]> git.ipfire.org Git - thirdparty/postfix.git/commitdiff
postfix-3.6-20210131
authorWietse Venema <wietse@porcupine.org>
Sun, 31 Jan 2021 05:00:00 +0000 (00:00 -0500)
committerViktor Dukhovni <postfix-users@dukhovni.org>
Sun, 7 Feb 2021 22:23:48 +0000 (20:23 -0200)
26 files changed:
postfix/HISTORY
postfix/README_FILES/COMPATIBILITY_README
postfix/RELEASE_NOTES
postfix/WISHLIST
postfix/conf/transport
postfix/html/COMPATIBILITY_README.html
postfix/html/postconf.5.html
postfix/html/smtpd.8.html
postfix/html/transport.5.html
postfix/man/man5/postconf.5
postfix/man/man5/transport.5
postfix/man/man8/smtpd.8
postfix/mantools/postlink
postfix/proto/COMPATIBILITY_README.html
postfix/proto/postconf.proto
postfix/proto/transport
postfix/src/dns/dns.h
postfix/src/dns/dns_sec.c
postfix/src/flush/flush.c
postfix/src/global/mail_params.c
postfix/src/global/mail_params.h
postfix/src/global/mail_version.h
postfix/src/global/record.c
postfix/src/smtpd/smtpd.c
postfix/src/smtpd/smtpd_check.c
postfix/src/util/stringops.h

index 27bc384d03e19fd0320f33200bfa6764cb2071b3..7df9fbeda677a6ed4c9c150d968b968d308f55ee 100644 (file)
@@ -25353,3 +25353,33 @@ Apologies for any names omitted.
 
        Bugfix: the 20210109 change broke 'postfix reload' for the
        master daemon. File: global/mail_params.c.
+
+20210111
+
+       Cleanup: compiler warning for casting '0' to the wrong type
+       (zero impact). File: dns/dns_sec.c .
+
+       Cleanup: after back-porting the dnssec_probe implementation
+       to Postfix 3.5 and earlier versions, forward-ported some
+       comment and documentation changes to the 3.6 releases.
+       Files: proto/postconf.proto, RELEASE_NOTES, dns/dns.h.
+
+20210113
+
+       Workaround: STRREF() macro to shut up compiler warnings for
+       legitimate expressions involving string constants. Files:
+       util.stringops.h, flush/flush.c.
+
+20210130
+
+       Feature: with smtpd_relay_before_recipient_restrictions=yes,
+       the Postfix SMTP server will evaluate smtpd_relay_restrictions
+       before smtpd_recipient_restrictions. This is the default
+       behavior with compatibility_level >= 3.6. This makes the
+       implemented behavior consistent with existing documentation.
+       There is a backwards-compatibility warning that allows users
+       to freeze historical behavior. Files: mantools/postlink,
+       proto/COMPATIBILITY_README.html, proto/postconf.proto,
+       global/mail_params.c, global/mail_params.h, smtpd/smtpd.c,
+       smtpd/smtpd_check.c.
+
index 42a600c44f951e78b8e69bf7812c39ff2261e6f8..8dc4f7d25ba22ac31dfb1573dce51734197935b6 100644 (file)
@@ -33,8 +33,8 @@ The following messages may be logged:
 
   * Using backwards-compatible default setting chroot=y
 
-  * Using backwards-compatible default setting smtpd_relay_restrictions =
-    (empty)
+  * Using backwards-compatible default setting "smtpd_relay_restrictions =
+    (empty)"
 
   * Using backwards-compatible default setting mynetworks_style=subnet
 
@@ -48,6 +48,9 @@ The following messages may be logged:
 
   * Using backwards-compatible default setting lmtp_tls_fingerprint_digest=md5
 
+  * Using backwards-compatible default setting
+    smtpd_relay_before_recipient_restrictions=no
+
 If such a message is logged in the context of a legitimate request, the system
 administrator should make the backwards-compatible setting permanent in main.cf
 or master.cf, as detailed in the sections that follow.
@@ -306,6 +309,36 @@ update your compatibility level.
         '\b'l\blm\bmt\btp\bp_\b_t\btl\bls\bs_\b_f\bfi\bin\bng\bge\ber\brp\bpr\bri\bin\bnt\bt_\b_d\bdi\big\bge\bes\bst\bt =\b= m\bmd\bd5\b5'\b'
     # p\bpo\bos\bst\btf\bfi\bix\bx r\bre\bel\blo\boa\bad\bd
 
+U\bUs\bsi\bin\bng\bg b\bba\bac\bck\bkw\bwa\bar\brd\bds\bs-\b-c\bco\bom\bmp\bpa\bat\bti\bib\bbl\ble\be d\bde\bef\bfa\bau\bul\blt\bt s\bse\bet\btt\bti\bin\bng\bg
+s\bsm\bmt\btp\bpd\bd_\b_r\bre\bel\bla\bay\by_\b_b\bbe\bef\bfo\bor\bre\be_\b_r\bre\bec\bci\bip\bpi\bie\ben\bnt\bt_\b_r\bre\bes\bst\btr\bri\bic\bct\bti\bio\bon\bns\bs=\b=n\bno\bo
+
+The smtpd_relay_before_recipient_restrictions feature was introduced in Postfix
+version 3.6, to evaluate smtpd_relay_restrictions before
+smtpd_recipient_restrictions. Historically, smtpd_relay_restrictions was
+evaluated after smtpd_recipient_restrictions, contradicting documented
+behavior.
+
+    Background: smtpd_relay_restrictions is primarily designed to enforce a
+    mail relaying policy, while smtpd_recipient_restrictions is primarily
+    designed to enforce spam blocking policy. Both are evaluated while replying
+    to the RCPT TO command, and both support the same features.
+
+When the compatibility_level less than 3.6, and the
+smtpd_relay_before_recipient_restrictions parameter is left at its implicit
+default setting, Postfix may log the following message:
+
+    postfix/smtpd[54696]: using backwards-compatible default setting
+        smtpd_relay_before_recipient_restrictions=no to reject recipient
+        "user@example.com" from client "host.example.net[10.0.0.2]"
+
+If Postfix should keep evaluating smtpd_recipient_restrictions before
+smtpd_relay_restrictions, then the system administrator should make the
+backwards-compatible setting "smtpd_relay_before_recipient_restrictions=no"
+permanent in main.cf:
+
+    #  p\bpo\bos\bst\btc\bco\bon\bnf\bf s\bsm\bmt\btp\bpd\bd_\b_r\bre\bel\bla\bay\by_\b_b\bbe\bef\bfo\bor\bre\be_\b_r\bre\bec\bci\bip\bpi\bie\ben\bnt\bt_\b_r\bre\bes\bst\btr\bri\bic\bct\bti\bio\bon\bns\bs=\b=n\bno\bo
+    #  p\bpo\bos\bst\btf\bfi\bix\bx r\bre\bel\blo\boa\bad\bd
+
 T\bTu\bur\brn\bni\bin\bng\bg o\bof\bff\bf t\bth\bhe\be b\bba\bac\bck\bkw\bwa\bar\brd\bds\bs-\b-c\bco\bom\bmp\bpa\bat\bti\bib\bbi\bil\bli\bit\bty\by s\bsa\baf\bfe\bet\bty\by n\bne\bet\bt
 
 Backwards compatibility is turned off by updating the compatibility_level
index 71e75f0ff1fe0e7a48a308ebff8aebfc38f83c9f..863d34d5caf5e1f3a880ab6865b00ec54926dcaa 100644 (file)
@@ -102,7 +102,7 @@ implementation.
 Major changes with snapshot 20200930
 ====================================
 
-When a Postfix process requires DNSSEC support (typically, for
+When a Postfix process requests DNSSEC support (typically, for
 Postfix DANE support), the process may do a one-time test to determine
 if DNSSEC validation is available. DNSSEC support may be broken
 because of local configuration, libc incompatibility, or network
index 93fd54cbef647a7eb4ee8add9c3ff13e14028347..0cc4af072580f315f617098b43b2573e84b0ae6d 100644 (file)
@@ -1,5 +1,9 @@
 Wish list:
 
+       http://www.postfix.org/postconf.5.html#inet_protocols default
+       differs from http://www.postfix.org/IPV6_README.html
+       and it's compile-time dependent.
+
        Eliminate duplicate user_acl check from sendmail, and pass
        the result through the postdrop-to-sendmail protocol. This
        requires that postdrop reads all inputs before responding.
index d1b32686b39a4ebb53845f358e36070f0bf1fd49..1dcd787bc7bd1cb0dae6eecf86400cbcb8852c12 100644 (file)
@@ -91,7 +91,7 @@
 # 
 #        The  pattern specifies an email address, a domain name, or
 #        a domain name hierarchy, as described  in  section  "TABLE
-#        LOOKUP".
+#        SEARCH ORDER".
 # 
 #        The  result is of the form transport:nexthop and specifies
 #        how or where to deliver mail. This is described in section
index 6ad62a93b4dba52007ca6fec696f79150b462c76..06f981a5ecc760c2180c048e35c5f834c2f498eb 100644 (file)
@@ -61,7 +61,7 @@ default setting append_dot_mydomain=yes </a> </p>
 chroot=y</a> </p>
 
 <li><p> <a href="#relay_restrictions"> Using backwards-compatible
-default setting smtpd_relay_restrictions = (empty)</a> </p>
+default setting "smtpd_relay_restrictions = (empty)"</a> </p>
 
 <li> <p> <a href="#mynetworks_style"> Using backwards-compatible
 default setting mynetworks_style=subnet </a> </p>
@@ -81,6 +81,9 @@ default setting smtp_tls_fingerprint_digest=md5</a> </p>
 <li> <p> <a href="#smtp_digest"> Using backwards-compatible
 default setting lmtp_tls_fingerprint_digest=md5</a> </p>
 
+<li> <p> <a href="#relay_before_rcpt"> Using backwards-compatible
+default setting smtpd_relay_before_recipient_restrictions=no</a> </p>
+
 </ul>
 
 <p> If such a message is logged in the context of a legitimate
@@ -461,6 +464,45 @@ warnings, you can <a href="#turnoff">update</a> your compatibility level.
 </pre>
 </blockquote>
 
+<h2> <a name="relay_before_rcpt"> Using backwards-compatible
+default setting smtpd_relay_before_recipient_restrictions=no</a> </h2>
+
+<p> The <a href="postconf.5.html#smtpd_relay_before_recipient_restrictions">smtpd_relay_before_recipient_restrictions</a> feature was
+introduced in Postfix version 3.6, to evaluate <a href="postconf.5.html#smtpd_relay_restrictions">smtpd_relay_restrictions</a>
+before <a href="postconf.5.html#smtpd_recipient_restrictions">smtpd_recipient_restrictions</a>. Historically, <a href="postconf.5.html#smtpd_relay_restrictions">smtpd_relay_restrictions</a>
+was evaluated after <a href="postconf.5.html#smtpd_recipient_restrictions">smtpd_recipient_restrictions</a>, contradicting
+documented behavior. </p>
+
+<blockquote> <p> Background: <a href="postconf.5.html#smtpd_relay_restrictions">smtpd_relay_restrictions</a> is
+primarily designed to enforce a mail relaying policy, while
+<a href="postconf.5.html#smtpd_recipient_restrictions">smtpd_recipient_restrictions</a> is primarily designed to enforce spam
+blocking policy. Both are evaluated while replying to the RCPT TO
+command, and both support the same features. </p> </blockquote>
+
+<p> When the <a href="postconf.5.html#compatibility_level">compatibility_level</a> less than 3.6, and the
+<a href="postconf.5.html#smtpd_relay_before_recipient_restrictions">smtpd_relay_before_recipient_restrictions</a> parameter is left at its
+implicit default setting, Postfix may log the following message: </p>
+
+<blockquote>
+<pre>
+postfix/smtpd[54696]: using backwards-compatible default setting
+    <a href="postconf.5.html#smtpd_relay_before_recipient_restrictions">smtpd_relay_before_recipient_restrictions</a>=no to reject recipient
+    "user@example.com" from client "host.example.net[10.0.0.2]"
+</pre>
+</blockquote>
+
+<p> If Postfix should keep evaluating <a href="postconf.5.html#smtpd_recipient_restrictions">smtpd_recipient_restrictions</a>
+before <a href="postconf.5.html#smtpd_relay_restrictions">smtpd_relay_restrictions</a>, then the system
+administrator should make the backwards-compatible setting
+"<a href="postconf.5.html#smtpd_relay_before_recipient_restrictions">smtpd_relay_before_recipient_restrictions</a>=no" permanent in <a href="postconf.5.html">main.cf</a>: </p>
+
+<blockquote>
+<pre>
+# <b> postconf <a href="postconf.5.html#smtpd_relay_before_recipient_restrictions">smtpd_relay_before_recipient_restrictions</a>=no </b>
+# <b> postfix reload </b>
+</pre>
+</blockquote>
+
 <h2> <a name="turnoff">Turning off the backwards-compatibility safety net</a> </h2>
 
 <p> Backwards compatibility is turned off by updating the
index de49f00c39e6e27c346c566dfdbbca4655c56279..6753f0ed76cb6c727b0b7c73da53d68af5361c86 100644 (file)
@@ -3102,7 +3102,8 @@ cached. If Postfix runs on a network where the DNS root zone is not
 reachable, specify a different probe, or specify an empty <a href="postconf.5.html#dnssec_probe">dnssec_probe</a>
 value to disable the feature. </p>
 
-<p> This feature is available in Postfix 3.6 and later. </p>
+<p> This feature is available in Postfix 3.6 and later. It was backported
+to Postfix versions 3.5.9, 3.4.19, 3.3.16. 3.2.21. </p>
 
 
 </DD>
@@ -12589,8 +12590,10 @@ authentication succeeds, it will be logged only as "Trusted", not
 </dl>
 
 <p> The default setting for Postfix &ge; 3.6 is "dane" with
-"<a href="postconf.5.html#smtp_tls_security_level">smtp_tls_security_level</a> = dane", otherwise "may".  With earlier
-Postfix versions the defauult setting was always "dane". </p>
+"<a href="postconf.5.html#smtp_tls_security_level">smtp_tls_security_level</a> = dane", otherwise "may". This behavior
+was backported to Postfix versions 3.5.9, 3.4.19, 3.3.16. 3.2.21.
+With earlier Postfix versions the default setting was always "dane".
+</p>
 
 <p> Though with "insecure" MX records an active attacker can
 compromise SMTP transport security by returning forged MX records,
@@ -16281,6 +16284,24 @@ This feature is available in Postfix 2.1 and later.
 </p>
 
 
+</DD>
+
+<DT><b><a name="smtpd_relay_before_recipient_restrictions">smtpd_relay_before_recipient_restrictions</a>
+(default: see "postconf -d" output)</b></DT><DD>
+
+<p> Evaluate <a href="postconf.5.html#smtpd_relay_restrictions">smtpd_relay_restrictions</a> before <a href="postconf.5.html#smtpd_recipient_restrictions">smtpd_recipient_restrictions</a>.
+Historically, <a href="postconf.5.html#smtpd_relay_restrictions">smtpd_relay_restrictions</a> was evaluated after
+<a href="postconf.5.html#smtpd_recipient_restrictions">smtpd_recipient_restrictions</a>, contradicting documented behavior. </p>
+
+<p> Background: the <a href="postconf.5.html#smtpd_relay_restrictions">smtpd_relay_restrictions</a> feature is primarily
+designed to enforce a mail relaying policy, while
+<a href="postconf.5.html#smtpd_recipient_restrictions">smtpd_recipient_restrictions</a> is primarily designed to enforce spam
+blocking policy. Both are evaluated while replying to the RCPT TO
+command, and both support the same features. </p>
+
+<p> This feature is available in Postfix 3.6 and later. </p>
+
+
 </DD>
 
 <DT><b><a name="smtpd_relay_restrictions">smtpd_relay_restrictions</a>
index 97c35179acc8758a52751f95a1d1a658606ec851..8304fc70c2b336e24efc2024632371d050a230ab 100644 (file)
@@ -159,8 +159,14 @@ SMTPD(8)                                                              SMTPD(8)
        <b><a href="postconf.5.html#smtpd_dns_reply_filter">smtpd_dns_reply_filter</a> (empty)</b>
               Optional filter for Postfix SMTP server DNS lookup results.
 
+       Available in Postfix version 3.6 and later:
+
+       <b><a href="postconf.5.html#smtpd_relay_before_recipient_restrictions">smtpd_relay_before_recipient_restrictions</a> (see 'postconf -d' output)</b>
+              Evaluate    <a href="postconf.5.html#smtpd_relay_restrictions">smtpd_relay_restrictions</a>    before     <a href="postconf.5.html#smtpd_recipient_restrictions">smtpd_recipi</a>-
+              <a href="postconf.5.html#smtpd_recipient_restrictions">ent_restrictions</a>.
+
 <b>ADDRESS REWRITING CONTROLS</b>
-       See the <a href="ADDRESS_REWRITING_README.html">ADDRESS_REWRITING_README</a> document for a detailed discussion  of
+       See  the <a href="ADDRESS_REWRITING_README.html">ADDRESS_REWRITING_README</a> document for a detailed discussion of
        Postfix address rewriting.
 
        <b><a href="postconf.5.html#receive_override_options">receive_override_options</a> (empty)</b>
@@ -170,37 +176,37 @@ SMTPD(8)                                                              SMTPD(8)
        Available in Postfix version 2.2 and later:
 
        <b><a href="postconf.5.html#local_header_rewrite_clients">local_header_rewrite_clients</a> (<a href="postconf.5.html#permit_inet_interfaces">permit_inet_interfaces</a>)</b>
-              Rewrite message header addresses in mail from these clients  and
+              Rewrite  message header addresses in mail from these clients and
               update incomplete addresses with the domain name in $<a href="postconf.5.html#myorigin">myorigin</a> or
-              $<a href="postconf.5.html#mydomain">mydomain</a>; either  don't  rewrite  message  headers  from  other
+              $<a href="postconf.5.html#mydomain">mydomain</a>;  either  don't  rewrite  message  headers  from other
               clients at all, or rewrite message headers and update incomplete
-              addresses with the domain  specified  in  the  <a href="postconf.5.html#remote_header_rewrite_domain">remote_header_re</a>-
+              addresses  with  the  domain  specified in the <a href="postconf.5.html#remote_header_rewrite_domain">remote_header_re</a>-
               <a href="postconf.5.html#remote_header_rewrite_domain">write_domain</a> parameter.
 
 <b>BEFORE-SMTPD PROXY AGENT</b>
        Available in Postfix version 2.10 and later:
 
        <b><a href="postconf.5.html#smtpd_upstream_proxy_protocol">smtpd_upstream_proxy_protocol</a> (empty)</b>
-              The  name of the proxy protocol used by an optional before-smtpd
+              The name of the proxy protocol used by an optional  before-smtpd
               proxy agent.
 
        <b><a href="postconf.5.html#smtpd_upstream_proxy_timeout">smtpd_upstream_proxy_timeout</a> (5s)</b>
-              The time  limit  for  the  proxy  protocol  specified  with  the
+              The  time  limit  for  the  proxy  protocol  specified  with the
               <a href="postconf.5.html#smtpd_upstream_proxy_protocol">smtpd_upstream_proxy_protocol</a> parameter.
 
 <b>AFTER QUEUE EXTERNAL CONTENT INSPECTION CONTROLS</b>
-       As  of  version  1.0,  Postfix can be configured to send new mail to an
-       external content filter AFTER the mail is queued. This  content  filter
-       is  expected to inject mail back into a (Postfix or other) MTA for fur-
+       As of version 1.0, Postfix can be configured to send  new  mail  to  an
+       external  content  filter AFTER the mail is queued. This content filter
+       is expected to inject mail back into a (Postfix or other) MTA for  fur-
        ther delivery. See the <a href="FILTER_README.html">FILTER_README</a> document for details.
 
        <b><a href="postconf.5.html#content_filter">content_filter</a> (empty)</b>
-              After the message is queued, send  the  entire  message  to  the
+              After  the  message  is  queued,  send the entire message to the
               specified <i>transport:destination</i>.
 
 <b>BEFORE QUEUE EXTERNAL CONTENT INSPECTION CONTROLS</b>
-       As  of  version  2.1, the Postfix SMTP server can be configured to send
-       incoming mail to a real-time SMTP-based content filter BEFORE  mail  is
+       As of version 2.1, the Postfix SMTP server can be  configured  to  send
+       incoming  mail  to a real-time SMTP-based content filter BEFORE mail is
        queued.  This content filter is expected to inject mail back into Post-
        fix.  See the <a href="SMTPD_PROXY_README.html">SMTPD_PROXY_README</a> document for details on how to config-
        ure and operate this feature.
@@ -209,40 +215,40 @@ SMTPD(8)                                                              SMTPD(8)
               The hostname and TCP port of the mail filtering proxy server.
 
        <b><a href="postconf.5.html#smtpd_proxy_ehlo">smtpd_proxy_ehlo</a> ($<a href="postconf.5.html#myhostname">myhostname</a>)</b>
-              How  the  Postfix SMTP server announces itself to the proxy fil-
+              How the Postfix SMTP server announces itself to the  proxy  fil-
               ter.
 
        <b><a href="postconf.5.html#smtpd_proxy_options">smtpd_proxy_options</a> (empty)</b>
-              List of options that control how the Postfix SMTP server  commu-
+              List  of options that control how the Postfix SMTP server commu-
               nicates with a before-queue content filter.
 
        <b><a href="postconf.5.html#smtpd_proxy_timeout">smtpd_proxy_timeout</a> (100s)</b>
-              The  time limit for connecting to a proxy filter and for sending
+              The time limit for connecting to a proxy filter and for  sending
               or receiving information.
 
 <b>BEFORE QUEUE MILTER CONTROLS</b>
        As of version 2.3, Postfix supports the Sendmail version 8 Milter (mail
-       filter)  protocol.  These content filters run outside Postfix. They can
-       inspect the SMTP command  stream  and  the  message  content,  and  can
-       request  modifications  before mail is queued. For details see the <a href="MILTER_README.html">MIL</a>-
+       filter) protocol. These content filters run outside Postfix.  They  can
+       inspect  the  SMTP  command  stream  and  the  message content, and can
+       request modifications before mail is queued. For details see  the  <a href="MILTER_README.html">MIL</a>-
        <a href="MILTER_README.html">TER_README</a> document.
 
        <b><a href="postconf.5.html#smtpd_milters">smtpd_milters</a> (empty)</b>
-              A list of Milter (mail filter) applications for  new  mail  that
+              A  list  of  Milter (mail filter) applications for new mail that
               arrives via the Postfix <a href="smtpd.8.html"><b>smtpd</b>(8)</a> server.
 
        <b><a href="postconf.5.html#milter_protocol">milter_protocol</a> (6)</b>
-              The  mail  filter  protocol version and optional protocol exten-
-              sions for communication with  a  Milter  application;  prior  to
+              The mail filter protocol version and  optional  protocol  exten-
+              sions  for  communication  with  a  Milter application; prior to
               Postfix 2.6 the default protocol is 2.
 
        <b><a href="postconf.5.html#milter_default_action">milter_default_action</a> (tempfail)</b>
-              The  default  action  when  a  Milter  (mail filter) response is
-              unavailable (for example, bad Postfix  configuration  or  Milter
+              The default action when  a  Milter  (mail  filter)  response  is
+              unavailable  (for  example,  bad Postfix configuration or Milter
               failure).
 
        <b><a href="postconf.5.html#milter_macro_daemon_name">milter_macro_daemon_name</a> ($<a href="postconf.5.html#myhostname">myhostname</a>)</b>
-              The  {daemon_name} macro value for Milter (mail filter) applica-
+              The {daemon_name} macro value for Milter (mail filter)  applica-
               tions.
 
        <b><a href="postconf.5.html#milter_macro_v">milter_macro_v</a> ($<a href="postconf.5.html#mail_name">mail_name</a> $<a href="postconf.5.html#mail_version">mail_version</a>)</b>
@@ -253,60 +259,60 @@ SMTPD(8)                                                              SMTPD(8)
               tion, and for negotiating protocol options.
 
        <b><a href="postconf.5.html#milter_command_timeout">milter_command_timeout</a> (30s)</b>
-              The  time  limit  for  sending an SMTP command to a Milter (mail
+              The time limit for sending an SMTP command  to  a  Milter  (mail
               filter) application, and for receiving the response.
 
        <b><a href="postconf.5.html#milter_content_timeout">milter_content_timeout</a> (300s)</b>
-              The time limit for sending message content  to  a  Milter  (mail
+              The  time  limit  for  sending message content to a Milter (mail
               filter) application, and for receiving the response.
 
        <b><a href="postconf.5.html#milter_connect_macros">milter_connect_macros</a> (see 'postconf -d' output)</b>
-              The  macros  that  are sent to Milter (mail filter) applications
+              The macros that are sent to Milter  (mail  filter)  applications
               after completion of an SMTP connection.
 
        <b><a href="postconf.5.html#milter_helo_macros">milter_helo_macros</a> (see 'postconf -d' output)</b>
-              The macros that are sent to Milter  (mail  filter)  applications
+              The  macros  that  are sent to Milter (mail filter) applications
               after the SMTP HELO or EHLO command.
 
        <b><a href="postconf.5.html#milter_mail_macros">milter_mail_macros</a> (see 'postconf -d' output)</b>
-              The  macros  that  are sent to Milter (mail filter) applications
+              The macros that are sent to Milter  (mail  filter)  applications
               after the SMTP MAIL FROM command.
 
        <b><a href="postconf.5.html#milter_rcpt_macros">milter_rcpt_macros</a> (see 'postconf -d' output)</b>
-              The macros that are sent to Milter  (mail  filter)  applications
+              The  macros  that  are sent to Milter (mail filter) applications
               after the SMTP RCPT TO command.
 
        <b><a href="postconf.5.html#milter_data_macros">milter_data_macros</a> (see 'postconf -d' output)</b>
-              The  macros  that  are  sent to version 4 or higher Milter (mail
+              The macros that are sent to version 4  or  higher  Milter  (mail
               filter) applications after the SMTP DATA command.
 
        <b><a href="postconf.5.html#milter_unknown_command_macros">milter_unknown_command_macros</a> (see 'postconf -d' output)</b>
-              The macros that are sent to version 3  or  higher  Milter  (mail
+              The  macros  that  are  sent to version 3 or higher Milter (mail
               filter) applications after an unknown SMTP command.
 
        <b><a href="postconf.5.html#milter_end_of_header_macros">milter_end_of_header_macros</a> (see 'postconf -d' output)</b>
-              The  macros  that  are sent to Milter (mail filter) applications
+              The macros that are sent to Milter  (mail  filter)  applications
               after the end of the message header.
 
        <b><a href="postconf.5.html#milter_end_of_data_macros">milter_end_of_data_macros</a> (see 'postconf -d' output)</b>
-              The macros that are sent to Milter  (mail  filter)  applications
+              The  macros  that  are sent to Milter (mail filter) applications
               after the message end-of-data.
 
        Available in Postfix version 3.1 and later:
 
        <b><a href="postconf.5.html#milter_macro_defaults">milter_macro_defaults</a> (empty)</b>
-              Optional  list  of  <i>name=value</i> pairs that specify default values
-              for arbitrary macros that Postfix may send  to  Milter  applica-
+              Optional list of <i>name=value</i> pairs that  specify  default  values
+              for  arbitrary  macros  that Postfix may send to Milter applica-
               tions.
 
        Available in Postfix version 3.2 and later:
 
        <b><a href="postconf.5.html#smtpd_milter_maps">smtpd_milter_maps</a> (empty)</b>
-              Lookup  tables  with  Milter  settings per remote SMTP client IP
+              Lookup tables with Milter settings per  remote  SMTP  client  IP
               address.
 
 <b>GENERAL CONTENT INSPECTION CONTROLS</b>
-       The following parameters are applicable for both built-in and  external
+       The  following parameters are applicable for both built-in and external
        content filters.
 
        Available in Postfix version 2.1 and later:
@@ -316,51 +322,51 @@ SMTPD(8)                                                              SMTPD(8)
               ing, or address mapping.
 
 <b>EXTERNAL CONTENT INSPECTION CONTROLS</b>
-       The following parameters  are  applicable  for  both  before-queue  and
+       The  following  parameters  are  applicable  for  both before-queue and
        after-queue content filtering.
 
        Available in Postfix version 2.1 and later:
 
        <b><a href="postconf.5.html#smtpd_authorized_xforward_hosts">smtpd_authorized_xforward_hosts</a> (empty)</b>
-              What  remote  SMTP  clients are allowed to use the XFORWARD fea-
+              What remote SMTP clients are allowed to use  the  XFORWARD  fea-
               ture.
 
 <b>SASL AUTHENTICATION CONTROLS</b>
        Postfix SASL support (<a href="http://tools.ietf.org/html/rfc4954">RFC 4954</a>) can be used to authenticate remote SMTP
-       clients  to  the  Postfix  SMTP server, and to authenticate the Postfix
-       SMTP client to a remote SMTP server.  See the <a href="SASL_README.html">SASL_README</a> document  for
+       clients to the Postfix SMTP server, and  to  authenticate  the  Postfix
+       SMTP  client to a remote SMTP server.  See the <a href="SASL_README.html">SASL_README</a> document for
        details.
 
        <b><a href="postconf.5.html#broken_sasl_auth_clients">broken_sasl_auth_clients</a> (no)</b>
-              Enable  interoperability with remote SMTP clients that implement
+              Enable interoperability with remote SMTP clients that  implement
               an obsolete version of the AUTH command (<a href="http://tools.ietf.org/html/rfc4954">RFC 4954</a>).
 
        <b><a href="postconf.5.html#smtpd_sasl_auth_enable">smtpd_sasl_auth_enable</a> (no)</b>
               Enable SASL authentication in the Postfix SMTP server.
 
        <b><a href="postconf.5.html#smtpd_sasl_local_domain">smtpd_sasl_local_domain</a> (empty)</b>
-              The name of the Postfix SMTP server's local SASL  authentication
+              The  name of the Postfix SMTP server's local SASL authentication
               realm.
 
        <b><a href="postconf.5.html#smtpd_sasl_security_options">smtpd_sasl_security_options</a> (noanonymous)</b>
               Postfix SMTP server SASL security options; as of Postfix 2.3 the
-              list of available features depends on the SASL server  implemen-
+              list  of available features depends on the SASL server implemen-
               tation that is selected with <b><a href="postconf.5.html#smtpd_sasl_type">smtpd_sasl_type</a></b>.
 
        <b><a href="postconf.5.html#smtpd_sender_login_maps">smtpd_sender_login_maps</a> (empty)</b>
-              Optional  lookup  table  with  the SASL login names that own the
+              Optional lookup table with the SASL login  names  that  own  the
               sender (MAIL FROM) addresses.
 
        Available in Postfix version 2.1 and later:
 
        <b><a href="postconf.5.html#smtpd_sasl_exceptions_networks">smtpd_sasl_exceptions_networks</a> (empty)</b>
-              What remote SMTP clients the Postfix SMTP server will not  offer
+              What  remote SMTP clients the Postfix SMTP server will not offer
               AUTH support to.
 
        Available in Postfix version 2.1 and 2.2:
 
        <b><a href="postconf.5.html#smtpd_sasl_application_name">smtpd_sasl_application_name</a> (smtpd)</b>
-              The  application name that the Postfix SMTP server uses for SASL
+              The application name that the Postfix SMTP server uses for  SASL
               server initialization.
 
        Available in Postfix version 2.3 and later:
@@ -371,11 +377,11 @@ SMTPD(8)                                                              SMTPD(8)
 
        <b><a href="postconf.5.html#smtpd_sasl_path">smtpd_sasl_path</a> (smtpd)</b>
               Implementation-specific information that the Postfix SMTP server
-              passes through  to  the  SASL  plug-in  implementation  that  is
+              passes  through  to  the  SASL  plug-in  implementation  that is
               selected with <b><a href="postconf.5.html#smtpd_sasl_type">smtpd_sasl_type</a></b>.
 
        <b><a href="postconf.5.html#smtpd_sasl_type">smtpd_sasl_type</a> (cyrus)</b>
-              The  SASL  plug-in  type that the Postfix SMTP server should use
+              The SASL plug-in type that the Postfix SMTP  server  should  use
               for authentication.
 
        Available in Postfix version 2.5 and later:
@@ -387,7 +393,7 @@ SMTPD(8)                                                              SMTPD(8)
        Available in Postfix version 2.11 and later:
 
        <b>smtpd_sasl_service (smtp)</b>
-              The  service  name  that  is  passed to the SASL plug-in that is
+              The service name that is passed to  the  SASL  plug-in  that  is
               selected with <b><a href="postconf.5.html#smtpd_sasl_type">smtpd_sasl_type</a></b> and <b><a href="postconf.5.html#smtpd_sasl_path">smtpd_sasl_path</a></b>.
 
        Available in Postfix version 3.4 and later:
@@ -399,20 +405,20 @@ SMTPD(8)                                                              SMTPD(8)
        Available in Postfix 3.6 and later:
 
        <b><a href="postconf.5.html#smtpd_sasl_mechanism_filter">smtpd_sasl_mechanism_filter</a> (!external, <a href="DATABASE_README.html#types">static</a>:rest)</b>
-              If  non-empty,  a  filter  for the SASL mechanism names that the
+              If non-empty, a filter for the SASL  mechanism  names  that  the
               Postfix SMTP server will announce in the EHLO response.
 
 <b>STARTTLS SUPPORT CONTROLS</b>
-       Detailed information about STARTTLS configuration may be found  in  the
+       Detailed  information  about STARTTLS configuration may be found in the
        <a href="TLS_README.html">TLS_README</a> document.
 
        <b><a href="postconf.5.html#smtpd_tls_security_level">smtpd_tls_security_level</a> (empty)</b>
-              The  SMTP TLS security level for the Postfix SMTP server; when a
+              The SMTP TLS security level for the Postfix SMTP server; when  a
               non-empty value is specified, this overrides the obsolete param-
               eters <a href="postconf.5.html#smtpd_use_tls">smtpd_use_tls</a> and <a href="postconf.5.html#smtpd_enforce_tls">smtpd_enforce_tls</a>.
 
        <b><a href="postconf.5.html#smtpd_sasl_tls_security_options">smtpd_sasl_tls_security_options</a> ($<a href="postconf.5.html#smtpd_sasl_security_options">smtpd_sasl_security_options</a>)</b>
-              The  SASL  authentication security options that the Postfix SMTP
+              The SASL authentication security options that the  Postfix  SMTP
               server uses for TLS encrypted SMTP sessions.
 
        <b><a href="postconf.5.html#smtpd_starttls_timeout">smtpd_starttls_timeout</a> (see 'postconf -d' output)</b>
@@ -420,25 +426,25 @@ SMTPD(8)                                                              SMTPD(8)
               during TLS startup and shutdown handshake procedures.
 
        <b><a href="postconf.5.html#smtpd_tls_CAfile">smtpd_tls_CAfile</a> (empty)</b>
-              A  file  containing  (PEM  format)  CA  certificates of root CAs
+              A file containing (PEM  format)  CA  certificates  of  root  CAs
               trusted to sign either remote SMTP client certificates or inter-
               mediate CA certificates.
 
        <b><a href="postconf.5.html#smtpd_tls_CApath">smtpd_tls_CApath</a> (empty)</b>
-              A  directory containing (PEM format) CA certificates of root CAs
+              A directory containing (PEM format) CA certificates of root  CAs
               trusted to sign either remote SMTP client certificates or inter-
               mediate CA certificates.
 
        <b><a href="postconf.5.html#smtpd_tls_always_issue_session_ids">smtpd_tls_always_issue_session_ids</a> (yes)</b>
-              Force  the  Postfix  SMTP server to issue a TLS session id, even
-              when  TLS  session  caching  is   turned   off   (<a href="postconf.5.html#smtpd_tls_session_cache_database">smtpd_tls_ses</a>-
+              Force the Postfix SMTP server to issue a TLS  session  id,  even
+              when   TLS   session   caching  is  turned  off  (<a href="postconf.5.html#smtpd_tls_session_cache_database">smtpd_tls_ses</a>-
               <a href="postconf.5.html#smtpd_tls_session_cache_database">sion_cache_database</a> is empty).
 
        <b><a href="postconf.5.html#smtpd_tls_ask_ccert">smtpd_tls_ask_ccert</a> (no)</b>
               Ask a remote SMTP client for a client certificate.
 
        <b><a href="postconf.5.html#smtpd_tls_auth_only">smtpd_tls_auth_only</a> (no)</b>
-              When  TLS  encryption is optional in the Postfix SMTP server, do
+              When TLS encryption is optional in the Postfix SMTP  server,  do
               not announce or accept SASL authentication over unencrypted con-
               nections.
 
@@ -449,18 +455,18 @@ SMTPD(8)                                                              SMTPD(8)
               File with the Postfix SMTP server RSA certificate in PEM format.
 
        <b><a href="postconf.5.html#smtpd_tls_exclude_ciphers">smtpd_tls_exclude_ciphers</a> (empty)</b>
-              List of ciphers or cipher types to exclude from the SMTP  server
+              List  of ciphers or cipher types to exclude from the SMTP server
               cipher list at all TLS security levels.
 
        <b><a href="postconf.5.html#smtpd_tls_dcert_file">smtpd_tls_dcert_file</a> (empty)</b>
               File with the Postfix SMTP server DSA certificate in PEM format.
 
        <b><a href="postconf.5.html#smtpd_tls_dh1024_param_file">smtpd_tls_dh1024_param_file</a> (empty)</b>
-              File with DH parameters that the Postfix SMTP server should  use
+              File  with DH parameters that the Postfix SMTP server should use
               with non-export EDH ciphers.
 
        <b><a href="postconf.5.html#smtpd_tls_dh512_param_file">smtpd_tls_dh512_param_file</a> (empty)</b>
-              File  with DH parameters that the Postfix SMTP server should use
+              File with DH parameters that the Postfix SMTP server should  use
               with export-grade EDH ciphers.
 
        <b><a href="postconf.5.html#smtpd_tls_dkey_file">smtpd_tls_dkey_file</a> ($<a href="postconf.5.html#smtpd_tls_dcert_file">smtpd_tls_dcert_file</a>)</b>
@@ -473,12 +479,12 @@ SMTPD(8)                                                              SMTPD(8)
               Enable additional Postfix SMTP server logging of TLS activity.
 
        <b><a href="postconf.5.html#smtpd_tls_mandatory_ciphers">smtpd_tls_mandatory_ciphers</a> (medium)</b>
-              The minimum TLS cipher grade that the Postfix SMTP  server  will
+              The  minimum  TLS cipher grade that the Postfix SMTP server will
               use with mandatory TLS encryption.
 
        <b><a href="postconf.5.html#smtpd_tls_mandatory_exclude_ciphers">smtpd_tls_mandatory_exclude_ciphers</a> (empty)</b>
-              Additional  list  of ciphers or cipher types to exclude from the
-              Postfix SMTP server cipher list at mandatory TLS  security  lev-
+              Additional list of ciphers or cipher types to exclude  from  the
+              Postfix  SMTP  server cipher list at mandatory TLS security lev-
               els.
 
        <b><a href="postconf.5.html#smtpd_tls_mandatory_protocols">smtpd_tls_mandatory_protocols</a> (see 'postconf -d' output)</b>
@@ -487,21 +493,21 @@ SMTPD(8)                                                              SMTPD(8)
 
        <b><a href="postconf.5.html#smtpd_tls_received_header">smtpd_tls_received_header</a> (no)</b>
               Request that the Postfix SMTP server produces Received:  message
-              headers  that  include information about the protocol and cipher
-              used, as well as the remote SMTP client  CommonName  and  client
+              headers that include information about the protocol  and  cipher
+              used,  as  well  as the remote SMTP client CommonName and client
               certificate issuer CommonName.
 
        <b><a href="postconf.5.html#smtpd_tls_req_ccert">smtpd_tls_req_ccert</a> (no)</b>
-              With  mandatory  TLS  encryption,  require a trusted remote SMTP
+              With mandatory TLS encryption, require  a  trusted  remote  SMTP
               client certificate in order to allow TLS connections to proceed.
 
        <b><a href="postconf.5.html#smtpd_tls_wrappermode">smtpd_tls_wrappermode</a> (no)</b>
-              Run  the Postfix SMTP server in the non-standard "wrapper" mode,
+              Run the Postfix SMTP server in the non-standard "wrapper"  mode,
               instead of using the STARTTLS command.
 
        <b><a href="postconf.5.html#tls_daemon_random_bytes">tls_daemon_random_bytes</a> (32)</b>
-              The number of pseudo-random bytes that an  <a href="smtp.8.html"><b>smtp</b>(8)</a>  or  <a href="smtpd.8.html"><b>smtpd</b>(8)</a>
-              process  requests from the <a href="tlsmgr.8.html"><b>tlsmgr</b>(8)</a> server in order to seed its
+              The  number  of  pseudo-random bytes that an <a href="smtp.8.html"><b>smtp</b>(8)</a> or <a href="smtpd.8.html"><b>smtpd</b>(8)</a>
+              process requests from the <a href="tlsmgr.8.html"><b>tlsmgr</b>(8)</a> server in order to seed  its
               internal pseudo random number generator (PRNG).
 
        <b><a href="postconf.5.html#tls_high_cipherlist">tls_high_cipherlist</a> (see 'postconf -d' output)</b>
@@ -517,41 +523,41 @@ SMTPD(8)                                                              SMTPD(8)
               The OpenSSL cipherlist for "export" or higher grade ciphers.
 
        <b><a href="postconf.5.html#tls_null_cipherlist">tls_null_cipherlist</a> (eNULL:!aNULL)</b>
-              The OpenSSL cipherlist for "NULL"  grade  ciphers  that  provide
+              The  OpenSSL  cipherlist  for  "NULL" grade ciphers that provide
               authentication without encryption.
 
        Available in Postfix version 2.5 and later:
 
        <b><a href="postconf.5.html#smtpd_tls_fingerprint_digest">smtpd_tls_fingerprint_digest</a> (see 'postconf -d' output)</b>
-              The   message   digest   algorithm   to  construct  remote  SMTP
-              client-certificate  fingerprints  or  public  key   fingerprints
-              (Postfix   2.9   and  later)  for  <b><a href="postconf.5.html#check_ccert_access">check_ccert_access</a></b>  and  <b>per-</b>
+              The  message  digest  algorithm   to   construct   remote   SMTP
+              client-certificate   fingerprints  or  public  key  fingerprints
+              (Postfix  2.9  and  later)  for  <b><a href="postconf.5.html#check_ccert_access">check_ccert_access</a></b>   and   <b>per-</b>
               <b>mit_tls_clientcerts</b>.
 
        Available in Postfix version 2.6 and later:
 
        <b><a href="postconf.5.html#smtpd_tls_protocols">smtpd_tls_protocols</a> (see postconf -d output)</b>
-              TLS protocols accepted by the Postfix SMTP  server  with  oppor-
+              TLS  protocols  accepted  by the Postfix SMTP server with oppor-
               tunistic TLS encryption.
 
        <b><a href="postconf.5.html#smtpd_tls_ciphers">smtpd_tls_ciphers</a> (medium)</b>
-              The  minimum  TLS cipher grade that the Postfix SMTP server will
+              The minimum TLS cipher grade that the Postfix SMTP  server  will
               use with opportunistic TLS encryption.
 
        <b><a href="postconf.5.html#smtpd_tls_eccert_file">smtpd_tls_eccert_file</a> (empty)</b>
-              File with the Postfix SMTP server ECDSA certificate in PEM  for-
+              File  with the Postfix SMTP server ECDSA certificate in PEM for-
               mat.
 
        <b><a href="postconf.5.html#smtpd_tls_eckey_file">smtpd_tls_eckey_file</a> ($<a href="postconf.5.html#smtpd_tls_eccert_file">smtpd_tls_eccert_file</a>)</b>
-              File  with the Postfix SMTP server ECDSA private key in PEM for-
+              File with the Postfix SMTP server ECDSA private key in PEM  for-
               mat.
 
        <b><a href="postconf.5.html#smtpd_tls_eecdh_grade">smtpd_tls_eecdh_grade</a> (see 'postconf -d' output)</b>
-              The Postfix SMTP server  security  grade  for  ephemeral  ellip-
+              The  Postfix  SMTP  server  security  grade for ephemeral ellip-
               tic-curve Diffie-Hellman (EECDH) key exchange.
 
        <b><a href="postconf.5.html#tls_eecdh_strong_curve">tls_eecdh_strong_curve</a> (prime256v1)</b>
-              The  elliptic curve used by the Postfix SMTP server for sensibly
+              The elliptic curve used by the Postfix SMTP server for  sensibly
               strong ephemeral ECDH key exchange.
 
        <b><a href="postconf.5.html#tls_eecdh_ultra_curve">tls_eecdh_ultra_curve</a> (secp384r1)</b>
@@ -562,7 +568,7 @@ SMTPD(8)                                                              SMTPD(8)
 
        <b><a href="postconf.5.html#tls_preempt_cipherlist">tls_preempt_cipherlist</a> (no)</b>
               With SSLv3 and later, use the Postfix SMTP server's cipher pref-
-              erence order instead of the remote  client's  cipher  preference
+              erence  order  instead  of the remote client's cipher preference
               order.
 
        <b><a href="postconf.5.html#tls_disable_workarounds">tls_disable_workarounds</a> (see 'postconf -d' output)</b>
@@ -575,7 +581,7 @@ SMTPD(8)                                                              SMTPD(8)
 
        Available in Postfix version 3.0 and later:
 
-       <b><a href="postconf.5.html#tls_session_ticket_cipher">tls_session_ticket_cipher</a>  (Postfix</b> &gt;<b>= 3.0: aes-256-cbc, Postfix</b> &lt; <b>3.0:</b>
+       <b><a href="postconf.5.html#tls_session_ticket_cipher">tls_session_ticket_cipher</a> (Postfix</b> &gt;<b>= 3.0: aes-256-cbc, Postfix</b> &lt;  <b>3.0:</b>
        <b>aes-128-cbc)</b>
               Algorithm used to encrypt <a href="http://tools.ietf.org/html/rfc5077">RFC5077</a> TLS session tickets.
 
@@ -588,33 +594,33 @@ SMTPD(8)                                                              SMTPD(8)
        Available in Postfix version 3.4 and later:
 
        <b><a href="postconf.5.html#smtpd_tls_chain_files">smtpd_tls_chain_files</a> (empty)</b>
-              List of one or more PEM files, each holding one or more  private
+              List  of one or more PEM files, each holding one or more private
               keys directly followed by a corresponding certificate chain.
 
        <b><a href="postconf.5.html#tls_server_sni_maps">tls_server_sni_maps</a> (empty)</b>
-              Optional  lookup tables that map names received from remote SMTP
-              clients via the TLS Server Name Indication  (SNI)  extension  to
+              Optional lookup tables that map names received from remote  SMTP
+              clients  via  the  TLS Server Name Indication (SNI) extension to
               the appropriate keys and certificate chains.
 
        Available in Postfix 3.5, 3.4.6, 3.3.5, 3.2.10, 3.1.13 and later:
 
        <b><a href="postconf.5.html#tls_fast_shutdown_enable">tls_fast_shutdown_enable</a> (yes)</b>
-              A  workaround  for implementations that hang Postfix while shut-
+              A workaround for implementations that hang Postfix  while  shut-
               ting down a TLS session, until Postfix times out.
 
        Available in Postfix 3.5 and later:
 
        <b><a href="postconf.5.html#info_log_address_format">info_log_address_format</a> (external)</b>
-              The email address form that will be used  in  non-debug  logging
+              The  email  address  form that will be used in non-debug logging
               (info, warning, etc.).
 
 <b>OBSOLETE STARTTLS CONTROLS</b>
-       The  following  configuration  parameters  exist for compatibility with
-       Postfix versions before 2.3. Support for these will  be  removed  in  a
+       The following configuration parameters  exist  for  compatibility  with
+       Postfix  versions  before  2.3.  Support for these will be removed in a
        future release.
 
        <b><a href="postconf.5.html#smtpd_use_tls">smtpd_use_tls</a> (no)</b>
-              Opportunistic  TLS:  announce  STARTTLS  support  to remote SMTP
+              Opportunistic TLS: announce  STARTTLS  support  to  remote  SMTP
               clients, but do not require that clients use TLS encryption.
 
        <b><a href="postconf.5.html#smtpd_enforce_tls">smtpd_enforce_tls</a> (no)</b>
@@ -622,94 +628,94 @@ SMTPD(8)                                                              SMTPD(8)
               and require that clients use TLS encryption.
 
        <b><a href="postconf.5.html#smtpd_tls_cipherlist">smtpd_tls_cipherlist</a> (empty)</b>
-              Obsolete  Postfix  &lt; 2.3 control for the Postfix SMTP server TLS
+              Obsolete Postfix &lt; 2.3 control for the Postfix SMTP  server  TLS
               cipher list.
 
 <b>SMTPUTF8 CONTROLS</b>
        Preliminary SMTPUTF8 support is introduced with Postfix 3.0.
 
        <b><a href="postconf.5.html#smtputf8_enable">smtputf8_enable</a> (yes)</b>
-              Enable preliminary SMTPUTF8 support for the protocols  described
+              Enable  preliminary SMTPUTF8 support for the protocols described
               in <a href="http://tools.ietf.org/html/rfc6531">RFC 6531</a>..6533.
 
        <b><a href="postconf.5.html#strict_smtputf8">strict_smtputf8</a> (no)</b>
               Enable stricter enforcement of the SMTPUTF8 protocol.
 
        <b><a href="postconf.5.html#smtputf8_autodetect_classes">smtputf8_autodetect_classes</a> (sendmail, verify)</b>
-              Detect  that  a message requires SMTPUTF8 support for the speci-
+              Detect that a message requires SMTPUTF8 support for  the  speci-
               fied mail origin classes.
 
        Available in Postfix version 3.2 and later:
 
        <b><a href="postconf.5.html#enable_idna2003_compatibility">enable_idna2003_compatibility</a> (no)</b>
-              Enable  'transitional'  compatibility   between   IDNA2003   and
-              IDNA2008,  when  converting UTF-8 domain names to/from the ASCII
+              Enable   'transitional'   compatibility   between  IDNA2003  and
+              IDNA2008, when converting UTF-8 domain names to/from  the  ASCII
               form that is used for DNS lookups.
 
 <b>VERP SUPPORT CONTROLS</b>
-       With VERP style delivery, each recipient of a message receives  a  cus-
-       tomized  copy of the message with his/her own recipient address encoded
+       With  VERP  style delivery, each recipient of a message receives a cus-
+       tomized copy of the message with his/her own recipient address  encoded
        in the envelope sender address.  The <a href="VERP_README.html">VERP_README</a> file describes config-
-       uration  and operation details of Postfix support for variable envelope
-       return path addresses.  VERP style delivery is requested with the  SMTP
-       XVERP  command  or  with  the  "sendmail -V" command-line option and is
+       uration and operation details of Postfix support for variable  envelope
+       return  path addresses.  VERP style delivery is requested with the SMTP
+       XVERP command or with the "sendmail  -V"  command-line  option  and  is
        available in Postfix version 1.1 and later.
 
        <b><a href="postconf.5.html#default_verp_delimiters">default_verp_delimiters</a> (+=)</b>
               The two default VERP delimiter characters.
 
        <b><a href="postconf.5.html#verp_delimiter_filter">verp_delimiter_filter</a> (-=+)</b>
-              The characters Postfix accepts as VERP delimiter  characters  on
+              The  characters  Postfix accepts as VERP delimiter characters on
               the Postfix <a href="sendmail.1.html"><b>sendmail</b>(1)</a> command line and in SMTP commands.
 
        Available in Postfix version 1.1 and 2.0:
 
        <b><a href="postconf.5.html#authorized_verp_clients">authorized_verp_clients</a> ($<a href="postconf.5.html#mynetworks">mynetworks</a>)</b>
-              What  remote  SMTP clients are allowed to specify the XVERP com-
+              What remote SMTP clients are allowed to specify the  XVERP  com-
               mand.
 
        Available in Postfix version 2.1 and later:
 
        <b><a href="postconf.5.html#smtpd_authorized_verp_clients">smtpd_authorized_verp_clients</a> ($<a href="postconf.5.html#authorized_verp_clients">authorized_verp_clients</a>)</b>
-              What remote SMTP clients are allowed to specify the  XVERP  com-
+              What  remote  SMTP clients are allowed to specify the XVERP com-
               mand.
 
 <b>TROUBLE SHOOTING CONTROLS</b>
-       The  <a href="DEBUG_README.html">DEBUG_README</a>  document describes how to debug parts of the Postfix
-       mail system. The methods vary from making the software  log  a  lot  of
+       The <a href="DEBUG_README.html">DEBUG_README</a> document describes how to debug parts of  the  Postfix
+       mail  system.  The  methods  vary from making the software log a lot of
        detail, to running some daemon processes under control of a call tracer
        or debugger.
 
        <b><a href="postconf.5.html#debug_peer_level">debug_peer_level</a> (2)</b>
-              The increment in verbose logging level when a  nexthop  destina-
-              tion,  remote client or server name or network address matches a
+              The  increment  in verbose logging level when a nexthop destina-
+              tion, remote client or server name or network address matches  a
               pattern given with the <a href="postconf.5.html#debug_peer_list">debug_peer_list</a> parameter.
 
        <b><a href="postconf.5.html#debug_peer_list">debug_peer_list</a> (empty)</b>
-              Optional list of nexthop destination, remote  client  or  server
-              name  or  network  address  patterns that, if matched, cause the
-              verbose logging level to increase by  the  amount  specified  in
+              Optional  list  of  nexthop destination, remote client or server
+              name or network address patterns that,  if  matched,  cause  the
+              verbose  logging  level  to  increase by the amount specified in
               $<a href="postconf.5.html#debug_peer_level">debug_peer_level</a>.
 
        <b><a href="postconf.5.html#error_notice_recipient">error_notice_recipient</a> (postmaster)</b>
-              The  recipient  of  postmaster notifications about mail delivery
+              The recipient of postmaster notifications  about  mail  delivery
               problems that are caused by policy, resource, software or proto-
               col errors.
 
        <b><a href="postconf.5.html#internal_mail_filter_classes">internal_mail_filter_classes</a> (empty)</b>
-              What   categories  of  Postfix-generated  mail  are  subject  to
-              before-queue   content    inspection    by    <a href="postconf.5.html#non_smtpd_milters">non_smtpd_milters</a>,
+              What  categories  of  Postfix-generated  mail  are  subject   to
+              before-queue    content    inspection    by   <a href="postconf.5.html#non_smtpd_milters">non_smtpd_milters</a>,
               <a href="postconf.5.html#header_checks">header_checks</a> and <a href="postconf.5.html#body_checks">body_checks</a>.
 
        <b><a href="postconf.5.html#notify_classes">notify_classes</a> (resource, software)</b>
               The list of error classes that are reported to the postmaster.
 
        <b><a href="postconf.5.html#smtpd_reject_footer">smtpd_reject_footer</a> (empty)</b>
-              Optional  information  that  is appended after each Postfix SMTP
+              Optional information that is appended after  each  Postfix  SMTP
               server 4XX or 5XX response.
 
        <b><a href="postconf.5.html#soft_bounce">soft_bounce</a> (no)</b>
-              Safety net to keep mail queued that would otherwise be  returned
+              Safety  net to keep mail queued that would otherwise be returned
               to the sender.
 
        Available in Postfix version 2.1 and later:
@@ -720,109 +726,109 @@ SMTPD(8)                                                              SMTPD(8)
        Available in Postfix version 2.10 and later:
 
        <b><a href="postconf.5.html#smtpd_log_access_permit_actions">smtpd_log_access_permit_actions</a> (empty)</b>
-              Enable logging of the named  "permit"  actions  in  SMTP  server
-              access  lists (by default, the SMTP server logs "reject" actions
+              Enable  logging  of  the  named  "permit" actions in SMTP server
+              access lists (by default, the SMTP server logs "reject"  actions
               but not "permit" actions).
 
 <b>KNOWN VERSUS UNKNOWN RECIPIENT CONTROLS</b>
-       As of Postfix version 2.0, the SMTP server  rejects  mail  for  unknown
+       As  of  Postfix  version  2.0, the SMTP server rejects mail for unknown
        recipients. This prevents the mail queue from clogging up with undeliv-
-       erable MAILER-DAEMON messages. Additional information on this topic  is
+       erable  MAILER-DAEMON messages. Additional information on this topic is
        in the <a href="LOCAL_RECIPIENT_README.html">LOCAL_RECIPIENT_README</a> and <a href="ADDRESS_CLASS_README.html">ADDRESS_CLASS_README</a> documents.
 
        <b><a href="postconf.5.html#show_user_unknown_table_name">show_user_unknown_table_name</a> (yes)</b>
-              Display  the  name  of the recipient table in the "User unknown"
+              Display the name of the recipient table in  the  "User  unknown"
               responses.
 
        <b><a href="postconf.5.html#canonical_maps">canonical_maps</a> (empty)</b>
-              Optional address mapping lookup tables for message  headers  and
+              Optional  address  mapping lookup tables for message headers and
               envelopes.
 
        <b><a href="postconf.5.html#recipient_canonical_maps">recipient_canonical_maps</a> (empty)</b>
-              Optional  address  mapping lookup tables for envelope and header
+              Optional address mapping lookup tables for envelope  and  header
               recipient addresses.
 
        <b><a href="postconf.5.html#sender_canonical_maps">sender_canonical_maps</a> (empty)</b>
-              Optional address mapping lookup tables for envelope  and  header
+              Optional  address  mapping lookup tables for envelope and header
               sender addresses.
 
        Parameters concerning known/unknown local recipients:
 
        <b><a href="postconf.5.html#mydestination">mydestination</a> ($<a href="postconf.5.html#myhostname">myhostname</a>, localhost.$<a href="postconf.5.html#mydomain">mydomain</a>, localhost)</b>
-              The  list of domains that are delivered via the $<a href="postconf.5.html#local_transport">local_transport</a>
+              The list of domains that are delivered via the  $<a href="postconf.5.html#local_transport">local_transport</a>
               mail delivery transport.
 
        <b><a href="postconf.5.html#inet_interfaces">inet_interfaces</a> (all)</b>
-              The network interface addresses that this mail  system  receives
+              The  network  interface addresses that this mail system receives
               mail on.
 
        <b><a href="postconf.5.html#proxy_interfaces">proxy_interfaces</a> (empty)</b>
-              The  network  interface addresses that this mail system receives
+              The network interface addresses that this mail  system  receives
               mail on by way of a proxy or network address translation unit.
 
        <b><a href="postconf.5.html#inet_protocols">inet_protocols</a> (all)</b>
-              The Internet protocols Postfix will attempt to use  when  making
+              The  Internet  protocols Postfix will attempt to use when making
               or accepting connections.
 
        <b><a href="postconf.5.html#local_recipient_maps">local_recipient_maps</a> (<a href="proxymap.8.html">proxy</a>:unix:passwd.byname $<a href="postconf.5.html#alias_maps">alias_maps</a>)</b>
               Lookup tables with all names or addresses of local recipients: a
-              recipient address is local when its domain  matches  $<a href="postconf.5.html#mydestination">mydestina</a>-
+              recipient  address  is local when its domain matches $<a href="postconf.5.html#mydestination">mydestina</a>-
               <a href="postconf.5.html#mydestination">tion</a>, $<a href="postconf.5.html#inet_interfaces">inet_interfaces</a> or $<a href="postconf.5.html#proxy_interfaces">proxy_interfaces</a>.
 
        <b><a href="postconf.5.html#unknown_local_recipient_reject_code">unknown_local_recipient_reject_code</a> (550)</b>
               The numerical Postfix SMTP server response code when a recipient
-              address is local, and $<a href="postconf.5.html#local_recipient_maps">local_recipient_maps</a> specifies a list  of
+              address  is local, and $<a href="postconf.5.html#local_recipient_maps">local_recipient_maps</a> specifies a list of
               lookup tables that does not match the recipient.
 
        Parameters concerning known/unknown recipients of relay destinations:
 
        <b><a href="postconf.5.html#relay_domains">relay_domains</a> (Postfix</b> &gt;<b>= 3.0: empty, Postfix</b> &lt; <b>3.0: $<a href="postconf.5.html#mydestination">mydestination</a>)</b>
-              What  destination  domains  (and subdomains thereof) this system
+              What destination domains (and subdomains  thereof)  this  system
               will relay mail to.
 
        <b><a href="postconf.5.html#relay_recipient_maps">relay_recipient_maps</a> (empty)</b>
-              Optional lookup tables with all valid addresses in  the  domains
+              Optional  lookup  tables with all valid addresses in the domains
               that match $<a href="postconf.5.html#relay_domains">relay_domains</a>.
 
        <b><a href="postconf.5.html#unknown_relay_recipient_reject_code">unknown_relay_recipient_reject_code</a> (550)</b>
-              The  numerical  Postfix  SMTP server reply code when a recipient
-              address matches $<a href="postconf.5.html#relay_domains">relay_domains</a>, and <a href="postconf.5.html#relay_recipient_maps">relay_recipient_maps</a>  speci-
-              fies  a  list of lookup tables that does not match the recipient
+              The numerical Postfix SMTP server reply code  when  a  recipient
+              address  matches $<a href="postconf.5.html#relay_domains">relay_domains</a>, and <a href="postconf.5.html#relay_recipient_maps">relay_recipient_maps</a> speci-
+              fies a list of lookup tables that does not match  the  recipient
               address.
 
-       Parameters  concerning  known/unknown  recipients  in   virtual   alias
+       Parameters   concerning   known/unknown  recipients  in  virtual  alias
        domains:
 
        <b><a href="postconf.5.html#virtual_alias_domains">virtual_alias_domains</a> ($<a href="postconf.5.html#virtual_alias_maps">virtual_alias_maps</a>)</b>
-              Postfix  is  final destination for the specified list of virtual
-              alias domains, that is, domains  for  which  all  addresses  are
+              Postfix is final destination for the specified list  of  virtual
+              alias  domains,  that  is,  domains  for which all addresses are
               aliased to addresses in other local or remote domains.
 
        <b><a href="postconf.5.html#virtual_alias_maps">virtual_alias_maps</a> ($<a href="postconf.5.html#virtual_maps">virtual_maps</a>)</b>
-              Optional  lookup  tables  that  alias specific mail addresses or
+              Optional lookup tables that alias  specific  mail  addresses  or
               domains to other local or remote address.
 
        <b><a href="postconf.5.html#unknown_virtual_alias_reject_code">unknown_virtual_alias_reject_code</a> (550)</b>
-              The Postfix SMTP server reply  code  when  a  recipient  address
-              matches  $<a href="postconf.5.html#virtual_alias_domains">virtual_alias_domains</a>,  and $<a href="postconf.5.html#virtual_alias_maps">virtual_alias_maps</a> speci-
-              fies a list of lookup tables that does not match  the  recipient
+              The  Postfix  SMTP  server  reply  code when a recipient address
+              matches $<a href="postconf.5.html#virtual_alias_domains">virtual_alias_domains</a>, and  $<a href="postconf.5.html#virtual_alias_maps">virtual_alias_maps</a>  speci-
+              fies  a  list of lookup tables that does not match the recipient
               address.
 
        Parameters  concerning  known/unknown  recipients  in  virtual  mailbox
        domains:
 
        <b><a href="postconf.5.html#virtual_mailbox_domains">virtual_mailbox_domains</a> ($<a href="postconf.5.html#virtual_mailbox_maps">virtual_mailbox_maps</a>)</b>
-              Postfix is final destination for the specified list of  domains;
-              mail  is  delivered  via  the  $<a href="postconf.5.html#virtual_transport">virtual_transport</a>  mail delivery
+              Postfix  is final destination for the specified list of domains;
+              mail is  delivered  via  the  $<a href="postconf.5.html#virtual_transport">virtual_transport</a>  mail  delivery
               transport.
 
        <b><a href="postconf.5.html#virtual_mailbox_maps">virtual_mailbox_maps</a> (empty)</b>
-              Optional lookup tables with all valid addresses in  the  domains
+              Optional  lookup  tables with all valid addresses in the domains
               that match $<a href="postconf.5.html#virtual_mailbox_domains">virtual_mailbox_domains</a>.
 
        <b><a href="postconf.5.html#unknown_virtual_mailbox_reject_code">unknown_virtual_mailbox_reject_code</a> (550)</b>
-              The  Postfix  SMTP  server  reply  code when a recipient address
-              matches  $<a href="postconf.5.html#virtual_mailbox_domains">virtual_mailbox_domains</a>,   and   $<a href="postconf.5.html#virtual_mailbox_maps">virtual_mailbox_maps</a>
+              The Postfix SMTP server reply  code  when  a  recipient  address
+              matches   $<a href="postconf.5.html#virtual_mailbox_domains">virtual_mailbox_domains</a>,   and  $<a href="postconf.5.html#virtual_mailbox_maps">virtual_mailbox_maps</a>
               specifies a list of lookup tables that does not match the recip-
               ient address.
 
@@ -831,7 +837,7 @@ SMTPD(8)                                                              SMTPD(8)
        control client request rates.
 
        <b><a href="postconf.5.html#line_length_limit">line_length_limit</a> (2048)</b>
-              Upon  input,  long  lines  are chopped up into pieces of at most
+              Upon input, long lines are chopped up into  pieces  of  at  most
               this length; upon delivery, long lines are reconstructed.
 
        <b><a href="postconf.5.html#queue_minfree">queue_minfree</a> (0)</b>
@@ -839,58 +845,58 @@ SMTPD(8)                                                              SMTPD(8)
               tem that is needed to receive mail.
 
        <b><a href="postconf.5.html#message_size_limit">message_size_limit</a> (10240000)</b>
-              The  maximal  size  in  bytes  of  a message, including envelope
+              The maximal size in  bytes  of  a  message,  including  envelope
               information.
 
        <b><a href="postconf.5.html#smtpd_recipient_limit">smtpd_recipient_limit</a> (1000)</b>
-              The maximal number of recipients that the  Postfix  SMTP  server
+              The  maximal  number  of recipients that the Postfix SMTP server
               accepts per message delivery request.
 
        <b><a href="postconf.5.html#smtpd_timeout">smtpd_timeout</a> (normal: 300s, overload: 10s)</b>
-              The  time  limit  for sending a Postfix SMTP server response and
+              The time limit for sending a Postfix SMTP  server  response  and
               for receiving a remote SMTP client request.
 
        <b><a href="postconf.5.html#smtpd_history_flush_threshold">smtpd_history_flush_threshold</a> (100)</b>
-              The maximal number of lines in the Postfix SMTP  server  command
-              history  before it is flushed upon receipt of EHLO, RSET, or end
+              The  maximal  number of lines in the Postfix SMTP server command
+              history before it is flushed upon receipt of EHLO, RSET, or  end
               of DATA.
 
        Available in Postfix version 2.3 and later:
 
        <b><a href="postconf.5.html#smtpd_peername_lookup">smtpd_peername_lookup</a> (yes)</b>
-              Attempt to look up the remote SMTP client hostname,  and  verify
+              Attempt  to  look up the remote SMTP client hostname, and verify
               that the name matches the client IP address.
 
        The per SMTP client connection count and request rate limits are imple-
-       mented in co-operation with the <a href="anvil.8.html"><b>anvil</b>(8)</a> service, and are available  in
+       mented  in co-operation with the <a href="anvil.8.html"><b>anvil</b>(8)</a> service, and are available in
        Postfix version 2.2 and later.
 
        <b><a href="postconf.5.html#smtpd_client_connection_count_limit">smtpd_client_connection_count_limit</a> (50)</b>
-              How  many simultaneous connections any client is allowed to make
+              How many simultaneous connections any client is allowed to  make
               to this service.
 
        <b><a href="postconf.5.html#smtpd_client_connection_rate_limit">smtpd_client_connection_rate_limit</a> (0)</b>
-              The maximal number of connection attempts any client is  allowed
+              The  maximal number of connection attempts any client is allowed
               to make to this service per time unit.
 
        <b><a href="postconf.5.html#smtpd_client_message_rate_limit">smtpd_client_message_rate_limit</a> (0)</b>
-              The  maximal number of message delivery requests that any client
-              is allowed to make to this service per time unit, regardless  of
+              The maximal number of message delivery requests that any  client
+              is  allowed to make to this service per time unit, regardless of
               whether or not Postfix actually accepts those messages.
 
        <b><a href="postconf.5.html#smtpd_client_recipient_rate_limit">smtpd_client_recipient_rate_limit</a> (0)</b>
-              The  maximal  number  of  recipient addresses that any client is
-              allowed to send to this service per  time  unit,  regardless  of
+              The maximal number of recipient addresses  that  any  client  is
+              allowed  to  send  to  this service per time unit, regardless of
               whether or not Postfix actually accepts those recipients.
 
        <b><a href="postconf.5.html#smtpd_client_event_limit_exceptions">smtpd_client_event_limit_exceptions</a> ($<a href="postconf.5.html#mynetworks">mynetworks</a>)</b>
-              Clients  that  are excluded from smtpd_client_*_count/rate_limit
+              Clients that are excluded  from  smtpd_client_*_count/rate_limit
               restrictions.
 
        Available in Postfix version 2.3 and later:
 
        <b><a href="postconf.5.html#smtpd_client_new_tls_session_rate_limit">smtpd_client_new_tls_session_rate_limit</a> (0)</b>
-              The maximal number of new (i.e., uncached) TLS sessions  that  a
+              The  maximal  number of new (i.e., uncached) TLS sessions that a
               remote SMTP client is allowed to negotiate with this service per
               time unit.
 
@@ -898,68 +904,68 @@ SMTPD(8)                                                              SMTPD(8)
 
        <b><a href="postconf.5.html#smtpd_per_record_deadline">smtpd_per_record_deadline</a> (normal: no, overload: yes)</b>
               Change  the  behavior  of  the  <a href="postconf.5.html#smtpd_timeout">smtpd_timeout</a>  and  <a href="postconf.5.html#smtpd_starttls_timeout">smtpd_start</a>-
-              <a href="postconf.5.html#smtpd_starttls_timeout">tls_timeout</a>  time  limits,  from  a time limit per read or write
-              system call, to a time limit  to  send  or  receive  a  complete
-              record  (an  SMTP command line, SMTP response line, SMTP message
+              <a href="postconf.5.html#smtpd_starttls_timeout">tls_timeout</a> time limits, from a time limit  per  read  or  write
+              system  call,  to  a  time  limit  to send or receive a complete
+              record (an SMTP command line, SMTP response line,  SMTP  message
               content line, or TLS protocol message).
 
        Available in Postfix version 3.1 and later:
 
        <b><a href="postconf.5.html#smtpd_client_auth_rate_limit">smtpd_client_auth_rate_limit</a> (0)</b>
-              The maximal number of AUTH commands that any client  is  allowed
-              to  send to this service per time unit, regardless of whether or
+              The  maximal  number of AUTH commands that any client is allowed
+              to send to this service per time unit, regardless of whether  or
               not Postfix actually accepts those commands.
 
 <b>TARPIT CONTROLS</b>
-       When a remote SMTP client makes errors, the  Postfix  SMTP  server  can
-       insert  delays  before  responding. This can help to slow down run-away
-       software.  The behavior is controlled by an error counter  that  counts
+       When  a  remote  SMTP  client makes errors, the Postfix SMTP server can
+       insert delays before responding. This can help to  slow  down  run-away
+       software.   The  behavior is controlled by an error counter that counts
        the number of errors within an SMTP session that a client makes without
        delivering mail.
 
        <b><a href="postconf.5.html#smtpd_error_sleep_time">smtpd_error_sleep_time</a> (1s)</b>
-              With Postfix version 2.1 and later:  the  SMTP  server  response
-              delay  after a client has made more than $<a href="postconf.5.html#smtpd_soft_error_limit">smtpd_soft_error_limit</a>
-              errors, and fewer than $<a href="postconf.5.html#smtpd_hard_error_limit">smtpd_hard_error_limit</a>  errors,  without
+              With  Postfix  version  2.1  and later: the SMTP server response
+              delay after a client has made more than  $<a href="postconf.5.html#smtpd_soft_error_limit">smtpd_soft_error_limit</a>
+              errors,  and  fewer than $<a href="postconf.5.html#smtpd_hard_error_limit">smtpd_hard_error_limit</a> errors, without
               delivering mail.
 
        <b><a href="postconf.5.html#smtpd_soft_error_limit">smtpd_soft_error_limit</a> (10)</b>
-              The  number  of  errors  a remote SMTP client is allowed to make
-              without delivering mail before the  Postfix  SMTP  server  slows
+              The number of errors a remote SMTP client  is  allowed  to  make
+              without  delivering  mail  before  the Postfix SMTP server slows
               down all its responses.
 
        <b><a href="postconf.5.html#smtpd_hard_error_limit">smtpd_hard_error_limit</a> (normal: 20, overload: 1)</b>
-              The  maximal number of errors a remote SMTP client is allowed to
+              The maximal number of errors a remote SMTP client is allowed  to
               make without delivering mail.
 
        <b><a href="postconf.5.html#smtpd_junk_command_limit">smtpd_junk_command_limit</a> (normal: 100, overload: 1)</b>
-              The number of junk commands (NOOP, VRFY, ETRN or  RSET)  that  a
-              remote  SMTP  client  can  send  before  the Postfix SMTP server
+              The  number  of  junk commands (NOOP, VRFY, ETRN or RSET) that a
+              remote SMTP client can  send  before  the  Postfix  SMTP  server
               starts to increment the error counter with each junk command.
 
        Available in Postfix version 2.1 and later:
 
        <b><a href="postconf.5.html#smtpd_recipient_overshoot_limit">smtpd_recipient_overshoot_limit</a> (1000)</b>
-              The number of recipients that a remote SMTP client can  send  in
+              The  number  of recipients that a remote SMTP client can send in
               excess  of  the  limit  specified  with  $<a href="postconf.5.html#smtpd_recipient_limit">smtpd_recipient_limit</a>,
-              before the Postfix SMTP server increments the per-session  error
+              before  the Postfix SMTP server increments the per-session error
               count for each excess recipient.
 
 <b>ACCESS POLICY DELEGATION CONTROLS</b>
-       As  of version 2.1, Postfix can be configured to delegate access policy
-       decisions to an external server that runs  outside  Postfix.   See  the
+       As of version 2.1, Postfix can be configured to delegate access  policy
+       decisions  to  an  external  server that runs outside Postfix.  See the
        file <a href="SMTPD_POLICY_README.html">SMTPD_POLICY_README</a> for more information.
 
        <b><a href="postconf.5.html#smtpd_policy_service_max_idle">smtpd_policy_service_max_idle</a> (300s)</b>
-              The  time after which an idle SMTPD policy service connection is
+              The time after which an idle SMTPD policy service connection  is
               closed.
 
        <b><a href="postconf.5.html#smtpd_policy_service_max_ttl">smtpd_policy_service_max_ttl</a> (1000s)</b>
-              The time after which an active SMTPD policy  service  connection
+              The  time  after which an active SMTPD policy service connection
               is closed.
 
        <b><a href="postconf.5.html#smtpd_policy_service_timeout">smtpd_policy_service_timeout</a> (100s)</b>
-              The  time limit for connecting to, writing to, or receiving from
+              The time limit for connecting to, writing to, or receiving  from
               a delegated SMTPD policy server.
 
        Available in Postfix version 3.0 and later:
@@ -969,81 +975,81 @@ SMTPD(8)                                                              SMTPD(8)
               The default action when an SMTPD policy service request fails.
 
        <b><a href="postconf.5.html#smtpd_policy_service_request_limit">smtpd_policy_service_request_limit</a> (0)</b>
-              The maximal number of requests per SMTPD policy service  connec-
+              The  maximal number of requests per SMTPD policy service connec-
               tion, or zero (no limit).
 
        <b><a href="postconf.5.html#smtpd_policy_service_try_limit">smtpd_policy_service_try_limit</a> (2)</b>
-              The  maximal  number of attempts to send an SMTPD policy service
+              The maximal number of attempts to send an SMTPD  policy  service
               request before giving up.
 
        <b><a href="postconf.5.html#smtpd_policy_service_retry_delay">smtpd_policy_service_retry_delay</a> (1s)</b>
-              The delay between attempts to resend a failed SMTPD policy  ser-
+              The  delay between attempts to resend a failed SMTPD policy ser-
               vice request.
 
        Available in Postfix version 3.1 and later:
 
        <b><a href="postconf.5.html#smtpd_policy_service_policy_context">smtpd_policy_service_policy_context</a> (empty)</b>
-              Optional  information  that the Postfix SMTP server specifies in
-              the "policy_context"  attribute  of  a  policy  service  request
-              (originally,  to  share the same service endpoint among multiple
+              Optional information that the Postfix SMTP server  specifies  in
+              the  "policy_context"  attribute  of  a  policy  service request
+              (originally, to share the same service endpoint  among  multiple
               <a href="postconf.5.html#check_policy_service">check_policy_service</a> clients).
 
 <b>ACCESS CONTROLS</b>
-       The <a href="SMTPD_ACCESS_README.html">SMTPD_ACCESS_README</a> document gives an introduction to all the  SMTP
+       The  <a href="SMTPD_ACCESS_README.html">SMTPD_ACCESS_README</a> document gives an introduction to all the SMTP
        server access control features.
 
        <b><a href="postconf.5.html#smtpd_delay_reject">smtpd_delay_reject</a> (yes)</b>
-              Wait    until    the   RCPT   TO   command   before   evaluating
+              Wait   until   the   RCPT   TO   command    before    evaluating
               $<a href="postconf.5.html#smtpd_client_restrictions">smtpd_client_restrictions</a>,     $<a href="postconf.5.html#smtpd_helo_restrictions">smtpd_helo_restrictions</a>     and
               $<a href="postconf.5.html#smtpd_sender_restrictions">smtpd_sender_restrictions</a>,  or  wait  until  the  ETRN  command
-              before      evaluating      $<a href="postconf.5.html#smtpd_client_restrictions">smtpd_client_restrictions</a>       and
+              before       evaluating      $<a href="postconf.5.html#smtpd_client_restrictions">smtpd_client_restrictions</a>      and
               $<a href="postconf.5.html#smtpd_helo_restrictions">smtpd_helo_restrictions</a>.
 
        <b><a href="postconf.5.html#parent_domain_matches_subdomains">parent_domain_matches_subdomains</a> (see 'postconf -d' output)</b>
-              A  list of Postfix features where the pattern "example.com" also
-              matches subdomains  of  example.com,  instead  of  requiring  an
+              A list of Postfix features where the pattern "example.com"  also
+              matches  subdomains  of  example.com,  instead  of  requiring an
               explicit ".example.com" pattern.
 
        <b><a href="postconf.5.html#smtpd_client_restrictions">smtpd_client_restrictions</a> (empty)</b>
-              Optional  restrictions  that  the Postfix SMTP server applies in
+              Optional restrictions that the Postfix SMTP  server  applies  in
               the context of a client connection request.
 
        <b><a href="postconf.5.html#smtpd_helo_required">smtpd_helo_required</a> (no)</b>
-              Require that a remote SMTP client  introduces  itself  with  the
-              HELO  or  EHLO  command before sending the MAIL command or other
+              Require  that  a  remote  SMTP client introduces itself with the
+              HELO or EHLO command before sending the MAIL  command  or  other
               commands that require EHLO negotiation.
 
        <b><a href="postconf.5.html#smtpd_helo_restrictions">smtpd_helo_restrictions</a> (empty)</b>
-              Optional restrictions that the Postfix SMTP  server  applies  in
+              Optional  restrictions  that  the Postfix SMTP server applies in
               the context of a client HELO command.
 
        <b><a href="postconf.5.html#smtpd_sender_restrictions">smtpd_sender_restrictions</a> (empty)</b>
-              Optional  restrictions  that  the Postfix SMTP server applies in
+              Optional restrictions that the Postfix SMTP  server  applies  in
               the context of a client MAIL FROM command.
 
        <b><a href="postconf.5.html#smtpd_recipient_restrictions">smtpd_recipient_restrictions</a> (see 'postconf -d' output)</b>
-              Optional restrictions that the Postfix SMTP  server  applies  in
-              the    context    of   a   client   RCPT   TO   command,   after
+              Optional  restrictions  that  the Postfix SMTP server applies in
+              the   context   of   a   client   RCPT   TO    command,    after
               <a href="postconf.5.html#smtpd_relay_restrictions">smtpd_relay_restrictions</a>.
 
        <b><a href="postconf.5.html#smtpd_etrn_restrictions">smtpd_etrn_restrictions</a> (empty)</b>
-              Optional restrictions that the Postfix SMTP  server  applies  in
+              Optional  restrictions  that  the Postfix SMTP server applies in
               the context of a client ETRN command.
 
        <b><a href="postconf.5.html#allow_untrusted_routing">allow_untrusted_routing</a> (no)</b>
-              Forward       mail       with      sender-specified      routing
-              (user[@%!]remote[@%!]site) from untrusted  clients  to  destina-
+              Forward      mail      with       sender-specified       routing
+              (user[@%!]remote[@%!]site)  from  untrusted  clients to destina-
               tions matching $<a href="postconf.5.html#relay_domains">relay_domains</a>.
 
        <b><a href="postconf.5.html#smtpd_restriction_classes">smtpd_restriction_classes</a> (empty)</b>
               User-defined aliases for groups of access restrictions.
 
        <b><a href="postconf.5.html#smtpd_null_access_lookup_key">smtpd_null_access_lookup_key</a> (</b>&lt;&gt;<b>)</b>
-              The  lookup  key  to be used in SMTP <a href="access.5.html"><b>access</b>(5)</a> tables instead of
+              The lookup key to be used in SMTP <a href="access.5.html"><b>access</b>(5)</a>  tables  instead  of
               the null sender address.
 
        <b><a href="postconf.5.html#permit_mx_backup_networks">permit_mx_backup_networks</a> (empty)</b>
-              Restrict the use of the <a href="postconf.5.html#permit_mx_backup">permit_mx_backup</a> SMTP access feature  to
+              Restrict  the use of the <a href="postconf.5.html#permit_mx_backup">permit_mx_backup</a> SMTP access feature to
               only domains whose primary MX hosts match the listed networks.
 
        Available in Postfix version 2.0 and later:
@@ -1053,19 +1059,19 @@ SMTPD(8)                                                              SMTPD(8)
               applies in the context of the SMTP DATA command.
 
        <b><a href="postconf.5.html#smtpd_expansion_filter">smtpd_expansion_filter</a> (see 'postconf -d' output)</b>
-              What characters are allowed in $name  expansions  of  RBL  reply
+              What  characters  are  allowed  in $name expansions of RBL reply
               templates.
 
        Available in Postfix version 2.1 and later:
 
        <b><a href="postconf.5.html#smtpd_reject_unlisted_sender">smtpd_reject_unlisted_sender</a> (no)</b>
-              Request  that  the Postfix SMTP server rejects mail from unknown
-              sender addresses, even when no  explicit  <a href="postconf.5.html#reject_unlisted_sender">reject_unlisted_sender</a>
+              Request that the Postfix SMTP server rejects mail  from  unknown
+              sender  addresses,  even when no explicit <a href="postconf.5.html#reject_unlisted_sender">reject_unlisted_sender</a>
               access restriction is specified.
 
        <b><a href="postconf.5.html#smtpd_reject_unlisted_recipient">smtpd_reject_unlisted_recipient</a> (yes)</b>
-              Request  that  the  Postfix SMTP server rejects mail for unknown
-              recipient     addresses,     even     when      no      explicit
+              Request that the Postfix SMTP server rejects  mail  for  unknown
+              recipient      addresses,      even     when     no     explicit
               <a href="postconf.5.html#reject_unlisted_recipient">reject_unlisted_recipient</a> access restriction is specified.
 
        Available in Postfix version 2.2 and later:
@@ -1079,17 +1085,17 @@ SMTPD(8)                                                              SMTPD(8)
        <b><a href="postconf.5.html#smtpd_relay_restrictions">smtpd_relay_restrictions</a> (<a href="postconf.5.html#permit_mynetworks">permit_mynetworks</a>, <a href="postconf.5.html#permit_sasl_authenticated">permit_sasl_authenticated</a>,</b>
        <b><a href="postconf.5.html#defer_unauth_destination">defer_unauth_destination</a>)</b>
               Access restrictions for mail relay control that the Postfix SMTP
-              server  applies  in  the  context of the RCPT TO command, before
+              server applies in the context of the  RCPT  TO  command,  before
               <a href="postconf.5.html#smtpd_recipient_restrictions">smtpd_recipient_restrictions</a>.
 
 <b>SENDER AND RECIPIENT ADDRESS VERIFICATION CONTROLS</b>
-       Postfix version 2.1 introduces sender and recipient  address  verifica-
+       Postfix  version  2.1 introduces sender and recipient address verifica-
        tion.  This feature is implemented by sending probe email messages that
        are  not  actually  delivered.   This  feature  is  requested  via  the
-       <a href="postconf.5.html#reject_unverified_sender">reject_unverified_sender</a>    and    <a href="postconf.5.html#reject_unverified_recipient">reject_unverified_recipient</a>   access
-       restrictions.  The status of verification probes is maintained  by  the
-       <a href="verify.8.html"><b>verify</b>(8)</a>  server.  See the file <a href="ADDRESS_VERIFICATION_README.html">ADDRESS_VERIFICATION_README</a> for infor-
-       mation about how to configure and operate the Postfix  sender/recipient
+       <a href="postconf.5.html#reject_unverified_sender">reject_unverified_sender</a>   and    <a href="postconf.5.html#reject_unverified_recipient">reject_unverified_recipient</a>    access
+       restrictions.   The  status of verification probes is maintained by the
+       <a href="verify.8.html"><b>verify</b>(8)</a> server.  See the file <a href="ADDRESS_VERIFICATION_README.html">ADDRESS_VERIFICATION_README</a> for  infor-
+       mation  about how to configure and operate the Postfix sender/recipient
        address verification service.
 
        <b><a href="postconf.5.html#address_verify_poll_count">address_verify_poll_count</a> (normal: 3, overload: 1)</b>
@@ -1101,7 +1107,7 @@ SMTPD(8)                                                              SMTPD(8)
               fication request in progress.
 
        <b><a href="postconf.5.html#address_verify_sender">address_verify_sender</a> ($<a href="postconf.5.html#double_bounce_sender">double_bounce_sender</a>)</b>
-              The  sender address to use in address verification probes; prior
+              The sender address to use in address verification probes;  prior
               to Postfix 2.5 the default was "postmaster".
 
        <b><a href="postconf.5.html#unverified_sender_reject_code">unverified_sender_reject_code</a> (450)</b>
@@ -1109,18 +1115,18 @@ SMTPD(8)                                                              SMTPD(8)
               address is rejected by the <a href="postconf.5.html#reject_unverified_sender">reject_unverified_sender</a> restriction.
 
        <b><a href="postconf.5.html#unverified_recipient_reject_code">unverified_recipient_reject_code</a> (450)</b>
-              The numerical Postfix SMTP  server  response  when  a  recipient
-              address  is rejected by the <a href="postconf.5.html#reject_unverified_recipient">reject_unverified_recipient</a> restric-
+              The  numerical  Postfix  SMTP  server  response when a recipient
+              address is rejected by the <a href="postconf.5.html#reject_unverified_recipient">reject_unverified_recipient</a>  restric-
               tion.
 
        Available in Postfix version 2.6 and later:
 
        <b><a href="postconf.5.html#unverified_sender_defer_code">unverified_sender_defer_code</a> (450)</b>
-              The numerical Postfix SMTP server response code  when  a  sender
+              The  numerical  Postfix  SMTP server response code when a sender
               address probe fails due to a temporary error condition.
 
        <b><a href="postconf.5.html#unverified_recipient_defer_code">unverified_recipient_defer_code</a> (450)</b>
-              The  numerical  Postfix  SMTP  server  response when a recipient
+              The numerical Postfix SMTP  server  response  when  a  recipient
               address probe fails due to a temporary error condition.
 
        <b><a href="postconf.5.html#unverified_sender_reject_reason">unverified_sender_reject_reason</a> (empty)</b>
@@ -1132,17 +1138,17 @@ SMTPD(8)                                                              SMTPD(8)
               <a href="postconf.5.html#reject_unverified_recipient">reject_unverified_recipient</a>.
 
        <b><a href="postconf.5.html#unverified_sender_tempfail_action">unverified_sender_tempfail_action</a> ($<a href="postconf.5.html#reject_tempfail_action">reject_tempfail_action</a>)</b>
-              The Postfix SMTP server's action  when  <a href="postconf.5.html#reject_unverified_sender">reject_unverified_sender</a>
+              The  Postfix  SMTP server's action when <a href="postconf.5.html#reject_unverified_sender">reject_unverified_sender</a>
               fails due to a temporary error condition.
 
        <b><a href="postconf.5.html#unverified_recipient_tempfail_action">unverified_recipient_tempfail_action</a> ($<a href="postconf.5.html#reject_tempfail_action">reject_tempfail_action</a>)</b>
-              The  Postfix SMTP server's action when <a href="postconf.5.html#reject_unverified_recipient">reject_unverified_recipi</a>-
+              The Postfix SMTP server's action when  <a href="postconf.5.html#reject_unverified_recipient">reject_unverified_recipi</a>-
               <a href="postconf.5.html#reject_unverified_recipient">ent</a> fails due to a temporary error condition.
 
        Available with Postfix 2.9 and later:
 
        <b><a href="postconf.5.html#address_verify_sender_ttl">address_verify_sender_ttl</a> (0s)</b>
-              The time  between  changes  in  the  time-dependent  portion  of
+              The  time  between  changes  in  the  time-dependent  portion of
               address verification probe sender addresses.
 
 <b>ACCESS CONTROL RESPONSES</b>
@@ -1154,36 +1160,36 @@ SMTPD(8)                                                              SMTPD(8)
               map "reject" action.
 
        <b><a href="postconf.5.html#defer_code">defer_code</a> (450)</b>
-              The  numerical  Postfix  SMTP server response code when a remote
+              The numerical Postfix SMTP server response code  when  a  remote
               SMTP client request is rejected by the "defer" restriction.
 
        <b><a href="postconf.5.html#invalid_hostname_reject_code">invalid_hostname_reject_code</a> (501)</b>
-              The numerical Postfix SMTP server response code when the  client
-              HELO   or   EHLO   command   parameter   is   rejected   by  the
+              The  numerical Postfix SMTP server response code when the client
+              HELO  or   EHLO   command   parameter   is   rejected   by   the
               <a href="postconf.5.html#reject_invalid_helo_hostname">reject_invalid_helo_hostname</a> restriction.
 
        <b><a href="postconf.5.html#maps_rbl_reject_code">maps_rbl_reject_code</a> (554)</b>
-              The numerical Postfix SMTP server response code  when  a  remote
-              SMTP   client  request  is  blocked  by  the  <a href="postconf.5.html#reject_rbl_client">reject_rbl_client</a>,
+              The  numerical  Postfix  SMTP server response code when a remote
+              SMTP  client  request  is  blocked  by  the   <a href="postconf.5.html#reject_rbl_client">reject_rbl_client</a>,
               <a href="postconf.5.html#reject_rhsbl_client">reject_rhsbl_client</a>,                <a href="postconf.5.html#reject_rhsbl_reverse_client">reject_rhsbl_reverse_client</a>,
               <a href="postconf.5.html#reject_rhsbl_sender">reject_rhsbl_sender</a> or <a href="postconf.5.html#reject_rhsbl_recipient">reject_rhsbl_recipient</a> restriction.
 
        <b><a href="postconf.5.html#non_fqdn_reject_code">non_fqdn_reject_code</a> (504)</b>
-              The  numerical  Postfix  SMTP  server  reply  code when a client
-              request  is  rejected  by   the   <a href="postconf.5.html#reject_non_fqdn_helo_hostname">reject_non_fqdn_helo_hostname</a>,
+              The numerical Postfix SMTP  server  reply  code  when  a  client
+              request   is   rejected  by  the  <a href="postconf.5.html#reject_non_fqdn_helo_hostname">reject_non_fqdn_helo_hostname</a>,
               <a href="postconf.5.html#reject_non_fqdn_sender">reject_non_fqdn_sender</a> or <a href="postconf.5.html#reject_non_fqdn_recipient">reject_non_fqdn_recipient</a> restriction.
 
        <b><a href="postconf.5.html#plaintext_reject_code">plaintext_reject_code</a> (450)</b>
-              The numerical Postfix SMTP server response code when  a  request
+              The  numerical  Postfix SMTP server response code when a request
               is rejected by the <b><a href="postconf.5.html#reject_plaintext_session">reject_plaintext_session</a></b> restriction.
 
        <b><a href="postconf.5.html#reject_code">reject_code</a> (554)</b>
-              The  numerical  Postfix  SMTP server response code when a remote
+              The numerical Postfix SMTP server response code  when  a  remote
               SMTP client request is rejected by the "reject" restriction.
 
        <b><a href="postconf.5.html#relay_domains_reject_code">relay_domains_reject_code</a> (554)</b>
-              The numerical Postfix SMTP server response code  when  a  client
-              request  is  rejected by the <a href="postconf.5.html#reject_unauth_destination">reject_unauth_destination</a> recipient
+              The  numerical  Postfix  SMTP server response code when a client
+              request is rejected by the  <a href="postconf.5.html#reject_unauth_destination">reject_unauth_destination</a>  recipient
               restriction.
 
        <b><a href="postconf.5.html#unknown_address_reject_code">unknown_address_reject_code</a> (450)</b>
@@ -1191,24 +1197,24 @@ SMTPD(8)                                                              SMTPD(8)
               a sender or recipient address because its domain is unknown.
 
        <b><a href="postconf.5.html#unknown_client_reject_code">unknown_client_reject_code</a> (450)</b>
-              The  numerical  Postfix  SMTP server response code when a client
-              without valid address  &lt;=&gt;  name  mapping  is  rejected  by  the
+              The numerical Postfix SMTP server response code  when  a  client
+              without  valid  address  &lt;=&gt;  name  mapping  is  rejected by the
               <a href="postconf.5.html#reject_unknown_client_hostname">reject_unknown_client_hostname</a> restriction.
 
        <b><a href="postconf.5.html#unknown_hostname_reject_code">unknown_hostname_reject_code</a> (450)</b>
-              The  numerical  Postfix SMTP server response code when the host-
-              name specified with the HELO or EHLO command is rejected by  the
+              The numerical Postfix SMTP server response code when  the  host-
+              name  specified with the HELO or EHLO command is rejected by the
               <a href="postconf.5.html#reject_unknown_helo_hostname">reject_unknown_helo_hostname</a> restriction.
 
        Available in Postfix version 2.0 and later:
 
        <b><a href="postconf.5.html#default_rbl_reply">default_rbl_reply</a> (see 'postconf -d' output)</b>
-              The  default Postfix SMTP server response template for a request
+              The default Postfix SMTP server response template for a  request
               that is rejected by an RBL-based restriction.
 
        <b><a href="postconf.5.html#multi_recipient_bounce_reject_code">multi_recipient_bounce_reject_code</a> (550)</b>
-              The numerical Postfix SMTP server response code  when  a  remote
-              SMTP  client  request  is  blocked  by  the <a href="postconf.5.html#reject_multi_recipient_bounce">reject_multi_recipi</a>-
+              The  numerical  Postfix  SMTP server response code when a remote
+              SMTP client  request  is  blocked  by  the  <a href="postconf.5.html#reject_multi_recipient_bounce">reject_multi_recipi</a>-
               <a href="postconf.5.html#reject_multi_recipient_bounce">ent_bounce</a> restriction.
 
        <b><a href="postconf.5.html#rbl_reply_maps">rbl_reply_maps</a> (empty)</b>
@@ -1218,52 +1224,52 @@ SMTPD(8)                                                              SMTPD(8)
 
        <b><a href="postconf.5.html#access_map_defer_code">access_map_defer_code</a> (450)</b>
               The numerical Postfix SMTP server response code for an <a href="access.5.html"><b>access</b>(5)</a>
-              map    "defer"    action,    including    "<a href="postconf.5.html#defer_if_permit">defer_if_permit</a>"   or
+              map   "defer"    action,    including    "<a href="postconf.5.html#defer_if_permit">defer_if_permit</a>"    or
               "<a href="postconf.5.html#defer_if_reject">defer_if_reject</a>".
 
        <b><a href="postconf.5.html#reject_tempfail_action">reject_tempfail_action</a> (<a href="postconf.5.html#defer_if_permit">defer_if_permit</a>)</b>
-              The Postfix SMTP server's action when a reject-type  restriction
+              The  Postfix SMTP server's action when a reject-type restriction
               fails due to a temporary error condition.
 
        <b><a href="postconf.5.html#unknown_helo_hostname_tempfail_action">unknown_helo_hostname_tempfail_action</a> ($<a href="postconf.5.html#reject_tempfail_action">reject_tempfail_action</a>)</b>
-              The  Postfix SMTP server's action when <a href="postconf.5.html#reject_unknown_helo_hostname">reject_unknown_helo_host</a>-
+              The Postfix SMTP server's action when  <a href="postconf.5.html#reject_unknown_helo_hostname">reject_unknown_helo_host</a>-
               <a href="postconf.5.html#reject_unknown_helo_hostname">name</a> fails due to a temporary error condition.
 
        <b><a href="postconf.5.html#unknown_address_tempfail_action">unknown_address_tempfail_action</a> ($<a href="postconf.5.html#reject_tempfail_action">reject_tempfail_action</a>)</b>
-              The      Postfix      SMTP      server's       action       when
-              <a href="postconf.5.html#reject_unknown_sender_domain">reject_unknown_sender_domain</a>  or <a href="postconf.5.html#reject_unknown_recipient_domain">reject_unknown_recipient_domain</a>
+              The       Postfix       SMTP      server's      action      when
+              <a href="postconf.5.html#reject_unknown_sender_domain">reject_unknown_sender_domain</a> or  <a href="postconf.5.html#reject_unknown_recipient_domain">reject_unknown_recipient_domain</a>
               fail due to a temporary error condition.
 
 <b>MISCELLANEOUS CONTROLS</b>
        <b><a href="postconf.5.html#config_directory">config_directory</a> (see 'postconf -d' output)</b>
-              The default location of the Postfix <a href="postconf.5.html">main.cf</a> and  <a href="master.5.html">master.cf</a>  con-
+              The  default  location of the Postfix <a href="postconf.5.html">main.cf</a> and <a href="master.5.html">master.cf</a> con-
               figuration files.
 
        <b><a href="postconf.5.html#daemon_timeout">daemon_timeout</a> (18000s)</b>
-              How  much  time  a  Postfix  daemon process may take to handle a
+              How much time a Postfix daemon process  may  take  to  handle  a
               request before it is terminated by a built-in watchdog timer.
 
        <b><a href="postconf.5.html#command_directory">command_directory</a> (see 'postconf -d' output)</b>
               The location of all postfix administrative commands.
 
        <b><a href="postconf.5.html#double_bounce_sender">double_bounce_sender</a> (double-bounce)</b>
-              The sender address of postmaster notifications that  are  gener-
+              The  sender  address of postmaster notifications that are gener-
               ated by the mail system.
 
        <b><a href="postconf.5.html#ipc_timeout">ipc_timeout</a> (3600s)</b>
-              The  time  limit  for  sending  or receiving information over an
+              The time limit for sending  or  receiving  information  over  an
               internal communication channel.
 
        <b><a href="postconf.5.html#mail_name">mail_name</a> (Postfix)</b>
-              The mail system name that is displayed in Received: headers,  in
+              The  mail system name that is displayed in Received: headers, in
               the SMTP greeting banner, and in bounced mail.
 
        <b><a href="postconf.5.html#mail_owner">mail_owner</a> (postfix)</b>
-              The  UNIX  system  account  that owns the Postfix queue and most
+              The UNIX system account that owns the  Postfix  queue  and  most
               Postfix daemon processes.
 
        <b><a href="postconf.5.html#max_idle">max_idle</a> (100s)</b>
-              The maximum amount of time that an idle Postfix  daemon  process
+              The  maximum  amount of time that an idle Postfix daemon process
               waits for an incoming connection before terminating voluntarily.
 
        <b><a href="postconf.5.html#max_use">max_use</a> (100)</b>
@@ -1274,11 +1280,11 @@ SMTPD(8)                                                              SMTPD(8)
               The internet hostname of this mail system.
 
        <b><a href="postconf.5.html#mynetworks">mynetworks</a> (see 'postconf -d' output)</b>
-              The  list of "trusted" remote SMTP clients that have more privi-
+              The list of "trusted" remote SMTP clients that have more  privi-
               leges than "strangers".
 
        <b><a href="postconf.5.html#myorigin">myorigin</a> ($<a href="postconf.5.html#myhostname">myhostname</a>)</b>
-              The domain name that locally-posted mail appears to  come  from,
+              The  domain  name that locally-posted mail appears to come from,
               and that locally posted mail is delivered to.
 
        <b><a href="postconf.5.html#process_id">process_id</a> (read-only)</b>
@@ -1291,24 +1297,24 @@ SMTPD(8)                                                              SMTPD(8)
               The location of the Postfix top-level queue directory.
 
        <b><a href="postconf.5.html#recipient_delimiter">recipient_delimiter</a> (empty)</b>
-              The  set of characters that can separate an email address local-
+              The set of characters that can separate an email address  local-
               part, user name, or a .forward file name from its extension.
 
        <b><a href="postconf.5.html#smtpd_banner">smtpd_banner</a> ($<a href="postconf.5.html#myhostname">myhostname</a> ESMTP $<a href="postconf.5.html#mail_name">mail_name</a>)</b>
-              The text that follows the 220 status code in the  SMTP  greeting
+              The  text  that follows the 220 status code in the SMTP greeting
               banner.
 
        <b><a href="postconf.5.html#syslog_facility">syslog_facility</a> (mail)</b>
               The syslog facility of Postfix logging.
 
        <b><a href="postconf.5.html#syslog_name">syslog_name</a> (see 'postconf -d' output)</b>
-              A  prefix  that  is  prepended  to  the  process  name in syslog
+              A prefix that  is  prepended  to  the  process  name  in  syslog
               records, so that, for example, "smtpd" becomes "prefix/smtpd".
 
        Available in Postfix version 2.2 and later:
 
        <b><a href="postconf.5.html#smtpd_forbidden_commands">smtpd_forbidden_commands</a> (CONNECT, GET, POST)</b>
-              List of commands that cause the Postfix SMTP server  to  immedi-
+              List  of  commands that cause the Postfix SMTP server to immedi-
               ately terminate the session with a 221 code.
 
        Available in Postfix version 2.5 and later:
@@ -1325,7 +1331,7 @@ SMTPD(8)                                                              SMTPD(8)
        Available in Postfix 3.4 and later:
 
        <b><a href="postconf.5.html#smtpd_reject_footer_maps">smtpd_reject_footer_maps</a> (empty)</b>
-              Lookup tables, indexed by the complete Postfix SMTP  server  4xx
+              Lookup  tables,  indexed by the complete Postfix SMTP server 4xx
               or 5xx response, with reject footer templates.
 
 <b>SEE ALSO</b>
index 150706f6c8be60789b62139a1c7f1823199bd3c2..25fb602b5a735efd27715dedd445a3fdb9ffba95 100644 (file)
@@ -87,7 +87,7 @@ TRANSPORT(5)                                                      TRANSPORT(5)
               starts with whitespace continues a logical line.
 
        The <i>pattern</i> specifies an email address, a domain name, or a domain name
-       hierarchy, as described in section "TABLE LOOKUP".
+       hierarchy, as described in section "TABLE SEARCH ORDER".
 
        The <i>result</i> is of the form <i>transport:nexthop</i> and specifies how or  where
        to deliver mail. This is described in section "RESULT FORMAT".
index 91b87775796f69a8ebfa8447af6aa6d01163098b..d449c1ced86a26fa99a89376f0dacab2a4fdda39 100644 (file)
@@ -1965,7 +1965,8 @@ cached. If Postfix runs on a network where the DNS root zone is not
 reachable, specify a different probe, or specify an empty dnssec_probe
 value to disable the feature.
 .PP
-This feature is available in Postfix 3.6 and later.
+This feature is available in Postfix 3.6 and later. It was backported
+to Postfix versions 3.5.9, 3.4.19, 3.3.16. 3.2.21.
 .SH dont_remove (default: 0)
 Don't remove queue files and save them to the "saved" mail queue.
 This is a debugging aid.  To inspect the envelope information and
@@ -8109,8 +8110,9 @@ authentication succeeds, it will be logged only as "Trusted", not
 .br
 .br
 The default setting for Postfix >= 3.6 is "dane" with
-"smtp_tls_security_level = dane", otherwise "may".  With earlier
-Postfix versions the defauult setting was always "dane".
+"smtp_tls_security_level = dane", otherwise "may". This behavior
+was backported to Postfix versions 3.5.9, 3.4.19, 3.3.16. 3.2.21.
+With earlier Postfix versions the default setting was always "dane".
 .PP
 Though with "insecure" MX records an active attacker can
 compromise SMTP transport security by returning forged MX records,
@@ -11155,6 +11157,18 @@ not null.
 .br
 .PP
 This feature is available in Postfix 2.1 and later.
+.SH smtpd_relay_before_recipient_restrictions (default: see "postconf \-d" output)
+Evaluate smtpd_relay_restrictions before smtpd_recipient_restrictions.
+Historically, smtpd_relay_restrictions was evaluated after
+smtpd_recipient_restrictions, contradicting documented behavior.
+.PP
+Background: the smtpd_relay_restrictions feature is primarily
+designed to enforce a mail relaying policy, while
+smtpd_recipient_restrictions is primarily designed to enforce spam
+blocking policy. Both are evaluated while replying to the RCPT TO
+command, and both support the same features.
+.PP
+This feature is available in Postfix 3.6 and later.
 .SH smtpd_relay_restrictions (default: permit_mynetworks, permit_sasl_authenticated, defer_unauth_destination)
 Access restrictions for mail relay control that the Postfix
 SMTP server applies in the context of the RCPT TO command, before
index aac9f7616dbf4be51403bc6c848dcdc325737242..b19cfd5961949dd281ef893c1ca4b6840c631265 100644 (file)
@@ -89,7 +89,8 @@ A logical line starts with non\-whitespace text. A line that
 starts with whitespace continues a logical line.
 .PP
 The \fIpattern\fR specifies an email address, a domain name, or
-a domain name hierarchy, as described in section "TABLE LOOKUP".
+a domain name hierarchy, as described in section "TABLE
+SEARCH ORDER".
 
 The \fIresult\fR is of the form \fItransport:nexthop\fR and
 specifies how or where to deliver mail. This is described in
index 547d947f0edb780015eb3db8fc99c489a7711a3f..180ea63591aac24418966657f791d90bd6269e9f 100644 (file)
@@ -160,6 +160,10 @@ line, SMTP message content line, or TLS protocol message).
 Available in Postfix version 3.0 and later:
 .IP "\fBsmtpd_dns_reply_filter (empty)\fR"
 Optional filter for Postfix SMTP server DNS lookup results.
+.PP
+Available in Postfix version 3.6 and later:
+.IP "\fBsmtpd_relay_before_recipient_restrictions (see 'postconf -d' output)\fR"
+Evaluate smtpd_relay_restrictions before smtpd_recipient_restrictions.
 .SH "ADDRESS REWRITING CONTROLS"
 .na
 .nf
index 551fde9d85d50cb1d47fa5558615c63c3beb77e1..0277cc251d468e5707a130ab6afebe17915d3ada 100755 (executable)
@@ -572,8 +572,9 @@ while (<>) {
     s;\bsmtpd_proxy_timeout\b;<a href="postconf.5.html#smtpd_proxy_timeout">$&</a>;g;
     s;\bsmtpd_proxy_options\b;<a href="postconf.5.html#smtpd_proxy_options">$&</a>;g;
     s;\bsmtpd_recip[-</bB>]*\n* *[<bB>]*ient_limit\b;<a href="postconf.5.html#smtpd_recipient_limit">$&</a>;g;
-    s;\bsmtpd_recip[-</bB>]*\n* *[<bB>]*ient_restric[-</bB>]*\n* *[<bB>]*tions\b;<a href="postconf.5.html#smtpd_recipient_restrictions">$&</a>;g;
+    s;\bsmtpd_recip[-</bB>]*\n* *[<bB>]*i[-</bB>]*\n* *[<bB>]*ent_restric[-</bB>]*\n* *[<bB>]*tions\b;<a href="postconf.5.html#smtpd_recipient_restrictions">$&</a>;g;
     s;\bsmtpd_relay_restrictions\b;<a href="postconf.5.html#smtpd_relay_restrictions">$&</a>;g;
+    s;\bsmtpd_relay_before_recipient_restrictions\b;<a href="postconf.5.html#smtpd_relay_before_recipient_restrictions">$&</a>;g;
     s;\bsmtpd_reject_unlisted_recip[-</bB>]*\n* *[<bB>]*ient\b;<a href="postconf.5.html#smtpd_reject_unlisted_recipient">$&</a>;g;
     s;\bsmtpd_reject_unlisted_sender\b;<a href="postconf.5.html#smtpd_reject_unlisted_sender">$&</a>;g;
     s;\bsmtpd_restriction_classes\b;<a href="postconf.5.html#smtpd_restriction_classes">$&</a>;g;
index ec483ddf6c76d4f6a1465a643557c353840c0acb..244fa162a5d5405c52fbad8b1364180a3b642209 100644 (file)
@@ -61,7 +61,7 @@ default setting append_dot_mydomain=yes </a> </p>
 chroot=y</a> </p>
 
 <li><p> <a href="#relay_restrictions"> Using backwards-compatible
-default setting smtpd_relay_restrictions = (empty)</a> </p>
+default setting "smtpd_relay_restrictions = (empty)"</a> </p>
 
 <li> <p> <a href="#mynetworks_style"> Using backwards-compatible
 default setting mynetworks_style=subnet </a> </p>
@@ -81,6 +81,9 @@ default setting smtp_tls_fingerprint_digest=md5</a> </p>
 <li> <p> <a href="#smtp_digest"> Using backwards-compatible
 default setting lmtp_tls_fingerprint_digest=md5</a> </p>
 
+<li> <p> <a href="#relay_before_rcpt"> Using backwards-compatible
+default setting smtpd_relay_before_recipient_restrictions=no</a> </p>
+
 </ul>
 
 <p> If such a message is logged in the context of a legitimate
@@ -461,6 +464,45 @@ warnings, you can <a href="#turnoff">update</a> your compatibility level.
 </pre>
 </blockquote>
 
+<h2> <a name="relay_before_rcpt"> Using backwards-compatible
+default setting smtpd_relay_before_recipient_restrictions=no</a> </h2>
+
+<p> The smtpd_relay_before_recipient_restrictions feature was
+introduced in Postfix version 3.6, to evaluate smtpd_relay_restrictions
+before smtpd_recipient_restrictions. Historically, smtpd_relay_restrictions
+was evaluated after smtpd_recipient_restrictions, contradicting
+documented behavior. </p>
+
+<blockquote> <p> Background: smtpd_relay_restrictions is
+primarily designed to enforce a mail relaying policy, while
+smtpd_recipient_restrictions is primarily designed to enforce spam
+blocking policy. Both are evaluated while replying to the RCPT TO
+command, and both support the same features. </p> </blockquote>
+
+<p> When the compatibility_level is less than 3.6, and the
+smtpd_relay_before_recipient_restrictions parameter is left at its
+implicit default setting, Postfix may log the following message: </p>
+
+<blockquote>
+<pre>
+postfix/smtpd[54696]: using backwards-compatible default setting
+    smtpd_relay_before_recipient_restrictions=no to reject recipient
+    "user@example.com" from client "host.example.net[10.0.0.2]"
+</pre>
+</blockquote>
+
+<p> If Postfix should keep evaluating smtpd_recipient_restrictions
+before smtpd_relay_restrictions, then the system
+administrator should make the backwards-compatible setting
+"smtpd_relay_before_recipient_restrictions=no" permanent in main.cf: </p>
+
+<blockquote>
+<pre>
+# <b> postconf smtpd_relay_before_recipient_restrictions=no </b>
+# <b> postfix reload </b>
+</pre>
+</blockquote>
+
 <h2> <a name="turnoff">Turning off the backwards-compatibility safety net</a> </h2>
 
 <p> Backwards compatibility is turned off by updating the
index e95a10baee70df43fed00d3294402d3d29e5dc53..39e2b8901c50cd3997ffdbbb2cc534253708d148 100644 (file)
@@ -16983,8 +16983,10 @@ authentication succeeds, it will be logged only as "Trusted", not
 </dl>
 
 <p> The default setting for Postfix &ge; 3.6 is "dane" with
-"smtp_tls_security_level = dane", otherwise "may".  With earlier
-Postfix versions the defauult setting was always "dane". </p>
+"smtp_tls_security_level = dane", otherwise "may". This behavior
+was backported to Postfix versions 3.5.9, 3.4.19, 3.3.16. 3.2.21.
+With earlier Postfix versions the default setting was always "dane".
+</p>
 
 <p> Though with "insecure" MX records an active attacker can
 compromise SMTP transport security by returning forged MX records,
@@ -17923,7 +17925,8 @@ cached. If Postfix runs on a network where the DNS root zone is not
 reachable, specify a different probe, or specify an empty dnssec_probe
 value to disable the feature. </p>
 
-<p> This feature is available in Postfix 3.6 and later. </p>
+<p> This feature is available in Postfix 3.6 and later. It was backported
+to Postfix versions 3.5.9, 3.4.19, 3.3.16. 3.2.21. </p>
 
 %PARAM local_login_sender_maps static:*
 
@@ -18007,3 +18010,17 @@ instead of deleting only the non-delivery notification. </dd>
 </dl>
 
 <p> This feature is available in Postfix 3.6 and later. </p>
+
+%PARAM smtpd_relay_before_recipient_restrictions see "postconf -d" output
+
+<p> Evaluate smtpd_relay_restrictions before smtpd_recipient_restrictions.
+Historically, smtpd_relay_restrictions was evaluated after
+smtpd_recipient_restrictions, contradicting documented behavior. </p>
+
+<p> Background: the smtpd_relay_restrictions feature is primarily
+designed to enforce a mail relaying policy, while
+smtpd_recipient_restrictions is primarily designed to enforce spam
+blocking policy. Both are evaluated while replying to the RCPT TO
+command, and both support the same features. </p>
+
+<p> This feature is available in Postfix 3.6 and later. </p>
index 49b3441d851f0335a38bf5113ba5ccc411ee2658..1cd30b3ceb9456cf9d90e7a2fc035c40cb5677a0 100644 (file)
@@ -79,7 +79,8 @@
 #      starts with whitespace continues a logical line.
 # .PP
 #      The \fIpattern\fR specifies an email address, a domain name, or
-#      a domain name hierarchy, as described in section "TABLE LOOKUP".
+#      a domain name hierarchy, as described in section "TABLE
+#      SEARCH ORDER".
 #
 #      The \fIresult\fR is of the form \fItransport:nexthop\fR and
 #      specifies how or where to deliver mail. This is described in
index 26a346279af0ef10c1fb54ef811cfc4b557b61cf..5f53dbc8ffaf3ed09f770b4d1ec9c9f3dc5c5423 100644 (file)
@@ -335,7 +335,7 @@ const char *dns_str_resflags(unsigned long);
 #define DNS_SEC_STATS_SET(flags) (dns_sec_stats |= (flags))
 #define DNS_SEC_STATS_TEST(flags) (dns_sec_stats & (flags))
 
-extern int dns_sec_stats;              /* See flags below */
+extern int dns_sec_stats;              /* See DNS_SEC_FLAG_XXX above */
 extern void dns_sec_probe(int);
 
 /* LICENSE
index e6d7bb740fe69608dda6632af2bf554d3d71899b..849627e4bcc5a34fd7af2828fdc3106f5cfb3ef8 100644 (file)
@@ -117,7 +117,7 @@ void    dns_sec_probe(int rflags)
                  VAR_DNSSEC_PROBE, var_dnssec_probe);
 
     why = vstring_alloc(100);
-    dns_status = dns_lookup(qname, qtype, rflags, &rrlist, (char) 0, why);
+    dns_status = dns_lookup(qname, qtype, rflags, &rrlist, (VSTRING *) 0, why);
     if (!DNS_SEC_STATS_TEST(DNS_SEC_FLAG_AVAILABLE))
        msg_warn("DNSSEC validation may be unavailable");
     else if (msg_verbose)
index 30e5d2b2a6d5522e278244f8caebf45f78e566ae..372f2cf20a9460411b7b880cd49a9576fdd0b8a4 100644 (file)
@@ -229,7 +229,7 @@ static DOMAIN_LIST *flush_domains;
   * Silly little macros.
   */
 #define STR(x)                 vstring_str(x)
-#define STREQ(x,y)             ((x) == (y) || strcmp(x,y) == 0)
+#define STREQ(x,y)             (STRREF(x) == STRREF(y) || strcmp(x,y) == 0)
 
  /*
   * Forward declarations resulting from breaking up routines according to
index 95c91ccc839121b081355927cf1576b7e71c9011..09e0884b9196eabc9706f91b8bddffac5fa186a0 100644 (file)
 /*     int     warn_compat_break_smtpd_tls_fpt_dgst;
 /*     int     warn_compat_break_smtp_tls_fpt_dgst;
 /*     int     warn_compat_break_lmtp_tls_fpt_dgst;
+/*     int     warn_compat_relay_before_rcpt_checks;
 /*
 /*     char    *var_maillog_file;
 /*     char    *var_maillog_file_pfxs;
 /*     char    *var_postlog_service;
 /*
 /*     char    *var_dnssec_probe;
+/*     bool    var_relay_before_rcpt_checks;
 /* DESCRIPTION
 /*     This module (actually the associated include file) defines
 /*     the names and defaults of all mail configuration parameters.
@@ -372,15 +374,17 @@ char   *var_maillog_file_stamp;
 char   *var_postlog_service;
 
 char   *var_dnssec_probe;
+bool    var_relay_before_rcpt_checks;
 
 const char null_format_string[1] = "";
 
  /*
-  * Compatibility level 3.
+  * Compatibility level 3.6.
   */
 int     warn_compat_break_smtpd_tls_fpt_dgst;
 int     warn_compat_break_smtp_tls_fpt_dgst;
 int     warn_compat_break_lmtp_tls_fpt_dgst;
+int     warn_compat_relay_before_rcpt_checks;
 
  /*
   * Compatibility level 2.
@@ -652,10 +656,13 @@ static void check_legacy_defaults(void)
            warn_compat_break_smtp_tls_fpt_dgst = 1;
        if (mail_conf_lookup(VAR_LMTP_TLS_FPT_DGST) == 0)
            warn_compat_break_lmtp_tls_fpt_dgst = 1;
+       if (mail_conf_lookup(VAR_RELAY_BEFORE_RCPT_CHECKS) == 0)
+           warn_compat_relay_before_rcpt_checks = 1;
     } else {
        warn_compat_break_smtpd_tls_fpt_dgst = 0;
        warn_compat_break_smtp_tls_fpt_dgst = 0;
        warn_compat_break_lmtp_tls_fpt_dgst = 0;
+       warn_compat_relay_before_rcpt_checks = 0;
     }
 
     /*
@@ -742,6 +749,7 @@ void    mail_params_init()
        /* read and process the following before opening tables. */
        VAR_SMTPUTF8_ENABLE, DEF_SMTPUTF8_ENABLE, &var_smtputf8_enable,
        VAR_IDNA2003_COMPAT, DEF_IDNA2003_COMPAT, &var_idna2003_compat,
+       VAR_RELAY_BEFORE_RCPT_CHECKS, DEF_RELAY_BEFORE_RCPT_CHECKS, &var_relay_before_rcpt_checks,
        0,
     };
     static const CONFIG_STR_FN_TABLE function_str_defaults[] = {
index 046252be9bf4e99f7dc997779e44ca99d025daee..f1b5c69a3caf991c44630e5a5f784fe45f87df32 100644 (file)
@@ -72,6 +72,7 @@ extern int warn_compat_break_mynetworks_style;
 extern int warn_compat_break_smtpd_tls_fpt_dgst;
 extern int warn_compat_break_smtp_tls_fpt_dgst;
 extern int warn_compat_break_lmtp_tls_fpt_dgst;
+extern int warn_compat_relay_before_rcpt_checks;
 
 extern long compat_level;
 
@@ -2174,6 +2175,11 @@ extern char *var_relay_checks;
 #define DEF_RCPT_CHECKS                ""
 extern char *var_rcpt_checks;
 
+#define VAR_RELAY_BEFORE_RCPT_CHECKS "smtpd_relay_before_recipient_restrictions"
+#define DEF_RELAY_BEFORE_RCPT_CHECKS "${{$compatibility_level} <level {3.6} ?" \
+                               " {no} : {yes}}"
+extern bool var_relay_before_rcpt_checks;
+
 #define VAR_ETRN_CHECKS                "smtpd_etrn_restrictions"
 #define DEF_ETRN_CHECKS                ""
 extern char *var_etrn_checks;
index 1250d0099a7195ac7de2e194b023d7d399e354a2..16ccd87200cc6b271264ffb024c5d59c6a0dd501 100644 (file)
@@ -20,7 +20,7 @@
   * Patches change both the patchlevel and the release date. Snapshots have no
   * patchlevel; they change the release date only.
   */
-#define MAIL_RELEASE_DATE      "20210110"
+#define MAIL_RELEASE_DATE      "20210131"
 #define MAIL_VERSION_NUMBER    "3.6"
 
 #ifdef SNAPSHOT
index 1dc9b757f2e0250f8ab516c8c928b1905a5e9cc3..5a3516368eb3e4db8fb7612a98e990f60658396e 100644 (file)
@@ -336,10 +336,9 @@ int     rec_goto(VSTREAM *stream, const char *buf)
      * is likely to insert 10000 message headers, but someone might append
      * 10000 recipients.
      */
-#define STREQ(x,y) ((x) == (y) && strcmp((x), (y)) == 0)
 #define REVERSE_JUMP_LIMIT     10000
 
-    if (!STREQ(saved_path, VSTREAM_PATH(stream))) {
+    if (saved_path != VSTREAM_PATH(stream)) {
        saved_path = VSTREAM_PATH(stream);
        reverse_count = 0;
        saved_offset = 0;
index 6751dbf73d8dd8a624b1e1ea456893111006aecb..5cac517d3a5ec26784272eafaaf1aa2d0879fa6a 100644 (file)
 /*     Available in Postfix version 3.0 and later:
 /* .IP "\fBsmtpd_dns_reply_filter (empty)\fR"
 /*     Optional filter for Postfix SMTP server DNS lookup results.
+/* .PP
+/*     Available in Postfix version 3.6 and later:
+/* .IP "\fBsmtpd_relay_before_recipient_restrictions (see 'postconf -d' output)\fR"
+/*     Evaluate smtpd_relay_restrictions before smtpd_recipient_restrictions.
 /* ADDRESS REWRITING CONTROLS
 /* .ad
 /* .fi
@@ -6408,6 +6412,7 @@ int     main(int argc, char **argv)
     };
     static const CONFIG_NBOOL_TABLE nbool_table[] = {
        VAR_SMTPD_REC_DEADLINE, DEF_SMTPD_REC_DEADLINE, &var_smtpd_rec_deadline,
+       VAR_RELAY_BEFORE_RCPT_CHECKS, DEF_RELAY_BEFORE_RCPT_CHECKS, &var_relay_before_rcpt_checks,
        0,
     };
     static const CONFIG_STR_TABLE str_table[] = {
index 73b8357c7ffbe2a1596db7f4f94f2bb9f5d796b8..d96050ce29ecdb5c817c1926cf2af6ff5f114759 100644 (file)
@@ -5039,6 +5039,8 @@ char   *smtpd_check_rcpt(SMTPD_STATE *state, char *recipient)
     char   *err;
     ARGV   *restrctions[2];
     int     n;
+    int     rcpt_index;
+    int     relay_index;
 
     /*
      * Initialize.
@@ -5098,17 +5100,28 @@ char   *smtpd_check_rcpt(SMTPD_STATE *state, char *recipient)
      * permit_sasl_authenticated, permit_auth_destination) and log a warning
      * if the result is DUNNO instead of OK, i.e. a reject_unauth_destinatin
      * at the end would have blocked the request.
+     * 
+     * If warn_compat_break_relay_restrictions is true, always evaluate
+     * smtpd_relay_restrictions last (rcpt_index == 1). The backwards
+     * compatibility warning says that it avoids blocking a recipient (with
+     * "Relay access denied"); that is not useful information when moments
+     * later, smtpd_recipient_restrictions blocks the recipient anyway (with
+     * 'Relay access denied' or some other cause).
      */
     SMTPD_CHECK_RESET();
-    restrctions[0] = rcpt_restrctions;
-    restrctions[1] = warn_compat_break_relay_restrictions ?
+    rcpt_index = (var_relay_before_rcpt_checks
+                 || warn_compat_break_relay_restrictions);
+    relay_index = !rcpt_index;
+
+    restrctions[rcpt_index] = rcpt_restrctions;
+    restrctions[relay_index] = warn_compat_break_relay_restrictions ?
        fake_relay_restrctions : relay_restrctions;
     for (n = 0; n < 2; n++) {
        status = setjmp(smtpd_check_buf);
        if (status == 0 && restrctions[n]->argc)
            status = generic_checks(state, restrctions[n],
                          recipient, SMTPD_NAME_RECIPIENT, CHECK_RECIP_ACL);
-       if (n == 1 && warn_compat_break_relay_restrictions
+       if (n == relay_index && warn_compat_break_relay_restrictions
            && status == SMTPD_CHECK_DUNNO) {
            msg_info("using backwards-compatible default setting \""
                     VAR_RELAY_CHECKS " = (empty)\" to avoid \"Relay "
@@ -5118,6 +5131,12 @@ char   *smtpd_check_rcpt(SMTPD_STATE *state, char *recipient)
        if (status == SMTPD_CHECK_REJECT)
            break;
     }
+    if (status == SMTPD_CHECK_REJECT
+       && warn_compat_relay_before_rcpt_checks && n == 0)
+       msg_info("using backwards-compatible default setting "
+                VAR_RELAY_BEFORE_RCPT_CHECKS "=no to reject "
+                "recipient \"%s\" from client \"%s\"",
+                state->recipient, state->namaddr);
 
     /*
      * Force permission into deferral when some earlier temporary error may
index dd79541c90c0df57d8e3e615bc91de78a37d2168..8ac177b9258c9a51eee7420dcafa225b6caf52d8 100644 (file)
@@ -82,6 +82,12 @@ extern int strncasecmp_utf8x(int, const char *, const char *, ssize_t);
 #define strncasecmp_utf8(s1, s2, l) \
     strncasecmp_utf8x(util_utf8_enable ? CASEF_FLAG_UTF8 : 0, (s1), (s2), (l))
 
+ /*
+  * Use STRREF(x) instead of x, to shut up compiler warnings when the operand
+  * is a string literal.
+  */
+#define STRREF(x)              (&x[0])
+
 /* LICENSE
 /* .ad
 /* .fi