[pfx] Re: check_policy_service only for inbound addresses

2025-08-27 Thread Ralph Seichter via Postfix-users
* Matteo Bini: > I've added to Postfix smtpd_recipient_restrictions the > check_policy_service option to check Dovecot quotas [...] > > Is there a way to tell Postfix to use the check_policy_service option > only for inbound addresses? You can configure different restrictions for different ports

[pfx] Re: how to reject a rewrited address

2025-08-07 Thread Ralph Seichter via Postfix-users
* Corey via Postfix-users: > /racknerd\.com/ reject > > will this be working? It should work, blocking all envelope senders containing the substring "racknerd.com" anywhere. If that is too general a match for you, and based on your example, you could also use /racknerd\.com=support@pobox\.be$/

[pfx] Re: how to reject a rewrited address

2025-08-07 Thread Ralph Seichter via Postfix-users
* Corey via Postfix-users: > SRS0=5MgR=s2=racknerd.com=supp...@pobox.be reject > > This is not useful since the part of "SRS0=5MgR=s2" changes every time. https://www.postfix.org/regexp_table.5.html should get you started. Regular expressions for the win. ;-) -Ralph _

[pfx] Re: Check Client Access

2025-07-30 Thread Ralph Seichter via Postfix-users
* Klaipedaville via Postfix-users: > I have the following setting: > smtpd_recipient_restrictions = check_client_access > regexp:/etc/postfix/check (other settings here) > > Now /etc/postfix/check contains the following line: > /^send\d+\.server\.com$/ REJECT No spam allowed. The expression "\d

[pfx] milter~regex homepage (was: Re: per-domain header checks?)

2025-04-17 Thread Ralph Seichter via Postfix-users
* Alex via Postfix-users: > It looks like this is the place to start? > https://github.com/milter-regex/milter-regex/tree/main I recommend starting at http://benzedrine.ch/milter-regex.html instead, because that's the official milter-regex homepage (plus, it shows the formatted manpage). -Ralph

[pfx] Re: list.sys4.de

2025-04-09 Thread Ralph Seichter via Postfix-users
* Erwan David via Postfix-users: > I worked for hosting companies. One was technically ready to connect > customers in IPv6, the other one had it on study. But in both we (the > tech staff) were told "customers do not ask for it". While not specifically Postfix-related, I think it is lamentable t

[pfx] Re: Can't connect to www.postfix.org

2025-02-13 Thread Ralph Seichter via Postfix-users
* John Griffiths via Postfix-users: > I was looking for reasons in my Ubiquity router's configuration and > found that Ubiquity had added a filter for TOR exit sites in an update > and it was enabled by default. Not quite. As I mentioned, ra.horus-it.com is not a Tor *exit* relay, which means tha

[pfx] Re: Can't connect to www.postfix.org

2025-02-12 Thread Ralph Seichter via Postfix-users
* Wietse Venema via Postfix-users: > There are known blocks based on anti-TOR policies, ranging from > anti-malware policies to censorship. Folk fearful of the Tor Project should also be reminded that entry-nodes and middle-nodes only route Tor traffic to other Tor nodes, by design. Only exit-nod

[pfx] Re: Can't connect to www.postfix.org

2025-02-12 Thread Ralph Seichter via Postfix-users
* John Griffiths via Postfix-users: > Is my IP, 47.201.27.231, or the subnet(s) blocked in the firewall? There are currently no existing blocks in the 47.201.0.0/16 subnet at all. Unless you plan to attack the server hosting the Postfix website, that server is not going to impose a block on your

[pfx] Re: Can't connect to www.postfix.org

2025-02-11 Thread Ralph Seichter via Postfix-users
* John Griffiths via Postfix-users: > I cannot reach the www.postfix.org server. I have to use a mirror if I > want to get to the documentation. According to the logs, traffic to www.postfix.org is as lively as usual, with no outages reported. During the last 24 hours, around three score IP addre

[pfx] Announcement: automx2 2025.1 is now available

2025-01-07 Thread Ralph Seichter via Postfix-users
I am happy to announce that automx2 release 2025.1 is now available. As usual, you can download it from PyPI [1] and documentation is available via [2]. [1] https://pypi.org/project/automx2/ [2] https://rseichter.github.io/automx2/ The most notable change in this version is the addition of sd

[pfx] Re: Implicit TLS via SRV record?

2024-12-31 Thread Ralph Seichter via Postfix-users
* Steffen Nurpmeso via Postfix-users: > I did not want to initiate a discussion, actually. And who would have guessed? Just push a feature which does not serve a real purpose. Discussions are *so* last year. > It was indeed quite the other way around, as you know very well [...] That was a lot

[pfx] Re: Implicit TLS via SRV record?

2024-12-30 Thread Ralph Seichter via Postfix-users
* Steffen Nurpmeso via Postfix-users: > There is nothing to link. postfix already supports SRV. [...] Seriously? You refer to a draft, then don't bother to link to it, or mention that you are the author, with an agenda to boot? What a strange way to try to initiate a discussion. One might suspect

[pfx] Re: Implicit TLS via SRV record?

2024-12-30 Thread Ralph Seichter via Postfix-users
* Steffen Nurpmeso via Postfix-users: > >Are you referring to [1], i.e. your own draft? "Nenne Ross und > >Reiter." > > Well i think that became obvious from the rest of the message. I think it is just good manners to let people know explicitly who is trying to promote a subject, and why. Also, t

[pfx] Re: Implicit TLS via SRV record?

2024-12-28 Thread Ralph Seichter via Postfix-users
* Steffen Nurpmeso via Postfix-users: > there is this IETF draft which asks for support SMTPS (aka really, > now), that is Implicit TLS via dedicated port for SMTP. Are you referring to [1], i.e. your own draft? "Nenne Ross und Reiter." [1] https://datatracker.ietf.org/doc/draft-nurpmeso-smtp-tl

[pfx] Re: Automatically match sendmail envelope sender to "From:" header

2024-12-12 Thread Ralph Seichter via Postfix-users
* Wietse Venema via Postfix-users: > If your message file has no From: header, then Postfix provides one > based on the envelope sender address, with a "full name" for that > header based on the -F option, or the NAME environment variable, > or the GECOS field in the password file. The issue I am

[pfx] Automatically match sendmail envelope sender to "From:" header

2024-12-12 Thread Ralph Seichter via Postfix-users
Consider a pre-generated text file sample.eml like this one: From: Bob To: al...@example.org Subject: foobar The message body goes here... Imagine further that Bob is logged in as user123 on host.example.net which runs Postfix, and Bob sends the message like so: $ /usr/sbin/sendmail

[pfx] Re: Pipe Transport: Answer with 500 instead of sending a bounce?

2024-11-21 Thread Ralph Seichter via Postfix-users
* Viktor Dukhovni via Postfix-users: > You probably also need a "postfix reload" in such cases, because > "defer_transports" is a qmgr(8) parameter, and qmgr(8) is a long-running > process. Indeed. I did not specifically mention it in my example, but I invoke "postfix reload" after each modificat

[pfx] Re: Pipe Transport: Answer with 500 instead of sending a bounce?

2024-11-21 Thread Ralph Seichter via Postfix-users
* Viktor Dukhovni via Postfix-users: > Why not: > defer_transports = local That's what I was wondering, too. For example, I like using postconf -e defer_transports=lmtp in scripts, to temporarily pause message delivery from Postfix to Dovecot during backup operations. -Ralph

[pfx] Re: from and return-path

2024-11-20 Thread Ralph Seichter via Postfix-users
* natan via Postfix-users: > > That kind of rejection can be realised easily using milter-regex [1]. > > Simply combine "envfrom" and "header" tests in a custom rule. > > Thenx for replay but this is not for postfix - without corrections and > reinventing the wheel Frankly, you are very wrong. Mi

[pfx] Re: from and return-path

2024-11-20 Thread Ralph Seichter via Postfix-users
* natan via Postfix-users: > If @domain.ltd in return-path and from: is dfferend then Reject "non > allowed" That kind of rejection can be realised easily using milter-regex [1]. Simply combine "envfrom" and "header" tests in a custom rule. -Ralph [1] https://www.benzedrine.ch/milter-regex.html

[pfx] PSA: Access to www.postfix.org on 2024-11-27

2024-11-14 Thread Ralph Seichter via Postfix-users
I have been notified about datacenter maintenance which will disrupt access to www.postfix.org. Maintenance is planned for 2024-11-27 between 03:30 and 04:30 (UTC). There are of course mirror sites available, and I only want to make sure that nobody is going to be surprised. -Ralph __

[pfx] Re: Spaces in Master.cf values

2024-10-22 Thread Ralph Seichter via Postfix-users
* postfix--- via Postfix-users: > Spaces are not allowed in submission -o override settings. > How do you handle adding a service? You can use commas as separators. -Ralph ___ Postfix-users mailing list -- postfix-users@postfix.org To unsubscribe send

[pfx] Re: Postfix in containers/kubernetes

2024-10-18 Thread Ralph Seichter via Postfix-users
* Nico Schottelius: > It's the opposite and let me put it into clear, logic terms: Oh, do try. ;-) > I need a postfix container [0] > I can easily build a postfix container [1] > Others might start using my postfix container due to the lack of an > official postfix container [2] If (!) you publ

[pfx] Re: Postfix in containers/kubernetes

2024-10-17 Thread Ralph Seichter via Postfix-users
* Nico Schottelius via Postfix-users: > As mentioned before, I/we can volunteer to building the image(s) and > rebuilding them on a new release, if the added workload is a concern. Why do I get the feeling that you promote the idea of an "official" container image and your role in it because you

[pfx] Re: Update issue 3.8.5-3.9.0

2024-08-31 Thread Ralph Seichter via Postfix-users
* Phil Stracchino via Postfix-users: > Don't know whether it's a Gentoo specific issue, but Postfix failed to > restart after update because the new lib directory was created as > /usr/lib64/postfix/3.9, not /usr/lib64/postfix/3.9.0. There's nothing inherently wrong with that. Here is what I se

[pfx] Re: question about postmaster account

2024-07-28 Thread Ralph Seichter via Postfix-users
* A. Schulze via Postfix-users: > https://datatracker.ietf.org/doc/html/rfc5321#section-4.5.1 > > 5321 btw... Indeed, that was an unfortunate typo on my end. Thanks, Andreas. -Ralph ___ Postfix-users mailing list -- postfix-users@postfix.org To unsubsc

[pfx] Re: question about postmaster account

2024-07-28 Thread Ralph Seichter via Postfix-users
* Walt E. via Postfix-users: > Is there any standard that, postmaster@domain is a required account > for this domain? Yes. The requirement has been specified as early as 1981 in RFC 822, and in its successors up to and including RFC 5322. -Ralph ___ Po

[pfx] Re: RFC logs_check

2024-07-24 Thread Ralph Seichter via Postfix-users
* Steffen Nurpmeso: > >I think it is more than "a bit flakey". You ask Wietse to support > >something which introduces a significant security risk. > > Now you exaggerate a bit. Not really, the original example of invoking "iptables" directly requires root provileges. That could be mitigated by u

[pfx] Re: RFC logs_check

2024-07-24 Thread Ralph Seichter via Postfix-users
* Bob via Postfix-users: > I get it might be a bit flakey from a security perspective and should > come with warnings but it is my box. I think it is more than "a bit flakey". You ask Wietse to support something which introduces a significant security risk. Plus, this particular something is not

[pfx] Re: RFC logs_check

2024-07-24 Thread Ralph Seichter via Postfix-users
* Jaroslaw Rafa via Postfix-users: > Despite what you say about your unsuccessful attempts with fail2ban, > it seems the best tool for the job. It's the whole idea of fail2ban > anyway - if "SOMETHING" appears in the logfile "SOME" number of times > (which can be 1), then stuff the IP address into

[pfx] Re: Transport settings for mailing list transport

2024-07-23 Thread Ralph Seichter via Postfix-users
* Bill Cole via Postfix-users: > Some systems are configured to "oversign" headers, essentially signing > the non-existence. Shhh! We don't want to advertise that in this scenario, do we? ;-) Still, you are correct to point out that the DKIM spec allows for these kinds of shenanigans. > Any addi

[pfx] Re: RFC logs_check

2024-07-23 Thread Ralph Seichter via Postfix-users
* Bob via Postfix-users: > I realise stuff like failtoban is available but when I look at it the > wrong way, or in any way, it falls over and it only looks at logfiles > every so often [...] I found fail2ban not to my taste, so like you I searched for possible alternatives. I finally came to ter

[pfx] Re: Transport settings for mailing list transport

2024-07-22 Thread Ralph Seichter via Postfix-users
* Austin Witmer via Postfix-users: > Will DMARC be broken if I only add the following headers to mailing > list messages? [...] Adding *new* headers can't break existing DKIM signatures, because these headers cannot have been signed before. New in this case means header names (not values) which h

[pfx] Re: How to bounce e-mail when using catchall

2024-07-12 Thread Ralph Seichter via Postfix-users
* John Fawcett via Postfix-users: > On 12/07/2024 15:30, Ralph Seichter via Postfix-users wrote: > > > "My advice true, forget this!" (Alvina) > > I agree with the advice but have some doubts about the milter > solution. I don't dare call it a solution, no

[pfx] Re: How to bounce e-mail when using catchall

2024-07-12 Thread Ralph Seichter via Postfix-users
* Francis Augusto Medeiros-Logeay via Postfix-users: > I want that mail sent to users who do not have a valid address (like > when they are not on ldap) to bounce back, like it happens by default, > but I’d also like these mail to be delivered to an specific mailbox. > > As you said, if I use catc

[pfx] Re: sending email to FQDN address without DNS

2024-07-11 Thread Ralph Seichter via Postfix-users
* Adam Weremczuk via Postfix-users: > I have a highly isolated host (e.g. most outgoing traffic blocked, no > DNS) but I would like to use Postfix on that host to send certain emails > to a single address exam...@example.com. [...] You can use Postfix a transport table to direct mail for specif

[pfx] Re: Continuous deferral

2024-07-10 Thread Ralph Seichter via Postfix-users
* Katherine via Postfix-users: > Why doesn't the server just reject it (5xx code)? This deferral is > very confusing to our administrators. Confusing how? You did not provide enough information. What is the actual deferral message? -Ralph ___ Postfix-u

[pfx] Re: Documentation Prefix

2024-07-07 Thread Ralph Seichter via Postfix-users
* Allen Coates via Postfix-users: > I am blocking 2001:db8::/32 (of course); it's the Teredo prefix > which I am allowing. I misunderstood the word "these" in your OP, and the subject line only referenced the documentation prefix, but no harm done. I don't have any numbers for connections from Te

[pfx] Re: Documentation Prefix

2024-07-07 Thread Ralph Seichter via Postfix-users
* Allen Coates via Postfix-users: > I have just been perusing my firewall logs, and notice I have had > several "hits" using the documentation prefix (2001:db8::/32) as the > source address. [...] > > I have also had some hits (on my website) from  Teredo addresses.  I > am allowing these, because

[pfx] Re: Handing off via localhost:10025 to spamassassin for scanning failure

2024-06-29 Thread Ralph Seichter via Postfix-users
* Curtis J. Blank via Postfix-users: > Everything except this that is: > mydestination = $myhostname, localhost.$mydomain, $mydomain, www.$mydomain > > Should this be set to: > mydestination = $myhostname, 127.0.0.1.$mydomain, $mydomain, www.$mydomain > > To keep ::1 from being used? No, that is

[pfx] Re: Handing off via localhost:10025 to spamassassin for scanning failure

2024-06-28 Thread Ralph Seichter via Postfix-users
* Curtis J. Blank via Postfix-users: > What I am looking for is pretty simple. How to get it to work with > "inet_protocols = all" like my existing server is currently set up to do > and not be limited to ipv4 only. Well, you seem to be in a good mood. ;-) > And it is already set to use 127.0.

[pfx] Re: Handing off via localhost:10025 to spamassassin for scanning failure

2024-06-27 Thread Ralph Seichter via Postfix-users
* Curtis J. Blank via Postfix-users: > I would like to get some insight as to the cause and correct > configuration to use. [...] Maybe it is simply too early in the morning for me to get your point, but what insight are you looking for, exactly? You already found out that localhost does not ne

[pfx] Re: REJECT sending mails to no-reply accounts

2024-06-20 Thread Ralph Seichter via Postfix-users
* Tan Mientras via Postfix-users: > Is an automated/unattended email notifying the user about something, > providing proper ways of contacting. "Proper" is for the recipients of your messages to be able to use the reply function in their MUA, to ask for clarification/assistance in regards to the

[pfx] Re: REJECT sending mails to no-reply accounts

2024-06-19 Thread Ralph Seichter via Postfix-users
* Ansgar Wiechers via Postfix-users: > [...] Did I ever send mail to you using the mailing list address you got barred from targeting, or send mail to you at all from my servers? No, I did not. You tried to initiate communication by sending mail to an address you had no reason to contact, this b

[pfx] Re: REJECT sending mails to no-reply accounts

2024-06-19 Thread Ralph Seichter via Postfix-users
* Bjoern Franke via Postfix-users: > From: Ralph Seichter via Postfix-users > Reply-To: Ralph Seichter Dang, blindsided by Mailman 3, sorry. What I wrote about my dislike of using "nore...@foo.bar" type addresses remains unchanged, however. If sender A sends mail to recipient

[pfx] Re: REJECT sending mails to no-reply accounts

2024-06-19 Thread Ralph Seichter via Postfix-users
* Tan Mientras via Postfix-users: > Trying to setup email REJECT when users try to send to a no-reply > email. Personally, I find this type of one-way communication annoying and impolite. The same goes for setting Reply-To to your personal email address after asking for help on a public mailing l

[pfx] Re: Forward mail

2024-04-13 Thread Ralph Seichter via Postfix-users
* Peng via Postfix-users: > Gmail/fastmail rely more on DKIM than SPF. What makes you assume that? Sending mail to f...@gmail.com works with SPF alone, in the absense of DKIM. I have not tried the reverse (DKIM without SPF) yet. -Ralph ___ Postfix-user

[pfx] Re: Postfix stable release 3.9.0

2024-03-07 Thread Ralph Seichter via Postfix-users
* Wietse Venema via Postfix-users: > Postfix stable release 3.9.0 is available. Postfix 3.5 - 3.8 were > updated earlier this week; after that, Postfix 3.5 will no longer > be updated. Thank you for your continued work. By "you" I mean not only Wietse, but also the other contributors who collabor

[pfx] Re: filter header from on forwarded mail

2024-03-05 Thread Ralph Seichter via Postfix-users
* Juerg Reimann via Postfix-users: > So, but now I still have to filter such incoming mail in a way that I'd be > able to block certain senders by their *header* From: on a user basis. I heartily recommend milter-regex [1]. It serves me well by allowing me to configure all kinds of complex antis

[pfx] Re: A functional lightweight reverse alias?

2024-03-04 Thread Ralph Seichter via Postfix-users
* mattpr via Postfix-users: > Adding email aliases to an email client doesn't make sense because > there are just too many and I wouldn't want to have to pick one. Pick one what? Pick an alias, I presume, or pick a mail client (MUA)? > Last count I had ~2500 records in my password manager (not a

[pfx] Re: postfix repo

2024-01-12 Thread Ralph Seichter via Postfix-users
* Viktor Dukhovni via Postfix-users: > On Thu, Jan 11, 2024 at 07:29:40PM +0100, Benny Pedersen via Postfix-users > wrote: > >> so next is gentoo ebuilds ? :) > > No. There is no Postfix binary release build farm, and nobody has > volunteered to coördinate binary release engineering at the Postfi

[pfx] Re: WTF X-ANONYMOUSTLS ???

2023-12-26 Thread Ralph Seichter via Postfix-users
* Viktor Dukhovni via Postfix-users: > Microsoft ESMTP MAIL Service [...] Gee, who woulda thunk? ;-) That being said, perhaps somebody on the "mailop" mailing list would be able to offer more insight? Some exotic extension, perhaps, or a weird application level firewall? I sure hope it is not a p

[pfx] Re: 25 years today

2023-12-15 Thread Ralph Seichter via Postfix-users
* Wietse Venema via Postfix-users: > As a few on this list may recall, it is 25 years ago today that the > "IBM secure mailer" had its public beta release. Time flies, no doubt about that. I find it comforting that Postfix has earned its place as a cornerstone of e-mail around the globe, based on

[pfx] Re: How to temporarily pause virtual mail delivery?

2023-11-23 Thread Ralph Seichter via Postfix-users
* Wietse Venema via Postfix-users: >> Now that I think of it again, I wonder if the reload command is even >> necessary? > > Yes, because it is implemented in the queue manager which is a > long-running process. Thank you. I have been using the reload step for so long, but I could not recall why

[pfx] Re: How to temporarily pause virtual mail delivery?

2023-11-22 Thread Ralph Seichter via Postfix-users
* Viktor Dukhovni via Postfix-users: > https://www.postfix.org/postconf.5.html#defer_transports Indeed. In my backup scripts, I like to use something like the following (from memory only, beware of possible typos): postconf -e defer_transports=lmtp,local,virtual && postfix reload Now that I t

[pfx] Re: www.postfix.org outage

2023-11-22 Thread Ralph Seichter via Postfix-users
* Bill Cole via Postfix-users: >> I am positive that I personally rebooted this server a number of times >> following Kernel updates, the last of which happened not long ago. ;-) > > If there's a virtualization layer, they are likely to be referring to > the real physical host rather than the VM

[pfx] Re: www.postfix.org outage

2023-11-22 Thread Ralph Seichter via Postfix-users
* Jaroslaw Rafa via Postfix-users: > Maybe it wasn't rebooted until now? (as PXE is a boot-related feature) :) I am positive that I personally rebooted this server a number of times following Kernel updates, the last of which happened not long ago. ;-) My guess is that the hosting company made c

[pfx] Re: www.postfix.org outage

2023-11-21 Thread Ralph Seichter via Postfix-users
The Postfix website is available again. The company hosting the server hardware informed me that there are "some issues with the PXE feature with this server model", whatever that means exactly, which their staff was able to fix in the meantime. I find it interesting how this particular server has

[pfx] Re: TAKE NOTE: "2 1 1" TLSA records vs. apparent change of Let's Encrypt default certificate chain

2023-11-19 Thread Ralph Seichter via Postfix-users
* Byung-Hee HWANG via Postfix-users: > Honestly, 311 it was not easy to set up to me. These days, one is a bit spoiled for choice when it comes to software which handles this automatically. LetsDNS (https://letsdns.org) is what I use and recommend, unsurprisingly, because it is robust and easy to

[pfx] Re: content filters

2023-11-09 Thread Ralph Seichter via Postfix-users
* Viktor Dukhovni via Postfix-users: > Relax, that wasn't an attack on you. There's no need to defend your > honour... :-) That's not always easy to determine, especially given the constraints of non-verbal communication. I'll take your word for it, of course. ;-) > I would like to suggest that

[pfx] Re: content filters

2023-11-09 Thread Ralph Seichter via Postfix-users
* Viktor Dukhovni via Postfix-users: > The requested filter is much too crude. How would the OP, for example, > have participated in this thread with that filter in place! I agree that the filter the OP asked for is a dumb idea, but milter- regex can nonetheless provide the functionality that was

[pfx] Re: content filters

2023-11-09 Thread Ralph Seichter via Postfix-users
* true kernel via Postfix-users: > What are the plugins or filters for postfix to stop sending a special > message body? You could try milter-regex (https://www.benzedrine.ch/milter-regex.html). -Ralph ___ Postfix-users mailing list -- postfix-users@po

[pfx] Re: Postfix Site Hosting Tor Node = Blocked Access For Some

2023-09-24 Thread Ralph Seichter via Postfix-users
* Viktor Dukhovni via Postfix-users: >> The server hosting the Postfix website, run by yours truly, is neither >> located in Germany, nor is it a Tor exit node. > > As for TOR, some sites may have stale or inaccurate data: > > https://www.ipqualityscore.com/tor-ip-address-check/lookup/65.108.3.114

[pfx] Re: Postfix Site Hosting Tor Node = Blocked Access For Some

2023-09-24 Thread Ralph Seichter via Postfix-users
* Eddie Rowe via Postfix-users: > I have been cutoff from the Postfix web site due to it apparently > being a TOR exit node in Germany. The server hosting the Postfix website, run by yours truly, is neither located in Germany, nor is it a Tor exit node. -Ralph ___

[pfx] Re: stop bulk messages

2023-05-06 Thread Ralph Seichter via Postfix-users
* Corey Hickman via Postfix-users: > Some clients abuse the outgoing smtp server for sending bulk messages. > [...] Do you know how to stop this behavior? There is 'default_destination_recipient_limit' to limit the number of recipients per message delivery. If however the abuser uses only a few

[pfx] Re: postscreen question

2023-04-27 Thread Ralph Seichter via Postfix-users
* Ken Peng via Postfix-users: > Using rspamd instead of postscreen? I'm not quite sure what you mean by that. If you suggest relying on rspamd only, and forgo postscreen, I have to disagree. In my experience, postscreen has proven highly useful in spam prevention, in particular when DNSBL lookup

[pfx] Re: www.postfix.org certificate expired

2023-04-22 Thread Ralph Seichter via Postfix-users
* Viktor Dukhovni via Postfix-users: > The "post hooks" in certbot are not *reliable*. For the curious among you: I use dehydrated [1], which integrates nicely with my other automation, including Ansible [2]. An Ansible handler is used to restart the web server if certificates were updated, and t

[pfx] Re: www.postfix.org certificate expired

2023-04-22 Thread Ralph Seichter via Postfix-users
* Peter Ajamian via Postfix-users: > Verify return code: 10 (certificate has expired) Thanks. For some reason, the web server had not been restarted after the last certificate update, which normally happens automatically. I just restarted the server process manually. -Ralph _

[pfx] Re: The joke writes itself.

2023-03-10 Thread Ralph Seichter via Postfix-users
* Robert A. via Postfix-users Cooper: > Some of us don't have a choice and are stuck with MS mail products due > to work policies. while OWA does now support header filtering, that > has not always been the case. So you are saying that even Microsoft has finally seen the light. Good, it took them

[pfx] Re: Postfix lists are migrating to a new list server

2023-03-10 Thread Ralph Seichter via Postfix-users
* Jim Popovitch via Postfix-users: > On Fri, 2023-03-10 at 17:35 +0200, mailmary--- via Postfix-users wrote: > >> Looking at the opendkim/opendmarc right now, they appear dead over >> the past 2 years or so, which is sad really. > > It's not sad at all. It's a testament to the stability of the pro

[pfx] Re: The joke writes itself.

2023-03-10 Thread Ralph Seichter via Postfix-users
* Patrick Ben Koetter via Postfix-users: > I don't need tags. Seconded. Do we really need to cater for software that's unable to use the "List-Id" headers? These are mailing lists for Postfix users and devs, not for a knitting circle, so I think it is fair to assume we subscribers all use decent

Re: Postfix.org website

2022-09-09 Thread Ralph Seichter
* Simon Wilson: > Noting that whilst some may consider that block excessive, it does > appear that some 'authorities', including at least the Australian > government's cyber security department, Fortinet, and others, > recommend these IPs are blocked. Which just goes to show how little these so-c

Re: Postfix.org website

2022-09-09 Thread Ralph Seichter
* Simon Wilson: > Pinging postfix-mirror.horus-it.com [65.108.3.114] with 32 bytes of data: > Reply from 65.108.3.114: bytes=32 time=323ms TTL=48 > Reply from 65.108.3.114: bytes=32 time=321ms TTL=48 > > Yet I cannot open www.postfix.org (either over http://www.postfix.org > or https://www.postf

Legacy recipient restriction using the "%" character

2022-06-26 Thread Ralph Seichter
Hello list. I am currently pondering the continued usefulness of the restriction smtpd_recipient_restrictions = ... check_recipient_access pcre:/etc/postfix/recipient_access ... with the content of /etc/postfix/recipient_access (1) being: /[@!%].*[@!%]/ REJECT As per RFC 5322,

Re: dkim setup with letsencrypt

2022-04-22 Thread Ralph Seichter
* ミユナ (alice): > is there a guide for adding DKIM to the outgoing messages with the > same letsencrypt certs? I suggest feeding your favourite search engine with "postfix dkim". -Ralph

Re: Announcement: LetsDNS release 1.0 is now available

2022-04-12 Thread Ralph Seichter
* Viktor Dukhovni: > Perhaps dane-users then. I don't find Github to be a good forum for > discussing design options. I'm happy to use dane-us...@sys4.de if you don't mind it. I consider that one pretty much *your* mailing list and did not mean to just barge in, although I had obviously hoped for

Re: Announcement: LetsDNS release 1.0 is now available

2022-04-12 Thread Ralph Seichter
* Erwan David: > as you can see, let'sDNS would have to act in cooperation with the > certificate update. Which is exactly why I launch LetsDNS from a "dehydrated" hook whenever the latter has obtained a new certificate, but before that certificate is moved from staging into production. This all

Re: Announcement: LetsDNS release 1.0 is now available

2022-04-12 Thread Ralph Seichter
* Viktor Dukhovni: > My first impression reading the docs is that "letdns" is not involved > in certificate rollovers. Its job is solely to automate TLSA record > updates. Indeed. > Are TLSA records matching the previous cert/key retained? No, LetsDNS is stateless beyond the configuration files

Re: Announcement: LetsDNS release 1.0 is now available

2022-04-12 Thread Ralph Seichter
* Erwan David: > Does it handle restarting/reloading a program when changing the > certificate ? Postfix does not need it, but dovecot does. LetsDNS does not obtain or change TLS certificates, because that's what specialised ACME clients like "dehydrated" or "certbot" are for. A hook function in

Re: Announcement: LetsDNS release 1.0 is now available

2022-04-12 Thread Ralph Seichter
* Ruben Safir: > automated systems with root access are inherently not secure Ah, nothing quite like shooting sweeping statements from the hip, is there? :-) See paragraph one of https://letsdns.org/operation.html . -Ralph

Announcement: LetsDNS release 1.0 is now available

2022-04-12 Thread Ralph Seichter
I'm happy to announce that LetsDNS release 1.0 is now available and ready for public use. Website: https://letsdns.org GitHub : https://github.com/LetsDNS/letsdns PyPI : https://pypi.org/project/letsdns/ LetsDNS is a utility to manage DANE TLSA records in DNS servers with only a few lines

Re: Postfix throws fatal errors in docker with stopped milter container and default_action=accept

2022-04-04 Thread Ralph Seichter
* Phil Stracchino: > You know, it might be just me, but if I have configured a service A to > depend on a service B, and service B is unavailable, I would think of it > as CORRECT BEHAVIOR for service A to stop and post an alert "I can't > reach service B", rather than shrugging and proceeding

Re: Why the name Postfix?

2022-03-28 Thread Ralph Seichter
* Wietse Venema: > We tried a bunch of names for which I could register a domain name, > and each time the IBM naming authority would reject our choice. Sounds interesting. What exactly is, or was, "the IBM naming authority"? Is it an entity related to IBM's legal team? > Changing the name of a

Re: Setting Up Header Checks

2022-03-05 Thread Ralph Seichter
* Austin Witmer: > What do I need to modify in the Makefile.linux file for my Ubuntu > system? Who knows. You did not provide logs or error messages. Also, nobody but yourself knows the specifics of your platform. In any case, this is not a Postfix issue. Daniel Hartmeier, the author of milter-r

Re: Setting Up Header Checks

2022-02-26 Thread Ralph Seichter
* Austin Witmer: > It is my understanding that header checks are processed line by line If you want to enforce rules based on a combination of message headers, you should use a milter which can operate at the beginning of the SMTP DATA phase. At that time, all headers are available. I can recomm

Re: virtual_mailbox_maps & virtual_alias_maps

2022-02-21 Thread Ralph Seichter
* Phil Biggs: > There doesn't appear to be a way to say "here is user and this is his > email address". It seems to be assumed that user "Fred" will have an > email address of "fred@..." and no way to override that. https://doc.dovecot.org/configuration_manual/authentication/user_database_extra_f

Re: www.postfix.org not working from certain locations

2022-02-09 Thread Ralph Seichter
* Vladimir Mishonov: > It looks like www.postfix.org is not available if browsing from > certain locations within Russia and Belarus [...] The server hosting the Postfix website does not use any type of GeoIP based blocking. Could Roskomnadzor be involved, perhaps? -Ralph

[Ann] PostQF feature release 0.5

2022-02-06 Thread Ralph Seichter
In addition to filtering JSON input and producing JSON output in the process, PostQF can now also generate a number of simple reports to answer some frequently asked questions about message queue content. The following data can be shown in reports: * Delay reason * Recipient address * Recipi

[Ann] PostQF release 0.3

2022-01-28 Thread Ralph Seichter
Release 0.3 brings the following changes: * Output data is now correctly rendered as JSON instead of a Python dict, except for raw queue IDs. * Simplified installation process. In addition to pip based setup, an installation BASH script is now provided. The script can either be downloa

[Ann] PostQF feature release 0.2

2022-01-25 Thread Ralph Seichter
(Please don't worry, this will not become a daily event.) Based on your feedback and on plans I had earlier, I have added the following features: * The ability to use '-a' and '-b' time filters simultaneously, in order to specify time intervals. * Time filter strings can now use ISO 8601

Re: First public release of PostQF

2022-01-24 Thread Ralph Seichter
* Jaroslaw Rafa: > Isn't setting up a venv an "overkill" for using one simple utility? > Why couldn't it just use the system-installed Python? It can, as is documented. If you have root (or sudo) privileges, using "pip install postqf" will do the trick. However, this is new software, and people

Re: [Announcement] First public release of PostQF

2022-01-23 Thread Ralph Seichter
* Viktor Dukhovni: > Of course implementing a "jq" script with the same command-line > interface as "postqf" is not too difficult. Faced with the choice between doing that or writing Python code, I chose the latter. ;-) > The main difference is that the regular expression syntax in JQ is > somew

Re: [Announcement] First public release of PostQF

2022-01-23 Thread Ralph Seichter
* raf: > I suppose a shell alias or function could take care of that without > needing to type the extra option (e.g.: alias postqq='postqueue -j | > postqf'). Indeed. In typical Unix-pipeline fashion, PostQF reads from stdin and writes to stdout per default, and it is up to the user to provide t

[Announcement] First public release of PostQF

2022-01-23 Thread Ralph Seichter
Hello Postfix users. Hopefully neither Wietse nor you folks will mind me announcing my latest software baby here. ;-) I have just released version 0.1 of PostQF, a user-friendly Postfix queue data filter easily used in Unix-like pipes. For example postqueue -j | postqf -a 90m | wc -l prints t

Re: webmail question

2022-01-18 Thread Ralph Seichter
* Frank Hwa: > I like postfix and dovecot for setting up mail systems. But I don't > like roundcube or rainloop webmail. You might give SOGo (https://www.sogo.nu) a shot. -Ralph

Re: https://www.postfix.org/ in trouble

2022-01-16 Thread Ralph Seichter
* neustrada...@hotmail.com: > The goal is to have the main website https://postfix.org/ and all > links must be redirected to the same https://postfix.org/exampleofpage > link without lost with .htaccess rules. > > [...] > > We will enter in the future when it will be done! Oooh, the drama. :-)

Re: Attention : Official website without https

2022-01-15 Thread Ralph Seichter
* neustrada...@hotmail.com: > It is possible to add the certificate to have HTTPS for postfix.org? Check the mailing list archives; this has been discussed mere days ago. -Ralph

Re: Re: After smtp authentication failed, is it possible to accecpt and send the email as anonymous?

2022-01-11 Thread Ralph Seichter
* JWD: > Will permit_mynetworks parameter ignore smtp authentication, and > accept the email? Please see http://www.postfix.org/SMTPD_ACCESS_README.html#lists for detailed information about using access restriction lists. -Ralph

Re: After smtp authentication failed, is it possible to accecpt and send the email as anonymous?

2022-01-10 Thread Ralph Seichter
* JWD: > After smtp authentication failed, is it possible to accecpt and send > the email as anonymous? Can you provide more details on what you are trying to achieve? Generally speaking, you can use permit_mynetworks in your smtpd restrictions to exempt local clients from SMTP authentication. H

  1   2   3   4   >