Re: use of inet_protocols= option in policy maps?

2022-02-04 Thread PGNet Dev
On 2/3/22 9:28 AM, Viktor Dukhovni wrote: Multiple transports can use the same policy table: relay-test4 unix - - n - - smtp ... -o inet_protocols=ipv4 -o smtp_tls_policy_maps=${def_db_type}:${conf_dir}/test/relay_tls_policy relay-test6 unix

Re: Add a disclaimer for all senders

2022-02-04 Thread Forums
I checked the logs again and I can't see any error message "warning" "error" "fatal" "panic". For testing, my disclaimer script just write something in /tmp/file. On master.cf I have this: smtp  inet  n   -   y   -   1 postscreen     -o content_filter=disclaimer: [...]

Re: Add a disclaimer for all senders

2022-02-04 Thread Viktor Dukhovni
> =On 4 Feb 2022, at 8:39 am, Forums wrote: > > smtp inet n - y - 1 postscreen > -o content_filter=disclaimer: The postscreen(8) program does not implement content filters. That setting should be for smtpd(8). -- Viktor.

Re: Add a disclaimer for all senders

2022-02-04 Thread Forums
Using "smtpd" instead of "postscreen" doesn't change issue. Le 04/02/2022 à 14:59, Viktor Dukhovni a écrit : =On 4 Feb 2022, at 8:39 am, Forums wrote: smtp inet n - y - 1 postscreen -o content_filter=disclaimer: The postscreen(8) program does not

Re: Add a disclaimer for all senders

2022-02-04 Thread Viktor Dukhovni
> On 4 Feb 2022, at 9:05 am, Forums wrote: > > Using "smtpd" instead of "postscreen" doesn't change issue. You'll have to back up that claim with: # postfix reload ... submission of a new message via TCP port 25 ... ... logs showing that message entering and leaving the

Using pkcs11 instead of plaintext certificates

2022-02-04 Thread Tobias Meyer
Hello list, Would anyone know if it is possible to configure pkcs11 as a signature source for TLS encryption in postfix? My concrete use-case would be to enable the use of Nitro Enclaves and native certificate management in AWS, but it would apply to just about any hardware security module as well

Re: Using pkcs11 instead of plaintext certificates

2022-02-04 Thread Viktor Dukhovni
On Fri, Feb 04, 2022 at 03:10:41PM +0100, Tobias Meyer wrote: > Would anyone know if it is possible to configure pkcs11 as a signature > source for TLS encryption in postfix? Sorry, only PEM files are supported (for SNI the base64 encoded content the file may need to be copied into a database tab

Re: Using pkcs11 instead of plaintext certificates

2022-02-04 Thread Tobias Meyer
> > Sorry, only PEM files are supported (for SNI the base64 encoded content > the file may need to be copied into a database table via "postmap -F"). > > Support for PKCS#11 is not presently available. > > Hello Viktor, Thanks for your prompt reply. Since openssl already supports pkcs#11 and postf

Re: Using pkcs11 instead of plaintext certificates

2022-02-04 Thread Viktor Dukhovni
On Fri, Feb 04, 2022 at 04:06:10PM +0100, Tobias Meyer wrote: > > Sorry, only PEM files are supported (for SNI the base64 encoded content > > the file may need to be copied into a database table via "postmap -F"). > > > > Support for PKCS#11 is not presently available. > > Since OpenSSL already su

Re: Using pkcs11 instead of plaintext certificates

2022-02-04 Thread Tobias Meyer
On Fri, Feb 4, 2022 at 4:57 PM Viktor Dukhovni wrote: > On Fri, Feb 04, 2022 at 04:06:10PM +0100, Tobias Meyer wrote: > > > Since OpenSSL already supports PKCS#11 and Postfix uses OpenSSL, do > > you think adding support might be a task someone with a little C/C++ > > background and a solid, but

Re: Add a disclaimer for all senders

2022-02-04 Thread Matus UHLAR - fantomas
On 4 Feb 2022, at 9:05 am, Forums wrote: Using "smtpd" instead of "postscreen" doesn't change issue. On 04.02.22 09:09, Viktor Dukhovni wrote: You'll have to back up that claim with: # postfix reload ... submission of a new message via TCP port 25 ... ... logs showing t

Multi-instance and outbound fails SPF

2022-02-04 Thread Alex
Hi, I have a multi-instance postfix config and am trying to figure out why Microsoft 365 is marking my email from the outbound instance as SPF softfail. I am trying to send mail from my gmail account to the multi-instance postfix system through to my Microsoft 365 account, where I've set up mail f

Re: Multi-instance and outbound fails SPF

2022-02-04 Thread Wietse Venema
Alex: > Hi, > I have a multi-instance postfix config and am trying to figure out why > Microsoft 365 is marking my email from the outbound instance as SPF > softfail. > > I am trying to send mail from my gmail account to the multi-instance > postfix system through to my Microsoft 365 account, wher

Re: Multi-instance and outbound fails SPF

2022-02-04 Thread Scott Kitterman
On Friday, February 4, 2022 3:14:29 PM EST Wietse Venema wrote: > Alex: > > Hi, > > I have a multi-instance postfix config and am trying to figure out why > > Microsoft 365 is marking my email from the outbound instance as SPF > > softfail. > > > > I am trying to send mail from my gmail account to

Re: Multi-instance and outbound fails SPF

2022-02-04 Thread Viktor Dukhovni
On Fri, Feb 04, 2022 at 02:34:35PM -0500, Alex wrote: > I have a multi-instance postfix config and am trying to figure out why > Microsoft 365 is marking my email from the outbound instance as SPF > softfail. Because you're forwarding email received from an external domain, and it is *that* (enve

ipv6 only postfix server

2022-02-04 Thread Jack Raats
I have an ipv6 only server running postfix. Mailing to and from an ipv6 server is no problem. BUT: How to mail to an ipv4 only server? Which options do I have? Gr., Jack Raats

Re: ipv6 only postfix server

2022-02-04 Thread Laura Smith
--- Original Message --- On Friday, February 4th, 2022 at 20:48, Jack Raats wrote: > > BUT: > > How to mail to an ipv4 only server? > > Which options do I have? > > Gr., > > Jack Raats That's really a question for your ISP to answer. ;-) Basically there needs to be a gateway somewhe

ADDRESS_VERIFICATION_README

2022-02-04 Thread postfix
If i missed this answer on the docs im sorry. In using address verification it is very clear that any "reject" from the remote mail server would result in the email triggering the verification to be rejected. But i do not see anything about 4xx defer responses. What if the remote server is doin

Re: ADDRESS_VERIFICATION_README

2022-02-04 Thread Viktor Dukhovni
On Fri, Feb 04, 2022 at 04:16:47PM -0500, post...@ptld.com wrote: > In using address verification it is very clear that any "reject" from > the remote mail server would result in the email triggering the > verification to be rejected. But i do not see anything about 4xx defer > responses. What if

Re: ADDRESS_VERIFICATION_README

2022-02-04 Thread postfix
On 02-04-2022 4:19 pm, Viktor Dukhovni wrote: > On Fri, Feb 04, 2022 at 04:16:47PM -0500, post...@ptld.com wrote: > >> In using address verification it is very clear that any "reject" from >> the remote mail server would result in the email triggering the >> verification to be rejected. But i do n

Re: ipv6 only postfix server

2022-02-04 Thread Jack Raats
Op 04-02-2022 om 21:57 schreef Laura Smith: --- Original Message --- On Friday, February 4th, 2022 at 20:48, Jack Raats wrote: BUT: How to mail to an ipv4 only server? Which options do I have? Gr., Jack Raats That's really a question for your ISP to answer. ;-) Basically ther

Re: ADDRESS_VERIFICATION_README

2022-02-04 Thread Wietse Venema
post...@ptld.com: > On 02-04-2022 4:19 pm, Viktor Dukhovni wrote: > > On Fri, Feb 04, 2022 at 04:16:47PM -0500, post...@ptld.com wrote: > > > >> In using address verification it is very clear that any "reject" from > >> the remote mail server would result in the email triggering the > >> verificat

Re: ipv6 only postfix server

2022-02-04 Thread Wietse Venema
Jack Raats: > Is it possible to send mail directly to an ipv6 and ipv4 (all) > mailserver and using the relayhost? for an ipv4 only mailserver? Use smtp_fallback_relay. Wietse

Re: ipv6 only postfix server

2022-02-04 Thread Benny Pedersen
On 2022-02-04 21:48, Jack Raats wrote: I have an ipv6 only server running postfix. Mailing to and from an ipv6 server is no problem. BUT: How to mail to an ipv4 only server? Which options do I have? ipv10 is the only one to wait for https://datatracker.ietf.org/doc/html/draft-omar-ipv10-06.ht

Re: ipv6 only postfix server

2022-02-04 Thread Viktor Dukhovni
> On 4 Feb 2022, at 5:58 pm, Benny Pedersen wrote: > > On 2022-02-04 21:48, Jack Raats wrote: >> I have an ipv6 only server running postfix. Mailing to and from an >> ipv6 server is no problem. >> BUT: >> How to mail to an ipv4 only server? >> Which options do I have? > > ipv10 is the only one t

Re: Multi-instance and outbound fails SPF

2022-02-04 Thread Alex
Hi, > > I have a multi-instance postfix config and am trying to figure out why > > Microsoft 365 is marking my email from the outbound instance as SPF > > softfail. > > Because you're forwarding email received from an external domain, > and it is *that* (envelope sender) domain's SPF records that

Re: Multi-instance and outbound fails SPF

2022-02-04 Thread Viktor Dukhovni
On Fri, Feb 04, 2022 at 08:16:49PM -0500, Alex wrote: > > Unless you're "google.com", or "google.com" lists your IPs in its SPF > > records, SPF is *supposed* to fail. This is why DKIM was invented, it > > survives simple verbatim forwarding. > > So signing my message as it leaves my server is t