[pfx] Converting a queue file into other formats

2025-07-22 Thread Dan Mahoney via Postfix-users
question is: what’s the best way to take the queue file and convert it back to something which most closely resembles what came in over the wire? The read generated by postcat has some weird wrapping and formatting. -Dan ___ Postfix-users mailing list

[pfx] Re: Questions on a couple of log entries

2025-05-20 Thread Dan Mahoney via Postfix-users
ficate, is it because we’re misconfigured on our end? I’m sure we’re not asking for client certs, and as far as I know there’s no way to present one if we’re not asking. I wasn’t aware there was a signaling method to say “I don’t like it, go away”. Thanks as always for what you folks do. -Dan

[pfx] Questions on a couple of log entries

2025-05-20 Thread Dan Mahoney via Postfix-users
pto/openssl/ssl/record/rec_layer_s3.c:1605:SSL alert number 42 They're probably harmless, but I am sort of interested in what would make these happen? -Dan ___ Postfix-users mailing list -- postfix-users@postfix.org To unsubscribe send an email

[pfx] Re: Incoming OpenDKIM signature verification failing

2025-05-10 Thread Dan Mahoney via Postfix-users
there. especially for a mailing list generator that presumably generates lots of the same thing. -Dan Sent from my iPhone > On May 10, 2025, at 09:41, Matus UHLAR - fantomas via Postfix-users > wrote: > >  >> >> Dnia 9.05.2025 o godz. 16:18:35 Matus UHLAR - fa

[pfx] Re: Incoming OpenDKIM signature verification failing

2025-05-09 Thread Dan Mahoney via Postfix-users
If any of those mailing lists are open, regular lists that I could be subscribed to, for testing, I’d be happy to try to do so to validate this for you. -Dan > On May 9, 2025, at 21:07, Nick Tait via Postfix-users > wrote: > > On 10/05/2025 15:29, Nick Tait via Postfix-users w

[pfx] Re: SSL cert authority, letsencrypt error

2025-05-08 Thread Dan Mahoney via Postfix-users
your cert chain, it will do the right thing as long as the certs are in the correct order. -Dan > On May 8, 2025, at 15:34, Carl Brewer via Postfix-users > wrote: > > > Hi, > > I've been running postscript on a FreeBSD 13.x server with Letsencrypt > runnin

[pfx] Re: Incoming OpenDKIM signature verification failing

2025-05-08 Thread Dan Mahoney via Postfix-users
for a sigfail. -Dan > On May 8, 2025, at 13:06, Ken Biggs via Postfix-users > wrote: > > OpenDKIM is failing signature verification on most incoming emails. Out of > 1,146 incoming emails, 173 have been successfully verified and 973 have "bad > signature data".

[pfx] Re: Viktor, can you share your dane-checking script?

2025-02-11 Thread Dan Mahoney via Postfix-users
> On Feb 10, 2025, at 01:59, Viktor Dukhovni via Postfix-users > wrote: > > On Mon, Feb 10, 2025 at 12:22:44AM -0800, Dan Mahoney via Postfix-users wrote: > >> I’d like to turn this into a check in our internal monitoring, since we >> do occasionally roll the cert

[pfx] Viktor, can you share your dane-checking script?

2025-02-10 Thread Dan Mahoney via Postfix-users
rules). Viktor, do you have that code up somewhere? (Obviously, I’d make it single-target) -Dan ___ Postfix-users mailing list -- postfix-users@postfix.org To unsubscribe send an email to postfix-users-le...@postfix.org

[pfx] postfix reload writing to stderr

2025-02-03 Thread Dan Mahoney via Postfix-users
/dev/null, but this means I might miss “real” errors. -Dan ___ Postfix-users mailing list -- postfix-users@postfix.org To unsubscribe send an email to postfix-users-le...@postfix.org

[pfx] Re: Restrict Sender Domain for Relay

2024-09-16 Thread Dan Lists via Postfix-users
On Fri, Sep 13, 2024 at 10:22 PM Viktor Dukhovni via Postfix-users < postfix-users@postfix.org> wrote: > On Fri, Sep 13, 2024 at 10:29:21AM -0500, Dan Lists via Postfix-users > wrote: > > > I have a small email relay server that is used to allow IOT devices to > send &

[pfx] Re: Restrict Sender Domain for Relay

2024-09-13 Thread Dan Lists via Postfix-users
On Fri, Sep 13, 2024 at 10:50 AM Wietse Venema via Postfix-users < postfix-users@postfix.org> wrote: > Dan Lists via Postfix-users: > > I have a small email relay server that is used to allow IOT devices to > send > > email. Some of those devices do not do authe

[pfx] Restrict Sender Domain for Relay

2024-09-13 Thread Dan Lists via Postfix-users
I have a small email relay server that is used to allow IOT devices to send email. Some of those devices do not do authentication. I'd like to restrict the sender domain based on the IP. I'm looking for something like smtpd_sender_login_maps, but for client IPs. Example of a smtpd_sender_login

[pfx] Encoding other information into VERP

2024-07-14 Thread Dan Mahoney (Gushi) via Postfix-users
ove to see it. (Ignoring the fact that sometimes stupid filters like office365 just silently discard or accept and route to spam instead of properly bouncing -- we can't really solve that). -Dan -- ___ Postfix-users mailing list -- postfix-users@postfi

[pfx] Re: myorigin usage for ONLY unqualified addresses

2024-06-15 Thread Dan Mahoney via Postfix-users
> On Jun 15, 2024, at 15:03, Wietse Venema via Postfix-users > wrote: > > One addendum about how to distinguish from root@mydomain > from different hosts. > > Dan Mahoney via Postfix-users: >>> Use a virtual alias mapping from "r...@dayjob.org" to the

[pfx] Re: myorigin usage for ONLY unqualified addresses

2024-06-15 Thread Dan Mahoney via Postfix-users
> On Jun 15, 2024, at 06:19, Wietse Venema via Postfix-users > wrote: > > Dan Mahoney via Postfix-users: >> Hello, >> >> We currently have myorigin = $mydomain, and mydomain = dayjob.org >> on one of our border MXes, which is also the outbound MX for

[pfx] myorigin usage for ONLY unqualified addresses

2024-06-14 Thread Dan Mahoney via Postfix-users
myorigin, without causing potential surprises elsewhere? -Dan ___ Postfix-users mailing list -- postfix-users@postfix.org To unsubscribe send an email to postfix-users-le...@postfix.org

[pfx] Re: Is there a way to just quickly deliver "everything" to a file somewhere

2024-04-13 Thread Dan Mahoney via Postfix-users
> On Apr 11, 2024, at 08:35, Viktor Dukhovni via Postfix-users > wrote: > > On Wed, Apr 10, 2024 at 11:39:24PM -0400, Dan Mahoney via Postfix-users wrote: > >>> On Apr 2, 2024, at 10:52, Viktor Dukhovni via Postfix-users >>> mailto:postfix-users@postfix.org

[pfx] Re: Is there a way to just quickly deliver "everything" to a file somewhere

2024-04-10 Thread Dan Mahoney via Postfix-users
> On Apr 2, 2024, at 10:52, Viktor Dukhovni via Postfix-users > wrote: > > On Tue, Apr 02, 2024 at 04:14:29AM -0400, Dan Mahoney via Postfix-users wrote: >> Hey there all, >> >> I’m setting up a staging version of dayjob’s ticket system, and we’d >> basi

[pfx] Is there a way to just quickly deliver "everything" to a file somewhere

2024-04-02 Thread Dan Mahoney via Postfix-users
port 25 connection. I’d like nothing to leave the box. Is there some kind of transport hack I can use for this? -Dan ___ Postfix-users mailing list -- postfix-users@postfix.org To unsubscribe send an email to postfix-users-le...@postfix.org

[pfx] Re: pushing changes to remote system

2024-03-06 Thread Dan Mahoney via Postfix-users
hey are root equivalent. That is not the improvement that you > appear to be looking for. > > Maybe you can use a pull model instead, like curl and a REST server. This is a solved problem, using tools like ansible, chef, or puppet. Puppet specifically can be configured to do periodi

[pfx] Is there a way to reject an internal domain on our border MXes

2024-02-03 Thread Dan Mahoney via Postfix-users
l destined to an internal domain (like zimbra.example.org) such that only our internal machines can deliver to it, but that any host on the outside gets an immediate reject notice from our border MXes? -Dan ___ Postfix-users mailing list -- pos

[pfx] Re: Accepting mail from old Dell iDRAC

2023-08-05 Thread Dan Mahoney via Postfix-users
which ones it supports, implicitly. Ergo, the only way to really test this, seems to me to experimentally try STARTTLS against a much older machine (or one with older ciphers), that would have been current at the time the iDrac 7 was new, and see which the highest supported is — even if you

[pfx] Re: Maildir changes in 3.7.4?

2023-07-06 Thread Dan Mahoney via Postfix-users
> On Jul 6, 2023, at 6:40 AM, Jaroslaw Rafa via Postfix-users > wrote: > > Dnia 6.07.2023 o godz. 05:43:22 Dan Mahoney via Postfix-users pisze: >> In /etc/aliases: >> >> noc:"|/usr/local/sbin/rtmailgate ops noc cor", >

[pfx] Maildir changes in 3.7.4?

2023-07-06 Thread Dan Mahoney via Postfix-users
s there a way to tell it to do this when delivering to a given maildir? -Dan ___ Postfix-users mailing list -- postfix-users@postfix.org To unsubscribe send an email to postfix-users-le...@postfix.org

[pfx] Different set of milters for one domain?

2023-03-28 Thread Dan Mahoney (Gushi) via Postfix-users
thout completely splitting the config up? -Dan -- --------Dan Mahoney Techie, Sysadmin, WebGeek Gushi on efnet/undernet IRC FB: fb.com/DanielMahoneyIV LI: linkedin.com/in/gushi Site: http://www.gushi.org --- ___ Po

[pfx] Helping OpenDKIM and OpenDMARC

2023-03-10 Thread Dan Mahoney via Postfix-users
Hey there all, I am one of the people who has maintainer access to OpenDKIM and OpenDMARC. I use both regularly, but I’m also a novice as a C-coder. (Sysadmin, not developer). As mentioned in another thread, I don’t have access to the web hosting stuff or the list management stuff, though I’

[pfx] Re: Postfix lists are migrating to a new list server

2023-03-10 Thread Dan Mahoney via Postfix-users
d I’m not going to respond much here. We could use help on a bunch of things, and I’m going to try and put together a list. I have administrative access to many things, but critically, NOT the box hosting the DNS or the mailing lists. I want to fix things. It’s not my day job, and I need he

[P-U] The joke writes itself.

2023-03-09 Thread Dan Mahoney via Postfix-users
I know that P-U stands for postfix users. I get it that a short subject tag was desired, but would [postfix] have been that much more distracting, without adding the obvious third-grader label that might better be held by qmail? -Dan ___ Postfix

[P-U] Re: Postfix lists are migrating to a new list server

2023-03-08 Thread Dan Mahoney via Postfix-users
If there’ a pull request to get it into the current “develop” branch of opendmarc, I have the privs to merge it. -Dan > On Mar 8, 2023, at 11:14 AM, Peter Ajamian via Postfix-users > wrote: > > On 9/03/23 08:11, Peter wrote: >> On 8/03/23 15:46, Scott Kitterman via P

Re: Simple forwarder for postfix?

2023-01-11 Thread Dan Mahoney
> On Jan 10, 2023, at 18:28, Viktor Dukhovni wrote: > > On Tue, Jan 10, 2023 at 05:10:41PM -0800, Dan Mahoney wrote: >> My actual question of "is there a mailing list engine that *just* >> handles a tiny subset of what a full-blown mailman does (no cgi, no >> m

Re: Simple forwarder for postfix?

2023-01-10 Thread Dan Mahoney
ctual question of "is there a mailing list engine that *just* handles a tiny subset of what a full-blown mailman does (no cgi, no membership management, some basic body tagging perhaps)" remains unanswered and I can't believe that such an animal doesn't exist. This is exactly the featureset we'd get with some kind of ESP, except in-house. -Dan

Re: Simple forwarder for postfix?

2023-01-10 Thread Dan Mahoney
envelope-sender address . Do the docs need to be updated to cover this as well? -Dan === Here’s that bounce message: Delivery has failed to these recipients or groups: support-conta...@support.isc.org <mailto:support-conta...@support.isc.org> Your message couldn't be delivered to th

Simple forwarder for postfix?

2023-01-10 Thread Dan Mahoney
All, Does anyone know of a simple remailer tool that can be used inside an aliases (via a pipe) file that will: * ‘explode’ messages out to a group statically defined in a textfile. * not expose my original envelope sender and recipients? Office365 is rejecting when they see our internal alias

Re: Authenticated Receive Chain (ARC Sealing) in Postfix?

2023-01-02 Thread Dan Mahoney
2022-October/106746.html I will note that we run our messages though openARC at both the point where mail enters our network (at our border MXes) as well as on our mailman machines, which applies a seal both as a message enters, and exits. This is the way the received chain is supposed to work. Hope it helps, or at least demystifies? -Dan

Re: Spammer succeeded in relaying through my server

2022-12-27 Thread Dan Mahoney
ak things on other platforms. And there's a bunch of stuff that, honestly, just needs to be ripped the hell out (like the GnuTLS support). If people want to get together on some chat platform and bang things out, I'd love to work with anyone who can. -Dan > On Dec 27, 2022, at

Re: DKIM not signing in plesk server with postfix

2022-12-25 Thread Dan Mahoney
Can you post the relevant bits of the postfix and opendkim configs (omit the actual key data, of course). Anything in the logfiles? -Dan > On Dec 25, 2022, at 15:18, Water Around wrote: > > > > Hi, thanks for the response... > I have exhausted my attempts with plesk docs,

Re: remailer for alias lists?

2022-12-04 Thread Dan Mahoney
> On Dec 4, 2022, at 11:30, Wietse Venema wrote: > > Dan Mahoney: >> Hey all, >> >> We have a mailing list (of like ten, not-often-changing people) >> that we'd like to not have to spin up a full mailing list program >> like mailman or whatnot. &g

remailer for alias lists?

2022-12-04 Thread Dan Mahoney
...@google.com <mailto:j...@google.com> I feel like the right answer here is something like “procmail” — is there some kind of alias map that can be used to handle this? Is there a standard postfix way to rewrite headers like this? -Dan

How to forward to aliases with correct envelope-sender

2022-11-23 Thread Dan Mahoney
ere a good answer for that as well? -Dan

How to forward to aliases with correct envelope sender

2022-11-18 Thread Dan Mahoney (Gushi)
buted script that can handle that expansion better than an alias :include:? Controlling who may *send* to such an alias/script is also a consideration. Is there a good answer for that as well? -Dan -- --------Dan Mahoney Techie, Sysadmin, WebGeek Gushi on efnet/undernet IRC FB: f

Re: placing recipient_canonical_maps before/after milters

2022-10-09 Thread Dan Mahoney
> On Oct 8, 2022, at 18:57, Wietse Venema wrote: > > Wietse Venema: >> Dan Mahoney: >>> >>> >>>> On Oct 8, 2022, at 12:59, Wietse Venema wrote: >>>> >>>> Dan Mahoney: >>>>> Hey there all, >>&

Re: placing recipient_canonical_maps before/after milters

2022-10-08 Thread Dan Mahoney
> On Oct 8, 2022, at 12:59, Wietse Venema wrote: > > Dan Mahoney: >> Hey there all, >> >> We have a couple of recipient canonical maps that do things like >> transform firstname_lastname into username (i.e. dan_mahoney --> >> dmahoney), also handle

Re: placing recipient_canonical_maps before/after milters

2022-10-07 Thread Dan Mahoney
> On Oct 7, 2022, at 15:08, Wietse Venema wrote: > > Dan Mahoney: >> Hey there all, >> >> We have a couple of recipient canonical maps that do things like >> transform firstname_lastname into username (i.e. dan_mahoney --> >> dmahoney), also handle

Re: placing recipient_canonical_maps before/after milters

2022-10-07 Thread Dan Mahoney
> On Oct 7, 2022, at 15:08, Wietse Venema wrote: > > CONTENT_FILTER_README I assume by that you mean https://www.postfix.org/FILTER_README.html CONTENT_FILTER_README yields a 404. -Dan

placing recipient_canonical_maps before/after milters

2022-10-07 Thread Dan Mahoney
ine will not match. Is there a way to tell specific milters where in this chain to fire? -Dan

Reject when delivering to a pipe?

2022-10-02 Thread Dan Mahoney
Hello all, If I am piping my mail to a program (in this case, day job's RT install), is there some way in which I can exit that will cause a message to be bounced back to the sender? Or do I need a full-on milter to do this kind of rejection? -Dan

Re: Client Certificate recommended/not-recommended RFCs?

2022-09-29 Thread Dan Mahoney
> On Sep 29, 2022, at 14:37, Viktor Dukhovni wrote: > > On Thu, Sep 29, 2022 at 01:33:58PM -0700, Dan Mahoney wrote: > >> I've always figured "if you configure your sendmail with both a client >> cert and a server cert, you might as well use it, af

Client Certificate recommended/not-recommended RFCs?

2022-09-29 Thread Dan Mahoney
is recommended or not recommended behavior. I know the authors also move in the OpenSSL community, and probably in the standards community as well. Are you aware of anything (internet drafts, BCP documents, etc). (Is this better asked on mailop, perhaps?) -Dan

Tool to correlate mail logs?

2022-08-14 Thread Dan Mahoney
m thinking of? Best, -Dan

Re: TLS issue with purchase order emails from ariba.com system.

2022-06-14 Thread Dan Mahoney
l) Postfix has sane defaults as long as you run a fairly recent version, and the developers have clue. Not all apps have sane defaults (for example, I could see the need to configure default SSL configs with Sendmail). -Dan

Spamtrap email — milter that can still receive, but reject?

2022-05-24 Thread Dan Mahoney
some of this down. -Dan Sent from my iPad

Re: TLS reporting

2022-04-26 Thread Dan Mahoney
> On Apr 19, 2022, at 6:08 PM, Viktor Dukhovni > wrote: > > On Tue, Apr 19, 2022 at 05:33:50PM -0700, Dan Mahoney wrote: > >> Does postfix have any support for TLS reporting (RFC8460)? >> >> Technically, one need not be using MTA-STS to benefit from this.

Re: password security

2022-04-25 Thread Dan Mahoney
e-compaint script, and do your part to make the internet a little cleaner. -Dan

Re: Rewriting envelope-from of root mail (realname, not email address)

2022-04-23 Thread Dan Mahoney
> On Apr 22, 2022, at 8:53 PM, Viktor Dukhovni > wrote: > > On Fri, Apr 22, 2022 at 06:54:56PM -0700, Dan Mahoney wrote: > >> masquerade_domains = !ops.foo.org, !support.foo.org, !gitlab.foo.org, >> !lists.foo.org, isc.org >> masquerade_exception

Rewriting envelope-from of root mail (realname, not email address)

2022-04-22 Thread Dan Mahoney
Which presents us with a problem. Is there any way to remove that exception but rewrite the root mail so that it's perhaps something like: "Systemname root" mailto:r...@foo.org>>, or even VERP it to be something like "Roots name from /etc/passwd" mailto:systemname=r...@foo.org>> -Dan

TLS reporting

2022-04-19 Thread Dan Mahoney
Hey there, Does postfix have any support for TLS reporting (RFC8460)? Technically, one need not be using MTA-STS to benefit from this. We get monitoring of this with our dmarc monitoring provider, and it feels like it would be useful to send these reports as well. -Dan

Re: Muliple mail delivery

2022-03-23 Thread Dan Mahoney
he state of which messages have been marked read, etc? -Dan

Re: Received-SPF: Temperror

2022-02-05 Thread Dan Mahoney
PF done properly, use a dedicated SPF component (of which > there are several). We are considering (and the latest releases release notes say) deprecating the internal SPF libs, and currently recommend using libspf2, which is not perfect, but at least spares us having to maintain our own internal implementation. -Dan

Re: https://www.postfix.org/ in trouble

2022-01-11 Thread Dan Mahoney
ache for 131.211.31.189:443, and thus will answer regardless of which Host: header is sent, just as if you browsed to it via IP address. (Which would also give you a cert mismatch warning). If we want something to be concerned about, the apache version is like...40 minor versions out of date. (2.4.6 -- it could be lying about its version). -Dan

Re: Some DNSSEC/DANE questions

2022-01-03 Thread Dan Mahoney
> On Jan 3, 2022, at 1:46 PM, Mike wrote: > > On 1/3/2022 2:38 PM, Dan Mahoney (Gushi) wrote: >> [snip] >> >> One more question: Does anyone know of a "reflector" like service that one >> can use to test DANE validation, i.e. a site that one is

Re: Some DNSSEC/DANE questions

2022-01-03 Thread Dan Mahoney (Gushi)
On Mon, 3 Jan 2022, Dan Mahoney wrote: This is a problem when your local resolver is slaving the root zone, as a standard root zone "type slave" will hand . NS out with the AA bit set, but will not set the AD bit. There's a feature in more recent versions of BIND (mirror zone

Re: Some DNSSEC/DANE questions

2022-01-03 Thread Dan Mahoney
> On Jan 3, 2022, at 6:22 AM, Viktor Dukhovni > wrote: > > On Mon, Jan 03, 2022 at 05:49:05AM -0800, Dan Mahoney (Gushi) wrote: > >> We run validating resolvers at the day job, but by default not on the box >> where postfix runs. (I.e. we rely on the AD bit).

Some DNSSEC/DANE questions

2022-01-03 Thread Dan Mahoney (Gushi)
ound mail? If you've set smtp_tls_security_level=dane, but haven't set smtp_dns_support_level=dnssec, is a warning logged? -Dan -- Dan Mahoney Techie, Sysadmin, WebGeek Gushi on efnet/undernet IRC FB: fb.com/DanielMahoneyIV LI: linkedin.com/in/gushi Site: http://www.gushi.org ---

Re: Macro explanation?

2022-01-01 Thread Dan Mahoney (Gushi)
On Sat, 1 Jan 2022, Wietse Venema wrote: Dan Mahoney (Gushi): Hey there, I'm trying to modernize older configs at the day job and have found that a coworker specified: milter_connect_macros = b i j _ {daemon_name} {if_name} {if_addr} milter_end_of_data_macros = b i j _ {daemon_name} {if

Macro explanation?

2022-01-01 Thread Dan Mahoney (Gushi)
x.org/MILTER_README.html#macros ... ..I don't see a "b" in the postfix docs. Is there a former value associated with this, or some sendmail compatibility shim or something? (For that matter, I don't see if_name or if_addr, but I do see the "workaround" notes). Clu

Are the CApath/CAfile config knobs case-sensitive?

2021-12-22 Thread Dan Mahoney
All, Question really says it all. Everything in postfix, except these, seems to be lower case. I’m not sure if this is a stylistic thing, or something having to do with an openssl internal, but if these get lowercased in a config, will it break? -Dan

Formatting long lists of mynetworks with comments?

2021-12-21 Thread Dan Mahoney
, #corporate office 5.6.7.8, # remote office [2001:1234:::dead:beef], #local office ipv6 Or would that break things? Alternatively, would mynetworks = 1.2.3.4, # and then the remote 5.6.7.8, work? -Dan

Re: "Correct" way to override cipher list?

2021-10-29 Thread Dan Mahoney
> On Oct 29, 2021, at 10:01 PM, Viktor Dukhovni > wrote: > > On Fri, Oct 29, 2021 at 08:36:38PM -0700, Dan Mahoney (Gushi) wrote: > >> I see sites like cipherlist.eu suggesting overriding the "medium" cipher >> set to only be: > > Ignore much of

"Correct" way to override cipher list?

2021-10-29 Thread Dan Mahoney (Gushi)
For example, it looks like at some point postfix stopped doing sslv2 and sslv3 (so the above smtpd_tls_protocols is already wrong for a modern postfix?), but with tls10 also known-problematic, will that drop out at some point? Best, -Dan -- Dan Mahoney Techie, Sysadmin, W

Re: smtp disobeying smtp_bind_address

2021-10-26 Thread Dan Mahoney
ow running 3_6), to see what changes to your config are effectively made by enabling that level? (effectively, to show a defaults-diff, or any commands whose behavior may not have the same meaning under a previous version)? -Dan

Re: postfix vpn problem

2021-10-20 Thread Dan Ziolkowski
r Dukhovni wrote: > On Wed, Oct 20, 2021 at 01:46:57PM -0400, Dan Ziolkowski wrote: > > > understood, i will gather them.. DAN > > Just one or two log entires showing a delivery failure logged by > postfix/smtp (not smtpd), is sufficient. No need for bulk log data. > >

Re: postfix vpn problem

2021-10-20 Thread Dan Ziolkowski
Viktor- understood, i will gather them.. DAN On Wed, Oct 20, 2021 at 1:40 PM Viktor Dukhovni wrote: > On Wed, Oct 20, 2021 at 01:16:45PM -0400, Dan Ziolkowski wrote: > > > I have postfix working fine sending mails though gmail while VPN not > > connected. When connected ,

postfix vpn problem

2021-10-20 Thread Dan Ziolkowski
=== So I added 495 , also tried 587. 465 inet n - - - - smtpd But still blocked. In summary, postfix mail works fine if VPN if off, does not work if VPN is on, any advice would be appreciated, thanks DAN -- Dan Ziolkowski KC2STA SKCC #4290T Ubuntu LINUX

Way to apply a postfix rule to both FROM and TO?

2021-10-17 Thread Dan Mahoney (Gushi)
e any easy way in postfix to say things like "Block all gmail.com addresses for stuff sent to i...@dayjob.com"? -Dan -- Dan Mahoney Techie, Sysadmin, WebGeek Gushi on efnet/undernet IRC FB: fb.com/DanielMahoneyIV LI: linkedin.com/in/gushi Site: http://www.gushi.org ---

Overriding nonexistent site error for auth'd hosts.

2021-10-03 Thread Dan Mahoney (Gushi)
27;ve marked as trusted. Is there a way to tell Postfix "we know it's invalid, accept it at the border anyway?" only for sites that have presented a valid client cert? -Dan -- Dan Mahoney Techie, Sysadmin, WebGeek Gushi on efnet/undernet IRC FB: fb.com/DanielM

Re: SpamC - connection refused

2021-09-28 Thread Dan Mahoney
Yup, either fix spamd so it listens on localhost (you'd see a LISTEN on port 783, which is missing), or correct your spamc flags to include -U /var/spool/postfix/spamass/spamd.sock -Dan > On Sep 28, 2021, at 11:45 AM, Viktor Dukhovni > wrote: > > On Tue, Sep 28, 2021 at

Re: SpamC - connection refused

2021-09-28 Thread Dan Mahoney
Connection refused speaks to the socket not running. What does netstat -na report? -Dan > On Sep 28, 2021, at 11:38 AM, Maurizio Caloro wrote: > > Sending to spamassassin group, and no answer will by appair, possible this > are outdated? > Please how I can fix this con

Re: Best current practice to analyze brute force login attempts?

2021-09-01 Thread Dan Mahoney (Gushi)
tools here could be as simple as tail, grep and sort I haven't automated this for fear of shooting myself in the foot, but I'm happy to share the script off-list. It's quick and hacky so I haven't bothered sticking it up on like, Github or something. Best, -Dan Hi Ha

Re: Google spam...

2021-08-17 Thread Dan Mahoney
I offer criticism and well-wishes) Same issue with outlook.com, for what it's worth. I get spammed by dmarc-passing sharepoint notifications from sexy girls, I am on office.com's feedback loop but occasionally get blocklisted for no reason. Neither answers abuse@, there's no way to get a human. It's incredibly frustrating. -Dan

RE: Newbie problem: infinite loop when From/To match

2021-07-12 Thread Dan Morton
> Forcing all senders to be "dan@mydomain" seems like the wrong > solution, but I guess that's ok if it works for you and no one else uses the > server. > Sometimes when you hold a hammer everything looks like a nail. Agreed, it is a bit draconian! But there won&

Newbie problem: infinite loop when From/To match

2021-07-12 Thread Dan Morton
will also add that because my login is "mylogin", I had to employ address rewriting as described here to map the FROM "mylogin" to "dan": https://serverfault.com/questions/147921/forcing-the-from-address-when-postf ix-relays-over-smtp When I execute: mylogin@myvps:

Trying to understand the postfix server process flow

2021-06-11 Thread Dan White
This page: http://www.postfix.org/OVERVIEW.html provides an excellent “picture” of how a message is passed between server processes. What I cannot yet get my brain wrapped around is how the server process sequences are expressed and/or configured in the master.cf file. A clue or three for this

Looking for examples of separated MTA / MDA pairs

2021-06-09 Thread Dan White
includes Dovecot with virtual mailbox accounts. The current setup is very confusing and convoluted. I would rather rebuild from scratch rather than waste any more time trying to understand the old mess. Thanks. ___ Dan White : d_e_wh

Re: dkim=pass but unprotected

2021-05-17 Thread Dan Mahoney
It's not dnssec signed. -Dan Mahoney > On May 17, 2021, at 6:14 PM, post...@ptld.com wrote: > > I noticed in the headers it shows: > > dkim=pass (2048-bit key; unprotected) > > What does the unprotected part refer to? > Anything to worry about? Something i ne

Re: OpenDMARC 1.4.1 Released

2021-04-30 Thread Dan Mahoney
against libspf2) and stuff it in to the existing port (which will set the appropriate sane defaults for —prefix and the like). None of the patches in the current version of the port should be required. If you run into trouble, email me privately. -Dan * https://en.wikipedia.org/wi

Re: OpenDMARC 1.4.1 Released

2021-04-30 Thread Dan Mahoney
1.3.x is latest. -Dan > On Apr 30, 2021, at 2:07 PM, Xavier Belanger wrote: > > Hi, > > John Levine wrote: > >> I cloned the github repo which contains no zip files, so no I don't know >> that. > > Cloning the repository will indeed not create a zi

OpenDMARC 1.4.1 Released

2021-04-29 Thread Dan Mahoney (Gushi)
.) We'll likely be turning our attention to OpenDKIM next, as it's also long due for a maintenance release. I'd like to thank the people on this mailing list for your lively discussion and feedback, and tolerance of the occasional off-topic post. Stay safe out there, -Dan Mah

Re: Trusting postfix client certs for relaying

2021-04-18 Thread Dan Mahoney
s it has issued, perhaps pumping those into an access table of some sort (with a perl script or the like) may be helpful to you. That said, if what you’re trying to do is use certs to say: the cert issued to bob.domain.com will only allow sending from b...@domain.com, then except on your own mail server, nobody is going to be inspecting the headers for this. (That is to say, this isn’t S/MIME). If the result is that mail is rejected unless this matches, then you’re only increasing the load on yourself. -Dan >

Re: Trusting postfix client certs for relaying

2021-04-18 Thread Dan Mahoney
Sent from my iPad > On Apr 17, 2021, at 14:16, Wietse Venema wrote: > Dan Mahoney (Gushi): >> All, >> >> The dayjob has a number of machines out in the wild that need to be able >> to send mail (mostly from cron jobs) home to the mothership. Not all hav

Trusting postfix client certs for relaying

2021-04-17 Thread Dan Mahoney (Gushi)
igured as a client cert (which we may want to *validate*, but *not permit for relaying*, that cert would allow relay) It seems that There are knobs that let you list *individual certs* for allowing trusted relaying, but not *individual ca's*. Is there any way around this? -Da

OpenDMARC 1.4.1 pre-release announcement

2021-04-16 Thread Dan Mahoney (Gushi)
like to get this out the door soon. If you hit a show-stopper, push an issue to our github or contact me privately. Best, -Dan -- Dan Mahoney Techie, Sysadmin, WebGeek Gushi on efnet/undernet IRC FB: fb.com/DanielMahoneyIV LI: linkedin.com/in/gushi Site: http://www.gushi.org ---

Re: Milters and policy

2021-04-02 Thread Dan Mahoney (Gushi)
o do such a thing. Apologies for the noise here. It may not fully be over, but it's my hope that the net result is good software for the internet at large. -Dan -- ----Dan Mahoney Techie, Sysadmin, WebGeek Gushi on efnet/undernet IRC FB: fb.com/DanielMahoneyIV LI: linke

Re: Milters and policy

2021-04-01 Thread Dan Mahoney
Replied inline and snipped. Apologies if my mail.app gets this wrong. > On Apr 1, 2021, at 7:49 PM, Simon Wilson wrote: > > - Message from Dan Mahoney - > Date: Thu, 1 Apr 2021 16:19:05 -0700 > From: Dan Mahoney > Subject: Re: Milters and p

Re: Milters and policy

2021-04-01 Thread Dan Mahoney
header, and > OpenDMARC set to trust the Authserv-Id added in Authentication-Results > headers by policyd-spf and OpenDKIM. All working nicely and good to > understand the sequence. Please read CVE-2019-20790, and tell me you’ve found a way to tell PyPolicyd not to trust the SMTP HELO to generate a passing AR header. -Dan > > Simon. > > -- > Simon Wilson > M: 0400 12 11 16

Re: opedmarc and opendkim

2021-03-31 Thread Dan Mahoney
> On Mar 31, 2021, at 1:09 PM, David Bürgin wrote: > > Dominic Raferd: >> On 31/03/2021 17:29, Benny Pedersen wrote: >>> On 2021-03-31 18:21, Dan Mahoney wrote: >>> >>>>> problem is your setup used Sender-ID with is long time depric

Re: opedmarc and opendkim

2021-03-31 Thread Dan Mahoney
Why would you advise not using libspf2? Sent from my iPad > On Mar 31, 2021, at 09:01, Benny Pedersen wrote: > > On 2021-03-31 17:51, Maurizio Caloro wrote: > >> SPFIgnoreResults true >> SPFSelfValidate true > > set both to false > > and dont use libspf2 > > problem is your setup used Send

Re: Allowing Special Characters in Email addresses

2021-03-25 Thread Dan Mahoney
This really feels to me like a “oh crap somebody put this email address on 10,000 pieces of customer correspondence and now we have to support it” problem. It’s about the only excuse I would consider valid. Sent from my iPhone > On Mar 25, 2021, at 19:00, John Levine wrote: > > It appears th

Re: Allowing Special Characters in Email addresses

2021-03-24 Thread Dan Mahoney
turned off the ! handling in postfix: -Dan > On Mar 24, 2021, at 4:56 AM, Paul Fowler wrote: > > .

Re: Milter Behavior

2021-03-12 Thread Dan Mahoney
> On Mar 11, 2021, at 11:09 PM, Dominic Raferd wrote: > > On 12/03/2021 02:35, Dan Mahoney wrote: >> >>> On Mar 11, 2021, at 1:00 AM, Dominic Raferd >> <mailto:domi...@timedicer.co.uk>> wrote: >>> >>> This works for me: >>>

  1   2   3   >