[pfx] Re: Postfix Website

[Zachary Appella via Postfix-users]

  
  
Thanks for the tips. My router had some "dark web" filter active
  which was blocking the traffic. I guess this makes sense because I
  also can't access the postfix website from my school network,
  which most definitely blocks onion routing. But this is strange
  though because *I don't think* the postfix webserver is actually a
  TOR relay node.

-- 
Zach Appella (306F2134B328487D0BB83E27DA67439E05A6D7A5)
  

___
Postfix-users mailing list -- postfix-users@postfix.org
To unsubscribe send an email to postfix-users-le...@postfix.org

[pfx] Re: {Disarmed} Error when I try send a e-mail using my postfix server using the "New Outlook"

[Peter via Postfix-users]

On 2/11/24 09:58, giuliano--- via Postfix-users wrote:

Hi everyone!

Thank you a lot Wietse your help was essential for me learn more about 
the dovecot and postfix and resolve the problem. I dont know why, but 
the dovecot.conf was not loading the conf.d/ folder. So after change 
these files I dont really have changes in the doveconf. I guess who 
installed the server in past years, decide use only one file for all 
configurations.


I'm new using the dovecot and postfix, so thank a lot for your time.

Now, the new version of outlook is working too!


Just a couple of notes for you:

What you probably ran across was the old admin simply ran doveconf -nP 
and saved the output to a new, clean dovecot.conf file.  This is not 
unusual and I do it myself.  It saves from having to hunt through 
multiple files in the future to find where a particular setting should 
reside and you get one simple, clean config file.  At the end of the 
day, the safe thing to do to always see the current config in any 
dovecot install is to run dovecot -n (-P includes passwords so you 
should use it if generating a new file but not if sharing the config 
with others).


LOGIN is an old Microsoft-specific mech which, for some unknown reason 
they still try to push people to use in the newest versions of outlook 
even though it's overly complex and offers no advantages when compared 
to PLAIN.  I would tend to recommend using PLAIN instead and outlook 
should have a configuration for that, or it should be able to just 
recognize that PLAIN is offered and not LOGIN and be able to use PLAIN. 
Of course if this is not the case (and it seems perhaps that it isn't in 
your case) then LOGIN is okay to use.  What I do find interesting is 
that it can connect to dovecot via IMAP and use PLAIN but can't use 
PLAIN for submission, or was dovecot somehow offering LOGIN via IMAP but 
not via the auth service?


I did note the following from your oroginal message:


The "new outlook" seems to use a Microsoft Cloud service in the middle, so it's 
no direct connection to my server.


If that is really the case I would ditch Outlook faster than you can 
blink and install and use Thunderbird instead ... just saying.



Peter
___
Postfix-users mailing list -- postfix-users@postfix.org
To unsubscribe send an email to postfix-users-le...@postfix.org

[pfx] Re: rejection policy

[Adriel via Postfix-users]

On 2024-11-01 11:46, postfix--- via Postfix-users wrote:

I have policyd-spf and opendkim (as a milter) installed for postfix.
How can I customize the policy that, if an incoming message has SPF 
failed AND has invalid DKIM then this message will be rejected? AFAIK 
google has this kind of rejection policy for their gmail.


That is what DMARC does. There is also an OpenDMARC in most linux 
packages.


That's nice. I will look into opendmarc. Thanks.
___
Postfix-users mailing list -- postfix-users@postfix.org
To unsubscribe send an email to postfix-users-le...@postfix.org

[pfx] Re: {Disarmed} Error when I try send a e-mail using my postfix server using the "New Outlook"

[Wietse Venema via Postfix-users]

giuliano--- via Postfix-users:
> Oct 31 19:23:44 host01 postfix/submission/smtpd[497262]: < 
> unknown[2603:1056:c03:1c16::5]: AUTH LOGIN 
> Z2l1bGlhbm9AaG9zcGVkYXF1aS5jb20uYnI=

The error is that Postfix will only accept AUTH PLAIN.

This is from the communication with Dovecot:

> xsasl_dovecot_server_mech_filter: keep mechanism: PLAIN
> sasl_mech_filter: keep SASL mechanism: 'PLAIN'

This is from the communuication with the remote SMTP client:

> unknown[2603:1056:c03:1c16::5]: 250-AUTH PLAIN
> unknown[2603:1056:c03:1c16::5]: 250-AUTH=PLAIN

Solutions:

- don't set sasl_mechanism_filer

- add 'login' to the sasl_mechanism_filer setting.

Wietse
___
Postfix-users mailing list -- postfix-users@postfix.org
To unsubscribe send an email to postfix-users-le...@postfix.org

[pfx] Re: {Disarmed} Error when I try send a e-mail using my postfix server using the "New Outlook"

[giuliano--- via Postfix-users]

Em 2024-11-01 10:34, Wietse Venema via Postfix-users escreveu:

giuliano--- via Postfix-users:

Oct 31 19:23:44 host01 postfix/submission/smtpd[497262]: <
unknown[2603:1056:c03:1c16::5]: AUTH LOGIN
Z2l1bGlhbm9AaG9zcGVkYXF1aS5jb20uYnI=


The error is that Postfix will only accept AUTH PLAIN.

This is from the communication with Dovecot:


xsasl_dovecot_server_mech_filter: keep mechanism: PLAIN
sasl_mech_filter: keep SASL mechanism: 'PLAIN'


This is from the communuication with the remote SMTP client:


unknown[2603:1056:c03:1c16::5]: 250-AUTH PLAIN
unknown[2603:1056:c03:1c16::5]: 250-AUTH=PLAIN


Solutions:

- don't set sasl_mechanism_filer

- add 'login' to the sasl_mechanism_filer setting.

Wietse
___
Postfix-users mailing list -- postfix-users@postfix.org
To unsubscribe send an email to postfix-users-le...@postfix.org


Thanks for the reply.

I dont really know what I am doing wrong.

I try to set in postfix (main.cf) sasl_mechanism_filter = plain, login

and try do change the dovecot confs to 
(/etc/dovecot/conf.d/10-auth.conf):

auth_mechanisms = plain login

And restart both systems, but dont work.

I guess the postfix was installed maybe without the LOGIN option. (I 
dont really understand, but i guess realted with the cyrus SASL)


I try to access my webserver using the openSSL:

Start Time: 1730484110
Timeout   : 7200 (sec)
Verify return code: 0 (ok)
Extended master secret: no
Max Early Data: 0
---
read R BLOCK
EHLO hospedaqui.com.br
250-host01.farm03.hospedaqui.net.br
250-PIPELINING
250-SIZE 251658240
250-ETRN
250-AUTH PLAIN
250-AUTH=PLAIN
250-ENHANCEDSTATUSCODES
250-8BITMIME
250-DSN
250 CHUNKING

The login dont really exist after changing the config files.
___
Postfix-users mailing list -- postfix-users@postfix.org
To unsubscribe send an email to postfix-users-le...@postfix.org

[pfx] Re: {Disarmed} Error when I try send a e-mail using my postfix server using the "New Outlook"

[Wietse Venema via Postfix-users]

giuliano--- via Postfix-users:
> I try to set in postfix (main.cf) sasl_mechanism_filter = plain, login
> 
> and try do change the dovecot confs to 
> (/etc/dovecot/conf.d/10-auth.conf):
> auth_mechanisms = plain login
> 
> And restart both systems, but dont work.

In your previous email message there was this:

Oct 31 19:23:44 host01 postfix/submission/smtpd[497262]:
xsasl_dovecot_server_connect: Connecting
Oct 31 19:23:44 host01 postfix/submission/smtpd[497262]:
xsasl_dovecot_server_connect: auth reply: VERSION?1?2
Oct 31 19:23:44 host01 postfix/submission/smtpd[497262]:
xsasl_dovecot_server_connect: auth reply: MECH?PLAIN?plaintext

You say that you changed Dovecot auth configuration. To prove that,
you will have to demonstrate that Postfix now ialso logs a line with

 xsasl_dovecot_server_connect: auth reply: MECH?LOGIN?plaintext

If it doesn't, then you made a mistake configuring Dovecot auth.

It may be helpful to use the 'doveconf' command and look for
differences with what you expect.

Wietse
___
Postfix-users mailing list -- postfix-users@postfix.org
To unsubscribe send an email to postfix-users-le...@postfix.org

[pfx] Re: domain reputation question

[Viktor Dukhovni via Postfix-users]

On Sat, Nov 02, 2024 at 06:34:36AM +0800, Adriel via Postfix-users wrote:

> There is a mail system said,
> 
> host east.xxx.com[3.138.xx.xx] said:
> 554 5.7.1 : Sender address rejected: We reject all
> .click domains.
> 
> I am just not sure, does the .click domain have low reputation on internet?
> so other providers choose to just reject it?
> 
> what's the high reputation domains then, .com/.net/.org?

Rather depends on which registries/registrars had a price promotion
attracting abusers recently enough to lead operators to choose to refuse
traffic.

The long-established gTLDs ccTLDs with a million+ registrations are by
and large not aggressivly priced and not blocked.

154342903com
19562007 cn
17678083 de
12475591 net
10991840 org
10372996 uk
6210775  nl
5702333  ru
5386914  br
4263546  au
4198061  fr
400  in
3694658  xyz
3656296  eu
3540175  info
3481481  it
3430626  shop
3395833  ca
310  co
3026500  online
2766657  top
2572263  pl
2532060  ch
210  us
2079045  es
1881840  pt
1766746  jp
1724239  be
1632933  ir
1571837  store
1510279  site
1480179  at
1474115  cz
1403289  se
140  cc
1365524  mx
1336066  za
1320645  dk
1236222  tr
1216203  biz
1112750  vip
110  io

A longer list is at: https://stats.dnssec-tools.org/#/?top=tlds&tld_tab=3
That includes "dev" and other gTLDs that don't AFAIK have a history of
reputation problems.

You can also search for price breaks on domain registrations and avoid
TLDs that have been aggressively discounted.

-- 
Viktor.
___
Postfix-users mailing list -- postfix-users@postfix.org
To unsubscribe send an email to postfix-users-le...@postfix.org

[pfx] domain reputation question

[Adriel via Postfix-users]

There is a mail system said,

host east.xxx.com[3.138.xx.xx] said:
554 5.7.1 : Sender address rejected: We reject 
all

.click domains.

I am just not sure, does the .click domain have low reputation on 
internet? so other providers choose to just reject it?


what's the high reputation domains then, .com/.net/.org?

Thank you.
___
Postfix-users mailing list -- postfix-users@postfix.org
To unsubscribe send an email to postfix-users-le...@postfix.org

[pfx] Re: domain reputation question

[Adriel via Postfix-users]

On 2024-11-02 12:00, Viktor Dukhovni via Postfix-users wrote:
On Sat, Nov 02, 2024 at 06:34:36AM +0800, Adriel via Postfix-users 
wrote:



There is a mail system said,

host east.xxx.com[3.138.xx.xx] said:
554 5.7.1 : Sender address rejected: We 
reject all

.click domains.

I am just not sure, does the .click domain have low reputation on 
internet?

so other providers choose to just reject it?

what's the high reputation domains then, .com/.net/.org?


Rather depends on which registries/registrars had a price promotion
attracting abusers recently enough to lead operators to choose to 
refuse

traffic.

The long-established gTLDs ccTLDs with a million+ registrations are by
and large not aggressivly priced and not blocked.

154342903com
19562007 cn
17678083 de
12475591 net
10991840 org
10372996 uk
6210775  nl
5702333  ru
5386914  br
4263546  au
4198061  fr
400  in
3694658  xyz
3656296  eu
3540175  info
3481481  it
3430626  shop
3395833  ca
310  co
3026500  online
2766657  top
2572263  pl
2532060  ch
210  us
2079045  es
1881840  pt
1766746  jp
1724239  be
1632933  ir
1571837  store
1510279  site
1480179  at
1474115  cz
1403289  se
140  cc
1365524  mx
1336066  za
1320645  dk
1236222  tr
1216203  biz
1112750  vip
110  io

A longer list is at: 
https://stats.dnssec-tools.org/#/?top=tlds&tld_tab=3

That includes "dev" and other gTLDs that don't AFAIK have a history of
reputation problems.

You can also search for price breaks on domain registrations and avoid
TLDs that have been aggressively discounted.


That's all right. thanks victor.
___
Postfix-users mailing list -- postfix-users@postfix.org
To unsubscribe send an email to postfix-users-le...@postfix.org

[pfx] Re: {Disarmed} Error when I try send a e-mail using my postfix server using the "New Outlook"

[giuliano--- via Postfix-users]

Hi everyone!

Thank you a lot Wietse your help was essential for me learn more about the 
dovecot and postfix and resolve the problem. I dont know why, but the 
dovecot.conf was not loading the conf.d/ folder. So after change these files I 
dont really have changes in the doveconf. I guess who installed the server in 
past years, decide use only one file for all configurations.

I'm new using the dovecot and postfix, so thank a lot for your time.

Now, the new version of outlook is working too!

Bests,

Giuliano Geiss Arnhold


From: Wietse Venema via Postfix-users 
Sent: Friday, November 1, 2024 5:07 PM
To: Postfix users 
Subject: [pfx] Re: {Disarmed} Error when I try send a e-mail using my postfix 
server using the "New Outlook"

giuliano--- via Postfix-users:
> I try to set in postfix (main.cf) sasl_mechanism_filter = plain, login
>
> and try do change the dovecot confs to
> (/etc/dovecot/conf.d/10-auth.conf):
> auth_mechanisms = plain login
>
> And restart both systems, but dont work.

In your previous email message there was this:

Oct 31 19:23:44 host01 postfix/submission/smtpd[497262]:
xsasl_dovecot_server_connect: Connecting
Oct 31 19:23:44 host01 postfix/submission/smtpd[497262]:
xsasl_dovecot_server_connect: auth reply: VERSION?1?2
Oct 31 19:23:44 host01 postfix/submission/smtpd[497262]:
xsasl_dovecot_server_connect: auth reply: MECH?PLAIN?plaintext

You say that you changed Dovecot auth configuration. To prove that,
you will have to demonstrate that Postfix now ialso logs a line with

 xsasl_dovecot_server_connect: auth reply: MECH?LOGIN?plaintext

If it doesn't, then you made a mistake configuring Dovecot auth.

It may be helpful to use the 'doveconf' command and look for
differences with what you expect.

Wietse
___
Postfix-users mailing list -- postfix-users@postfix.org
To unsubscribe send an email to postfix-users-le...@postfix.org
___
Postfix-users mailing list -- postfix-users@postfix.org
To unsubscribe send an email to postfix-users-le...@postfix.org

[pfx] Postfix Website

[Zachary Appella via Postfix-users]

  
  
Is it just me, or has the postfix website been down for months?

-- 
Zach Appella (306F2134B328487D0BB83E27DA67439E05A6D7A5)
  

___
Postfix-users mailing list -- postfix-users@postfix.org
To unsubscribe send an email to postfix-users-le...@postfix.org

[pfx] Re: Postfix Website

[Phil via Postfix-users]

On 2/11/24 08:06, Thomas Cameron via Postfix-users wrote:

On 11/1/24 4:01 PM, Zachary Appella via Postfix-users wrote:

Is it just me, or has the postfix website been down for months?


Works for me. But you have to go to https://www.postfix.org, not just 
https://postfix.org.




Wouldn't a quick dns update fix that . . .
___
Postfix-users mailing list -- postfix-users@postfix.org
To unsubscribe send an email to postfix-users-le...@postfix.org

[pfx] Re: Postfix Website

[Danjel Jungersen via Postfix-users]

I had the same idea until very recently, I had a TOR filter in my 
firewall enabled (Don't remember why, the docs said "don't unless sure")


But after changing it it worked again.

Could this be your case?

//Danjel

On 01-11-2024 22:01, Zachary Appella via Postfix-users wrote:


Is it just me, or has the postfix website been down for months?

--
Zach Appella (306F2134B328487D0BB83E27DA67439E05A6D7A5)

___
Postfix-users mailing list --postfix-users@postfix.org
To unsubscribe send an email topostfix-users-le...@postfix.org

--
Med venlig hilsen/Kind regards
Danjel Jungersen
Mail: dan...@jungersen.dk
Mobile: +45 20 42 20 11

Jungersen Grafisk ApS,
Holsbjergvej 39, DK-2620 Albertslund,
Denmark.
Tel: +45 43 64 10 00

WEBSHOP: PRINTLIGHT.DK  | WWW.JUNGERSEN.DK 



Logo ___
Postfix-users mailing list -- postfix-users@postfix.org
To unsubscribe send an email to postfix-users-le...@postfix.org

[pfx] Re: Postfix Website

[Adriel via Postfix-users]

On 2024-11-02 05:06, Thomas Cameron via Postfix-users wrote:

On 11/1/24 4:01 PM, Zachary Appella via Postfix-users wrote:

Is it just me, or has the postfix website been down for months?


Works for me. But you have to go to https://www.postfix.org, not just 
https://postfix.org.


i almost accessed https://www.postfix.org/ everyday. there were no 
issues for me.

___
Postfix-users mailing list -- postfix-users@postfix.org
To unsubscribe send an email to postfix-users-le...@postfix.org

[pfx] Re: Postfix Website

[Thomas Cameron via Postfix-users]

On 11/1/24 4:01 PM, Zachary Appella via Postfix-users wrote:

Is it just me, or has the postfix website been down for months?


Works for me. But you have to go to https://www.postfix.org, not just 
https://postfix.org.


--
Thomas
___
Postfix-users mailing list -- postfix-users@postfix.org
To unsubscribe send an email to postfix-users-le...@postfix.org

[pfx] Re: rejection policy

[Danjel Jungersen via Postfix-users]

On 01-11-2024 01:00, Adriel via Postfix-users wrote:

Hello,

I have policyd-spf and opendkim (as a milter) installed for postfix.

How can I customize the policy that, if an incoming message has SPF 
failed AND has invalid DKIM then this message will be rejected? AFAIK 
google has this kind of rejection policy for their gmail.


I know that in opendkim.conf and policyd-spf.conf I can setup the 
policy for rejection. But the two files are separated.


I use rspamd, if you already have that in use maybe it is just as easy.

The "DMARC_POLICY_REJECT" sybol is triggered if dmarc fails.
I have the score set to the reject value.
In most cases these mails have plenty of other points to make it score 
way above reject threshold, even if there are some negative scores also, 
and is therefore rejected.


Want to be extra certain? Just increase the score.

I suspect that this setup may increase the number of cpu cycles used, 
compared to a simple reject, but that is no issue for me, since I have a 
low volume.


:-)
Danjel





Thanks.
___
Postfix-users mailing list -- postfix-users@postfix.org
To unsubscribe send an email to postfix-users-le...@postfix.org

--
Med venlig hilsen/Kind regards
Danjel Jungersen
Mail: dan...@jungersen.dk
Mobile: +45 20 42 20 11

Jungersen Grafisk ApS,
Holsbjergvej 39, DK-2620 Albertslund,
Denmark.
Tel: +45 43 64 10 00

WEBSHOP: PRINTLIGHT.DK  | WWW.JUNGERSEN.DK 



Logo ___
Postfix-users mailing list -- postfix-users@postfix.org
To unsubscribe send an email to postfix-users-le...@postfix.org

[pfx] Re: {Disarmed} Error when I try send a e-mail using my postfix server using the "New Outlook"

[giuliano--- via Postfix-users]

Em 2024-10-31 16:36, Wietse Venema via Postfix-users escreveu:

Wietse Venema via Postfix-users:

giuliano--- via Postfix-users:
> Hi everyone,
> I hope this message finds you well.
>
> I'm having problems with the "new outlook" the default version in
> Windows 11.
>
> When I connect to my account in the "new outlook", the IMAP connection
> works fine, I can see all the e-mails, but when I try to send a new
> e-mail a receive a e-mail with error.
>
> We couldn't deliver your message.
>
> Original message details
> Created date: 10/31/2024 5:53:03 PM
> Sender address: giuli...@hospedaqui.com.br
> Recipient addresses: *@gmail.com
> Subject: teste
>
> Technical details
> SmtpSubmissionPermanent5XXException: Smtp submission failed. Server
> 'smtp.hospedaqui.com.br' Port '587'. --> Unexpected SMTP server
> response. Expected: 334, actual: 535, whole response: 535 5.7.8 Error:
> authentication failed: Invalid authentication mechanism

And Postfix logging:

> Oct 31 17:54:08 host01 postfix/submission/smtpd[467495]: warning:
> unknown[2603:1056:c03:1c16::5]: SASL LOGIN authentication failed:
> Invalid authentication mechanism

As answered in off-list email, this is an error message from the
Postfix Dovecot SASL client.

You need to turn on one extra level of logging to see which AUTH
mechanism names Dovecot and Postfix expect, and which AUTH mechanism
name the remote SMTP client sends.

main.cf:
debug_peer_list = 143.198.0.0/16
debug_peer_level = 1

IMPORTANT: If you include this logging in follow-up email, be sure
to censor the base64 text in the AUTH command because that may
contain a password.


My example was based on the logging your earlier message. You'
need to add something like 2603:1056:c03:1c16:/64":

 main.cf:
 debug_peer_list = 143.198.0.0/16, 2603:1056:c03:1c16::/64
 debug_peer_level = 1

Alternatively you could temporarily increase the logging level for
all submission clients in master.cf with:

 master.cf:
 submission . smtpd
# Execute "postfix reload" after changing master.cf.
-o debug_peer_list=static:all
-o debug_peer_level=1
...other -o overrides...

But that would log everyone's password.

Wietse
___
Postfix-users mailing list -- postfix-users@postfix.org
To unsubscribe send an email to postfix-users-le...@postfix.org


Sorry for that, I try to active the debbug, but I type the IPV6 and 
forget the []. Now I did the same correctly,


I guess these the most important part of the LOG:

Oct 31 19:23:44 host01 postfix/submission/smtpd[497262]: < 
unknown[2603:1056:c03:1c16::5]: AUTH LOGIN 
Z2l1bGlhbm9AaG9zcGVkYXF1aS5jb20uYnI=
Oct 31 19:23:44 host01 postfix/submission/smtpd[497262]: query milter 
states for other event
Oct 31 19:23:44 host01 postfix/submission/smtpd[497262]: 
milter8_other_event: milter inet:127.0.0.1:8891
Oct 31 19:23:44 host01 postfix/submission/smtpd[497262]: 
xsasl_dovecot_server_first: sasl_method LOGIN, init_response 
Z2l1bGlhbm9AaG9zcGVkYXF1aS5jb20uYnI=
Oct 31 19:23:44 host01 postfix/submission/smtpd[497262]: warning: 
unknown[2603:1056:c03:1c16::5]: SASL LOGIN authentication failed: 
Invalid authentication mechanism
Oct 31 19:23:44 host01 postfix/submission/smtpd[497262]: > 
unknown[2603:1056:c03:1c16::5]: 535 5.7.8 Error: authentication failed: 
Invalid authentication mechanism



Complete log:

Oct 31 19:23:44 host01 postfix/submission/smtpd[497262]: connect from 
unknown[2603:1056:c03:1c16::5]
Oct 31 19:23:44 host01 postfix/submission/smtpd[497262]: 
smtp_stream_setup: maxtime=300 enable_deadline=0
Oct 31 19:23:44 host01 postfix/submission/smtpd[497262]: match_hostname: 
smtpd_client_event_limit_exceptions: unknown ~? 127.0.0.0/8
Oct 31 19:23:44 host01 postfix/submission/smtpd[497262]: match_hostaddr: 
smtpd_client_event_limit_exceptions: 2603:1056:c03:1c16::5 ~? 
127.0.0.0/8
Oct 31 19:23:44 host01 postfix/submission/smtpd[497262]: 
match_list_match: unknown: no match
Oct 31 19:23:44 host01 postfix/submission/smtpd[497262]: 
match_list_match: 2603:1056:c03:1c16::5: no match
Oct 31 19:23:44 host01 postfix/submission/smtpd[497262]: send attr 
request = connect
Oct 31 19:23:44 host01 postfix/submission/smtpd[497262]: send attr ident 
= submission:2603:1056:c03:1c16::5
Oct 31 19:23:44 host01 postfix/submission/smtpd[497262]: private/anvil: 
wanted attribute: status
Oct 31 19:23:44 host01 postfix/submission/smtpd[497262]: input attribute 
name: status
Oct 31 19:23:44 host01 postfix/submission/smtpd[497262]: input attribute 
value: 0
Oct 31 19:23:44 host01 postfix/submission/smtpd[497262]: private/anvil: 
wanted attribute: count
Oct 31 19:23:44 host01 postfix/submission/smtpd[497262]: input attribute 
name: count
Oct 31 19:23:44 host01 postfix/submission/smtpd[497262]: input attribute 
value: 1
Oct 31 19:23:44 host01 postfix/submission/smtpd[497262]: private/anvil: 
wanted attribute: rate
Oct 31 19:23:44 host01 postfix/submission/smtpd[497262]: input attribute