Re: submission by cert verification only

2013-10-09 Thread Dan Langille
On Oct 9, 2013, at 9:26 PM, Viktor Dukhovni wrote: > On Wed, Oct 09, 2013 at 09:21:36PM -0400, Dan Langille wrote: > >>> Don't forget: >>> >>> main.cf: >>> smtpd_tls_fingerprint_digest = sha1 >> >> >> Does that have to be in main.cf? I added it to master.cf. > > Generally, keeping sett

Re: submission by cert verification only

2013-10-09 Thread Viktor Dukhovni
On Wed, Oct 09, 2013 at 09:21:36PM -0400, Dan Langille wrote: > > Don't forget: > > > >main.cf: > > smtpd_tls_fingerprint_digest = sha1 > > > Does that have to be in main.cf? I added it to master.cf. Generally, keeping settings in main.cf is better. Use master.cf only when settings n

Re: submission by cert verification only

2013-10-09 Thread Dan Langille
On Oct 7, 2013, at 11:01 AM, Viktor Dukhovni wrote: > On Mon, Oct 07, 2013 at 09:06:09AM -0400, Dan Langille wrote: > >>> # cat /usr/local/etc/postfix-config/main/relay_clientcerts >>> 3A:2E:AB:6A:F1:D4:32:74:C9:C6:DD:2B:8D:2A:87:97 cliff.example.org >>> >>> This looks like md5, and while still

Re: Postfix DNS resolver blindly relying on cached Additional section?

2013-10-09 Thread Viktor Dukhovni
On Thu, Oct 10, 2013 at 02:39:41AM +0200, Dominik George wrote: > > The correct description is: > > > > When both IPv4 and IPv6 support are enabled, the Postfix SMTP > > client, for Postfix versions prior to 2.8, will attempt to > > connect via IPv6 before attempting to use IPv4. Sta

Re: Postfix DNS resolver blindly relying on cached Additional section?

2013-10-09 Thread Dominik George
> The correct description is: > > When both IPv4 and IPv6 support are enabled, the Postfix SMTP > client, for Postfix versions prior to 2.8, will attempt to > connect via IPv6 before attempting to use IPv4. Starting > with 2.8 protocol preference is controlled via the new > sm

Re: Postfix DNS resolver blindly relying on cached Additional section?

2013-10-09 Thread Wietse Venema
Viktor Dukhovni: > On Thu, Oct 10, 2013 at 01:58:45AM +0200, Dominik George wrote: > > > > Confirmed, Postfix looks at the answer section only. Claims to > > > the contrary are based on false speculation. > > > > Hmm, that leads us to the original question: > > > > Why does postfix sometimes not

Re: Google rejecting IPv6 mails

2013-10-09 Thread Wietse Venema
Patrick Lists: > On 10/10/2013 01:37 AM, Wietse Venema wrote: > > James Cloos: > >> Unfortunately it is not uncommon with v6. > >> > >> I've had to whitelist a number of sites over the last year where the > >> outoing mta added a v6 address w/o a ptr. > >> > >> Mostly it appeared to be due to new v

Re: Postfix DNS resolver blindly relying on cached Additional section?

2013-10-09 Thread Viktor Dukhovni
On Thu, Oct 10, 2013 at 01:58:45AM +0200, Dominik George wrote: > > Confirmed, Postfix looks at the answer section only. Claims to > > the contrary are based on false speculation. > > Hmm, that leads us to the original question: > > Why does postfix sometimes not find the record for any giv

Re: Postfix DNS resolver blindly relying on cached Additional section?

2013-10-09 Thread Wietse Venema
Dominik George: > > Confirmed, Postfix looks at the answer section only. Claims to > > the contrary are based on false speculation. > > Hmm, that leads us to the original question: > > Why does postfix sometimes not find the record for any given MX? Don't shoot the messenger of bad news. As

Re: postfix configuration

2013-10-09 Thread Noel Jones
On 10/9/2013 3:03 PM, Stefano Gatto wrote: > Hi all > I'm trying to configure postfix 2.7.1 to protect internal mailing list with > the restriction classes as per > http://www.postfix.org/RESTRICTION_CLASS_README.html#internal > Example > /etc/postfix/main.cf: > smtpd_recipient_restrictions =

Re: Google rejecting IPv6 mails

2013-10-09 Thread Patrick Lists
On 10/10/2013 01:37 AM, Wietse Venema wrote: James Cloos: Unfortunately it is not uncommon with v6. I've had to whitelist a number of sites over the last year where the outoing mta added a v6 address w/o a ptr. Mostly it appeared to be due to new v6 routes and autoconfig surprising the mta adm

Re: Postfix DNS resolver blindly relying on cached Additional section?

2013-10-09 Thread Dominik George
> Confirmed, Postfix looks at the answer section only. Claims to > the contrary are based on false speculation. Hmm, that leads us to the original question: Why does postfix sometimes not find the record for any given MX? -nik -- # apt-assassinate --help Usage: apt-assassinate [upstream|m

Re: Postfix DNS resolver blindly relying on cached Additional section?

2013-10-09 Thread Wietse Venema
Viktor Dukhovni: > On Thu, Oct 10, 2013 at 12:47:34AM +0200, Dominik George wrote: > > > Most tools, mainly libc's resolver, seem to ignore the Additional > > section and resolve relevant names on their owns, explicitly asking for > > the RR types they are itnerested in, and that's what seems to b

Re: Google rejecting IPv6 mails

2013-10-09 Thread Wietse Venema
James Cloos: > Unfortunately it is not uncommon with v6. > > I've had to whitelist a number of sites over the last year where the > outoing mta added a v6 address w/o a ptr. > > Mostly it appeared to be due to new v6 routes and autoconfig surprising > the mta admins. I wonder how this could happ

Re: Postfix DNS resolver blindly relying on cached Additional section?

2013-10-09 Thread Viktor Dukhovni
On Thu, Oct 10, 2013 at 12:47:34AM +0200, Dominik George wrote: > Most tools, mainly libc's resolver, seem to ignore the Additional > section and resolve relevant names on their owns, explicitly asking for > the RR types they are itnerested in, and that's what seems to be > appropriate. Postfix, h

Re: Google rejecting IPv6 mails

2013-10-09 Thread James Cloos
> "ln" == lists@rhsoft net writes: ln> wrong way - don't whitelist them and they will fix it Nonsense. Remaining subscribed to the lists in question is /vastly/ more important. Protesting hurts me or my users, not the list admins. The job of an MX admin is to get the legitimate mail throu

Postfix DNS resolver blindly relying on cached Additional section?

2013-10-09 Thread Dominik George
Hi, while debugging the Google/IPv6 issue, we discovered something strange. Our uplink provider operates caching DNS servers, and they reply with a rather detailed Additional section when asked for MX records, but only with cached results. For example, if example.com has an MX record pointing to

Re: Google rejecting IPv6 mails

2013-10-09 Thread li...@rhsoft.net
Am 09.10.2013 23:54, schrieb James Cloos: >> "ln" == lists@rhsoft net writes: > > ln> show me one legitimate mail server in 2013 without a PTR > > Unfortunately it is not uncommon with v6. because people change configurations in hurry to have ipv6 > I've had to whitelist a number of sites

Re: Google rejecting IPv6 mails

2013-10-09 Thread James Cloos
> "ln" == lists@rhsoft net writes: ln> show me one legitimate mail server in 2013 without a PTR Unfortunately it is not uncommon with v6. I've had to whitelist a number of sites over the last year where the outoing mta added a v6 address w/o a ptr. Mostly it appeared to be due to new v6 ro

Re: postfix configuration

2013-10-09 Thread Jeroen Geilman
On 10/09/2013 10:03 PM, Stefano Gatto wrote: Hi all I'm trying to configure postfix 2.7.1 to protect internal mailing list with the restriction classes as per http://www.postfix.org/RESTRICTION_CLASS_README.html#internal Example /etc/postfix/main.cf: smtpd_recipient_restrictions = .

postfix configuration

2013-10-09 Thread Stefano Gatto
Hi all I'm trying to configure postfix 2.7.1 to protect internal mailing list with the restriction classes as per http://www.postfix.org/RESTRICTION_CLASS_README.html#internal Example /etc/postfix/main.cf: smtpd_recipient_restrictions = ... check_recipient_access hash:/etc/post

Re: Is it possible to manually copy files in incoming directory?

2013-10-09 Thread Bernardo Pons
It worked! Thank you Wietse & Viktor for your help. Great piece of software Postfix! 2013/10/9 Wietse Venema > Bernardo Pons: > > Well, rather than moved, all files into the incoming directory were > copied > > to a different folder in the same filesystem. > > So the files, and thus the inodes,

Re: Is it possible to manually copy files in incoming directory?

2013-10-09 Thread Wietse Venema
Bernardo Pons: > Well, rather than moved, all files into the incoming directory were copied > to a different folder in the same filesystem. > So the files, and thus the inodes, are different from the originals. The > filenames are preserved. > The ownership was set back to the original (user and gr

Re: Is it possible to manually copy files in incoming directory?

2013-10-09 Thread Bernardo Pons
Well, rather than moved, all files into the incoming directory were copied to a different folder in the same filesystem. So the files, and thus the inodes, are different from the originals. The filenames are preserved. The ownership was set back to the original (user and group running Postfix) Perm

Re: Is it possible to manually copy files in incoming directory?

2013-10-09 Thread Wietse Venema
Viktor Dukhovni: > On Wed, Oct 09, 2013 at 06:09:31PM +0200, Bernardo Pons wrote: > > > If, for some reason, the files containing messages present in the incoming > > directory had to be moved to a temp directory, is it possible to copy them > > back to the incoming directory in order to be re-que

Re: Is it possible to manually copy files in incoming directory?

2013-10-09 Thread Viktor Dukhovni
On Wed, Oct 09, 2013 at 06:09:31PM +0200, Bernardo Pons wrote: > If, for some reason, the files containing messages present in the incoming > directory had to be moved to a temp directory, is it possible to copy them > back to the incoming directory in order to be re-queued by Postfix? The detail

Is it possible to manually copy files in incoming directory?

2013-10-09 Thread Bernardo Pons
If, for some reason, the files containing messages present in the incoming directory had to be moved to a temp directory, is it possible to copy them back to the incoming directory in order to be re-queued by Postfix? -- Bernardo Pons