936 The minimum plaintext data transfer rate in bytes/second for 937 DATA requests, when deadlines are enabled with 938 <a href="postconf.5.html#smtp_per_request_deadline">smtp_per_request_deadline</a>. 939 940 Implemented in the <a href="qmgr.8.html">qmgr(8)</a> daemon: 941 942 <b><a href="postconf.5.html#transport_destination_concurrency_limit">transport_destination_concurrency_limit</a> ($<a href="postconf.5.html#default_destination_concurrency_limit">default_destination_concur</a>-</b> 943 <b><a href="postconf.5.html#default_destination_concurrency_limit">rency_limit</a>)</b> 944 A transport-specific override for the <a href="postconf.5.html#default_destination_concurrency_limit">default_destination_con</a>- 945 <a href="postconf.5.html#default_destination_concurrency_limit">currency_limit</a> parameter value, where <i>transport</i> is the <a href="master.5.html">master.cf</a> 946 name of the message delivery transport. 947 948 <b><a href="postconf.5.html#transport_destination_recipient_limit">transport_destination_recipient_limit</a> ($<a href="postconf.5.html#default_destination_recipient_limit">default_destination_recipi</a>-</b> 949 <b><a href="postconf.5.html#default_destination_recipient_limit">ent_limit</a>)</b> 950 A transport-specific override for the <a href="postconf.5.html#default_destination_recipient_limit">default_destination_recip</a>- 951 <a href="postconf.5.html#default_destination_recipient_limit">ient_limit</a> parameter value, where <i>transport</i> is the <a href="master.5.html">master.cf</a> 952 name of the message delivery transport. 953 954 <b><a name="smtputf8_controls">SMTPUTF8 CONTROLS</a></b> 955 Preliminary SMTPUTF8 support is introduced with Postfix 3.0. 956 957 <b><a href="postconf.5.html#smtputf8_enable">smtputf8_enable</a> (yes)</b> 958 Enable preliminary SMTPUTF8 support for the protocols described 959 in <a href="https://tools.ietf.org/html/rfc6531">RFC 6531</a>, <a href="https://tools.ietf.org/html/rfc6532">RFC 6532</a>, and <a href="https://tools.ietf.org/html/rfc6533">RFC 6533</a>. 960 961 <b><a href="postconf.5.html#smtputf8_autodetect_classes">smtputf8_autodetect_classes</a> (sendmail, verify)</b> 962 Detect that a message requires SMTPUTF8 support for the speci- 963 fied mail origin classes. 964 965 Available in Postfix version 3.2 and later: 966 967 <b><a href="postconf.5.html#enable_idna2003_compatibility">enable_idna2003_compatibility</a> (no)</b> 968 Enable 'transitional' compatibility between IDNA2003 and 969 IDNA2008, when converting UTF-8 domain names to/from the ASCII 970 form that is used for DNS lookups. 971 972 <b><a name="trouble_shooting_controls">TROUBLE SHOOTING CONTROLS</a></b> 973 <b><a href="postconf.5.html#debug_peer_level">debug_peer_level</a> (2)</b> 974 The increment in verbose logging level when a nexthop destina- 975 tion, remote client or server name or network address matches a 976 pattern given with the <a href="postconf.5.html#debug_peer_list">debug_peer_list</a> parameter. 977 978 <b><a href="postconf.5.html#debug_peer_list">debug_peer_list</a> (empty)</b> 979 Optional list of nexthop destination, remote client or server 980 name or network address patterns that, if matched, cause the 981 verbose logging level to increase by the amount specified in 982 $<a href="postconf.5.html#debug_peer_level">debug_peer_level</a>. 983 984 <b><a href="postconf.5.html#error_notice_recipient">error_notice_recipient</a> (postmaster)</b> 985 The recipient of postmaster notifications about mail delivery 986 problems that are caused by policy, resource, software or proto- 987 col errors. 988 989 <b><a href="postconf.5.html#internal_mail_filter_classes">internal_mail_filter_classes</a> (empty)</b> 990 What categories of Postfix-generated mail are subject to 991 before-queue content inspection by <a href="postconf.5.html#non_smtpd_milters">non_smtpd_milters</a>, 992 <a href="postconf.5.html#header_checks">header_checks</a> and <a href="postconf.5.html#body_checks">body_checks</a>. 993 994 <b><a href="postconf.5.html#notify_classes">notify_classes</a> (resource, software)</b> 995 The list of error classes that are reported to the postmaster. 996 997 <b><a name="miscellaneous_controls">MISCELLANEOUS CONTROLS</a></b> 998 <b><a href="postconf.5.html#best_mx_transport">best_mx_transport</a> (empty)</b> 999 Where the Postfix SMTP client should deliver mail when it 1000 detects a "mail loops back to myself" error condition. 1001 1002 <b><a href="postconf.5.html#config_directory">config_directory</a> (see 'postconf -d' output)</b> 1003 The default location of the Postfix <a href="postconf.5.html">main.cf</a> and <a href="master.5.html">master.cf</a> con- 1004 figuration files. 1005 1006 <b><a href="postconf.5.html#daemon_timeout">daemon_timeout</a> (18000s)</b> 1007 How much time a Postfix daemon process may take to handle a 1008 request before it is terminated by a built-in watchdog timer. 1009 1010 <b><a href="postconf.5.html#delay_logging_resolution_limit">delay_logging_resolution_limit</a> (2)</b> 1011 The maximal number of digits after the decimal point when log- 1012 ging delay values. 1013 1014 <b><a href="postconf.5.html#disable_dns_lookups">disable_dns_lookups</a> (no)</b> 1015 Disable DNS lookups in the Postfix SMTP and LMTP clients. 1016 1017 <b><a href="postconf.5.html#inet_interfaces">inet_interfaces</a> (all)</b> 1018 The local network interface addresses that this mail system 1019 receives mail on. 1020 1021 <b><a href="postconf.5.html#inet_protocols">inet_protocols</a> (see 'postconf -d' output)</b> 1022 The Internet protocols Postfix will attempt to use when making 1023 or accepting connections. 1024 1025 <b><a href="postconf.5.html#ipc_timeout">ipc_timeout</a> (3600s)</b> 1026 The time limit for sending or receiving information over an 1027 internal communication channel. 1028 1029 <b><a href="postconf.5.html#lmtp_assume_final">lmtp_assume_final</a> (no)</b> 1030 When a remote LMTP server announces no DSN support, assume that 1031 the server performs final delivery, and send "delivered" deliv- 1032 ery status notifications instead of "relayed". 1033 1034 <b><a href="postconf.5.html#lmtp_tcp_port">lmtp_tcp_port</a> (24)</b> 1035 The default TCP port that the Postfix LMTP client connects to. 1036 1037 <b><a href="postconf.5.html#max_idle">max_idle</a> (100s)</b> 1038 The maximum amount of time that an idle Postfix daemon process 1039 waits for an incoming connection before terminating voluntarily. 1040 1041 <b><a href="postconf.5.html#max_use">max_use</a> (100)</b> 1042 The maximal number of incoming connections that a Postfix daemon 1043 process will service before terminating voluntarily. 1044 1045 <b><a href="postconf.5.html#process_id">process_id</a> (read-only)</b> 1046 The process ID of a Postfix command or daemon process. 1047 1048 <b><a href="postconf.5.html#process_name">process_name</a> (read-only)</b> 1049 The process name of a Postfix command or daemon process. 1050 1051 <b><a href="postconf.5.html#proxy_interfaces">proxy_interfaces</a> (empty)</b> 1052 The remote network interface addresses that this mail system 1053 receives mail on by way of a proxy or network address transla- 1054 tion unit. 1055 1056 <b><a href="postconf.5.html#smtp_address_preference">smtp_address_preference</a> (any)</b> 1057 The address type ("ipv6", "ipv4" or "any") that the Postfix SMTP 1058 client will try first, when a destination has IPv6 and IPv4 1059 addresses with equal MX preference. 1060 1061 <b><a href="postconf.5.html#smtp_bind_address">smtp_bind_address</a> (empty)</b> 1062 An optional numerical network address that the Postfix SMTP 1063 client should bind to when making an IPv4 connection. 1064 1065 <b><a href="postconf.5.html#smtp_bind_address6">smtp_bind_address6</a> (empty)</b> 1066 An optional numerical network address that the Postfix SMTP 1067 client should bind to when making an IPv6 connection. 1068 1069 <b><a href="postconf.5.html#smtp_helo_name">smtp_helo_name</a> ($<a href="postconf.5.html#myhostname">myhostname</a>)</b> 1070 The hostname to send in the SMTP HELO or EHLO command. 1071 1072 <b><a href="postconf.5.html#lmtp_lhlo_name">lmtp_lhlo_name</a> ($<a href="postconf.5.html#myhostname">myhostname</a>)</b> 1073 The hostname to send in the LMTP LHLO command. 1074 1075 <b><a href="postconf.5.html#smtp_host_lookup">smtp_host_lookup</a> (dns)</b> 1076 What mechanisms the Postfix SMTP client uses to look up a host's 1077 IP address. 1078 1079 <b><a href="postconf.5.html#smtp_randomize_addresses">smtp_randomize_addresses</a> (yes)</b> 1080 Randomize the order of equal-preference MX host addresses. 1081 1082 <b><a href="postconf.5.html#syslog_facility">syslog_facility</a> (mail)</b> 1083 The syslog facility of Postfix logging. 1084 1085 <b><a href="postconf.5.html#syslog_name">syslog_name</a> (see 'postconf -d' output)</b> 1086 A prefix that is prepended to the process name in syslog 1087 records, so that, for example, "smtpd" becomes "prefix/smtpd". 1088 1089 Available with Postfix 2.2 and earlier: 1090 1091 <b><a href="postconf.5.html#fallback_relay">fallback_relay</a> (empty)</b> 1092 Optional list of relay hosts for SMTP destinations that can't be 1093 found or that are unreachable. 1094 1095 Available with Postfix 2.3 and later: 1096 1097 <b><a href="postconf.5.html#smtp_fallback_relay">smtp_fallback_relay</a> ($<a href="postconf.5.html#fallback_relay">fallback_relay</a>)</b> 1098 Optional list of relay destinations that will be used when an 1099 SMTP destination is not found, or when delivery fails due to a 1100 non-permanent error. 1101 1102 Available with Postfix 3.0 and later: 1103 1104 <b><a href="postconf.5.html#smtp_address_verify_target">smtp_address_verify_target</a> (rcpt)</b> 1105 In the context of email address verification, the SMTP protocol 1106 stage that determines whether an email address is deliverable. 1107 1108 Available with Postfix 3.1 and later: 1109 1110 <b><a href="postconf.5.html#lmtp_fallback_relay">lmtp_fallback_relay</a> (empty)</b> 1111 Optional list of relay hosts for LMTP destinations that can't be 1112 found or that are unreachable. 1113 1114 Available with Postfix 3.2 and later: 1115 1116 <b><a href="postconf.5.html#smtp_tcp_port">smtp_tcp_port</a> (smtp)</b> 1117 The default TCP port that the Postfix SMTP client connects to. 1118 1119 Available in Postfix 3.3 and later: 1120 1121 <b><a href="postconf.5.html#service_name">service_name</a> (read-only)</b> 1122 The <a href="master.5.html">master.cf</a> service name of a Postfix daemon process. 1123 1124 Available in Postfix 3.7 and later: 1125 1126 <b><a href="postconf.5.html#smtp_bind_address_enforce">smtp_bind_address_enforce</a> (no)</b> 1127 Defer delivery when the Postfix SMTP client cannot apply the 1128 <a href="postconf.5.html#smtp_bind_address">smtp_bind_address</a> or <a href="postconf.5.html#smtp_bind_address6">smtp_bind_address6</a> setting. 1129 1130 <b><a name="see_also">SEE ALSO</a></b> 1131 <a href="generic.5.html">generic(5)</a>, output address rewriting 1132 <a href="header_checks.5.html">header_checks(5)</a>, message header content inspection 1133 <a href="header_checks.5.html">body_checks(5)</a>, body parts content inspection 1134 <a href="qmgr.8.html">qmgr(8)</a>, queue manager 1135 <a href="bounce.8.html">bounce(8)</a>, delivery status reports 1136 <a href="scache.8.html">scache(8)</a>, connection cache server 1137 <a href="postconf.5.html">postconf(5)</a>, configuration parameters 1138 <a href="master.5.html">master(5)</a>, generic daemon options 1139 <a href="master.8.html">master(8)</a>, process manager 1140 <a href="tlsmgr.8.html">tlsmgr(8)</a>, TLS session and PRNG management 1141 <a href="postlogd.8.html">postlogd(8)</a>, Postfix logging 1142 syslogd(8), system logging 1143 1144 <b><a name="readme_files">README FILES</a></b> 1145 <a href="SASL_README.html">SASL_README</a>, Postfix SASL howto 1146 <a href="TLS_README.html">TLS_README</a>, Postfix STARTTLS howto 1147 1148 <b><a name="license">LICENSE</a></b> 1149 The Secure Mailer license must be distributed with this software. 1150 1151 <b>AUTHOR(S)</b> 1152 Wietse Venema 1153 IBM T.J. Watson Research 1154 P.O. Box 704 1155 Yorktown Heights, NY 10598, USA 1156 1157 Wietse Venema 1158 Google, Inc. 1159 111 8th Avenue 1160 New York, NY 10011, USA 1161 1162 Command pipelining in cooperation with: 1163 Jon Ribbens 1164 Oaktree Internet Solutions Ltd., 1165 Internet House, 1166 Canal Basin, 1167 Coventry, 1168 CV1 4LY, United Kingdom. 1169 1170 SASL support originally by: 1171 Till Franke 1172 SuSE Rhein/Main AG 1173 65760 Eschborn, Germany 1174 1175 TLS support originally by: 1176 Lutz Jaenicke 1177 BTU Cottbus 1178 Allgemeine Elektrotechnik 1179 Universitaetsplatz 3-4 1180 D-03044 Cottbus, Germany 1181 1182 Revised TLS and SMTP connection cache support by: 1183 Victor Duchovni 1184 Morgan Stanley 1185 1186 SMTP(8) 1187 </pre> </body> </html> 1188
Indexes created Wed Sep 23 00:26:21 UTC 2026