[pfx] Re: preserving multi line header_checks REPLACE

2024-03-08 Thread Wietse Venema via Postfix-users
Viktor Dukhovni via Postfix-users: > On Fri, Mar 08, 2024 at 03:45:42PM -0500, Wietse Venema via Postfix-users > wrote: > > > The postmap command reads input from stdin one line at a time, and > > applies each input line to all the header_checks patterns. It can't > > be used for multiline input

[pfx] Re: mta-sts and smtp_tls_security_level

2024-03-08 Thread Viktor Dukhovni via Postfix-users
On Fri, Mar 08, 2024 at 11:11:40PM +0100, Joachim Lindenberg via Postfix-users wrote: > But is there any reason that prevents google to use DNSSEC other than > the arrogance of power? My read is that there is not sufficient market pressure to make it a priority. Robust implementation at scale i

[pfx] Re: mta-sts and smtp_tls_security_level

2024-03-08 Thread Joachim Lindenberg via Postfix-users
But is there any reason that prevents google to use DNSSEC other than the arrogance of power? Imho it is obvious that mta-sts is only useful for big players that prefer to ignore destinations not in their cache. For the rest of us, mta-sts is inferior to smtp-dane. Joachim -Ursprüngliche Na

[pfx] Re: mta-sts and smtp_tls_security_level

2024-03-08 Thread Viktor Dukhovni via Postfix-users
On Fri, Mar 08, 2024 at 10:01:29PM +0100, Joachim Lindenberg via Postfix-users wrote: > Imho you get pretty close to mta-sts if you use verify together with a > DNSSEC-validating resolver. You just validate the "authorized" MTAs by > different means. Yes, but google.com and yahoo.com (the domain

[pfx] Re: mta-sts and smtp_tls_security_level

2024-03-08 Thread Joachim Lindenberg via Postfix-users
Imho you get pretty close to mta-sts if you use verify together with a DNSSEC-validating resolver. You just validate the "authorized" MTAs by different means. I still think SMTP-DANE (RFC 7672) is preferrable. Regards, Joachim -Ursprüngliche Nachricht- Von: Michael W. Lucas via Postfix-u

[pfx] Re: preserving multi line header_checks REPLACE

2024-03-08 Thread Viktor Dukhovni via Postfix-users
On Fri, Mar 08, 2024 at 03:45:42PM -0500, Wietse Venema via Postfix-users wrote: > The postmap command reads input from stdin one line at a time, and > applies each input line to all the header_checks patterns. It can't > be used for multiline inputs. Time has passed, and you've forgotten that y

[pfx] Re: preserving multi line header_checks REPLACE

2024-03-08 Thread Wietse Venema via Postfix-users
Mailinglists35 via Postfix-users: > > Hi > > I run a postfix 3.5.9 smtp relay for a webserver that sends user signup and > forgot password emails. That's the only use case and the server does not > receive any other emails and neither generates any locally. > > I'm trying to prevent le

[pfx] Re: mta-sts and smtp_tls_security_level

2024-03-08 Thread Michael W. Lucas via Postfix-users
On Fri, Mar 08, 2024 at 03:05:43PM -0500, Viktor Dukhovni via Postfix-users wrote: > On Fri, Mar 08, 2024 at 01:28:00PM -0500, Michael W. Lucas via Postfix-users > wrote: > > > Realistically, Gmail and Yahoo do not care about my MTA-STS > > reports. All they care about is that I validate their X

[pfx] Re: preserving multi line header_checks REPLACE

2024-03-08 Thread Viktor Dukhovni via Postfix-users
On Fri, Mar 08, 2024 at 09:23:19PM +0200, Mailinglists35 via Postfix-users wrote: > The postmap input looks like this: > > echo -e"Received: from [127.0.0.1] (web1dev [10.11.12.13])\n\tby > email.domain.tld (Postfix) with ESMTPS id C9056 >7E002\n\tfor ; Fri,8 Mar 2024 19:20:29 +02

[pfx] Re: mta-sts and smtp_tls_security_level

2024-03-08 Thread Viktor Dukhovni via Postfix-users
On Fri, Mar 08, 2024 at 01:28:00PM -0500, Michael W. Lucas via Postfix-users wrote: > Realistically, Gmail and Yahoo do not care about my MTA-STS > reports. All they care about is that I validate their X.509 certs. > > Is there any reason to use something like mta-sts-daemon in that > transport

[pfx] Re: preserving multi line header_checks REPLACE

2024-03-08 Thread Mailinglists35 via Postfix-users
Solved. I had from previous tries set `regexp` instead of pcre in main.cf header checks After changing to `pcre` it does what I intended to do. > > On Mar 8, 2024 at 9:23, mailto:mailinglist...@gmail.com)> > wrote: > > > > Hi > > I run a postfix 3.5.9 smtp re

[pfx] preserving multi line header_checks REPLACE

2024-03-08 Thread Mailinglists35 via Postfix-users
Hi I run a postfix 3.5.9 smtp relay for a webserver that sends user signup and forgot password emails. That's the only use case and the server does not receive any other emails and neither generates any locally. I'm trying to prevent leaking internal information (hostname & IP) in R

[pfx] mta-sts and smtp_tls_security_level

2024-03-08 Thread Michael W. Lucas via Postfix-users
Hi, Pondering MTA-STS validation. My understanding is the recommendation is to use DANE as the default (smtp_tls_security_level=dane), but if you want MTA-STS for select domains you can point them at a transport that requires X.509 validation. Realistically, Gmail and Yahoo do not care about my

[pfx] Re: Dumb question about logging

2024-03-08 Thread Wietse Venema via Postfix-users
Stephen Satchell via Postfix-users: > Assuming that one's configuration has open relay, what does a log entry > for relayed mail look like? > > I don't think I've any open relay, but I want to look and make sure. > > I've searched for half an hour, and no answer came up. But, I did find > some

[pfx] Re: Dumb question about logging

2024-03-08 Thread Benny Pedersen via Postfix-users
Stephen Satchell via Postfix-users skrev den 2024-03-08 06:52: grep relay= mail.log | grep -v relay=local I can then use the message ID to get all the log information for each questioned transaction. Am I on the right road? Please disabuse me of any incorrect notions. is it not grep -i r

[pfx] Re: Dumb question about logging

2024-03-08 Thread Matus UHLAR - fantomas via Postfix-users
On 07.03.24 21:52, Stephen Satchell via Postfix-users wrote: Assuming that one's configuration has open relay, what does a log entry for relayed mail look like? It looks like any other mail, just it was received without authentication, from unstrusted clients and sent to remote (not in relay_d

[pfx] Re: Active queue congestion

2024-03-08 Thread Matus UHLAR - fantomas via Postfix-users
You can also configure a non-zero smtpd_client_message_rate_limit On 07.03.24 17:21, Colin McKinnon via Postfix-users wrote: H, not so sure about that. The docs do advise against this for legitimate traffic - and I've yet to see anything in the documentation that describes what happens when