[pfx] relocated: Allow custom message

2023-05-03 Thread Paul Menzel via Postfix-users
Dear Postfix users, Some of our users, that relocate, ask for a custom message over the current one: user has moved to new_location For example: This address is out of service. For business please contact funct...@company.example.net, or n...@private.example.net for private contac

[pfx] Re: relocated: Allow custom message

2023-05-03 Thread Paul Menzel via Postfix-users
Dear Matus, Thank you for your reply. Am 03.05.23 um 15:02 schrieb Matus UHLAR - fantomas via Postfix-users: On 03.05.23 14:53, Paul Menzel via Postfix-users wrote: Some of our users, that relocate, ask for a custom message over the current one:    user has moved to new_location For

[pfx] TLS client policy according to domain MTA-STS policy

2023-05-24 Thread Paul Menzel via Postfix-users
Dear Postfix folks, Running the *Public Email & DNS Testbed* [1], I was reminded, that we have MTA-STS set up, but do not take the MTAT-STS policy of other domains into account. As a solution I found *postfix-mta-sts-resolver* [2], which warns about a “RFC violation” [3]: ### Warning: MT

[pfx] Detect/extract attachments in broken messages composed by Apple Mail

2023-05-26 Thread Paul Menzel via Postfix-users
Dear Postfix folks, Apple Mail violates the standard [1], resulting in attachments only being shown in the HTML view. This behaviour is to be expected given the incorrect MIME structure of the message. It is: multipart/alternative text/plain multipart/mixed text/html attachment

[pfx] How to verify that DH key generation parameters from RFC 7919 are used?

2023-07-12 Thread Paul Menzel via Postfix-users
Dear Postfix folks, The Internet.nl email test, reports for molgen.mpg.de [1]: Key exchange parameters Verdict: At least one of your mail servers supports insufficiently secure parameters for Diffie-Hellman key exchange. Technical details: c1241.mx.srv.dfn.de.DH-2048 insufficien

[pfx] Re: How to verify that DH key generation parameters from RFC 7919 are used?

2023-07-12 Thread Paul Menzel via Postfix-users
Dear Ivan, Thank you very much for your reply. Am 12.07.23 um 10:16 schrieb Ivan Hadzhiev: You can copy from here: https://github.com/internetstandards/dhe_groups/blob/main/ffdhe4096.pem or you can create it openssl genpkey -genparam -algorithm DH -pkeyopt dh_param:ffdhe4096 -out /etc/postfi

[pfx] Re: SMTP client: How to log reason for untrusted TLS connection to MX?

2023-07-24 Thread Paul Menzel via Postfix-users
Dear Viktor, Thank you for your reply. Am 23.07.23 um 23:42 schrieb Viktor Dukhovni via Postfix-users: On Sun, Jul 23, 2023 at 11:22:26PM +0200, Paul Menzel wrote: Does it really matter why some site offering opportunistic STARTTLS does not have a validatable certificate? The connection can

[pfx] OT: Does the GPDR require mandatory/verified TLS encryption? (was: SMTP client: How to log reason for untrusted TLS connection to MX?)

2023-07-24 Thread Paul Menzel via Postfix-users
Dear Jaroslow, Am 24.07.23 um 19:02 schrieb Jaroslaw Rafa via Postfix-users: Dnia 24.07.2023 o godz. 17:05:40 Paul Menzel via Postfix-users pisze: (Also from the legal perspective, without being a lawyer, I’d say, that actually all German (European) companies are required to only transmit

[pfx] Re: email being flagged a spam for using localhost [127.0.0.1] as first hop

2023-08-08 Thread Paul Menzel via Postfix-users
Dear Fourhundred, Am 09.08.23 um 07:34 schrieb Fourhundred Thecat via Postfix-users: my email was flagged as spam by Microsoft. I have the received email, together with all the headers that Microsoft added. Specifically the item: X-Microsoft-Antispam-Message-Info: I have found a tool on gith

[pfx] How to hide Exim behind Postfix (Configuring Postfix as a proxy in front of Exim MTAs) (was: Possible (indirect) libspf2 security issues)

2023-09-30 Thread Paul Menzel via Postfix-users
Dear Postfix, Am 30.09.23 um 22:47 schrieb Viktor Dukhovni via Postfix-users: Recent news of security issues in Exim appear to in part implicate libspf2. […] Off-topic for Postfix users, but Tobias Fiebig published the article *Configuring Postfix as a proxy in front of Exim MTAs* [1]. K

[pfx] Re: logging username in a failed smtp attemps

2023-10-24 Thread Paul Menzel via Postfix-users
Dear Eric, Am 24.10.23 um 11:32 schrieb Eric Doutreleau via Postfix-users: i m using on my server postfix-3.5.8 and cyrus-sasl-2.1.27 I m using fail2ban too to prevent brute force attack. my problem is that when a connection failed because of wrong password i don't know what account is targ

[pfx] Re: (Patch "half-dane" logging corner case) Untrusted TLS connections where email domain does not support DNSSEC but MX server has DNSSEC/DANE records

2024-01-04 Thread Paul Menzel via Postfix-users
Dear Viktor, dear Wietse, Am 25.11.22 um 17:25 schrieb Viktor Dukhovni: On Fri, Nov 25, 2022 at 09:35:28AM -0500, Wietse Venema wrote: Viktor Dukhovni: However, in this case the issue is a minor oversight in the Postfix TLS client code. The intended logging behaviour does not happen. Patch

[pfx] How to reject messages on submission with typo in To address?

2024-01-21 Thread Paul Menzel via Postfix-users
Dear Postfix users, The Max Planck Society consists of several institutes/organizations each running their own email infrastructure (which is good, as it’s decentralized. Most of them have the a subdomain under mpg.de, and sometimes we notice users from our institute sending emails to collea

[pfx] Re: How to reject messages on submission with typo in To address?

2024-01-23 Thread Paul Menzel via Postfix-users
Dear Viktor, Thank you for the quick reply with a solution. Am 21.01.24 um 16:55 schrieb Viktor Dukhovni via Postfix-users: On Sun, Jan 21, 2024 at 09:39:06AM +0100, Paul Menzel wrote: pg.de is currently a parked domain, so our users will not going to email there, and I would like to reject

[pfx] Implementing From: field heuristic when sending messages?

2024-03-03 Thread Paul Menzel via Postfix-users
Dear Postfix users, A user had their password guessed/leaked, and the account was used to send spam/phishing messages – but only once an hour or so, so it wasn’t detected as abnormal traffic. One thing detectable thing would have been, that the sent unsolicited messages used a different name

[pfx] Re: vacation segfaults

2024-08-08 Thread Paul Menzel via Postfix-users
Dear Alex, Am 08.08.24 um 20:41 schrieb Alex via Postfix-users: On Thu, Aug 8, 2024 at 2:13 PM Wietse Venema wrote: Alex via Postfix-users: I've migrated my config and user data from a fedora38 system to a fedora40 system with postfix-3.8.5 and now vacation is segfaulting for some users.

[pfx] Re: vacation segfaults

2024-08-08 Thread Paul Menzel via Postfix-users
Dear Alex, A kind request in the beginning to not wrap the lines in the quotes. Am 08.08.24 um 21:07 schrieb Alex via Postfix-users: I've migrated my config and user data from a fedora38 system to a fedora40 system with postfix-3.8.5 and now vacation is segfaulting for some users. I don't und

[pfx] Re: vacation segfaults

2024-08-08 Thread Paul Menzel via Postfix-users
Dear Alex, Am 09.08.24 um 03:51 schrieb Alex via Postfix-users: Hi, Stack trace of thread 468215: #0 0x00404610 strlcpy (vacation + 0x4610) #1 0x00402e0e main (vacation + 0x2e0e) #2 0x7f2a6f8a00

[pfx] Options to deal with aliases to external domains in DANE setup?

2024-10-30 Thread Paul Menzel via Postfix-users
Dear Postfix folks, We use an external company for managing job applications. We set up the domain jobs.molgen.mpg.de as an alias, and the domain is used in email addresses for sending and receiving emails. $ host jobs.molgen.mpg.de jobs.molgen.mpg.de is an alias for cs-balancers-1.b