[pfx] Re: blacklistd issues

On 9 Jun 2025, at 21:46, Bill Cole via Postfix-users wrote: > > Is a blacklistd entry for port587 supposed to block port 25? > > I use blacklistd with ipfw, where the 'portxyz' tables are used in rules that > only block port xyz. I would expect that it does the same with pf. Same behavior wi

[pfx] Re: blacklistd issues

On 9 Jun 2025, at 21:34, Doug Hardie via Postfix-users wrote: > > Indeed it is just that. I dug into the port and found that blacklistd > support was an added patch. It only is called for failed authentication, not > for the other myriad of reasons that postfix will drop a connection. > Un

[pfx] Re: blacklistd issues

tables, but not blocking anything. I suspect the rule > (taken from the handbook for blacklistd) is the culprit. However, I have no > idea how to correct that. > > -- Doug > >> On Jun 9, 2025, at 06:13, Patrick Proniewski wrote: >> >> Hello, >> >

[pfx] Re: blacklistd issues

Hello, > On 9 Jun 2025, at 02:13, Doug Hardie via Postfix-users > wrote: > > I believe that pf is not properly blocking IPs that are supposedly blocked by > blacklistd. In trying to test this, I am using postfix. However, I don't > seem to be able to get postfix to call blacklistd. The app

[pfx] Re: spamlist checks

Hi, > On 23 Jun 2023, at 05:14, Fourhundred Thecat via Postfix-users > wrote: > > Spamhaus has some removal form on their website, but the page does not > work for me (it is stuck at: Checking if the site connection is secure) > > Anyway, I was trying to find out on which other spamlists I mig

[pfx] Re: Postfix: running a script on authentication failure

Hi, > On 22 Jun 2023, at 21:05, André Rodier via Postfix-users > wrote: > > What are you using on your side ? I'm running postfix on FreeBSD so I can use blacklistd. A blacklistd hook has been inserted in Postfix source code so treatment is triggered directly from events handled by Postfix.

[pfx] Re: Question to reject_rbl_client zen.spamhaus.org

On 9 Apr 2023, at 08:18, tom--- via Postfix-users wrote: > >> First off make sure that policyd isn't somehow returning an OK (or >> equivalent) response, if you're not sure temporarily remove >> "check_policy_service unix:private/policyd-spf," from your restrictions >> above and see if it mak

Re: Spammer succeeded in relaying through my server

On 21 Dec 2022, at 08:52, Peter wrote: > > On 21/12/22 20:35, Samer Afach wrote: >> Dear Pat: >> Thank you for throwing this idea, because I really thought it wasn't >> possible to retrieve docker logs without setup, but I dug and found the >> logs. I have them all. Unfortunately, I can't share

Re: Spammer succeeded in relaying through my server

Hello, Do you have the logs (postfix and maybe dovecot) showing the spammer interaction with the server? pat > On 21 Dec 2022, at 05:45, Samer Afach wrote: > > Thank you, Phil. Here we go. Here's postconf -n: > > > I hope this helps in better identifying how the spammer was able to use my

Re: filtering incoming email mail_from/reply to/from/etc.

Hi, I'm already using: smtpd_sender_restrictions = reject_unlisted_sender, check_sender_access hash:/etc/postfix/sender_access reject_unknown_sender_domain, reject_non_fqdn_sender, permit But the "loophole" here is that blank sender/return-path is allowed

Re: Announcement: LetsDNS release 1.0 is now available

Hello, This statement is at best off topic. Worst case scenario, it's toxic. And you can be polite, too. Thank you. > On 12 Apr 2022, at 16:58, Ruben Safir wrote: > > automated systems with root access are inherently not secure > > > On Tue, Apr 12, 2022 at 03:30:57PM +0200, Ralph Seichter w

Re: way to test delivery to me

On 01 Feb 2021, at 13:38, Viktor Dukhovni wrote: > > On Mon, Feb 01, 2021 at 12:09:38PM +, pat...@patpro.net wrote: > >> It's a risk I can take if I'm stuck but I'm willing to try the dual-sign >> method. > > I should mention that given the humongous sizes of your current > signatures, dua

Re: way to test delivery to me

On 31 Jan 2021, at 18:13, Wietse Venema wrote: > > Patrick Proniewski: >> I'm looking for a tool/service that would help me diagnose delivery problems >> to my server? Any hint appreciated. > What about good old telnet or netcat? because I'm looking for a way t

way to test delivery to me

Hello, I've got a strange problem with my MX server, that is not related to postfix: looks like neither Steam nor Binance can post email to me. I've had a discussion with Steam support, they said they have delivery failure on their side but couldn't provide more details than this: Time Attemp

Re: spamassassin & bayes

Hi, I've switched to REDIS for bayesian storage in Spamassassin more than 4 years ago, and I've never looked back: very good performances and no problem with files (like locking for a start). I wrote about it at the time, unfortunately it's in French ;) https://www.patpro.net/blog/index.php/2016

put message on HOLD based on sender & recipient

Hello, What would be the best way to hold an incoming email that match both criteria From=foo and To=bar? First I thought about header_checks with something like: if /^From:.*foo.*/ /^To:.*bar.*/ HOLD endif but obviously it can't work as headers are processed 1 by 1. The final solution will hav

Re: SMTPUTF8 problem with Exchange servers

On 17 juin 2020, at 22:05, Viktor Dukhovni wrote: > > On Wed, Jun 17, 2020 at 10:00:32PM +0200, Patrick Proniewski wrote: > >>> - disable SMTPUTF8 in Postfix. >> >> That means disabling it everywhere and let messages bounce on MX servers. >> Would n

Re: SMTPUTF8 problem with Exchange servers

Hello, > On 17 juin 2020, at 16:28, Wietse Venema wrote: > > Patrick Proniewski: >> Jun 17 12:34:20 postfix-mailgw/smtp[77347]: 57F56EB256: >> to=, orig_to=, >> relay=Exchange-VIP[Exchange-VIP]:25, delay=0.01, delays=0.01/0/0/0, >> dsn=5.6.7, status=bounced (

Re: SMTPUTF8 problem with Exchange servers

Hello, > On 17 juin 2020, at 22:48, @lbutlr wrote: > > On 17 Jun 2020, at 14:00, Patrick Proniewski wrote: >> Not possible yet. A flag exists for Exchange 2019 but we are running 2016 >> now and upgrade is not scheduled for now. > > Perhaps showing the bounci

Re: SMTPUTF8 problem with Exchange servers

Hi, > On 17 juin 2020, at 15:42, Bastian Blank > wrote: > > On Wed, Jun 17, 2020 at 02:37:23PM +0200, Patrick Proniewski wrote: >> For some time now I notice that some messages, either originating from >> Internet or from internal servers are bounced when they ar

Re: SMTPUTF8 problem with Exchange servers

Hi, > On 17 juin 2020, at 15:08, Matus UHLAR - fantomas wrote: > > On 17.06.20 14:37, Patrick Proniewski wrote: >> I have at work a Postfix infrastructure that sits between Internet and our >> Exchange servers. Postfix is used for MX and SMTP roles, ensure filtering &

SMTPUTF8 problem with Exchange servers

Hello, I have at work a Postfix infrastructure that sits between Internet and our Exchange servers. Postfix is used for MX and SMTP roles, ensure filtering with Amavisd/Clamav/etc. For some time now I notice that some messages, either originating from Internet or from internal servers are bounc

Re: dnsblog filtering?

Hi, > On 10 juin 2020, at 05:22, PGNet Dev wrote: > > On 6/9/20 8:15 PM, Noel Jones wrote: >> Postfix assumes the logs are private. > > They generally are. The very-recent switch to BLs with Acct-ID's is new, and > complicated that a bit. > >> To sanitize the log, you'll need to use an exter

Re: Preferred/maintained greylisting options?

On 25 mai 2020, at 13:56, Michael wrote: > > I've found the Barracuda rbl to be very useful. > > https://www.barracudacentral.org/rbl I'm using paid spamhaus RBL (local zone file rsynched) for a very long time, at work, and we are very happy about it. I use complementary RBL also like fresh.

Re: Preferred/maintained greylisting options?

Hello, > On 25 mai 2020, at 03:59, Vincent Pelletier wrote: > > On Fri, May 22, 2020 at 5:43 AM Ralph Seichter wrote: >> Yeah, delays... Used to be people understood the difference between >> asynchronous messaging (i.e. email) and instant messaging. Nowadays it >> seems that no day goes by wit

Re: filtering locally submitted emails / tidying up the config

-* headers. My bad. thank you all. patpro > On 02 mai 2020, at 19:36, Patrick Proniewski wrote: > > On 02 mai 2020, at 19:25, Matus UHLAR - fantomas wrote: >> >> On 02.05.20 17:46, Patrick Proniewski wrote: >>> well in fact I've tried the

Re: filtering locally submitted emails / tidying up the config

On 02 mai 2020, at 19:25, Matus UHLAR - fantomas wrote: > > On 02.05.20 17:46, Patrick Proniewski wrote: >> well in fact I've tried the default settings first ("client" as per >> <https://manpages.debian.org/testing/amavisd-milter/amavisd-milter.8.en.html#D>

Re: filtering locally submitted emails / tidying up the config

> On 02 mai 2020, at 18:09, Bob Proulx wrote: > >> Unfortunately I've discovered that Amavisd is unable to add headers >> I want as it would do as an smtp proxy filter. >> It will properly add: >> >> X-Virus-Scanned: my custom tag >> X-Crm114-Status: UNSURE ( 6.79 ) > > Those two mi

Re: filtering locally submitted emails / tidying up the config

On 02 mai 2020, at 15:13, Bastian Blank wrote: > > On Sat, May 02, 2020 at 11:40:52AM +0200, Patrick Proniewski wrote: >> It negates the benefit you were writing about as amavisd-milter will drop >> the message on the milter interface (postfix/cleanup[26401]: 87E5316135:

Re: filtering locally submitted emails / tidying up the config

On 02 mai 2020, at 14:19, Wietse Venema wrote: > > Patrick Proniewski: >> It negates the benefit you were writing about as amavisd-milter >> will drop the message on the milter interface (postfix/cleanup[26401]: >> 87E5316135: milter-discard: END-OF-MESSAGE from localho

Re: filtering locally submitted emails / tidying up the config

On 01 mai 2020, at 18:28, Wietse Venema wrote: >> >> would there be a performance/functionality penalty switching from >> smtpd_proxy_filter to smtpd_milters/non_smtpd_milters? > > It will be faster, because it avoids the need to deliver the whole > message outside of Postfix, and then to receiv

Re: filtering locally submitted emails / tidying up the config

Thanks Wietse, > On 01 mai 2020, at 15:37, Wietse Venema wrote: > > Patrick Proniewski: >> I really feel like my setup needs some cleanup and I'm not sure were to >> start. Some of you have suggested to me, in the past, that I could move to >> amavisd-milter i

filtering locally submitted emails / tidying up the config

Hello, I've been using postfix with great success and delight for many years now, but my config has become quite messy over time, with additions like dkim/spf/dmarc and various filtering options. I'm currently having a problem with some locally generated emails (eg. sendmail command). I would l

Re: Building recipient maps from Exchange/O365

Hi, I'm using an hourly shell script to retrieve from our AD the proper LDAP records, and an AWK script to transform this output into an alias map (our Exchange setup uses a different internal address from the public external address). This alias map is later used to create a list of allowed re

Re: Postfix web interface for log analysis

Hi Emanuel, > Is there any web interface exists for postfix email log analysis? What I > need is to see all the logs through web interface, see the reports of > rejection, deferred, bounces, success etc. w.r.t. datetime and/or domain > filter etc. If you have a moderate volume of logs (less than

Re: 5XX vs 4XX

Hi > On 02 nov. 2019, at 19:44, John Schmerold wrote: > > I have a few email addresses that were valid 15 years ago, but they have been > invalid for 5+ years, we are rejecting them with a 450 message, my thought is > "Let's tie up this spammer's computer just a little bit" > > Good idea? Bad

Re: how to use (open)dmarc when already doing before-queue content filtering?

On 25 févr. 2019, at 20:23, Peter wrote: > > On 24/02/19 08:47, Patrick Proniewski wrote: >> I'm also using postscreen, but it doesn't provide the same filtering >> as a regular greylist. And milter-greylist is nice enough to >> synchronise between mult

Re: how to use (open)dmarc when already doing before-queue content filtering?

On 25 févr. 2019, at 19:55, Viktor Dukhovni wrote: > > On Mon, Feb 25, 2019 at 07:43:49PM +0100, Patrick Proniewski wrote: > >> Then, I'm currently trying another approach. In my current setup, I've an >> amavisd sandwich: outer-smtp->amavisd->inner-smtp. I

Re: how to use (open)dmarc when already doing before-queue content filtering?

Hi, > On 23 févr. 2019, at 23:03, Matus UHLAR - fantomas wrote: > >> Anyway is there any alternative to opendmarc that would be compatible with >> BQCF? I realize a good place for that would be inside Amavisd-new, but >> this feature is not available :/ > > whatever it is, running it as milter

Re: how to use (open)dmarc when already doing before-queue content filtering?

On 23 févr. 2019, at 20:58, Viktor Dukhovni wrote: > >> On Feb 23, 2019, at 2:47 PM, Patrick Proniewski wrote: >> >> My try was a reply to Andrey saying that it's working and I should try. > > Milters that inspect message content can only be used downstream o

Re: how to use (open)dmarc when already doing before-queue content filtering?

On 23 févr. 2019, at 18:49, Matus UHLAR - fantomas wrote: > > I believe you read it correctly, and I found it interesting that something > is documented, behaves like documented and yet you wonder about it. I don't wonder about it. See my first post where I wrote: > I would like to add opendmar

Re: how to use (open)dmarc when already doing before-queue content filtering?

Hello, > On 22 févr. 2019, at 23:20, Andrey Repin wrote: > >> I would like to add opendmarc for DMARC checking of inbound emails but it >> looks like it's only available as a milter. Unfortunately, last time I'v >> checked, milter couldn't modify emails when used in a before-queue content >> fil

how to use (open)dmarc when already doing before-queue content filtering?

Hello, I'm using postfix for years with this setup : milter-greylist policyd-spf in check_policy_service amavisd-new as a before-queue content filter opendkim signature for outbound emails It's working really great. I would like to add opendmarc for DMARC checking of inbound emails but it looks

Re: Need help about pcre REGEX header check

On 18 avr. 2014, at 17:18, Joachim Coqblin wrote: > /From:(*tomorrowltd.*.)/i REJECT "Die spammer!!" what about /From: .*tomorrowltd\..*/i REJECT "bye" Patrick

Re: log format (feature request)

On 17 avr. 2014, at 08:33, Robert Schetterer wrote: > perhaps off topic, with using postix and graylog2 i was advised to use > massive pre filter with syslog daemon before "inject" to graylog2 > so this may help you tmp too, but for sure ,its very complex I'm currently trying to adapt grok patter

Re: log format (feature request)

On 16 avr. 2014, at 21:39, Wietse Venema wrote: > Patrick Proniewski: >> That would be really awesome if Postfix could log into a structured >> format. I'm thinking about JSON, because that's what >> logstash/elasticsearch eats. But any key=value output is fin

log format (feature request)

Hi all, I love Postfix and I use it everywhere I can. At work, I now have about 6 of them for different uses. My MX alone accepts about 1 million messages per month. I must (forensic/support request/law) keep logs from all these Postfix servers, and more importantly I must be able to browse/sea

Re: limited syntax in regexp:header_checks ?

On 16 mai 2013, at 14:26, Wietse Venema wrote: > Patrick Proniewski: >> Hello, >> >> I'm trying to create an header_check filter (regexp format) that >> would issue a warning (or info) when the "References:" header is >> longer than 800 charac

limited syntax in regexp:header_checks ?

Hello, I'm trying to create an header_check filter (regexp format) that would issue a warning (or info) when the "References:" header is longer than 800 characters. I've discovered that using this kind of syntax won't work: /^References: .\{800,\}$/ INFO too long /^Refere

header_checks oddities

Hello, Few months ago, I've switched my postfix setup from "regular" greylisting to "milter" greylisting, and it appears to have changed few things about header_checks I didn't notice until yesterday. My setup uses before-queue content filtering: # Before-filter SMTP server. Receive mail from t

Re: postfix / dkim: no signature for emails submitted through ssh tunnel

Finally, after an interesting discussion over this issue on opendkim-users, I've been able to google my way out, with a solution from Wietse: thanks, On 17 mars 2013, at 14:51, patrick.proniew...@free.fr

Re: postfix / dkim: no signature for emails submitted through ssh tunnel

On 17 mars 2013, at 00:38, Noel Jones wrote: > On 3/16/2013 2:51 PM, patrick.proniew...@free.fr wrote: >> Hello, >> >> I have a small problem with my postfix/dkim setup: >> >> - dkim properly sign every emails I send via my webmail frontend, crontab, >> or the mail command from the server. >>

postfix / dkim: no signature for emails submitted through ssh tunnel

Hello, I have a small problem with my postfix/dkim setup: - dkim properly sign every emails I send via my webmail frontend, crontab, or the mail command from the server. - dkim won't sign emails I send from my workstation to my server via an ssh tunnel. transcript for a webmail sending: r

Re: enabling double delivery for some users

On 24 nov. 2012, at 23:40, Wietse Venema wrote: >>> I believe the same properties hold with recipients added via >>> recipient_bcc_maps (automatic NOTIFY=NEVER up to the last forward-path >>> MTA that supports DSN). Therefore, it may be simpler to use bcc maps, >>> rather than implement a proxy fi

enabling double delivery for some users

Hello, I want to enable double delivery for selected users into my MX servers. My MX servers (I have two, load balanced through a Cisco ACE) are only relay servers, once filtered and accepted, emails are transported to a gateway that performs, if needed address rewrite, and dispatch. On MX serv

Re: Questions about queue cli commands

d mail in the delivery process of postfix (to force > the retry of the delivery) > > - postsuper -r ALL -r is not for retry, it's for requeue. Don't use it unless you really want the requeue process to be done. Use postqueue -f instead. Patrick PRONIEWSKI -- Administrateu

Re: virtual aliases and unlisted email addresses

On 9 juin 2011, at 17:46, Victor Duchovni wrote: > On Thu, Jun 09, 2011 at 10:12:17AM +0200, Patrick Proniewski wrote: > >> On 8 juin 2011, at 18:15, Victor Duchovni wrote: >> >>> On Wed, Jun 08, 2011 at 11:33:48AM +0200, Patrick Proniewski wrote: >>> >

Re: virtual aliases and unlisted email addresses

On 8 juin 2011, at 18:15, Victor Duchovni wrote: > On Wed, Jun 08, 2011 at 11:33:48AM +0200, Patrick Proniewski wrote: > >> After the period of double delivery is over, we will deliver emails only to >> Google servers. So the virtual aliases map is to look like: >> >

virtual aliases and unlisted email addresses

on2.frpublic-addr...@univ-lyon2.fr ... The first line looks pretty silly to me. Is there any way to tell that addresses not listed in virtual aliases map are to be forwarded "as is" ? Thanks, Patrick PRONIEWSKI -- Administrateur Système - DSI - Université Lumière Lyon 2

Re: some watchdog timeout

igher. I'm running Postfix 2.7.1 on top of FreeBSD 7.3-RELEASE-p2 #0, amd64, on top of ESXi 4 But if it's linked to virtualization, it might be a vmware tools problem... Patrick PRONIEWSKI -- Administrateur Système - SENTIER - Université Lumière Lyon 2 smime.p7s Description: S/MIME cryptographic signature

Re: some watchdog timeout

re Tools. I'll try to get some support from VMWare (and FreeBSD users), but if someone here has an idea (vmware issue? bios tuning? freebsd tuning?...) I'd be happy to read about it. thanks, Patrick PRONIEWSKI -- Administrateur Système - SENTIER - Université Lumière Lyon 2 smime.p

some watchdog timeout

tination. Any idea about where I should start looking? Patrick PRONIEWSKI -- Administrateur Système - SENTIER - Université Lumière Lyon 2 smime.p7s Description: S/MIME cryptographic signature

Re: timeout trouble with postfix and amavisd in BQCF

eyDB perl module). enable_db=0 does the trick, for now. I've found this about amavisd and BDB performance problem on FreeBSD: <http://www.mail-archive.com/amavis-u...@lists.sourceforge.net/msg15381.html> I'll test ASAP. regards, Patrick PRONIEWSKI -- Administrateur

Re: timeout trouble with postfix and amavisd in BQCF

without high machine load... I'll double check my settings, but in theory, I don't use RBL for inside email traffic filtering. Patrick PRONIEWSKI -- Administrateur Système - SENTIER - Université Lumière Lyon 2

Re: timeout trouble with postfix and amavisd in BQCF

"smtp" or "smtp"->"mailgw"->"smtp" or "smtp-liste"->"mailgw"->"smtp" (recipient address in our domain, but finally rewritten into an external address) is very low. These days, this traffic is higher, because addresses of +2000 users are aliased to a remote domain (it's 7% of our active users, 3% of our total users list), so we have many emails going from "mailgw" to "smtp". But I don't see how few more emails can wreak havoc in amavisd. That would be a good idea to plug "mailgw"-to-"smtp" traffic on an smtpd without filtering. Patrick PRONIEWSKI -- Administrateur Système - SENTIER - Université Lumière Lyon 2 smime.p7s Description: S/MIME cryptographic signature

Re: timeout trouble with postfix and amavisd in BQCF

quot;smtp" and "smtp-liste" postfix instances are sending local domain emails to "mailgw", "smtp-liste" send huge bursts of emails (like 3 recipients in 2-3 minutes), and it can greatly impact normal email delivery. So I throttle "smtp-liste" so that physical users emails posted via "smtp" are not delayed by a (useless) corporate emailing. Thank you very much for your reply Patrick PRONIEWSKI -- Administrateur Système - SENTIER - Université Lumière Lyon 2 smime.p7s Description: S/MIME cryptographic signature

timeout trouble with postfix and amavisd in BQCF

ot;smtp-liste" to "eat" every possible connexion to "smtp" during a local emailing, I've set it's smtp_destination_concurrency_limit to 1, so that other more legitimate clients (3 physical users) can still send emails during a local emailing. Let me know if you n

Re: Better spam filter for postfix

very fast, but it works. In France, we have a similar limitation: it's illegal to destroy a communication (mail, email…). With BQCF spam is rejected, not destroyed. Patrick PRONIEWSKI -- Administrateur Système - SENTIER - Université Lumière Lyon 2 smime.p7s Description: S/MIME cryptographic signature