From: Wietse Venema Date: Tue, 20 Jan 2004 05:00:00 +0000 (-0500) Subject: postfix-2.0.17-20040120 X-Git-Tag: v2.1-RC1-20040331~5 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=63f4ae5ddebaee7cbf310c3b0e34732f8611d83d;p=thirdparty%2Fpostfix.git postfix-2.0.17-20040120 --- diff --git a/postfix/HISTORY b/postfix/HISTORY index 234dca77c..b96dbdbab 100644 --- a/postfix/HISTORY +++ b/postfix/HISTORY @@ -8749,6 +8749,10 @@ Apologies for any names omitted. address). This is useful as a catch-all pattern at the end of a table. Files: util/dict_cidr.c, util/match_ops.c. + Cleanup: don't report that $queue_directory/etc/filename + differs from /etc/filename when /etc/filename does not + exist. File: conf/postfix-script. + 20031112 Feature: client_connection_status_update_time parameter @@ -9026,13 +9030,13 @@ Apologies for any names omitted. 20040115 - Bugfix: allow delivery concurrency to increase even while - mail is deferred, as long as the delivery agent does not - report really serious trouble with the destination. Files: - *qmgr/qmgr_deliver.c. + Performance: allow delivery concurrency to increase even + while mail is deferred, as long as the delivery agent does + not report really serious trouble with the destination. + Files: *qmgr/qmgr_deliver.c. Cleanup: in postfix-files, symbolic links and hard links - are now first-class entries with explicit mention of + are now first-class citizens with explicit mention of source and destination pathnames. Files: postfix-install, conf/postfix-files, conf/post-install. @@ -9051,10 +9055,32 @@ Apologies for any names omitted. Documentation: finished the HOSTING_README file with an overview of methods to host domains with Postfix. +20040119 + + Bugfix: anvil (count and rate limiting) server race condition + could result in dangling pointer. Postfix erases memory + after allocating and before freeing, so it is extremely + unlikely that this could be used to bring harmful data into + the anvil server. File anvil/anvil.c. + +20040120 + + Cleanup: new header_checks(5) and body_checks(5) manual + pages. The sample-regexp* and sample-pcre* files are no + longer needed and have been removed, as are the default + *_table configuration files. + + Cleanup: support for the non-standard Errors-To: header + is removed. File: cleanup/cleanup_message.c. + Open problems: - High: when virtual aliasing is turned off after content - filtering, local submissions may escape virtual aliasing. + Med: silly queue file bit so that the queue manager doesn't + skip files when fast flush is requested while a queue scan + is in progress. + + Med: postsuper -r should do something with recipients in + bounce logfiles. Low: qmgr_move should not reset time stamps on queue files without shared lock (i.e. not open by a delivery agent). @@ -9062,9 +9088,6 @@ Open problems: Low: postsuper re-run after renaming files, but only a limited number of times. - Doc: mention the proxy_interfaces parameter everywhere the - inet_interfaces and mydestination parameters are mentioned. - Low: smtp-source may block when sending large test messages. Med: make qmgr recipient bounce/defer activity asynchronous @@ -9076,9 +9099,6 @@ Open problems: Med: find a way to log the sender address when MAIL FROM is rejected due to lack of disk space. - Low: after successful delivery, per-queue window += 1/window, - after failure, queue window -= 1 (Victor). - Low: revise other local delivery agent duplicate filters. Low: all table lookups should consistently use internalized @@ -9116,7 +9136,8 @@ Open problems: Low: postconf -e edits parameters that postconf won't list. Low: while converting 8bit text to quoted-printable, perhaps - use =46rom instead of >From. + use =46rom to avoid having to produce >From when delivering + to mailbox. virtual_mailbox_path expression like forward_path, so that people can specify prefix and suffix. diff --git a/postfix/Makefile.in.stable b/postfix/Makefile.in.stable index 063b27442..981909ac9 100644 --- a/postfix/Makefile.in.stable +++ b/postfix/Makefile.in.stable @@ -7,7 +7,7 @@ DIRS = src/util src/global src/dns src/master src/postfix src/smtpstone \ src/pipe src/showq src/postalias src/postcat src/postconf src/postdrop \ src/postkick src/postlock src/postlog src/postmap src/postqueue \ src/postsuper src/qmqpd src/spawn src/flush src/verify \ - src/virtual src/proxymap src/anvil + src/virtual src/proxymap MANDIRS = proto man html default: update diff --git a/postfix/README_FILES/ADDRESS_CLASS_README b/postfix/README_FILES/ADDRESS_CLASS_README index 07658ccba..65f02feb5 100644 --- a/postfix/README_FILES/ADDRESS_CLASS_README +++ b/postfix/README_FILES/ADDRESS_CLASS_README @@ -32,7 +32,7 @@ Class Description ------------------------------------------------------------------- local For UNIX accounts and for traditional /etc/aliases Domain names are listed in $mydestination (or match the IP - address listed with $inet_interfaces) + address listed with $inet_interfaces or $proxy_interfaces) Known recipients are listed in $local_recipient_maps (this information is currently used by the Postfix SMTP server only; if $local_recipient_maps is empty, the Postfix diff --git a/postfix/README_FILES/HOSTING_README b/postfix/README_FILES/HOSTING_README index 11e381d37..246ffb610 100644 --- a/postfix/README_FILES/HOSTING_README +++ b/postfix/README_FILES/HOSTING_README @@ -1,13 +1,14 @@ Purpose of this document ======================== -This document gives an overview of how to use Postfix for hosting -multiple Internet domains, both for final delivery on the machine -itself and for the purpose of forwarding to destinations elsewhere. - -It not only describes delivery mechanisms that are already built -into Postfix, but also gives pointers for using non-Postfix mail -delivery software. +This document gives an overview of how Postfix can be used for +hosting multiple Internet domains, both for final delivery on the +machine itself and for the purpose of forwarding to destinations +elsewhere. + +The text not only describes delivery mechanisms that are built into +Postfix, but also gives pointers for using non-Postfix mail delivery +software. The following topics are covered: diff --git a/postfix/README_FILES/LOCAL_RECIPIENT_README b/postfix/README_FILES/LOCAL_RECIPIENT_README index e616a23d0..f9a5ec1d8 100644 --- a/postfix/README_FILES/LOCAL_RECIPIENT_README +++ b/postfix/README_FILES/LOCAL_RECIPIENT_README @@ -22,7 +22,8 @@ Configuring the local_recipient_maps parameter The local_recipient_maps parameter specifies lookup tables with all names or addresses of local recipients. A recipient address is -local when the address domain matches $mydestination or $inet_interfaces. +local when the address domain matches $mydestination, $inet_interfaces +or $proxy_interfaces. The right-hand side of the lookup tables is conveniently ignored. In the left-hand side, specify a bare username, an @domain.tld diff --git a/postfix/RELEASE_NOTES b/postfix/RELEASE_NOTES index 9ac807625..5d7088d23 100644 --- a/postfix/RELEASE_NOTES +++ b/postfix/RELEASE_NOTES @@ -12,24 +12,55 @@ snapshot release). Patches change the patchlevel and the release date. Snapshots change only the release date, unless they include the same bugfixes as a patch release. -Incompatible changes with Postfix snapshot 2.0.16-2004XXXX +Incompatible changes with Postfix snapshot 2.0.17-2004120 ========================================================== +The new queue manager nqmgr has become the default qmgr queue +manager. For a limited time the old queue manager remains available +under the name oqmgr. The name nqmgr still works but will cause a +warning to be logged. + Queue files creates with "sendmail -v" are no longer compatible with earlier Postfix 2.x versions. A new record type, "killed", -was introduced in order to avoid repeated mail delivery notification -reports with mail that could not be delivered due to a temproary -error condition. +was introduced in order to avoid repeated mail delivery reports +from mail that could not be delivered due to a temporary error +condition. The format of the postfix-files file has changed. There is a new type for hard links. With hard or symbolic link entries, the first field is now the destination pathname and the "owner" field is now the origin pathname, while "group" and "permissions" are ignored. -The SMTP server no longer accepts sender addresses that match a -local, virtual or relay domain while the address is not listed as -valid in the corresponding local, virtual or relay recipient table. -This is not configurable. +The SMTP server now rejects non-existent sender addresses in a +local, virtual or relay domain; that is, a sender address must +pass the same "user unknown" test as a recipient would have to +pass. This is not configurable. + +Support for the non-standard Errors-To: message header is removed. +This also helps to stop potential attacks that rely on bouncing +mail to a destination that is not directly reachable by the attacker. + +The sample-regexp/pcre-* files are replaced by header_checks(5) +and body_checks(5) manual pages that give more complete information. + +The LDAP and SQL clients have been moved to the global directory +in order to eliminate reversed dependencies. + +Major changes with Postfix snapshot 2.0.17-20040120 +=================================================== + +The new queue manager nqmgr has become the default qmgr queue +manager. For a limited time the old queue manager remains available +under the name oqmgr. The name nqmgr still works but will cause a +warning to be logged. + +The HOSTING_README file now documents most of the methods that can +be used to host domains with a Postfix MTA. + +New header_checks(5) and body_checks(5) manual pages that give a +more complete description than the old sample configuration files. + +Slightly more agressive delivery to sites that defer a lot of mail. Incompatible changes with Postfix snapshot 2.0.16-20031226 ========================================================== @@ -39,8 +70,7 @@ addresses (user@1.2.3.4). This is not configurable. The form user@[ipaddress] is still allowed. Bounce messages now have a separate queue life time. This is -controlled by the bounce_queue_lifetime parameter. The default is -$maximal_queue_life_time. +controlled by the bounce_queue_lifetime parameter. Incompatible changes with Postfix snapshot 2.0.16-20031223 ========================================================== diff --git a/postfix/SNAPSHOT b/postfix/SNAPSHOT new file mode 100644 index 000000000..617eeba5a --- /dev/null +++ b/postfix/SNAPSHOT @@ -0,0 +1,6 @@ +Features to be disabled for the stable 2.1 release: + +name #ifdef module man html config sample +====================================================== +tcp_table +anvil diff --git a/postfix/conf/canonical b/postfix/conf/canonical index 4cea8b406..66ceacad9 100644 --- a/postfix/conf/canonical +++ b/postfix/conf/canonical @@ -82,68 +82,69 @@ # user address # user@site is replaced by address when site is equal # to $myorigin, when site is listed in $mydestina- -# tion, or when it is listed in $inet_interfaces. +# tion, or when it is listed in $inet_interfaces or +# $proxy_interfaces. # -# This form is useful for replacing login names by +# This form is useful for replacing login names by # Firstname.Lastname. # # @domain address -# Every address in domain is replaced by address. +# Every address in domain is replaced by address. # This form has the lowest precedence. # -# In all the above forms, when address has the form @other- +# In all the above forms, when address has the form @other- # domain, the result is the same user in otherdomain. # # ADDRESS EXTENSION # When a mail address localpart contains the optional recip- -# ient delimiter (e.g., user+foo@domain), the lookup order +# ient delimiter (e.g., user+foo@domain), the lookup order # becomes: user+foo@domain, user@domain, user+foo, user, and # @domain. # -# The propagate_unmatched_extensions parameter controls -# whether an unmatched address extension (+foo) is propa- +# The propagate_unmatched_extensions parameter controls +# whether an unmatched address extension (+foo) is propa- # gated to the result of table lookup. # # REGULAR EXPRESSION TABLES -# This section describes how the table lookups change when +# This section describes how the table lookups change when # the table is given in the form of regular expressions. For -# a description of regular expression lookup table syntax, +# a description of regular expression lookup table syntax, # see regexp_table(5) or pcre_table(5). # -# Each pattern is a regular expression that is applied to +# Each pattern is a regular expression that is applied to # the entire address being looked up. Thus, user@domain mail -# addresses are not broken up into their user and @domain +# addresses are not broken up into their user and @domain # constituent parts, nor is user+foo broken up into user and # foo. # -# Patterns are applied in the order as specified in the -# table, until a pattern is found that matches the search +# Patterns are applied in the order as specified in the +# table, until a pattern is found that matches the search # string. # -# Results are the same as with indexed file lookups, with -# the additional feature that parenthesized substrings from +# Results are the same as with indexed file lookups, with +# the additional feature that parenthesized substrings from # the pattern can be interpolated as $1, $2 and so on. # # TCP-BASED TABLES -# This section describes how the table lookups change when +# This section describes how the table lookups change when # lookups are directed to a TCP-based server. For a descrip- -# tion of the TCP client/server lookup protocol, see +# tion of the TCP client/server lookup protocol, see # tcp_table(5). # # Each lookup operation uses the entire address once. Thus, -# user@domain mail addresses are not broken up into their +# user@domain mail addresses are not broken up into their # user and @domain constituent parts, nor is user+foo broken # up into user and foo. # # Results are the same as with indexed file lookups. # # BUGS -# The table format does not understand quoting conventions. +# The table format does not understand quoting conventions. # # CONFIGURATION PARAMETERS -# The following main.cf parameters are especially relevant -# to this topic. See the Postfix main.cf file for syntax -# details and for default values. Use the postfix reload +# The following main.cf parameters are especially relevant +# to this topic. See the Postfix main.cf file for syntax +# details and for default values. Use the postfix reload # command after a configuration change. # # canonical_maps @@ -158,34 +159,39 @@ # header sender addresses. # # propagate_unmatched_extensions -# A list of address rewriting or forwarding mecha- -# nisms that propagate an address extension from the -# original address to the result. Specify zero or -# more of canonical, virtual, alias, forward, or +# A list of address rewriting or forwarding mecha- +# nisms that propagate an address extension from the +# original address to the result. Specify zero or +# more of canonical, virtual, alias, forward, or # include. # # Other parameters of interest: # # inet_interfaces -# The network interface addresses that this system +# The network interface addresses that this system # receives mail on. You need to stop and start Post- # fix when this parameter changes. # +# proxy_interfaces +# Other interfaces that this machine receives mail on +# by way of a proxy agent or network address transla- +# tor. +# # masquerade_classes -# List of address classes subject to masquerading: -# zero or more of envelope_sender, envelope_recipi- +# List of address classes subject to masquerading: +# zero or more of envelope_sender, envelope_recipi- # ent, header_sender, header_recipient. # # masquerade_domains -# List of domains that hide their subdomain struc- +# List of domains that hide their subdomain struc- # ture. # # masquerade_exceptions -# List of user names that are not subject to address +# List of user names that are not subject to address # masquerading. # # mydestination -# List of domains that this mail system considers +# List of domains that this mail system considers # local. # # myorigin @@ -204,7 +210,7 @@ # tcp_table(5) TCP client/server table lookup protocol # # LICENSE -# The Secure Mailer license must be distributed with this +# The Secure Mailer license must be distributed with this # software. # # AUTHOR(S) diff --git a/postfix/conf/cidr_table b/postfix/conf/cidr_table deleted file mode 100644 index 2f3e55798..000000000 --- a/postfix/conf/cidr_table +++ /dev/null @@ -1,79 +0,0 @@ -# CIDR_TABLE(5) CIDR_TABLE(5) -# -# NAME -# cidr_table - format of Postfix CIDR tables -# -# SYNOPSIS -# postmap -q "string" cidr:/etc/postfix/filename -# -# postmap -q - cidr:/etc/postfix/filename $@ +canonical.5.html: ../proto/canonical + PATH=../mantools:$$PATH; \ + srctoman - $? | $(AWK) | nroff -man | uniq | man2html | postlink >$@ + cidr_table.5.html: ../proto/cidr_table PATH=../mantools:$$PATH; \ srctoman - $? | $(AWK) | nroff -man | uniq | man2html | postlink >$@ -canonical.5.html: ../proto/canonical +header_checks.5.html: ../proto/header_checks PATH=../mantools:$$PATH; \ srctoman - $? | $(AWK) | nroff -man | uniq | man2html | postlink >$@ diff --git a/postfix/html/anvil.8.html b/postfix/html/anvil.8.html index 43b1c110b..eac1785e7 100644 --- a/postfix/html/anvil.8.html +++ b/postfix/html/anvil.8.html @@ -2,7 +2,7 @@ ANVIL(8) ANVIL(8) NAME - anvil - Postfix connection count and rate management + anvil - Postfix client count and rate management SYNOPSIS anvil [generic Postfix daemon options] diff --git a/postfix/html/canonical.5.html b/postfix/html/canonical.5.html index b767e0fcf..48ac4e496 100644 --- a/postfix/html/canonical.5.html +++ b/postfix/html/canonical.5.html @@ -83,68 +83,69 @@ CANONICAL(5) CANONICAL(5) user address user@site is replaced by address when site is equal to $myorigin, when site is listed in $mydestina- - tion, or when it is listed in $inet_interfaces. + tion, or when it is listed in $inet_interfaces or + $proxy_interfaces. - This form is useful for replacing login names by + This form is useful for replacing login names by Firstname.Lastname. @domain address - Every address in domain is replaced by address. + Every address in domain is replaced by address. This form has the lowest precedence. - In all the above forms, when address has the form @other- + In all the above forms, when address has the form @other- domain, the result is the same user in otherdomain. ADDRESS EXTENSION When a mail address localpart contains the optional recip- - ient delimiter (e.g., user+foo@domain), the lookup order + ient delimiter (e.g., user+foo@domain), the lookup order becomes: user+foo@domain, user@domain, user+foo, user, and @domain. - The propagate_unmatched_extensions parameter controls - whether an unmatched address extension (+foo) is propa- + The propagate_unmatched_extensions parameter controls + whether an unmatched address extension (+foo) is propa- gated to the result of table lookup. REGULAR EXPRESSION TABLES - This section describes how the table lookups change when + This section describes how the table lookups change when the table is given in the form of regular expressions. For - a description of regular expression lookup table syntax, + a description of regular expression lookup table syntax, see regexp_table(5) or pcre_table(5). - Each pattern is a regular expression that is applied to + Each pattern is a regular expression that is applied to the entire address being looked up. Thus, user@domain mail - addresses are not broken up into their user and @domain + addresses are not broken up into their user and @domain constituent parts, nor is user+foo broken up into user and foo. - Patterns are applied in the order as specified in the - table, until a pattern is found that matches the search + Patterns are applied in the order as specified in the + table, until a pattern is found that matches the search string. - Results are the same as with indexed file lookups, with - the additional feature that parenthesized substrings from + Results are the same as with indexed file lookups, with + the additional feature that parenthesized substrings from the pattern can be interpolated as $1, $2 and so on. TCP-BASED TABLES - This section describes how the table lookups change when + This section describes how the table lookups change when lookups are directed to a TCP-based server. For a descrip- - tion of the TCP client/server lookup protocol, see + tion of the TCP client/server lookup protocol, see tcp_table(5). Each lookup operation uses the entire address once. Thus, - user@domain mail addresses are not broken up into their + user@domain mail addresses are not broken up into their user and @domain constituent parts, nor is user+foo broken up into user and foo. Results are the same as with indexed file lookups. BUGS - The table format does not understand quoting conventions. + The table format does not understand quoting conventions. CONFIGURATION PARAMETERS - The following main.cf parameters are especially relevant - to this topic. See the Postfix main.cf file for syntax - details and for default values. Use the postfix reload + The following main.cf parameters are especially relevant + to this topic. See the Postfix main.cf file for syntax + details and for default values. Use the postfix reload command after a configuration change. canonical_maps @@ -159,34 +160,39 @@ CANONICAL(5) CANONICAL(5) header sender addresses. propagate_unmatched_extensions - A list of address rewriting or forwarding mecha- - nisms that propagate an address extension from the - original address to the result. Specify zero or - more of canonical, virtual, alias, forward, or + A list of address rewriting or forwarding mecha- + nisms that propagate an address extension from the + original address to the result. Specify zero or + more of canonical, virtual, alias, forward, or include. Other parameters of interest: inet_interfaces - The network interface addresses that this system + The network interface addresses that this system receives mail on. You need to stop and start Post- fix when this parameter changes. + proxy_interfaces + Other interfaces that this machine receives mail on + by way of a proxy agent or network address transla- + tor. + masquerade_classes - List of address classes subject to masquerading: - zero or more of envelope_sender, envelope_recipi- + List of address classes subject to masquerading: + zero or more of envelope_sender, envelope_recipi- ent, header_sender, header_recipient. masquerade_domains - List of domains that hide their subdomain struc- + List of domains that hide their subdomain struc- ture. masquerade_exceptions - List of user names that are not subject to address + List of user names that are not subject to address masquerading. mydestination - List of domains that this mail system considers + List of domains that this mail system considers local. myorigin @@ -205,7 +211,7 @@ CANONICAL(5) CANONICAL(5) tcp_table(5) TCP client/server table lookup protocol LICENSE - The Secure Mailer license must be distributed with this + The Secure Mailer license must be distributed with this software. AUTHOR(S) diff --git a/postfix/html/cleanup.8.html b/postfix/html/cleanup.8.html index c283ca901..4cad09cbf 100644 --- a/postfix/html/cleanup.8.html +++ b/postfix/html/cleanup.8.html @@ -239,7 +239,9 @@ CLEANUP(8) CLEANUP(8) sion. SEE ALSO + body_checks(5) body parts content inspection canonical(5) canonical address lookup table format + header_checks(5) message header content inspection qmgr(8) queue manager daemon syslogd(8) system logging trivial-rewrite(8) address rewriting diff --git a/postfix/html/header_checks.5.html b/postfix/html/header_checks.5.html new file mode 100644 index 000000000..d54482bb7 --- /dev/null +++ b/postfix/html/header_checks.5.html @@ -0,0 +1,261 @@ + 
+HEADER_CHECKS(5)                                 HEADER_CHECKS(5)
+
+NAME
+       header_checks - Postfix built-in header/body inspection
+
+SYNOPSIS
+       header_checks = pcre:/etc/postfix/header_checks
+       mime_header_checks = pcre:/etc/postfix/mime_header_checks
+       nested_header_checks = pcre:/etc/postfix/nested_header_checks
+
+       body_checks = pcre:/etc/postfix/body_checks
+
+       postmap -q "string" pcre:/etc/postfix/filename
+       postmap -q - pcre:/etc/postfix/filename <inputfile
+
+DESCRIPTION
+       Postfix  provides  a  simple  built-in  content inspection
+       mechanism that examines incoming mail one  message  header
+       or  one  message  body  line  at  a time.  This feature is
+       implemented by the Postfix cleanup(8) server.
+
+       Postfix header or body_checks are designed to stop a flood
+       of mail from worms and viruses. They are not meant to be a
+       substitute for content filters that decode attachments and
+       that do other sophisticated content analyses.
+
+       Postfix supports four built-in content inspection classes:
+
+       header_checks
+              These are applied to each  primary  message  header
+              (except for the MIME related headers).
+
+       mime_header_checks (default: $header_checks)
+              These  are applied each MIME related message header
+              only.
+
+       nested_header_checks (default: $header_checks)
+              These  are  applied  to  each  message  header   of
+              attached email messages.
+
+       body_checks
+              These  are  applied to every other line of content,
+              including multi-part message boundaries.
+
+       Note: message headers are examined one logical header at a
+       time,  even  when  a  message header spans multiple lines.
+       Body lines are always examined one line at a time.
+
+REGEXP AND PCRE TABLE FORMAT
+       Header and body_checks rules are normally specified in the
+       form of regular expression lookup tables. The best perfor-
+       mance is  obtained  with  pcre  (Perl  Compatible  Regular
+       Expression)  tables,  but the slower regexp (POSIX regular
+       expressions) support is more  widely  available.  Use  the
+       command postconf -m to find out what types of lookup table
+       your Postfix system supports.
+
+       The general format of a header or body_checks table is:
+
+       /pattern/flags action
+              When pattern matches the input string, execute  the
+              corresponding  action. See below for a list of pos-
+              sible actions.
+
+       !/pattern/flags action
+              When pattern does not match the input string,  exe-
+              cute the corresponding action.
+
+       if /pattern/flags
+
+       endif  Match the input string against the patterns between
+              if and endif, if and only if the input string  also
+              matches pattern. The if..endif can nest.
+
+              Note:  do not prepend whitespace to patterns inside
+              if..endif.
+
+       if !/pattern/flags
+
+       endif  Match the input string against the patterns between
+              if  and endif, if and only if the input string does
+              not match pattern. The if..endif can nest.
+
+       blank lines and comments
+              Empty lines and whitespace-only lines are  ignored,
+              as  are  lines whose first non-whitespace character
+              is a `#'.
+
+       multi-line text
+              A pattern/action line  starts  with  non-whitespace
+              text.  A line that starts with whitespace continues
+              a logical line.
+
+       For a discussion of pattern syntax and flags details,  see
+       regexp_table(5) or pcre_table(5), respectively.
+
+TABLE SEARCH ORDER
+       For  each  line of message input, the patterns are applied
+       in the order as specified in the table. When a pattern  is
+       found  that  matches  the  input  line,  the corresponding
+       action is  executed  and  then  the  next  input  line  is
+       inspected.
+
+TEXT SUBSTITUTION
+       Substitution  of  substrings  from  the matched expression
+       into the action string is possible using the  conventional
+       Perl  syntax  ($1,  $2,  etc.).   The macros in the result
+       string may need to be written as  ${n}  or  $(n)  if  they
+       aren't followed by whitespace.
+
+       Note:  since negated patterns (those preceded by !) return
+       a result when the expression does not match, substitutions
+       are not available for negated patterns.
+
+ACTIONS
+       Action names are case insensitive. They are shown in upper
+       case for consistency with other Postfix documentation.
+
+       DISCARD optional text...
+              Claim successful delivery and silently discard  the
+              message.   Log the optional text if specified, oth-
+              erwise log a generic message.
+
+              Note:  this  action  disables  further  header   or
+              body_checks  inspection  of the current message and
+              affects all recipients.
+
+       DUNNO  Pretend that the search string was not  found,  and
+              inspect  the  next  input  line. This action can be
+              used to shorten the table search.
+
+              For backwards compatibility reasons,  Postfix  also
+              accepts  OK but it is (and always has been) treated
+              as DUNNO.
+
+       FILTER transport:destination
+              Write a content filter request record to the  queue
+              file  and  inspect  the next input line.  After the
+              message is queued, it  will  be  sent  through  the
+              specified  external  content filter.  More informa-
+              tion about external content filters is in the Post-
+              fix FILTER_README file.
+
+              Note:   this  action  overrides  the  main.cf  con-
+              tent_filter setting, and affects all recipients  of
+              the  message.  In  the  case  that  multiple FILTER
+              actions fire, the only last one is executed.
+
+       HOLD optional text...
+              Arrange for the message to be placed  on  the  hold
+              queue,  and  inspect the next input line.  The mes-
+              sage remains on hold until someone  either  deletes
+              it  or  releases it for delivery.  Log the optional
+              text if specified, otherwise log a generic message.
+
+              Mail  that  is  placed on hold can be examined with
+              the postcat(1) command, and  can  be  destroyed  or
+              released with the postsuper(1) command.
+
+              Note:  this  action  affects  all recipients of the
+              message.
+
+       IGNORE Delete the current line from the input and  inspect
+              the next input line.
+
+       REDIRECT user@domain
+              Write  a  message  redirection request to the queue
+              file and inspect the next  input  line.  After  the
+              message is queued, it will be sent to the specified
+              address instead of the intended recipient(s).
+
+              Note: this action overrides the FILTER action,  and
+              affects  all recipients of the message. If multiple
+              REDIRECT actions fire only the  last  one  is  exe-
+              cuted.
+
+       REJECT optional text...
+              Reject  the  entire  message.  Reply  with optional
+              text... when the optional text is specified, other-
+              wise reply with a generic error message.
+
+              Note:   this  action  disables  further  header  or
+              body_checks inspection of the current  message  and
+              affects all recipients.
+
+       WARN optional text...
+              Log  a  warning with the optional text... (or log a
+              generic message) and inspect the next  input  line.
+              This action is useful for debugging and for testing
+              a pattern before taking more drastic actions.
+
+BUGS
+       Many people overlook the main limitations  of  header  and
+       body_checks  rules.   These  rules  operate on one logical
+       message header or body line at a time, and a decision made
+       for one line is not carried over to the next line.
+
+CONFIGURATION PARAMETERS
+       body_checks
+              Lookup tables with content filter rules for message
+              body lines.  These filters see one physical line at
+              a  time,  in  chunks  of at most $line_length_limit
+              bytes.
+
+       body_checks_size_limit
+              The amount of  content  per  message  body  segment
+              (attachment) that is subjected to $body_checks fil-
+              tering.
+
+       header_checks
+
+       mime_header_checks (default: $header_checks)
+
+       nested_header_checks (default: $header_checks)
+              Lookup tables with content filter rules for message
+              header  lines:  respectively,  these are applied to
+              the primary message  headers  (not  including  MIME
+              headers),  to the MIME headers anywhere in the mes-
+              sage, and to the initial headers of  attached  mes-
+              sages.
+
+              Note:  these filters see one logical message header
+              at a time, even when a message header spans  multi-
+              ple  lines.  Message  headers  that are longer than
+              $header_size_limit characters are truncated.
+
+       disable_mime_input_processing
+              While receiving mail, give no special treatment  to
+              MIME  related  message  headers; all text after the
+              initial message headers is considered to be part of
+              the  message body. This means that header_checks is
+              applied to all the  primary  message  headers,  and
+              that body_checks is applied to the remainder of the
+              message.
+
+              Note: when used in this  manner,  body_checks  will
+              process  a  multi-line message header one line at a
+              time.
+
+SEE ALSO
+       cleanup(8) canonicalize and enqueue Postfix message
+       pcre_table(5) format of PCRE tables
+       regexp_table(5) format of POSIX regular expression tables
+       postconf(1) Postfix configuration utility
+       postmap(1) Postfix lookup table management
+       postsuper(1) Postfix janitor
+       postcat(1) show Postfix queue file contents
+
+LICENSE
+       The Secure Mailer license must be  distributed  with  this
+       software.
+
+AUTHOR(S)
+       Wietse Venema
+       IBM T.J. Watson Research
+       P.O. Box 704
+       Yorktown Heights, NY 10598, USA
+
+                                                 HEADER_CHECKS(5)
+
diff --git a/postfix/html/relocated.5.html b/postfix/html/relocated.5.html index a880035b2..5e5ed977d 100644 --- a/postfix/html/relocated.5.html +++ b/postfix/html/relocated.5.html @@ -1,4 +1,4 @@ - 
+  
 RELOCATED(5)                                         RELOCATED(5)
 
 NAME
@@ -59,7 +59,7 @@ RELOCATED(5)                                         RELOCATED(5)
 
        user   Matches user@site when site is $myorigin, when site
               is listed in $mydestination, or when site is listed
-              in $inet_interfaces.
+              in $inet_interfaces or $proxy_interfaces.
 
        @domain
               Matches  every address in domain. This form has the
@@ -132,6 +132,11 @@ RELOCATED(5)                                         RELOCATED(5)
        myorigin
               The domain that is appended to locally-posted mail.
 
+       proxy_interfaces
+              Other interfaces that this machine receives mail on
+              by way of a proxy agent or network address transla-
+              tor.
+
 SEE ALSO
        postmap(1) create lookup table
        pcre_table(5) format of PCRE tables
diff --git a/postfix/html/smtpd.8.html b/postfix/html/smtpd.8.html
index 9e5db190c..cf983556f 100644
--- a/postfix/html/smtpd.8.html
+++ b/postfix/html/smtpd.8.html
@@ -267,10 +267,10 @@ SMTPD(8)                                                 SMTPD(8)
 
        unknown_local_recipient_reject_code
               The response code when a client specifies a recipi-
-              ent   whose   domain   matches   $mydestination  or
-              $inet_interfaces,  while  $local_recipient_maps  is
-              non-empty  and  does not list the recipient address
-              or address local-part.
+              ent    whose    domain    matches   $mydestination,
+              $inet_interfaces   or   $proxy_interfaces,    while
+              $local_recipient_maps  is  non-empty  and  does not
+              list the recipient address or address local-part.
 
        unknown_relay_recipient_reject_code
               The response code when a client specifies a recipi-
diff --git a/postfix/html/trivial-rewrite.8.html b/postfix/html/trivial-rewrite.8.html
index 6d6f272f6..44e09a844 100644
--- a/postfix/html/trivial-rewrite.8.html
+++ b/postfix/html/trivial-rewrite.8.html
@@ -1,4 +1,4 @@
-    
+  
 TRIVIAL-REWRITE(8)                             TRIVIAL-REWRITE(8)
 
 NAME
@@ -40,52 +40,50 @@ TRIVIAL-REWRITE(8)                             TRIVIAL-REWRITE(8)
        verify Resolve  an  address  for address verification pur-
               poses.
 
-DEFAULT DELIVERY METHODS
+DEFAULT DELIVERY METHODS
        By default, Postfix uses one  of  the  following  delivery
        methods.   This  may be overruled with the optional trans-
        port(5) table.  The default delivery method is selected by
        matching  the  recipient address domain against one of the
        following:
 
-       $mydestination
-
-       $inet_interfaces
+       $mydestination, $inet_interfaces, $proxy_interfaces
               The transport and optional  nexthop  are  specified
-              with  $local_transport.  The default nexthop is the
+              with  $local_transport.  The default nexthop is the
               recipient domain.
 
-       $virtual_alias_domains
+       $virtual_alias_domains
               The  recipient  address  is   undeliverable   (user
               unknown).   By definition, all known addresses in a
               virtual  alias  domain   are   aliased   to   other
               addresses.
 
-       $virtual_mailbox_domains
+       $virtual_mailbox_domains
               The  transport  and  optional nexthop are specified
-              with $virtual_transport.  The  default  nexthop  is
+              with $virtual_transport.  The  default  nexthop  is
               the recipient domain.
 
-       $relay_domains
+       $relay_domains
               The  transport  and  optional nexthop are specified
-              with $relay_transport. This overrides the  optional
+              with $relay_transport. This overrides the  optional
               nexthop  information that is specified with $relay-
               host.  The default nexthop is the recipient domain.
 
        none of the above
               The  transport  and  optional nexthop are specified
-              with  $default_transport.    This   overrides   the
+              with  $default_transport.    This   overrides   the
               optional nexthop information that is specified with
               $relayhost.  The default nexthop is  the  recipient
               domain.
 
-SERVER PROCESS MANAGEMENT
+SERVER PROCESS MANAGEMENT
        The trivial-rewrite servers run under control by the Post-
        fix master server.  Each server can handle multiple simul-
        taneous  connections.   When  all servers are busy while a
        client connects, the master creates a new server  process,
        provided  that the trivial-rewrite server process limit is
        not  exceeded.   Each  trivial-rewrite  server  terminates
-       after serving at least $max_use clients of after $max_idle
+       after serving at least $max_use clients of after $max_idle
        seconds of idle time.
 
 STANDARDS
@@ -102,42 +100,44 @@ TRIVIAL-REWRITE(8)                             TRIVIAL-REWRITE(8)
        Problems and transactions are logged to syslogd(8).
 
 BUGS
-CONFIGURATION PARAMETERS
+CONFIGURATION PARAMETERS
        The following main.cf parameters are  especially  relevant
        to  this  program. See the Postfix main.cf file for syntax
-       details and for default values.  Use  the  postfix  reload
+       details and for default values.  Use  the  postfix  reload
        command after a configuration change.
 
 Miscellaneous
-       empty_address_recipient
+       empty_address_recipient
               The  recipient  that  is  substituted  for the null
               address.
 
-       inet_interfaces
+       inet_interfaces
+
+       proxy_interfaces
               The  network  interfaces  that  this  mail   system
               receives  mail  on.   This  information  is used to
               determine if user@[net.work.addr.ess] is  local  or
               remote.   Mail  for  local  users  is  given to the
-              $local_transport.
+              $local_transport.
 
        mydestination
-              List of domains that are given to the $local_trans-
+              List of domains that are given to the $local_trans-
               port.
 
-       virtual_alias_domains
+       virtual_alias_domains
               List  of  virtual  alias  domains (domains with all
               recipients aliased to some other  local  or  remote
               domain).
 
-       virtual_mailbox_domains
+       virtual_mailbox_domains
               List  of  domains  that  are  given  to  the  $vir-
-              tual_transport.
+              tual_transport.
 
-       relay_domains
-              List of domains that are given to the $relay_trans-
+       relay_domains
+              List of domains that are given to the $relay_trans-
               port.
 
-       resolve_unquoted_address
+       resolve_unquoted_address
               When resolving an address, do not quote the address
               localpart as per RFC 822, so that additional  @,  %
               or  !   characters  remain visible. This is techni-
@@ -145,7 +145,7 @@ TRIVIAL-REWRITE(8)                             TRIVIAL-REWRITE(8)
               attacks  when forwarding mail to a Sendmail primary
               MX host.
 
-       relocated_maps
+       relocated_maps
               Tables with contact information for users, hosts or
               domains that no longer exist. See relocated(5).
 
@@ -154,83 +154,83 @@ TRIVIAL-REWRITE(8)                             TRIVIAL-REWRITE(8)
               The domain that locally-posted mail appears to come
               from.
 
-       allow_percent_hack
+       allow_percent_hack
               Rewrite user%domain to user@domain.
 
-       append_at_myorigin
+       append_at_myorigin
               Rewrite user to user@$myorigin.
 
-       append_dot_mydomain
+       append_dot_mydomain
               Rewrite user@host to user@host.$mydomain.
 
-       swap_bangpath
+       swap_bangpath
               Rewrite site!user to user@site.
 
 Routing
-       local_transport
+       local_transport
               Where to deliver mail for destinations  that  match
-              $mydestination  or  $inet_interfaces.   The default
-              transport is local:$myhostname.
+              $mydestination,  $inet_interfaces  or $proxy_inter-
+              faces.  The default transport is local:$myhostname.
 
-              Syntax is transport:nexthop; see  transport(5)  for
+              Syntax  is  transport:nexthop; see transport(5) for
               details. The :nexthop part is optional.
 
-       virtual_transport
-              Where  to  deliver  mail for non-local domains that
-              match $virtual_mailbox_domains.  The default trans-
+       virtual_transport
+              Where to deliver mail for  non-local  domains  that
+              match $virtual_mailbox_domains.  The default trans-
               port is virtual.
 
-              Syntax  is  transport:nexthop; see transport(5) for
+              Syntax is transport:nexthop; see  transport(5)  for
               details. The :nexthop part is optional.
 
-       relay_transport
-              Where to deliver mail for  non-local  domains  that
-              match  $relay_domains.   The  default  transport is
+       relay_transport
+              Where  to  deliver  mail for non-local domains that
+              match $relay_domains.   The  default  transport  is
               relay (which normally is a clone of the smtp trans-
               port).
 
-              Syntax  is  transport:nexthop; see transport(5) for
+              Syntax is transport:nexthop; see  transport(5)  for
               details. The :nexthop part is optional.
 
-       default_transport
-              Where to deliver all  other  non-local  mail.   The
+       default_transport
+              Where  to  deliver  all  other non-local mail.  The
               default transport is smtp.
 
-              Syntax  is  transport:nexthop; see transport(5) for
+              Syntax is transport:nexthop; see  transport(5)  for
               details. The :nexthop part is optional.
 
-       parent_domain_matches_subdomains
-              List of Postfix features that use  domain.tld  pat-
-              terns   to  match  sub.domain.tld  (as  opposed  to
+       parent_domain_matches_subdomains
+              List  of  Postfix features that use domain.tld pat-
+              terns  to  match  sub.domain.tld  (as  opposed   to
               requiring .domain.tld patterns).
 
        relayhost
-              The default host to send non-local mail to when  no
-              host   is   specified   with   $relay_transport  or
-              $default_transport, and when the recipient  address
+              The  default host to send non-local mail to when no
+              host  is   specified   with   $relay_transport   or
+              $default_transport,  and when the recipient address
               does not match the optional the transport(5) table.
 
-       transport_maps
-              List of tables with recipient or domain to  (trans-
-              port, nexthop) mappings.
+       transport_maps
+              List  of tables with recipient or domain to (trans-
+              port, nexthop) mappings.
 
-Address verification
+Address verification
        By default, address verification probes use the same route
-       as regular mail. To override specific aspects  of  message
-       routing  for  address  verification probes, specify one or
-       more  of  the  following:  address_verify_local_transport,
-       address_verify_virtual_transport,             address_ver-
-       ify_relay_transport,     address_verify_default_transport,
-       address_verify_relayhost, address_verify_transport_maps.
-
-SEE ALSO
+       as  regular  mail. To override specific aspects of message
+       routing for address verification probes,  specify  one  or
+       more  of  the  following:  address_verify_local_transport,
+       address_verify_virtual_transport,             address_ver-
+       ify_relay_transport,     address_verify_default_transport,
+       address_verify_relayhost, address_verify_transport_maps.
+
+SEE ALSO
        master(8) process manager
        syslogd(8) system logging
        transport(5) transport table format
        relocated(5) format of the "user has moved" table
 
 LICENSE
-       The  Secure  Mailer  license must be distributed with this
+       The Secure Mailer license must be  distributed  with  this
        software.
 
 AUTHOR(S)
diff --git a/postfix/html/uce.html b/postfix/html/uce.html
index 9498a5697..04c01dd56 100644
--- a/postfix/html/uce.html
+++ b/postfix/html/uce.html
@@ -93,9 +93,7 @@ restrictions
 
 
 
-
-
-
 Header filtering

+ 
 Header filtering
 
 
 The header_checks parameter restricts what is allowed in
 message headers. Patterns are applied to entire logical message
@@ -108,8 +106,6 @@ primary message headers, for MIME headers (including headers at
 the start of multipart body parts), and for the headers at the
 beginning of attached email messages.
 
-

-
 

 
 
Default:
@@ -120,76 +116,12 @@ beginning of attached email messages.
 
 
Syntax:
 
-
Specify a list of zero or more lookup tables. Whenever a header
-matches a table, the action depends on the lookup result:
-
-

-
-

-
-
REJECT 

-
-
REJECT text... 

-
-Reject the message, log the header and the optional text,
-and send the optional text to the originator.
-
-
DUNNO 

-
-
DUNNO text... 
Skip all further header patterns for this header line.
-This has the same effect as OK, which is deprecated.
-
-
IGNORE 

-
-
IGNORE text... 
 Delete the header line from the message.
-
-
WARN 

-
-
WARN text... 
 
+
Specify a list of zero or more lookup tables with pattern +
+action rules. 
 
-Log (but do not reject) the header with a warning, and log the
-optional text.
-
-
HOLD 

-
-
HOLD text... 

-
-Place the message on the hold queue. Mail on hold can be
-inspected with the postcat command,
-and can be destroyed or taken off hold with the postsuper command.  
-The optional text is logged together with the matched text.
-
-
DISCARD 
 
-
-
DISCARD text... 

-
-Claim successful delivery and silently discard the message.
-The optional text is logged together with the matched text.
-
-
FILTER transport:nexthop 

-After the message is queued, send the entire message through
-a content filter. This requires different cleanup servers
-before and after the filter, with header/body checks turned
-off in the second cleanup server. More details about content
-filtering are in the Postfix FILTER_README file. This feature
-overrides the main.cf content_filter setting.
-
-
REDIRECT user@domain 

-After the message is queued, send the message to the
-specified address instead of the intended recipients.
-overrides the FILTER action.
-
-

-
-

-
-At present, specifying a header pattern with OK serves no useful
-purpose. A rule ending in OK affects only the header being matched.
-The next header may still result in a REJECT match, causing the
-mail still to be rejected.
-
-

+A complete discussion of header_checks table format, including
+actions, can be found in the 
+header_checks(5) manual page.
 
 

 
@@ -205,11 +137,9 @@ mail still to be rejected.
 
 
 /^to: *friend@public\.com$/ REJECT
 
-

-
-
+
 
-
 Body filtering

+ 
 Body filtering
 
 
 The body_checks parameter restricts what text is
 is allowed in message body lines.
@@ -231,76 +161,11 @@ There is no multi-line concept as with message headers.
 
 
Syntax:
 
-
Specify a list of zero or more lookup tables. Whenever a body
-line matches a table, the action depends on the lookup result:
-
-

-
-

-
-
REJECT 

-
-
REJECT text... 

-
-Reject the message, log the body line and the optional text,
-and send the optional text to the originator.
-
-
WARN 

-
-
WARN text... 
 
-
-Log (but do not reject) the body line with a warning, and log the
-optional text.
-
-
DUNNO 

-
-
DUNNO text... 
Skip all further body patterns for this body line.
-This has the same effect as OK, which is deprecated.
-
-
IGNORE 

-
-
IGNORE text... 
 Delete the body line from the message.
+
Specify a list of zero or more lookup tables with pattern +
+action rules. 
 
-
HOLD 
 
-
-
HOLD text... 

-
-Place the message on the hold queue. Mail on hold can be
-inspected with the postcat command,
-and can be destroyed or taken off hold with the postsuper command.
-The optional text is logged together with the matched text.
-
-
DISCARD 
 
-
-
DISCARD text... 
 
-
-Claim successful delivery and silently discard the message.
-The optional text is logged together with the matched text.
-
-
FILTER transport:nexthop 

-After the message is queued, send the entire message through
-a content filter. This requires different cleanup servers
-before and after the filter, with header/body checks turned
-off in the second cleanup server. More details about content
-filtering are in the Postfix FILTER_README file. This feature
-overrides the main.cf content_filter setting.
-
-
REDIRECT user@domain 

-After the message is queued, send the message to the 
-specified address instead of the intended recipients.
-overrides the FILTER action.
-
-

-
-

-
-At present, specifying a pattern with OK serves no useful
-purpose. A rule ending in OK affects only the line being matched.
-The next line may still result in a REJECT match, causing the
-mail still to be rejected.
-
-
+A complete discussion of body_checks table format can be found in
+the  body_checks(5) manual page.
 
 

 
@@ -310,11 +175,10 @@ mail still to be rejected.
 
 
 body_checks = pcre:/etc/postfix/body_checks
 
-

-
-
+
 
-
 Client hostname/address restrictions

+ 
 Client hostname/address
+restrictions
 
 
 The smtpd_client_restrictions parameter restricts what
 clients this system accepts SMTP connections from.
@@ -382,27 +246,23 @@ reject_unknown_client
 
 

 
-
-
-
 reject_unknown_client 
 Reject the request when the
-client IP address has no PTR (address to name) record in the DNS,
-or when the PTR record does not have a matching A (name to address)
-record.  The unknown_client_reject_code parameter specifies
-the response code to rejected requests (default:  450).
+
  reject_unknown_client
+ 
 Reject the request when the client IP address has no PTR
+(address to name) record in the DNS, or when the PTR record does
+not have a matching A (name to address) record.  The
+unknown_client_reject_code parameter specifies the response
+code to rejected requests (default:  450).
 
 

 
-
-
-
 permit_mynetworks 
 Permit the request when the
-client IP address matches any network listed in  $mynetworks.
+
  permit_mynetworks 
+
 Permit the request when the client IP address matches any
+network listed in  $mynetworks.
 
 

 
-
-
-
 reject_rbl_client domain.tld=127.0.0.2
+
  reject_rbl_client 
+domain.tld=127.0.0.2
 
 
 reject_rbl_client domain.tld 
 Reject the
 request when the reversed client network address is listed with an
@@ -420,9 +280,8 @@ indexed by RBL domain.
 
 

 
-
-
-
 reject_rhsbl_client domain.tld=127.0.0.2
+
  reject_rhsbl_client 
+domain.tld=127.0.0.2
 
 
 reject_rhsbl_client domain.tld 
 Reject the
 request when the client hostname is listed with an A record under
@@ -434,9 +293,8 @@ specific address from a multi-valued result.
 
 

 
-
-
-
 check_client_access maptype:mapname
+
  check_client_access 
+maptype:mapname
 
 
 maptype:mapname 
 Search the named access database for the client hostname, parent
@@ -463,9 +321,7 @@ significant octets.
 
 

 
-
-
-
 Require HELO (EHLO) command

+ 
 Require HELO (EHLO) command
 
 
 The smtpd_helo_required parameter determines if clients must
 send a HELO (or EHLO) command at the beginning of an
@@ -498,9 +354,8 @@ does not require the use of HELO (EHLO).
 
 
 
-
-
-
 HELO (EHLO) hostname restrictions

+ 
 HELO (EHLO) hostname
+restrictions
 
 
 The smtpd_helo_restrictions parameter restricts what hostnames
 clients may send with the HELO (EHLO) command.  Some
@@ -561,37 +416,31 @@ reject_invalid_hostname
 
 

 
-
-
-
 reject_invalid_hostname 
 Reject the request when
-the client HELO or EHLO parameter has a bad hostname syntax. The
-invalid_hostname_reject_code specifies the response code to
-rejected requests (default:  501).
+
  reject_invalid_hostname
+ 
 Reject the request when the client HELO or EHLO parameter
+has a bad hostname syntax. The invalid_hostname_reject_code
+specifies the response code to rejected requests (default:  501).
 
 

 
-
-
-
 reject_unknown_hostname 
 Reject the request when
-the hostname in the client HELO (EHLO) command has no DNS A or MX
-record. The unknown_hostname_reject_code specifies the
-response code to rejected requests (default:  450).
+
  reject_unknown_hostname
+ 
 Reject the request when the hostname in the client HELO
+(EHLO) command has no DNS A or MX record. The
+unknown_hostname_reject_code specifies the response code to
+rejected requests (default:  450).
 
 

 
-
-
-
 reject_non_fqdn_hostname 
 Reject the request when
-the hostname in the client HELO (EHLO) command is not in fully-qualified
-domain form, as required by the RFC. The non_fqdn_reject_code
-specifies the response code to rejected requests (default:
-504).
+
  reject_non_fqdn_hostname
+ 
 Reject the request when the hostname in the client HELO
+(EHLO) command is not in fully-qualified domain form, as required
+by the RFC. The non_fqdn_reject_code specifies the response
+code to rejected requests (default:  504).
 
 

 
-
-
-
 check_helo_access maptype:mapname
+
  check_helo_access 
+maptype:mapname
 
 
 maptype:mapname 
 Search the named access database for the HELO hostname
@@ -599,13 +448,11 @@ or parent domains.
 
 

 
-
+
  check_helo_ns_access
+ maptype:mapname
 
-
 check_helo_ns_access maptype:mapname
-
-
-
-
 check_helo_mx_access maptype:mapname
+
  check_helo_mx_access
+ maptype:mapname
 
 
 Apply the specified access database
 to the DNS (or MX) servers for the host or domain name given with
@@ -615,9 +462,8 @@ the HELO (or EHLO) command.
 
 

 
-
-
-
 reject_rhsbl_helo domain.tld=127.0.0.2
+
  reject_rhsbl_helo 
+domain.tld=127.0.0.2
 
 
 reject_rhsbl_helo domain.tld 
 Reject the
 request when the HELO (or EHLO) hostname is listed with an A record
@@ -654,9 +500,8 @@ indexed by RBL domain.
 
 

 
-
-
-
 Require strict RFC 821-style envelope addresses 

+ 
 Require strict RFC 821-style
+envelope addresses 
 
 
 The strict_rfc821_envelopes parameter controls how tolerant
 Postfix is with respect to addresses given in MAIL FROM or RCPT TO
@@ -690,9 +535,8 @@ software out there on the Internet.
 
 
 
-
-
-
 Sender address restrictions

+ 
 Sender address
+restrictions
 
 
 The smtpd_sender_restrictions parameter restricts what sender
 addresses this system accepts in MAIL FROM commands.
@@ -751,9 +595,8 @@ reject_unknown_sender_domain
 
 

 
-
-
-
 reject_unknown_sender_domain 
 Reject the request
+
 
+reject_unknown_sender_domain  
 Reject the request
 when the sender mail address has no DNS A or MX record. The
 unknown_address_reject_code  parameter specifies the response
 code for rejected requests (default:  450).  The response
@@ -761,25 +604,22 @@ is always 450 in case of a temporary DNS error.
 
 

 
-
-
-
 reject_unverified_sender 
 Reject the request when
-mail to the sender address is known to bounce, or when the sender
-address destination is not reachable.  Address verification
-information is managed by the  verify(8)
-server.  The unverified_sender_reject_code  parameter
-specifies the response when an address is known to bounce (default:
-450, change into 550 when you are confident that it is safe to do
-so). Postfix replies with 450 when an address probe failed due to
-a temporary problem.
+
  reject_unverified_sender
+ 
 Reject the request when mail to the sender address is
+known to bounce, or when the sender address destination is not
+reachable.  Address verification information is managed by the  verify(8) server.  The
+unverified_sender_reject_code  parameter specifies the
+response when an address is known to bounce (default:  450, change
+into 550 when you are confident that it is safe to do so). Postfix
+replies with 450 when an address probe failed due to a temporary
+problem.
 
 

 
-
-
-
 reject_rhsbl_sender domain.tld 
 Reject the
-request when the sender mail address domain is listed with an A
-record under domain.tld.
+
  reject_rhsbl_sender 
+domain.tld 
 Reject the request when the sender mail
+address domain is listed with an A record under domain.tld.
 
 The  maps_rbl_reject_code parameter specifies the response
 code for rejected requests (default:  554), the  parameter specifies tables with server replies
 indexed by RBL domain.
 

 
-
-
-
 check_sender_access maptype:mapname
+
  check_sender_access 
+maptype:mapname
 
 
 maptype:mapname 
 Search the named access database for the sender mail address,
-sender domain and parent domain, or localpart@. 
+sender domain and parent domain, or localpart@.
 
 

 
-
-
-
 check_sender_ns_access maptype:mapname
-
-
+
  check_sender_ns_access
+ maptype:mapname
 
-
 check_sender_mx_access maptype:mapname
+
  check_sender_mx_access
+ maptype:mapname
 
 
 Apply the specified access database
 to the DNS (or MX) servers for the host or domain name given with
@@ -815,11 +652,10 @@ the MAIL FROM command.
 
 

 
-
-
-
 reject_unlisted_sender 
 Reject the request when
-the sender address matches one of the domain lists below, but
-is not listed in one of the corresponding address lists:
+
  reject_unlisted_sender
+ 
 Reject the request when the sender address matches one
+of the domain lists below, but is not listed in one of the
+corresponding address lists:
 
 

 
@@ -827,8 +663,9 @@ is not listed in one of the corresponding address lists:
 
 Domain list Address list 
 
- $mydestination or
-$inet_interfaces 
+ $mydestination,
+$inet_interfaces or
+$proxy_interfaces 
 $local_recipient_maps
 
 $virtual_alias_domains $virtual_alias_maps 
@@ -851,18 +688,16 @@ restriction at the end of all sender restrictions.
 
 

 
-
-
-
 reject_non_fqdn_sender 
 Reject the request when
-the address in the client MAIL FROM command is not in fully-qualified
-domain form. The non_fqdn_reject_code specifies the
-response code to rejected requests (default:  504).
+
  reject_non_fqdn_sender
+ 
 Reject the request when the address in the client MAIL
+FROM command is not in fully-qualified domain form. The
+non_fqdn_reject_code specifies the response code to rejected
+requests (default:  504).
 
 

 
-
-
-
 reject_sender_login_mismatch
+
 
+reject_sender_login_mismatch 
 
 
 Reject the request when 
 $smtpd_sender_login_maps specifies an owner for the MAIL FROM
@@ -872,9 +707,8 @@ client login name doesn't own the MAIL FROM address.
 
 

 
-
-
-
 reject_authenticated_sender_login_mismatch
+
 
+reject_authenticated_sender_login_mismatch 
 
 
 Reject the request when the client is (SASL) logged in but
 the client login name doesn't own the MAIL FROM address according
@@ -882,9 +716,8 @@ to $smtpd_sender_login_maps.
 
 

 
-
-
-
 reject_unauthenticated_sender_login_mismatch
+
 
+reject_unauthenticated_sender_login_mismatch 
 
 
 Reject the request when 
 $smtpd_sender_login_maps specifies an owner for the address,
@@ -910,9 +743,8 @@ but the client is not (SASL) logged in.
 
 

 
-
-
-
 Recipient address restrictions

+ 
 Recipient address
+restrictions
 
 
 The smtpd_recipient_restrictions parameter restricts what
 recipient addresses this system accepts in RCPT TO commands.
@@ -953,7 +785,8 @@ destination: