From: Wietse Venema Date: Wed, 28 Feb 2007 05:00:00 +0000 (-0500) Subject: postfix-2.4.0-RC1 X-Git-Tag: v2.4.0-RC1^0 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=8a9a9527bffbe8c06f69017c88bebb172628a1d6;p=thirdparty%2Fpostfix.git postfix-2.4.0-RC1 --- diff --git a/postfix/HISTORY b/postfix/HISTORY index 2643b31ad..34c956f4e 100644 --- a/postfix/HISTORY +++ b/postfix/HISTORY @@ -9851,7 +9851,7 @@ Apologies for any names omitted. Bugfix: the test for "no debugger_command" was wrong. Leandro Santi. File: global/debugger_command.c. -20041117 +20040117 Robustness: the master-child protocol now includes a process generation number besides the child process ID. The process @@ -13303,97 +13303,10 @@ Apologies for any names omitted. instead of appending mail to a deleted file. To minimize the use of this workaround, Postfix now by default creates mailbox dotlock files on all systems, and creates dotlock - files before opening mailbox files. Files: util/sys_defs.h, - global/mbox_open.c. - -20070301 - - Workaround: updated workaround for broken Solaris accept(). - File: util/inet_listen.c. - - Workaround: on some FreeBSD versions, accept(2) can fail - with a bogus EINVAL error. We now allow accept(2) to fail - for a limited number of times before terminating the process. - Files: master/single_server.c, master/multi_server.c. - -20070306 - - Bugfix (introduced with Postfix 2.3 Milter support): postdrop - reported "illegal seek" instead of "file too large". File: - postdrop/postdrop.c. - -20070310 - - Cleanup: specify "undisclosed_recipients_header =" to disable - Postfix's "To: undisclosed-recipients:;" header for mail - that lists no recipient. The To: header is not required as - of RFC 2822. The undisclosed_recipients_header parameter - value can now be an empty string, a value that was not - allowed with earlier Postfix versions. With Postfix 2.5 it - will be empty by default. Files: cleanup/cleanup.c, - cleanup/cleanup_message.c. - -20070312 - - Backwards compatibility: don't pad short message header - records when Milter support is turned off. This maintains - compatibility with Postfix versions that pre-date Milter - support. File: cleanup/cleanup_out.c. - -20070314 - - Bitrot: move the "don't run this daemon by hand" message - before other tests. Files: master/*server.c. - -20070315 - - Bitrot: New OpenLDAP APIs deprecate simplified interfaces, - that are the only ones available in Sun's LDAP SDK. Define - suitable macros that work with new OpenLDAP and Sun's code. - Victor Duchovni, Morgan Stanley. File: src/global/dict_ldap.c - - Cleanup: new "leaf" and "terminal" result attributes support - fine-tuning of LDAP group expansion, and provide a solution - for the problem case where DN recursion returns both the - group address and the addresses of the member objects. - Victor Duchovni, Morgan Stanley. Files: src/global/dict_ldap.c, - proto/LDAP_README.html, proto/ldap_table - -20070317 - - Idioten Sicherheit: stamp every executable file and every - core dump file with "mail_version=xxxxx". Adding version - stamps and checks to every IPC message is too much change - after code freeze, and requires too much time for testing. - File: src/global/mail_version.h and every main program file. - -20070320 - - Bugfix (introduced between 20070120 and 20070121): the - cleanup server stored no "delayed mail warning" queue file - records with "sendmail -t", and no header_checks filter/redirect - records or content encoding records with other mail. File: - global/rec_type.h. - -20070321 - - Bugfix (introduced 20070224): local(8) or virtual(8) could - log a misleading error message after failure to open a - mailbox file. File: global/mbox_open.c. - - Bugfix (code should have been updated 20070104): the proxymap - client did not propagate changes in case folding flags. - Currently, nothing in Postfix uses this functionality. - File: global/dict_proxy.c. + files before opening mailbox files. Files: util/sys_defs.h. Wish list: - Bind all deliveries to the same local delivery process, - making Postfix perform as poorly as monolithic mailers, - but giving a possibility to eliminate duplicate deliveries. - - Maybe declare loop when resolve_local(mxhost) is true? - Update message content length when adding/removing headers. Need scache size limit. @@ -13406,7 +13319,6 @@ Wish list: am using now. Update MILTER_README with Martinec info. - http://www.ijs.si/software/amavisd/amavisd-new-docs.html#dkim Make postcat header/body aware so people can grep headers. diff --git a/postfix/README_FILES/AAAREADME b/postfix/README_FILES/AAAREADME index 44e307ca7..4a317e155 100644 --- a/postfix/README_FILES/AAAREADME +++ b/postfix/README_FILES/AAAREADME @@ -18,6 +18,7 @@ PPrroobblleemm ssoollvviinngg * QSHAPE_README: Bottleneck analysis * TUNING_README: Performance tuning * DEBUG_README: Debugging strategies + * Error messages (*) CCoonntteenntt iinnssppeeccttiioonn @@ -49,16 +50,20 @@ LLooookkuupp ttaabblleess ((ddaattaabbaasseess)) MMaaiilliinngg lliisstt ssuuppppoorrtt + * qmail/ezmlm support (*) * VERP_README: VERP Support SSppeecciiffiicc eennvviirroonnmmeennttss * LINUX_README: Linux issues * NFS_README: NFS issues + * ULTRIX_README: Ultrix support OOtthheerr mmaaiill ddeelliivveerryy aaggeennttss + * Cyrus (*) * MAILDROP_README: Maildrop + * LMTP (*) OOtthheerr ttooppiiccss @@ -73,3 +78,6 @@ OOtthheerr ttooppiiccss * XCLIENT_README: XCLIENT Command * XFORWARD_README: XFORWARD Command +(*) These documents will be made available via http://www.postfix.org/ and +mirror sites. + diff --git a/postfix/README_FILES/ADDRESS_CLASS_README b/postfix/README_FILES/ADDRESS_CLASS_README index 2de5acc88..9a8b9075c 100644 --- a/postfix/README_FILES/ADDRESS_CLASS_README +++ b/postfix/README_FILES/ADDRESS_CLASS_README @@ -28,10 +28,8 @@ An address class is defined by three items. * The list of domains that are a member of the class: for example, all local domains, or all relay domains. - * The default delivery transport. For example, the local, virtual or relay - delivery transport (delivery transports are defined in master.cf). This - helps to keep Postfix configurations simple, by avoiding the need for - explicit routing information in transport maps. + * The default delivery method. For example, the local or smtp delivery agent. + This helps to keep Postfix configurations simple. * The list of valid recipient addresses for that address class. The Postfix SMTP server rejects invalid recipients with "User unknown in scache(8) <-> smtp(8) --> Internet + + The scache(8) server, introduced with Postfix version 2.2, maintains the shared connection cache. With Postfix version 2.2, only the smtp(8) client has support to access this cache. - /-- smtp(8) --> Internet - - qmgr(8) | - | - \-- | smtp(8) --> Internet - | - ^ - | - - scache(8) - When SMTP connection caching is enabled (see next section), the smtp(8) client does not disconnect after a mail transaction, but gives the connection to the scache(8) server which keeps the connection open for a limited amount of time. diff --git a/postfix/README_FILES/DATABASE_README b/postfix/README_FILES/DATABASE_README index b1a9645a1..ef86f651c 100644 --- a/postfix/README_FILES/DATABASE_README +++ b/postfix/README_FILES/DATABASE_README @@ -44,8 +44,7 @@ Benefits of the Postfix (key, value) query interface: lookups" below. * You can use Berkeley DB files with fixed lookup strings for simple address rewriting operations and you can use regular expression tables for the more - complicated work. In other words, you don't have to put everything into the - same table. + complicated work. PPoossttffiixx lliissttss vveerrssuuss ttaabblleess @@ -125,8 +124,7 @@ update fails because the disk is full or because something else happens. This is because commands such as postmap(1) or postalias(1) overwrite existing files. If the update fails in the middle then you have no usable database, and Postfix will stop working. This is not an issue with the CDB database type -available with Postfix 2.2 and later: CDB creates a new file, and renames the -file upon successful completion. +available with Postfix 2.2 and later, because CDB database rebuilds are atomic. With multi-file databases such as DBM, there is no simple solution. With Berkeley DB and other "one file" databases, it is possible to add some extra @@ -246,7 +244,7 @@ To find out what database types your Postfix system supports, use the "ppooss in tcp_table(5). The lookup table name is "tcp:host:port" where "host" specifies a symbolic hostname or a numeric IP address, and "port" specifies a symbolic service name or a numeric port number. This - protocol is not available up to and including Postfix version 2.4. + protocol is not available up to and including Postfix version 2.2. uunniixx (read-only) A limited way to query the UNIX authentication database. The following tables are implemented: diff --git a/postfix/README_FILES/DB_README b/postfix/README_FILES/DB_README index 955a60ace..62b852ef3 100644 --- a/postfix/README_FILES/DB_README +++ b/postfix/README_FILES/DB_README @@ -25,15 +25,14 @@ This document describes: BBuuiillddiinngg PPoossttffiixx oonn ssyysstteemmss wwiitthhoouutt BBeerrkkeelleeyy DDBB -Some UNIXes ship without Berkeley DB support; for historical reasons these use -DBM files instead. A problem with DBM files is that they can store only limited -amounts of data. To build Postfix with Berkeley DB support you need to download -and install the source code from http://www.oracle.com/database/berkeley-db/. +Many commercial UNIXes ship without Berkeley DB support. Examples are Solaris, +HP-UX, IRIX, UNIXWARE. In order to build Postfix with Berkeley DB support you +need to download and install the source code from http://www.sleepycat.com/ Warning: some Linux system libraries use Berkeley DB, as do some third-party libraries such as SASL. If you compile Postfix with a different Berkeley DB implementation, then every Postfix program will dump core because either the -system library, the SASL library, or Postfix itself ends up using the wrong +system library, SASL library, or Postfix itself ends up using the wrong version. The more recent Berkeley DB versions have a compile-time switch, "--with- @@ -41,8 +40,8 @@ uniquename", which renames the symbols so that multiple versions of Berkeley DB can co-exist in the same application. Although wasteful, this may be the only way to keep things from falling apart. -To build Postfix after you installed the Berkeley DB from source code, use -something like: +To build Postfix after you installed the Berkeley DB from http:// +www.sleepycat.com/, use something like: % make tidy % make makefiles CCARGS="-DHAS_DB -I/usr/local/BerkeleyDB/include" \ @@ -152,5 +151,5 @@ Add the "-lpthread" library to the "make makefiles" command. % make makefiles .... AUXLIBS="... -lpthread" -More information is available at http://www.oracle.com/database/berkeley-db/. +More information is available at http://www.sleepycat.com/. diff --git a/postfix/README_FILES/DEBUG_README b/postfix/README_FILES/DEBUG_README index fd447f8c2..bb2ee7393 100644 --- a/postfix/README_FILES/DEBUG_README +++ b/postfix/README_FILES/DEBUG_README @@ -54,8 +54,8 @@ The nature of each problem is indicated as follows: configuration file settings that you can fix. Postfix cannot proceed until this is fixed. - * "eerrrroorr" reports an error condition. For safety reasons, a Postfix process - will terminate when more than 13 of these happen. + * "eerrrroorr" reports a fatal or non-fatal error condition. Postfix cannot + proceed until this is fixed. * "wwaarrnniinngg" indicates a non-fatal error. These are problems that you may not be able to fix (such as a broken DNS server elsewhere on the network) but @@ -85,7 +85,7 @@ Postfix can produce two types of mail delivery reports for debugging: Mail Delivery Status Report will be mailed to . These reports contain information that is generated by Postfix delivery agents. -Since these run as daemon processes that cannot interact with users directly, +Since these run as daemon processes and do not interact with users directly, the result is sent as mail to the sender of the test message. The format of these reports is practically identical to that of ordinary non-delivery notifications. @@ -136,31 +136,29 @@ change effective immediately, execute the command "ppoossttffiixx rreel RReeccoorrdd tthhee SSMMTTPP sseessssiioonn wwiitthh aa nneettwwoorrkk ssnniiffffeerr This example uses ttccppdduummpp. In order to record a conversation you need to -specify a large enough buffer with the "--ss" option or else you will miss some +specify a large enough buffer with the "-s" option or else you will miss some or all of the packet payload. - # ttccppdduummpp --ww //ffiillee//nnaammee --ss 00 hhoosstt eexxaammppllee..ccoomm aanndd ppoorrtt 2255 - -Older tcpdump versions don't support "--ss 00"; in that case, use "--ss 22000000" -instead. + # ttccppdduummpp --ww //ffiillee//nnaammee --ss 22000000 hhoosstt eexxaammppllee..ccoomm aanndd ppoorrtt 2255 Run this for a while, stop with Ctrl-C when done. To view the data use a binary -viewer, eetthheerreeaall, or good old lleessss. +viewer, or eetthheerreeaall, or use my ttccppdduummppxx utility that is available from ftp:// +ftp.porcupine.org/pub/debugging/. MMaakkiinngg PPoossttffiixx ddaaeemmoonn pprrooggrraammss mmoorree vveerrbboossee Append one or more "--vv" options to selected daemon definitions in /etc/postfix/ master.cf and type "ppoossttffiixx rreellooaadd". This will cause a lot of activity to be -logged to the syslog daemon. For example, to make the Postfix SMTP server -process more verbose: +logged to the syslog daemon. Example: /etc/postfix/master.cf: smtp inet n - n - - smtpd -v -To diagnose problems with address rewriting specify a "--vv" option for the -cleanup(8) and/or trivial-rewrite(8) daemon, and to diagnose problems with mail -delivery specify a "--vv" option for the qmgr(8) or oqmgr(8) queue manager, or -for the lmtp(8), local(8), pipe(8), smtp(8), or virtual(8) delivery agent. +This makes the Postfix SMTP server more verbose. To diagnose problems with +address rewriting one would specify a "--vv" option for the cleanup(8) and/or +trivial-rewrite(8) daemon, and to diagnose problems with mail delivery one +would specify a "--vv" option for the qmgr(8) or oqmgr(8) queue manager, or for +the lmtp(8), local(8), pipe(8), smtp(8), or virtual(8) delivery agent. MMaannuuaallllyy ttrraacciinngg aa PPoossttffiixx ddaaeemmoonn pprroocceessss @@ -363,17 +361,16 @@ When reporting a problem, be sure to include the following information. * Postfix logging. See the text at the top of the DEBUG_README document to find out where logging is stored. Please do not frustrate the helpers by - word wrapping the logging. If the logging is more than a few kbytes of - text, consider posting an URL on a web or ftp site. + word wrapping the logging. * Consider using a test email address so that you don't have to reveal email addresses or passwords of innocent people. - * If you can't use a test email address, please anonymize email addresses and - host names consistently. Replace each letter by "A", each digit by "D" so - that the helpers can still recognize syntactical errors. + * If you can't use a test email address, please anonymize information + consistently. Replace each letter by "A", each digit by "D" so that the + helpers can still recognize syntactical errors. - * Output from "ppoossttccoonnff --nn". Please do not send your main.cf file, or 500+ + * Output from "ppoossttccoonnff --nn". Please do not send your main.cf file or 400+ lines of ppoossttccoonnff output. * Better, provide output from the ppoossttffiinnggeerr tool. This can be found at http: @@ -386,7 +383,7 @@ When reporting a problem, be sure to include the following information. * If the problem is about too much mail in the queue, consider including output from the qqsshhaappee tool, as described in the QSHAPE_README file. - * If the problem is protocol related (connections time out, or an SMTP server + * If the problem is protocol related (connections time out or an SMTP server complains about syntax errors etc.) consider recording a session with ttccppdduummpp, as described in the DEBUG_README document. diff --git a/postfix/README_FILES/DSN_README b/postfix/README_FILES/DSN_README index efd7f4c11..a422a3f6f 100644 --- a/postfix/README_FILES/DSN_README +++ b/postfix/README_FILES/DSN_README @@ -22,7 +22,7 @@ Specifically, DSN support gives an email sender the ability to specify: confused with the message ID, which identifies the message content. The implementation of DSN support involves extra parameters to the SMTP MAIL -FROM and RCPT TO commands, as well as two Postfix sendmail command line options +FROM and RCPT TO commands, as well as new Postfix sendmail command line options that provide a sub-set of the functions of the extra SMTP command parameters. This document has information on the following topics: diff --git a/postfix/README_FILES/ETRN_README b/postfix/README_FILES/ETRN_README index 76bc8dece..5970aacbb 100644 --- a/postfix/README_FILES/ETRN_README +++ b/postfix/README_FILES/ETRN_README @@ -11,6 +11,10 @@ to the customer, and delivers that mail bbyy ccoonnnneeccttiinngg t sseerrvveerr. The mail is not delivered via the connection that was used for sending ETRN. +Postfix versions before 1.0 (also known as version 20010228) implemented the +ETRN command in an inefficient manner: they simply attempted to deliver all +queued mail. This is slow on mail servers that queue mail for many customers. + As of version 1.0, Postfix has a fast ETRN implementation that does not require Postfix to examine every queue file. Instead, Postfix maintains a record of what queue files contain mail for destinations that are configured for ETRN @@ -36,11 +40,11 @@ The following is an example SMTP session that shows how an SMTP client requests the ETRN service. Client commands are shown in bold font. 220 my.server.tld ESMTP Postfix - HHEELLOO mmyy..cclliieenntt..ttlldd + hheelloo mmyy..cclliieenntt..ttlldd 250 Ok - EETTRRNN ssoommee..ccuussttoommeerr..ddoommaaiinn + eettrrnn ssoommee..ccuussttoommeerr..ddoommaaiinn 250 Queuing started - QQUUIITT + qquuiitt 221 Bye As mentioned in the introduction, the mail is delivered by connecting to the @@ -49,8 +53,7 @@ send the ETRN command. The Postfix operator can request delivery for a specific customer by using the command "sendmail -qRdestination" and, with Postfix version 1.1 and later, -"postqueue -sdestination". Access to this feature is controlled with the -authorized_flush_users configuration parameter (Postfix version 2.2 and later). +"postqueue -sdestination". HHooww PPoossttffiixx ffaasstt EETTRRNN wwoorrkkss @@ -82,14 +85,13 @@ service for every possible destination. * The flush(8) daemon maintains per-destination logfiles with queue file names. When a request to "deliver mail now" arrives, Postfix will attempt to deliver all recipients in the queue files that have mail for the - destination in question. This does not perform well with queue files that - have recipients in many different domains, such as queue files with - outbound mailing list traffic. + destination in question. This does not perform well when queue files have + recipients in many different domains. * The flush(8) daemon maintains per-destination logfiles only for - destinations listed with $fast_flush_domains. With other destinations you - cannot request delivery with "sendmail -qRdestination" or, with Postfix - version 1.1 and later, "postqueue -sdestination". + destinations listed with $fast_flush_domains. With other destinations it + not possible to trigger delivery with "sendmail -qRdestination" or, with + Postfix version 1.1 and later, "postqueue -sdestination". * Up to and including early versions of Postfix version 2.1, the "fast flush" service may not deliver some messages if the request to "deliver mail now" @@ -98,10 +100,6 @@ service for every possible destination. dead domains, and the list of message delivery transports specified with the defer_transports configuration parameter. - * Up to and including Postfix version 2.3, the "fast flush" service may not - deliver some messages if the request to "deliver mail now" arrives while an - incoming queue scan is already in progress. - CCoonnffiigguurriinngg tthhee PPoossttffiixx ffaasstt EETTRRNN sseerrvviiccee The behavior of the flush(8) daemon is controlled by parameters in the main.cf @@ -202,9 +200,9 @@ client that is allowed to execute ETRN commands (by default, that's every client), and type the commands shown in boldface: 220 my.server.tld ESMTP Postfix - HHEELLOO mmyy..cclliieenntt..ttlldd + hheelloo mmyy..cclliieenntt..ttlldd 250 Ok - EETTRRNN ssoommee..ccuussttoommeerr..ddoommaaiinn + eettrrnn ssoommee..ccuussttoommeerr..ddoommaaiinn 250 Queuing started where "some.customer.domain" is the name of a domain that has a non-empty @@ -227,9 +225,9 @@ relay to (any domain listed in $relay_domains), but that has no mail queued. The text in bold face stands for the commands that you type: 220 my.server.tld ESMTP Postfix - HHEELLOO mmyy..cclliieenntt..ttlldd + hheelloo mmyy..cclliieenntt..ttlldd 250 Ok - EETTRRNN ssoommee..ootthheerr..ccuussttoommeerr..ddoommaaiinn + eettrrnn ssoommee..ootthheerr..ccuussttoommeerr..ddoommaaiinn 250 Queuing started This time, the "ETRN"" command should trigger NO mail deliveries at all. If @@ -241,9 +239,9 @@ willing to relay to. It does not matter if your server has mail queued for that destination. 220 my.server.tld ESMTP Postfix - HHEELLOO mmyy..cclliieenntt..ttlldd + hheelloo mmyy..cclliieenntt..ttlldd 250 Ok - EETTRRNN nnoott..aa..ccuussttoommeerr..ddoommaaiinn + eettrrnn nnoott..aa..ccuussttoommeerr..ddoommaaiinn 459 : service unavailable In this case, Postfix should reject the request as shown above. diff --git a/postfix/README_FILES/FILTER_README b/postfix/README_FILES/FILTER_README index 192ed2a48..970583712 100644 --- a/postfix/README_FILES/FILTER_README +++ b/postfix/README_FILES/FILTER_README @@ -21,9 +21,9 @@ This document describes implementations that use a single Postfix instance for everything: receiving, filtering and delivering mail. Applications that use two separate Postfix instances will be covered by a later version of this document. -The after-queue content filter is not to be confused with the approaches -described in the SMTPD_PROXY_README or MILTER_README documents, where incoming -SMTP mail is filtered BEFORE it is stored into the Postfix queue. +The after-queue content filter is not to be confused with the approach that is +described in the SMTPD_PROXY_README document, where incoming SMTP mail is +filtered BEFORE it is stored into the Postfix queue. This document describes two approaches to content filter all email, as well as several options to filter mail selectively: @@ -50,16 +50,14 @@ several options to filter mail selectively: PPrriinncciipplleess ooff ooppeerraattiioonn -An after-queue content filter receives unfiltered mail from Postfix (as -described further below) and can do one of the following: +An external content filter receives unfiltered mail from Postfix (as described +further below) and does one of the following: 1. Re-inject the mail back into Postfix, perhaps after changing content and/or destination. - 2. Discard or quarantine the mail. - - 3. Reject the mail (by sending a suitable status code back to Postfix). - Postfix will send the mail back to the sender address. + 2. Reject the mail (by sending a suitable status code back to Postfix). + Postfix will return the mail to the sender. NOTE: in this time of mail worms and forged spam, it is a VERY BAD IDEA to send viruses back to the sender address, because the sender address is almost @@ -69,9 +67,8 @@ it. SSiimmppllee ccoonntteenntt ffiilltteerr eexxaammppllee -The first example is simple to set up, but has major limitations that will be -addressed in a second example. Postfix receives unfiltered mail from the -network with the smtpd(8) server, and delivers unfiltered mail to a content +The first example is simple to set up. Postfix receives unfiltered mail from +the network with the smtpd(8) server, and delivers unfiltered mail to a content filter with the Postfix pipe(8) delivery agent. The content filter injects filtered mail back into Postfix with the Postfix sendmail(1) command, so that Postfix can deliver it to the final destination. @@ -129,36 +126,33 @@ The content filter can be a simple shell script like this: Notes: - * Line 8: The -G option says the filter output is not a local mail - submission: don't do silly things like appending the local domain name to - addresses in message headers. This option does nothing before Postfix - version 2.3. + * Line 8: The -G option does nothing before Postfix 2.3, otherwise it + disables address rewriting of message headers. * Line 8: The -i option says don't stop reading input when a line contains "." only. * Line 8: NEVER NEVER NEVER use the "-t" command-line option here. It will - mis-deliver mail, like sending messages from a mailing list back to the - mailing list. + mis-deliver mail, like sending mailing list mail back to the mailing list. * Line 21: The idea is to first capture the message to file and then run the content through a third-party content filter program. - * Line 22: If the message cannot be captured to file, mail delivery is - deferred by terminating with exit status 75 (EX_TEMPFAIL). Postfix places - the message in the deferred mail queue and tries again later. + * Line 22: If the mail cannot be captured to file, mail delivery is deferred + by terminating with exit status 75 (EX_TEMPFAIL). Postfix places the + message in the deferred mail queue and tries again later. * Line 25: You will need to specify a real content filter program here that receives the content on standard input. * Line 26: If the content filter program finds a problem, the mail is bounced - by terminating with exit status 69 (EX_UNAVAILABLE). Postfix will send the - message back to the sender as undeliverable mail. + by terminating with exit status 69 (EX_UNAVAILABLE). Postfix will return + the message to the sender as undeliverable. - * NOTE: in this time of mail worms and spam, it is a BAD IDEA to send known + * Note: in this time of mail worms and spam, it is a BAD IDEA to send known viruses or spam back to the sender, because that address is likely to be - forged. It is safer to discard known viruses and to quarantine suspicious - content so that it can be inspected by a human being. + forged. It is safer to discard known to be bad content and to quarantine + suspicious content so that it can be inspected by a human being. * Line 28: If the content is OK, it is given as input to the Postfix sendmail command, and the exit status of the filter command is whatever exit status @@ -170,7 +164,7 @@ Notes: I suggest that you first run this script by hand until you are satisfied with the results. Run it with a real message (headers+body) as input: - % /path/to/script -f sender -- recipient... directly (which is not allowed) and overriding the __FD_SETSIZE macro. Beware, undocumented interfaces can change at any time and without warning. -But wait, there is more: none of this will work unless the operating system is -configured to handle thousands of connections. See the TUNING_README guide for -examples of how to increase the number of open sockets or files. - 44..66 -- CCoommppiilliinngg PPoossttffiixx,, aatt llaasstt If the command @@ -288,22 +267,15 @@ to end up placing "#ifdef" sections all over the source code again. This text describes how to install Postfix from source code. See the PACKAGE_README file if you are building a package for distribution to other -systems. +systems. See auxiliary/MacOSX/README-INSTALL.OSX for information about +installing Postfix from source on Mac OS X. 66..11 -- SSaavvee eexxiissttiinngg SSeennddmmaaiill bbiinnaarriieess IMPORTANT: if you are REPLACING an existing Sendmail installation with Postfix, you may need to keep the old sendmail program running for some time in order to -flush the mail queue. - - * Some systems implement a mail switch mechanism where different MTAs - (Postfix, Sendmail, etc.) can be installed at the same time, while only one - of them is actually being used. Examples of such switching mechanisms are - the FreeBSD mailwrapper(8) or the Linux mail switch. In this case you - should try to "flip" the switch to "Postfix" before installing Postfix. - - * If your system has no mail switch mechanism, execute the following commands - (your sendmail, newaliases and mailq programs may be in a different place): +flush the mail queue. As superuser, execute the following commands (your +sendmail, newaliases and mailq programs may be in a different place): # mv /usr/sbin/sendmail /usr/sbin/sendmail.OFF # mv /usr/bin/newaliases /usr/bin/newaliases.OFF @@ -348,15 +320,14 @@ following commands as the super-user: # make upgrade (non-interactive version, for upgrades) - * The interactive version ("make install") asks for pathnames for Postfix - data and program files, and stores your preferences in the main.cf file. IIff - yyoouu ddoonn''tt wwaanntt PPoossttffiixx ttoo oovveerrwwrriittee nnoonn--PPoossttffiixx ""sseennddmmaaiill"",, ""mmaaiillqq"" aanndd - ""nneewwaalliiaasseess"" ffiilleess,, ssppeecciiffyy ppaatthhnnaammeess tthhaatt eenndd iinn ""..ppoossttffiixx"". - * The non-interactive version ("make upgrade") needs the /etc/postfix/main.cf file from a previous installation. If the file does not exist, use interactive installation ("make install") instead. + * The interactive version offers suggestions for pathnames that you can + override interactively, and stores your preferences in /etc/postfix/main.cf + for convenient future upgrades. + 66..44 -- CCoonnffiigguurree PPoossttffiixx Proceed to the section on how you wish to run Postfix on your particular @@ -420,12 +391,6 @@ leaving your Sendmail setup intact, by running Postfix on a virtual interface address. Simply configure your mail user agent to directly invoke the Postfix sendmail program. -To create a virtual network interface address, study your system ifconfig -manual page. The command syntax could be any of: - - # iiffccoonnffiigg llee00::11 <> nneettmmaasskk <> uupp - # iiffccoonnffiigg eenn00 aalliiaass <> nneettmmaasskk 225555..225555..225555..225555 - In the /etc/postfix/main.cf file, I would specify /etc/postfix/main.cf: diff --git a/postfix/README_FILES/LDAP_README b/postfix/README_FILES/LDAP_README index fc5da6b1a..12f31d110 100644 --- a/postfix/README_FILES/LDAP_README +++ b/postfix/README_FILES/LDAP_README @@ -18,7 +18,6 @@ Topics covered in this document: * Configuring LDAP lookups * Example: aliases * Example: virtual domains/addresses - * Example: expanding LDAP groups * Other uses of LDAP lookups * Notes and things to think about * Feedback @@ -97,12 +96,12 @@ in main.cf, you have: and in ldap:/etc/postfix/ldap-aliases.cf you have: - server_host = ldap.example.com - search_base = dc=example, dc=com + server_host = ldap.my.com + search_base = dc=my, dc=com Upon receiving mail for a local address "ldapuser" that isn't found in the / etc/aliases database, Postfix will search the LDAP server listening at port 389 -on ldap.example.com. It will bind anonymously, search for any directory entries +on ldap.my.com. It will bind anonymously, search for any directory entries whose mailacceptinggeneralid attribute is "ldapuser", read the "maildrop" attributes of those found, and build a list of their maildrops, which will be treated as RFC822 addresses to which the message will be delivered. @@ -117,7 +116,7 @@ want to make sure all of your virtual recipient's mailacceptinggeneralid attributes are fully qualified with their virtual domains. Finally, if you want to designate a directory entry as the default user for a virtual domain, just give it an additional mailacceptinggeneralid (or the equivalent in your -directory) of "@fake.dom". That's right, no user part. If you don't want a +directory) of "@virtual.dom". That's right, no user part. If you don't want a catchall user, omit this step and mail to unknown users in the domain will simply bounce. @@ -144,194 +143,12 @@ this: Normal users might simply have one mailacceptinggeneralid and maildrop, e.g. "normaluser@fake.dom" and "normaluser@real.dom". -EExxaammppllee:: eexxppaannddiinngg LLDDAAPP ggrroouuppss - -LDAP is frequently used to store group member information. There are a number -of ways of handling LDAP groups. We will show a few examples in order of -increasing complexity, but owing to the number of independent variables, we can -only present a tiny portion of the solution space. We show how to: - - 1. query groups as lists of addresses; - - 2. query groups as lists of user objects containing addresses; - - 3. forward special lists unexpanded to a separate list server, for moderation - or other processing; - - 4. handle complex schemas by controlling expansion and by treating leaf nodes - specially, using features that are new in Postfix 2.4. - -The example LDAP entries and implied schema below show two group entries -("agroup" and "bgroup") and four user entries ("auser", "buser", "cuser" and -"duser"). The group "agroup" has the users "auser" (1) and "buser" (2) as -members via DN references in the multi-valued attribute "memberdn", and direct -email addresses of two external users "auser@example.org" (3) and -"buser@example.org" (4) stored in the multi-valued attribute "memberaddr". The -same is true of "bgroup" and "cuser"/"duser" (6)/(7)/(8)/(9), but "bgroup" also -has a "maildrop" attribute of "bgroup@mlm.example.com" (5): - - dn: cn=agroup, dc=example, dc=com - objectclass: top - objectclass: ldapgroup - cn: agroup - mail: agroup@example.com - 1 -> memberdn: uid=auser, dc=example, dc=com - 2 -> memberdn: uid=buser, dc=example, dc=com - 3 -> memberaddr: auser@example.org - 4 -> memberaddr: buser@example.org - - dn: cn=bgroup, dc=example, dc=com - objectclass: top - objectclass: ldapgroup - cn: bgroup - mail: bgroup@example.com - 5 -> maildrop: bgroup@mlm.example.com - 6 -> memberdn: uid=cuser, dc=example, dc=com - 7 -> memberdn: uid=duser, dc=example, dc=com - 8 -> memberaddr: cuser@example.org - 9 -> memberaddr: duser@example.org - - dn: uid=auser, dc=example, dc=com - objectclass: top - objectclass: ldapuser - uid: auser - 10 -> mail: auser@example.com - 11 -> maildrop: auser@mailhub.example.com - - dn: uid=buser, dc=example, dc=com - objectclass: top - objectclass: ldapuser - uid: buser - 12 -> mail: buser@example.com - 13 -> maildrop: buser@mailhub.example.com - - dn: uid=cuser, dc=example, dc=com - objectclass: top - objectclass: ldapuser - uid: cuser - 14 -> mail: cuser@example.com - - dn: uid=duser, dc=example, dc=com - objectclass: top - objectclass: ldapuser - uid: duser - 15 -> mail: duser@example.com - -Our first use case ignores the "memberdn" attributes, and assumes that groups -hold only direct "memberaddr" strings as in (3), (4), (8) and (9). The goal is -to map the group address to the list of constituent "memberaddr" values. This -is simple, ignoring the various connection related settings (hosts, ports, bind -settings, timeouts, ...) we have: - - simple.cf: - ... - search_base = dc=example, dc=com - query_filter = mail=%s - result_attribute = memberaddr - $ postmap -q agroup@example.com ldap:simple.cf - auser@example.org,buser@example.org - -We search "dc=example, dc=com". The "mail" attribute is used in the -query_filter to locate the right group, the "result_attribute" setting -described in ldap_table(5) is used to specify that "memberaddr" values from the -matching group are to be returned as a comma separated list. Always check -tables using postmap(1) with the "-q" option, before deploying them into -production use in main.cf. - -Our second use case instead expands "memberdn" attributes (1), (2), (6) and -(7), follows the DN references and returns the "maildrop" of the referenced -user entries. Here we use the "special_result_attribute" setting from -ldap_table(5) to designate the "memberdn" attribute as holding DNs of the -desired member entries. The "result_attribute" setting selects which attributes -are returned from the selected DNs. It is important to choose a result -attribute that is not also present in the group object, because result -attributes are collected from both the group and the member DNs. In this case -we choose "maildrop" and assume for the moment that groups never have a -"maildrop" (the "bgroup" "maildrop" attribute is for a different use case). The -returned data for "auser" and "buser" is from items (11) and (13) in the -example data. - - special.cf: - ... - search_base = dc=example, dc=com - query_filter = mail=%s - result_attribute = maildrop - special_result_attribute = memberdn - $ postmap -q agroup@example.com ldap:special.cf - auser@mailhub.example.com,buser@mailhub.example.com - -Note: if the desired member object result attribute is always also present in -the group, you get surprising results: the expansion also returns the address -of the group. This is a known limitation of Postfix releases prior to 2.4, and -is addressed in the new with Postfix 2.4 "leaf_result_attribute" feature -described in ldap_table(5). - -Our third use case has some groups that are expanded immediately, and other -groups that are forwarded to a dedicated mailing list manager host for delayed -expansion. This uses two LDAP tables, one for users and forwarded groups and a -second for groups that can be expanded immediately. It is assumed that groups -that require forwarding are never nested members of groups that are directly -expanded. - - no_expand.cf: - ... - search_base = dc=example, dc=com - query_filter = mail=%s - result_attribute = maildrop - expand.cf - ... - search_base = dc=example, dc=com - query_filter = mail=%s - result_attribute = maildrop - special_result_attribute = memberdn - $ postmap -q auser@example.com ldap:no_expand.cf ldap:expand.cf - auser@mailhub.example.com - $ postmap -q agroup@example.com ldap:no_expand.cf ldap:expand.cf - auser@mailhub.example.com,buser@mailhub.example.com - $ postmap -q bgroup@example.com ldap:no_expand.cf ldap:expand.cf - bgroup@mlm.example.com - -Non-group objects and groups with delayed expansion (those that have a maildrop -attribute) are rewritten to a single maildrop value. Groups that don't have a -maildrop are expanded as the second use case. This admits a more elegant -solution with Postfix 2.4 and later. - -Our final use case is the same as the third, but this time uses new features in -Postfix 2.4. We now are able to use just one LDAP table and no longer need to -assume that forwarded groups are never nested inside expanded groups. - - fancy.cf: - ... - search_base = dc=example, dc=com - query_filter = mail=%s - result_attribute = memberaddr - special_result_attribute = memberdn - terminal_result_attribute = maildrop - leaf_result_attribute = mail - $ postmap -q auser@example.com ldap:fancy.cf - auser@mailhub.example.com - $ postmap -q cuser@example.com ldap:fancy.cf - cuser@example.com - $ postmap -q agroup@example.com ldap:fancy.cf - - auser@mailhub.example.com,buser@mailhub.example.com,auser@example.org,buser@example.org - $ postmap -q bgroup@example.com ldap:fancy.cf - bgroup@mlm.example.com - -Above, delayed expansion is enabled via "terminal_result_attribute", which, if -present, is used as the sole result and all other expansion is suppressed. -Otherwise, the "leaf_result_attribute" is only returned for leaf objects that -don't have a "special_result_attribute" (non-groups), while the -"result_attribute" (direct member address of groups) is returned at every level -of recursive expansion, not just the leaf nodes. This fancy example illustrates -all the features of Postfix 2.4 group expansion. - OOtthheerr uusseess ooff LLDDAAPP llooookkuuppss Other common uses for LDAP lookups include rewriting senders and recipients with Postfix's canonical lookups, for example in order to make mail leaving -your site appear to be coming from "First.Last@example.com" instead of -"userid@example.com". +your site appear to be coming from "First.Last@site.dom" instead of +"userid@site.dom". NNootteess aanndd tthhiinnggss ttoo tthhiinnkk aabboouutt @@ -349,9 +166,9 @@ NNootteess aanndd tthhiinnggss ttoo tthhiinnkk aabboouu define an entry intended for use as a mailing list that looks like this (Warning! Schema made up just for this example): - dn: cn=Accounting Staff List, dc=example, dc=com + dn: cn=Accounting Staff List, dc=my, dc=com cn: Accounting Staff List - o: example.com + o: my.com objectclass: maillist mailacceptinggeneralid: accountingstaff mailacceptinggeneralid: accounting-staff @@ -430,9 +247,6 @@ CCrreeddiittss * Liviu Daia with further refinements from Jose Luis Tallon and Victor Duchovni developed the common query, result_format, domain and expansion_limit interface for LDAP, MySQL and PosgreSQL. - * Gunnar Wrobel provided a first implementation of a feature to limit LDAP - search results to leaf nodes only. Victor generalized this into the Postfix - 2.4 "leaf_result_attribute" feature. And of course Wietse. diff --git a/postfix/README_FILES/LINUX_README b/postfix/README_FILES/LINUX_README index 432accbd0..3325cd1d1 100644 --- a/postfix/README_FILES/LINUX_README +++ b/postfix/README_FILES/LINUX_README @@ -4,16 +4,16 @@ PPoossttffiixx aanndd LLiinnuuxx BBeerrkkeelleeyy DDBB iissssuueess -If you can't compile Postfix because the file "db.h" isn't found, then you MUST -install the Berkeley DB development package (name: db???-devel-???) that -matches your system library. You can find out what is installed with the rpm -command. For example: +Warning: if you can't compile Postfix because the file "db.h" isn't found, then +you MUST install the Berkeley DB development package (name: db???-devel-???) +that matches your system library. You can find out what is installed with the +rpm command. For example: $ rrppmm --qqff //uussrr//lliibb//lliibbddbb..ssoo db4-4.3.29-2 This means that you need to install db4-devel-4.3.29-2 (on some systems, -specify "rrppmm --qqff //lliibb//lliibbddbb..ssoo" instead). +specify /lib/libdb.so in the rpm query). DO NOT download some Berkeley DB version from the network. Every Postfix program will dump core when it is built with a different Berkeley DB version @@ -23,9 +23,7 @@ file for further information. PPrrooccmmaaiill iissssuueess On RedHat Linux 7.1 and later pprrooccmmaaiill no longer has permission to write the -mail spool directory. Workaround: - - # chmod 1777 /var/spool/mail +mail spool directory. Workaround: chmod 1777 /var/spool/mail. SSyyssllooggdd ppeerrffoorrmmaannccee diff --git a/postfix/README_FILES/LOCAL_RECIPIENT_README b/postfix/README_FILES/LOCAL_RECIPIENT_README index ea4ce2546..51ae9b8f3 100644 --- a/postfix/README_FILES/LOCAL_RECIPIENT_README +++ b/postfix/README_FILES/LOCAL_RECIPIENT_README @@ -45,11 +45,7 @@ To turn off unknown local recipient rejects by the SMTP server, specify: local_recipient_maps = That is, an empty value. With this setting, the Postfix SMTP server will not -reject mail with "User unknown in local recipient table". DDoonn''tt ddoo tthhiiss oonn -ssyysstteemmss tthhaatt rreecceeiivvee mmaaiill ddiirreeccttllyy ffrroomm tthhee IInntteerrnneett.. WWiitthh ttooddaayy''ss wwoorrmmss aanndd -vviirruusseess,, PPoossttffiixx wwiillll bbeeccoommee aa bbaacckkssccaatttteerr ssoouurrccee:: iitt aacccceeppttss mmaaiill ffoorr nnoonn-- -eexxiisstteenntt rreecciippiieennttss aanndd tthheenn ttrriieess ttoo rreettuurrnn tthhaatt mmaaiill aass ""uunnddeelliivveerraabbllee"" ttoo -tthhee oofftteenn ffoorrggeedd sseennddeerr aaddddrreessss. +reject mail with "User unknown in local recipient table". WWhheenn yyoouu nneeeedd ttoo cchhaannggee tthhee llooccaall__rreecciippiieenntt__mmaappss sseettttiinngg iinn mmaaiinn..ccff diff --git a/postfix/README_FILES/MAILDROP_README b/postfix/README_FILES/MAILDROP_README index 23c90e08f..2693f655a 100644 --- a/postfix/README_FILES/MAILDROP_README +++ b/postfix/README_FILES/MAILDROP_README @@ -20,9 +20,7 @@ typically do this for hosted domains with recipients that don't have UNIX home directories. The following example shows how to use maildrop for some.domain and for -someother.domain. The example comes in two parts. - -Part 1 describes changes to the main.cf file: +someother.domain. 1 /etc/postfix/main.cf: 2 maildrop_destination_recipient_limit = 1 @@ -66,8 +64,6 @@ appropriate owner to deliver the mail. Note: Do not use the postfix user as the maildrop user. -Part 2 describes changes to the master.cf file: - /etc/postfix/master.cf: maildrop unix - n n - - pipe flags=ODRhu user=vmail argv=/path/to/maildrop -d ${recipient} diff --git a/postfix/README_FILES/MILTER_README b/postfix/README_FILES/MILTER_README index 7c7a34a27..ac96f8c88 100644 --- a/postfix/README_FILES/MILTER_README +++ b/postfix/README_FILES/MILTER_README @@ -11,10 +11,9 @@ FROM, etc.) as well as mail content. All this happens before mail is queued. The reason for adding Milter support to Postfix is that there exists a large collection of applications, not only to block unwanted mail, but also to verify -authenticity (examples: Domain keys identified mail, SenderID+SPF and Domain -keys) or to digitally sign mail (examples: Domain keys identified mail, Domain -keys). Having yet another Postfix-specific version of all that software is a -poor use of human and system resources. +authenticity (examples: SenderID+SPF and Domain keys) or to digitally sign mail +(example: Domain keys). Having yet another Postfix-specific version of all that +software is a poor use of human and system resources. Postfix version 2.4 implements all the requests of Sendmail version 8 Milter protocols up to version 4, including message body replacement (body replacement @@ -87,11 +86,11 @@ implements the Sendmail 8 Milter protocol. Postfix currently does not provide such a library, but Sendmail does. On some Linux and *BSD distributions, the Sendmail libmilter library is -installed by default. With this, applications such as dkim-milter and sid- -milter build out of the box without requiring any tinkering: +installed by default. With this, applications such as dk-milter and sid-milter +build out of the box without requiring any tinkering: - $ ggzzccaatt ddkkiimm--mmiilltteerr--xx..yy..zz..ttaarr..ggzz || ttaarr xxff -- - $ ccdd ddkkiimm--mmiilltteerr--xx..yy..zz + $ ggzzccaatt ddkk--mmiilltteerr--xx..yy..zz..ttaarr..ggzz || ttaarr xxff -- + $ ccdd ddkk--mmiilltteerr--xx..yy..zz $ mmaakkee [...lots of output omitted...] @@ -127,7 +126,7 @@ RRuunnnniinngg MMiilltteerr aapppplliiccaattiioonnss To run a Milter application, see the documentation of the filter for options. A typical command looks like this: - # //ssoommee//wwhheerree//ddkkiimm--ffiilltteerr --uu uusseerriidd --pp iinneett::ppoorrttnnuummbbeerr@@llooccaallhhoosstt ......ootthheerr + # //ssoommee//wwhheerree//ddkk--ffiilltteerr --uu uusseerriidd --pp iinneett::ppoorrttnnuummbbeerr@@llooccaallhhoosstt ......ootthheerr ooppttiioonnss...... Please specify a userid value that isn't used for other applications (not @@ -408,73 +407,68 @@ Milter applications make assumptions that aren't true in a Postfix environment. X-SenderID: Sendmail Sender-ID Filter vx.y.z host.example.com - This happens because those Milter applications expect that the queue ID is + This happens because some Milter applications expect that the queue ID is known before the MTA accepts the MAIL FROM (sender) command. Postfix, on the other hand, does not choose a queue file name until after it accepts - the first valid RCPT TO (recipient) command (Postfix queue file names must + the first valid RCPT TO (recipient) command. Postfix queue file names must be unique across multiple directories, so the name can't be chosen before - the file is created; if multiple messages were to use the same queue ID - simultaneously, mail would be lost). + the file is created. If multiple messages were to use the same queue ID + simultaneously, mail would be lost. -If you experience the ugly header problem, see if a recent version of the -Milter application fixes it. For example, current versions of dkim-filter and -dk-filter already have code that looks up the Postfix queue ID at a later -protocol stage. + To work around the ugly message header from Milter applications, we add a + little code to the Milter source to look up the queue ID after Postfix + receives the end of the message. -To fix the ugly message header with sid-filter applications, we change the -source code, so that it does the queue ID lookup after Postfix receives the end -of the message. + o Edit the filter source file (typically named dk-filter/dk-filter.c or + similar). - * Edit the filter source file (named sid-filter/sid-filter.c). + o Look up the mlfi_eom() function and add code near the top shown as bboolldd + text below: - * Look up the smfilter table and replace mlfi_eoh by NULL. + dfc = cc->cctx_msg; + assert(dfc != NULL); - * Look up the mlfi_eom() function and add code near the top that calls - mlfi_eoh() as shown by the bboolldd text below: + //** DDeetteerrmmiinnee tthhee jjoobb IIDD ffoorr llooggggiinngg.. **// + iiff ((ddffcc-->>mmccttxx__jjoobbiidd ==== 00 |||| ssttrrccmmpp((ddffcc-->>mmccttxx__jjoobbiidd,, JJOOBBIIDDUUNNKKNNOOWWNN)) ==== 00)) + {{ + cchhaarr **jjoobbiidd == ssmmffii__ggeettssyymmvvaall((ccttxx,, ""ii""));; + iiff ((jjoobbiidd !!== 00)) + ddffcc-->>mmccttxx__jjoobbiidd == jjoobbiidd;; + }} - assert(ctx != NULL); - #endif /* !DEBUG */ + /* get hostname; used in the X header and in new MIME boundaries */ - rreett == mmllffii__eeoohh((ccttxx));; - iiff ((rreett !!== SSMMFFIISS__CCOONNTTIINNUUEE)) - rreettuurrnn rreett;; + NOTES: -NOTES: + o Different mail filters use slightly different names for variables. If + the above code does not compile, look for the code at the start of the + mlfi_eoh() routine. - * This was tested with sid-milter-0.2.10 and sid-milter-0.2.14. + o This fixes only the ugly message header, but not the WARNING message. + Fortunately, dk-filter logs that message only once. - * This fixes only the ugly message header, but not the WARNING message. - Fortunately, sid-milter logs that message only once. + With some Milter applications we can fix both the WARNING and the "unknown- + msgid" by postponing the call of mlfi_eoh() (or whatever routine logs the + WARNING) until the end of the message. -To fix the ugly message header with other Milter applications, you will need to -do something like this: + o Edit the filter source file (typically named sid-filter/sid-filter.c or + similar). - * Edit the filter source file (typically named xxx-filter/xxx-filter.c or - similar). + o Look up the smfilter table and replace mlfi_eoh (or whatever routine + logs the WARNING) by NULL. - * Look up the mlfi_eom() function and add code near the top shown as bboolldd - text below: + o Look up the mlfi_eom() function and add code near the top that calls + mlfi_eoh() as shown by the bboolldd text below: - dfc = cc->cctx_msg; - assert(dfc != NULL); + assert(ctx != NULL); + #endif /* !DEBUG */ - //** DDeetteerrmmiinnee tthhee jjoobb IIDD ffoorr llooggggiinngg.. **// - iiff ((ddffcc-->>mmccttxx__jjoobbiidd ==== 00 |||| ssttrrccmmpp((ddffcc-->>mmccttxx__jjoobbiidd,, JJOOBBIIDDUUNNKKNNOOWWNN)) ==== 00)) {{ - cchhaarr **jjoobbiidd == ssmmffii__ggeettssyymmvvaall((ccttxx,, ""ii""));; - iiff ((jjoobbiidd !!== 00)) - ddffcc-->>mmccttxx__jjoobbiidd == jjoobbiidd;; - }} + rreett == mmllffii__eeoohh((ccttxx));; + iiff ((rreett !!== SSMMFFIISS__CCOONNTTIINNUUEE)) + rreettuurrnn rreett;; - /* get hostname; used in the X header and in new MIME boundaries */ - -NOTES: - - * Different mail filters use slightly different names for variables. If the - above code does not compile, look for the code at the start of the mlfi_eoh - () routine. - - * This fixes only the ugly message header, but not the WARNING message. - Fortunately, many Milters log that message only once. + This works with sid-milter-0.2.10. Other Milter applications will dump core + when you do this. LLiimmiittaattiioonnss @@ -520,7 +514,8 @@ the CONTENT_INSPECTION_README document for a discussion. application name: st_optionneg[134563840]: 0x3d does not fulfill action requirements 0x1e - The solution is to use Postfix version 2.4 or later. + The solution is to use a Postfix version that supports the missing + functionality. * Most Milter configuration options are global. Future Postfix versions may support per-Milter timeouts, per-Milter error handling, etc. diff --git a/postfix/README_FILES/OVERVIEW b/postfix/README_FILES/OVERVIEW index dc5026a22..7331c2b1b 100644 --- a/postfix/README_FILES/OVERVIEW +++ b/postfix/README_FILES/OVERVIEW @@ -276,20 +276,10 @@ queues. When delivering mail to a destination with multiple mail servers, connection caching can help to skip over a non-responding server, and thus - dramatically speed up delivery. SMTP connection caching is available in - Postfix version 2.2 and later. More information about this feature is in - the CONNECTION_CACHE_README document. + dramatically speed up delivery. - /-- smtp(8) --> Internet - - qmgr(8) | - | - \-- | smtp(8) --> Internet - | - ^ - | - - scache(8) + smtp(8) <-> scache(8) <-> smtp(8) + * The showq(8) servers list the Postfix queue status. This is the queue listing service that does the work for the mailq(1) and postqueue(1) diff --git a/postfix/README_FILES/PACKAGE_README b/postfix/README_FILES/PACKAGE_README index d0e57d854..71cec7151 100644 --- a/postfix/README_FILES/PACKAGE_README +++ b/postfix/README_FILES/PACKAGE_README @@ -11,10 +11,10 @@ for general use. GGeenneerraall ddiissttrriibbuuttiioonnss:: pplleeaassee pprroovviiddee aa ssmmaallll ddeeffaauulltt mmaaiinn..ccff ffiillee The installed main.cf file must be small. PLEASE resist the temptation to list -all parameters in the main.cf file. Postfix is supposed to be easy to -configure. Listing all parameters in main.cf defeats the purpose. It is an -invitation for hobbyists to make random changes without understanding what they -do, and gets them into endless trouble. +all 400+ parameters in the main.cf file. Postfix is supposed to be easy to +configure. Listing all 400+ in main.cf defeats the purpose. It is an invitation +for hobbyists to make random changes without understanding what they do, and +gets them into endless trouble. GGeenneerraall ddiissttrriibbuuttiioonnss:: pplleeaassee iinncclluuddee RREEAADDMMEE oorr HHTTMMLL ffiilleess diff --git a/postfix/README_FILES/QSHAPE_README b/postfix/README_FILES/QSHAPE_README index 05c546a87..fc04162d5 100644 --- a/postfix/README_FILES/QSHAPE_README +++ b/postfix/README_FILES/QSHAPE_README @@ -4,11 +4,15 @@ PPoossttffiixx BBoottttlleenneecckk AAnnaallyyssiiss PPuurrppoossee ooff tthhiiss ddooccuummeenntt -This document is an introduction to Postfix queue congestion analysis. It -explains how the qshape(1) program can help to track down the reason for queue -congestion. qshape(1) is bundled with Postfix 2.1 and later source code, under -the "auxiliary" directory. This document describes qshape(1) as bundled with -Postfix 2.4. +This document describes the qshape(1) program which helps the administrator +understand the Postfix queue message distribution sorted by time and by sender +or recipient domain. qshape(1) is bundled with the Postfix 2.1 source under the +"auxiliary" directory. + +In order to understand the output of qshape(1), it useful to understand the +various Postfix queues. To this end the role of each Postfix queue directory is +described briefly in the "Background info: Postfix queue directories" section +near the end of this document. This document covers the following topics: @@ -18,7 +22,7 @@ This document covers the following topics: * Example 2: Deferred queue full of dictionary attack bounces * Example 3: Congestion in the active queue * Example 4: High volume destination backlog - * Postfix queue directories + * Background info: Postfix queue directories o The "maildrop" queue o The "hold" queue @@ -65,20 +69,14 @@ sender domain distribution for captured spam in the "hold" queue: 10 and 20 minutes old, 1 between 320 and 640 minutes old and 12 older than 1280 minutes (1440 minutes in a day). -When the output is a terminal intermediate results showing the top 20 domains -(-n option) are displayed after every 1000 messages (-N option) and the final -output also shows only the top 20 domains. This makes qshape useful even when -the deferred queue is very large and it may otherwise take prohibitively long -to read the entire deferred queue. - By default, qshape shows statistics for the union of both the incoming and active queues which are the most relevant queues to look at when analyzing performance. One can request an alternate list of queues: - $ qshape deferred - $ qshape incoming active deferred + $ qshape deferred | less + $ qshape incoming active deferred | less this will show the age distribution of the deferred queue or the union of the incoming active and deferred queues. @@ -97,19 +95,18 @@ stopped. The problem destinations or sender domains appear near the top left corner of the output table. Remember that the active queue can accommodate up to 20000 -($qmgr_message_active_limit) messages. To check whether this limit has been +($qmgr_message_active_limit) messages. To check wether this limit has been reached, use: - $ qshape -s active (show sender statistics) + $ qshape -s active | head (show sender statistics) If the total sender count is below 20000 the active queue is not yet saturated, any high volume sender domains show near the top of the output. -With oqmgr(8) the active queue is also limited to at most 20000 recipient -addresses ($qmgr_message_recipient_limit). To check for exhaustion of this -limit use: +The active queue is also limited to at most 20000 recipient addresses +($qmgr_message_recipient_limit). To check for exhaustion of this limit use: - $ qshape active (show recipient statistics) + $ qshape active | head (show recipient statistics) Having found the high volume domains, it is often useful to search the logs for recent messages pertaining to the domains in question. @@ -271,10 +268,7 @@ for the queue manager to mark the destination as "dead" despite the transient nature of the errors. The destination will be retried again after the expiration of a $minimal_backoff_time timer. If the error bursts are frequent enough it may be that only a small quantity of email is delivered before the -destination is again marked "dead". In some cases enabling static (not on -demand) connection caching by listing the appropriate nexthop domain in a table -included in "smtp_connection_cache_destinations" may help to reduce the error -rate, because most messages will re-use existing connections. +destination is again marked "dead". The MTA that has been observed most frequently to exhibit such bursts of errors is Microsoft Exchange, which refuses connections under load. Some proxy virus @@ -282,13 +276,14 @@ scanners in front of the Exchange server propagate the refused connection to the client as a "421" error. Note that it is now possible to configure Postfix to exhibit similarly erratic -behavior by misconfiguring the anvil(8) service. Do not use anvil(8) for -steady-state rate limiting, its purpose is (unintentional) DoS prevention and -the rate limits set should be very generous! +behavior by misconfiguring the anvil(8) server (not included in Postfix 2.1.). +Do not use anvil(8) for steady-state rate limiting, its purpose is DoS +prevention and the rate limits set should be very generous! -If one finds oneself needing to deliver a high volume of mail to a destination -that exhibits frequent brief bursts of errors and connection caching does not -solve the problem, there is a subtle workaround. +In the long run it is hoped that the Postfix dead host detection and +concurrency control mechanism will be tuned to be more "noise" tolerant. If one +finds oneself needing to deliver a high volume of mail to a destination that +exhibits frequent brief bursts of errors, there is a subtle workaround. * In master.cf set up a dedicated clone of the "smtp" transport for the destination in question. @@ -297,15 +292,15 @@ solve the problem, there is a subtle workaround. number in the 10-20 range is typical). * IMPORTANT!!! In main.cf configure a very large initial and destination - concurrency limit for this transport (say 2000). + concurrency limit for this transport (say 200). /etc/postfix/main.cf: - initial_destination_concurrency = 2000 - transportname_destination_concurrency_limit = 2000 + initial_destination_concurrency = 200 + transportname_destination_concurrency_limit = 200 Where transportname is the name of the master.cf entry in question. -The effect of this surprising configuration is that up to 2000 consecutive +The effect of this surprising configuration is that up to 200 consecutive errors are tolerated without marking the destination dead, while the total concurrency remains reasonable (10-20 processes). This trick is only for a very specialized situation: high volume delivery into a channel with multi-error @@ -339,7 +334,7 @@ connection caching is introduced. Hopefully a more elegant solution to these problems will be found in the future. -PPoossttffiixx qquueeuuee ddiirreeccttoorriieess +BBaacckkggrroouunndd iinnffoo:: PPoossttffiixx qquueeuuee ddiirreeccttoorriieess The following sections describe Postfix queues: their purpose, what normal behavior looks like, and how to diagnose abnormal behavior. @@ -360,9 +355,8 @@ the "maildrop" queue and to notify the pickup(8) service of its arrival. All mail that enters the main Postfix queue does so via the cleanup(8) service. The cleanup service is responsible for envelope and header rewriting, header -and body regular expression checks, automatic bcc recipient processing, milter -content processing, and reliable insertion of the message into the Postfix -"incoming" queue. +and body regular expression checks, automatic bcc recipient processing and +guaranteed insertion of the message into the Postfix "incoming" queue. In the absence of excessive CPU consumption in cleanup(8) header or body regular expression checks or other software consuming all available CPU @@ -378,16 +372,16 @@ not negligible) of the cleanup service. Congestion in this queue is indicative of an excessive local message submission rate or perhaps excessive CPU consumption in the cleanup(8) service due to -excessive body_checks, or (Postfix >= 2.3) high latency milters. +excessive body_checks. Note, that once the active queue is full, the cleanup service will attempt to slow down message injection by pausing $in_flow_delay for each message. In this case "maildrop" queue congestion may be a consequence of congestion downstream, rather than a problem in its own right. -Note, you should not attempt to deliver large volumes of mail via the pickup(8) -service. High volume sites should avoid using "simple" content filters that re- -inject scanned mail via Postfix sendmail(1) and postdrop(1). +Note also, that one should not attempt to deliver large volumes of mail via the +pickup(8) service. High volume sites must avoid using content filters that +reinject scanned mail via Postfix sendmail(1) and postdrop(1). A high arrival rate of locally submitted mail may be an indication of an uncaught forwarding loop, or a run-away notification program. Try to keep the @@ -407,12 +401,13 @@ processing and placed indefinitely in the "hold" queue. Messages placed in the delivery attempts are made for messages in the "hold" queue. The postsuper(1) command can be used to manually release messages into the "deferred" queue. -Messages can potentially stay in the "hold" queue longer than -$maximal_queue_lifetime. If such "old" messages need to be released from the -"hold" queue, they should typically be moved into the "maildrop" queue using -"postsuper -r", so that the message gets a new timestamp and is given more than -one opportunity to be delivered. Messages that are "young" can be moved -directly into the "deferred" queue using "postsuper -H". +Messages can potentially stay in the "hold" queue for a time exceeding the +normal maximal queue lifetime (after which undelivered messages are bounced +back to the sender). If such "old" messages need to be released from the "hold" +queue, they should typically be moved into the "maildrop" queue, so that the +message gets a new timestamp and is given more than one opportunity to be +delivered. Messages that are "young" can be moved directly into the "deferred" +queue. The "hold" queue plays little role in Postfix performance, and monitoring of the "hold" queue is typically more closely motivated by tracking spam and @@ -440,14 +435,10 @@ queue as soon as they become available. The incoming queue grows when the message input rate spikes above the rate at which the queue manager can import messages into the active queue. The main -factors slowing down the queue manager are disk I/O and lookup queries to the -trivial-rewrite service. If the queue manager is routinely not keeping up, -consider not using "slow" lookup services (MySQL, LDAP, ...) for transport -lookups or speeding up the hosts that provide the lookup service. If the -problem is I/O starvation, consider striping the queue over more disks, faster -controllers with a battery write cache, or other hardware improvements. At the -very least, make sure that the queue directory is mounted with the "noatime" -option if applicable to the underlying filesystem. +factor slowing down the queue manager is transport queries to the trivial- +rewrite service. If the queue manager is routinely not keeping up, consider not +using "slow" lookup services (MySQL, LDAP, ...) for transport lookups or +speeding up the hosts that provide the lookup service. The in_flow_delay parameter is used to clamp the input rate when the queue manager starts to fall behind. The cleanup(8) service will pause for @@ -493,37 +484,22 @@ of recipients that share the same transport/nexthop combination; the group size is capped by the transport's recipient concurrency limit. Multiple recipient groups (from one or more messages) are queued for delivery -grouped by transport/nexthop combination. The ddeessttiinnaattiioonn concurrency limit for -the transports caps the number of simultaneous delivery attempts for each -nexthop. Transports with a rreecciippiieenntt concurrency limit of 1 are special: these -are grouped by the actual recipient address rather than the nexthop, yielding -per-recipient concurrency limits rather than per-domain concurrency limits. -Per-recipient limits are appropriate when performing final delivery to +via the common transport/nexthop combination. The destination concurrency limit +for the transports caps the number of simultaneous delivery attempts for each +nexthop. Transports with a recipient concurrency limit of 1 are special: these +are grouped by the actual recipient address rather than the nexthop, thereby +enabling per-recipient concurrency limits rather than per-domain concurrency +limits. Per-recipient limits are appropriate when performing final delivery to mailboxes rather than when relaying to a remote server. Congestion occurs in the active queue when one or more destinations drain -slower than the corresponding message input rate. - -Input into the active queue comes both from new mail in the "incoming" queue, -and retries of mail in the "deferred" queue. Should the "deferred" queue get -really large, retries of old mail can dominate the arrival rate of new mail. -Systems with more CPU, faster disks and more network bandwidth can deal with -larger deferred queues, but as a rule of thumb the deferred queue scales to -somewhere between 100,000 and 1,000,000 messages with good performance unlikely -above that "limit". Systems with queues this large should typically stop -accepting new mail, or put the backlog "on hold" until the underlying issue is -fixed (provided that there is enough capacity to handle just the new mail). - -When a destination is down for some time, the queue manager will mark it dead, -and immediately defer all mail for the destination without trying to assign it -to a delivery agent. In this case the messages will quickly leave the active -queue and end up in the deferred queue (with Postfix < 2.4, this is done -directly by the queue manager, with Postfix >= 2.4 this is done via the "retry" -delivery agent). - -When the destination is instead simply slow, or there is a problem causing an -excessive arrival rate the active queue will grow and will become dominated by -mail to the congested destination. +slower than the corresponding message input rate. If a destination is down for +some time, the queue manager will mark it dead, and immediately defer all mail +for the destination without trying to assign it to a delivery agent. In this +case the messages will quickly leave the active queue and end up in the +deferred queue. If the destination is instead simply slow, or there is a +problem causing an excessive arrival rate the active queue will grow and will +become dominated by mail to the congested destination. The only way to reduce congestion is to either reduce the input rate or increase the throughput. Increasing the throughput requires either increasing @@ -547,52 +523,23 @@ ESTABLISHED or SYN_SENT) reaches the process limit, mail is draining slowly and the system and network are not loaded, raise the "smtp" and/or "relay" process limits! -When a high volume destination is served by multiple MX hosts with typically -low delivery latency, performance can suffer dramatically when one of the MX -hosts is unresponsive and SMTP connections to that host timeout. For example, -if there are 2 equal weight MX hosts, the SMTP connection timeout is 30 seconds -and one of the MX hosts is down, the average SMTP connection will take -approximately 15 seconds to complete. With a default per-destination -concurrency limit of 20 connections, throughput falls to just over 1 message -per second. - -The best way to avoid bottlenecks when one or more MX hosts is non-responsive -is to use connection caching. Connection caching was introduced with Postfix -2.2 and is by default enabled on demand for destinations with a backlog of mail -in the active queue. When connection caching is in effect for a particular -destination, established connections are re-used to send additional messages, -this reduces the number of connections made per message delivery and maintains -good throughput even in the face of partial unavailability of the destination's -MX hosts. - -If connection caching is not available (Postfix < 2.2) or does not provide a -sufficient latency reduction, especially for the "relay" transport used to -forward mail to "your own" domains, consider setting lower than default SMTP -connection timeouts (1-5 seconds) and higher than default destination -concurrency limits. This will further reduce latency and provide more -concurrency to maintain throughput should latency rise. - -Setting high concurrency limits to domains that are not your own may be viewed -as hostile by the receiving system, and steps may be taken to prevent you from -monopolizing the destination system's resources. The defensive measures may -substantially reduce your throughput or block access entirely. Do not set -aggressive concurrency limits to remote domains without coordinating with the -administrators of the target domain. - -If necessary, dedicate and tune custom transports for selected high volume -destinations. The "relay" transport is provided for forwarding mail to domains -for which your server is a primary or backup MX host. These can make up a -substantial fraction of your email traffic. Use the "relay" and not the "smtp" -transport to send email to these domains. Using the "relay" transport allocates -a separate delivery agent pool to these destinations and allows separate tuning -of timeouts and concurrency limits. +Especially for the "relay" transport, consider lower SMTP connection timeouts +(1-5 seconds) and higher than default destination concurrency limits. Compute +the expected latency when 1 out of N of the MX hosts for a high volume site is +down and not responding, and make sure that the configured concurrency divided +by this latency exceeds the required steady-state message rate. If the +destination is managed by you, consider load balancers in front of groups of MX +hosts. Load balancers have higher uptime and will be able to hide individual MX +host failures. + +If necessary, dedicate and tune custom transports for high volume destinations. Another common cause of congestion is unwarranted flushing of the entire deferred queue. The deferred queue holds messages that are likely to fail to be -delivered and are also likely to be slow to fail delivery (time out). As a -result the most common reaction to a large deferred queue (flush it!) is more -than likely counter-productive, and typically makes the congestion worse. Do -not flush the deferred queue unless you expect that most of its content has +delivered and are also likely to be slow to fail delivery (timeouts). This +means that the most common reaction to a large deferred queue (flush it!) is +more than likely counter- productive, and is likely to make the problem worse. +Do not flush the deferred queue unless you expect that most of its content has recently become deliverable (e.g. relayhost back up after an outage)! Note that whenever the queue manager is restarted, there may already be @@ -602,8 +549,7 @@ the active queue messages back into the incoming queue, and then uses its normal incoming queue scan to refill the active queue. The process of moving all the messages back and forth, redoing transport table (trivial-rewrite(8) resolve service) lookups, and re-importing the messages back into memory is -expensive. At all costs, avoid frequent restarts of the queue manager (e.g. via -frequent execution of "postfix reload"). +expensive. At all costs, avoid frequent restarts of the queue manager. TThhee ""ddeeffeerrrreedd"" qquueeuuee @@ -615,15 +561,15 @@ The queue manager scans the deferred queue periodically. The scan interval is controlled by the queue_run_delay parameter. While a deferred queue scan is in progress, if an incoming queue scan is also in progress (ideally these are brief since the incoming queue should be short), the queue manager alternates -between looking for messages in the "incoming" queue and in the "deferred" +between bringing a new "incoming" message and a new "deferred" message into the queue. This "round-robin" strategy prevents starvation of either the incoming or the deferred queues. Each deferred queue scan only brings a fraction of the deferred queue back into the active queue for a retry. This is because each message in the deferred queue is assigned a "cool-off" time when it is deferred. This is done by time- -warping the modification time of the queue file into the future. The queue file -is not eligible for a retry if its modification time is not yet reached. +warping the modification times of the queue file into the future. The queue +file is not eligible for a retry if its modification time is not yet reached. The "cool-off" time is at least $minimal_backoff_time and at most $maximal_backoff_time. The next retry time is set by doubling the message's age @@ -632,29 +578,24 @@ that young messages are initially retried more often than old messages. If a high volume site routinely has large deferred queues, it may be useful to adjust the queue_run_delay, minimal_backoff_time and maximal_backoff_time to -provide short enough delays on first failure (Postfix >= 2.4 has a sensibly low -minimal backoff time by default), with perhaps longer delays after multiple -failures, to reduce the retransmission rate of old messages and thereby reduce -the quantity of previously deferred mail in the active queue. If you want a -really low minimal_backoff_time, you may also want to lower queue_run_delay, -but understand that more frequent scans will increase the demand for disk I/O. +provide short enough delays on first failure, with perhaps longer delays after +multiple failures, to reduce the retransmission rate of old messages and +thereby reduce the quantity of previously deferred mail in the active queue. One common cause of large deferred queues is failure to validate recipients at the SMTP input stage. Since spammers routinely launch dictionary attacks from unrepliable sender addresses, the bounces for invalid recipient addresses clog the deferred queue (and at high volumes proportionally clog the active queue). Recipient validation is strongly recommended through use of the -local_recipient_maps and relay_recipient_maps parameters. Even when bounces -drain quickly they inundate innocent victims of forgery with unwanted email. To -avoid this, do not accept mail for invalid recipients. +local_recipient_maps and relay_recipient_maps parameters. When a host with lots of deferred mail is down for some time, it is possible for the entire deferred queue to reach its retry time simultaneously. This can lead to a very full active queue once the host comes back up. The phenomenon can repeat approximately every maximal_backoff_time seconds if the messages are -again deferred after a brief burst of congestion. Perhaps, a future Postfix -release will add a random offset to the retry time (or use a combination of -strategies) to reduce the odds of repeated complete deferred queue flushes. +again deferred after a brief burst of congestion. Ideally, in the future +Postfix will add a random offset to the retry time (or use a combination of +strategies) to reduce the chances of repeated complete deferred queue flushes. CCrreeddiittss diff --git a/postfix/README_FILES/SASL_README b/postfix/README_FILES/SASL_README index ee39ad617..5cf940db4 100644 --- a/postfix/README_FILES/SASL_README +++ b/postfix/README_FILES/SASL_README @@ -86,18 +86,18 @@ Notes: BBuuiillddiinngg tthhee CCyyrruuss SSAASSLL lliibbrraarryy -Postfix appears to work with cyrus-sasl-1.5.x or cyrus-sasl-2.1.x, which are +Postfix appears to work with cyrus-sasl-1.5.5 or cyrus-sasl-2.1.1, which are available from: ftp://ftp.andrew.cmu.edu/pub/cyrus-mail/ IMPORTANT: if you install the Cyrus SASL libraries as per the default, you will -have to symlink /usr/lib/sasl -> /usr/local/lib/sasl for version 1.5.x or /usr/ -lib/sasl2 -> /usr/local/lib/sasl2 for version 2.1.x. +have to symlink /usr/lib/sasl -> /usr/local/lib/sasl for version 1.5.5 or /usr/ +lib/sasl2 -> /usr/local/lib/sasl2 for version 2.1.1. -Reportedly, Microsoft Outlook (Express) requires the non-standard LOGIN -authentication method. To enable this authentication method, specify ``./ -configure --enable-login''. +Reportedly, Microsoft Internet Explorer version 5 requires the non-standard +SASL LOGIN authentication method. To enable this authentication method, specify +``./configure --enable-login''. BBuuiillddiinngg PPoossttffiixx wwiitthh CCyyrruuss SSAASSLL ssuuppppoorrtt @@ -106,13 +106,13 @@ include, and that the Cyrus SASL libraries are in /usr/local/lib. On some systems this generates the necessary Makefile definitions: -(for Cyrus SASL version 1.5.x): +(for Cyrus SASL version 1.5.5): % make tidy # if you have left-over files from a previous build % make makefiles CCARGS="-DUSE_SASL_AUTH -DUSE_CYRUS_SASL \ -I/usr/local/include" AUXLIBS="-L/usr/local/lib -lsasl" -(for Cyrus SASL version 2.1.x): +(for Cyrus SASL version 2.1.1): % make tidy # if you have left-over files from a previous build % make makefiles CCARGS="-DUSE_SASL_AUTH -DUSE_CYRUS_SASL \ @@ -121,14 +121,14 @@ On some systems this generates the necessary Makefile definitions: On Solaris 2.x you need to specify run-time link information, otherwise ld.so will not find the SASL shared library: -(for Cyrus SASL version 1.5.x): +(for Cyrus SASL version 1.5.5): % make tidy # if you have left-over files from a previous build % make makefiles CCARGS="-DUSE_SASL_AUTH -DUSE_CYRUS_SASL \ -I/usr/local/include" AUXLIBS="-L/usr/local/lib \ -R/usr/local/lib -lsasl" -(for Cyrus SASL version 2.1.x): +(for Cyrus SASL version 2.1.1): % make tidy # if you have left-over files from a previous build % make makefiles CCARGS="-DUSE_SASL_AUTH -DUSE_CYRUS_SASL \ @@ -158,8 +158,8 @@ Note: the SASL login names will be shared with the entire world. Older Microsoft SMTP client software implements a non-standard version of the AUTH protocol syntax, and expects that the SMTP server replies to EHLO with -"250 AUTH=mechanism-list" instead of "250 AUTH mechanism-list". To accommodate -such clients (in addition to conformant clients) use the following: +"250 AUTH=stuff" instead of "250 AUTH stuff". To accommodate such clients (in +addition to conformant clients) use the following: /etc/postfix/main.cf: broken_sasl_auth_clients = yes @@ -201,83 +201,71 @@ authentication server. CCyyrruuss SSAASSLL ccoonnffiigguurraattiioonn ffoorr tthhee PPoossttffiixx SSMMTTPP sseerrvveerr -You need to configure how the Cyrus SASL library should authenticate a client's -username and password. These settings must be stored in a separate -configuration file. - -The name of the configuration file (default: smtpd.conf) will be constructed -from a value sent by Postfix to the Cyrus SASL library, which adds the suffix -.conf. The value is configured using one of the following variables: - - /etc/postfix/main.cf: - # Postfix 2.3 and later - smtpd_sasl_path = smtpd - # Postfix < 2.3 - smtpd_sasl_application_name = smtpd - -Cyrus SASL searches for the configuration file in /usr/local/lib/sasl/ (Cyrus -SASL version 1.5.5) or /usr/local/lib/sasl2/ (Cyrus SASL version 2.1.x). +In /usr/local/lib/sasl/smtpd.conf (Cyrus SASL version 1.5.5) or /usr/local/lib/ +sasl2/smtpd.conf (Cyrus SASL version 2.1.1) you need to specify how the server +should validate client passwords. Note: some Postfix distributions are modified and look for the smtpd.conf file -in /etc/postfix/sasl. +in /etc/postfix. Note: some Cyrus SASL distributions look for the smtpd.conf file in /etc/sasl2. - * To authenticate against the UNIX password database, use: + * To authenticate against the UNIX password database, try: - (Cyrus SASL version 1.5.x) + (Cyrus SASL version 1.5.5) /usr/local/lib/sasl/smtpd.conf: pwcheck_method: pwcheck - IMPORTANT: pwcheck establishes a UNIX domain socket in /var/pwcheck and - waits for authentication requests. Postfix processes must have - read+execute permission to this directory or authentication attempts - will fail. + (Cyrus SASL version 2.1.1) + + /usr/local/lib/sasl2/smtpd.conf: + pwcheck_method: pwcheck + + The name of the file in /usr/local/lib/sasl (Cyrus SASL version 1.5.5) or / + usr/local/lib/sasl2 (Cyrus SASL version 2.1.1) used by the SASL library for + configuration can be set with: + + /etc/postfix/main.cf: + smtpd_sasl_application_name = smtpd (Postfix < 2.3) + smtpd_sasl_path = smtpd (Postfix 2.3 and later) + + The pwcheck daemon is contained in the cyrus-sasl source tarball. + + IMPORTANT: postfix processes need to have group read+execute permission for + the /var/pwcheck directory, otherwise authentication attempts will fail. - The pwcheck daemon is contained in the cyrus-sasl source tarball. + * Alternately, in Cyrus SASL 1.5.26 and later (including 2.1.1), try: (Cyrus SASL version 1.5.26) /usr/local/lib/sasl/smtpd.conf: pwcheck_method: saslauthd - (Cyrus SASL version 2.1.x) + (Cyrus SASL version 2.1.1) /usr/local/lib/sasl2/smtpd.conf: pwcheck_method: saslauthd - mech_list: PLAIN LOGIN The saslauthd daemon is also contained in the cyrus-sasl source tarball. It is more flexible than the pwcheck daemon, in that it can authenticate against PAM and various other sources. To use PAM, start saslauthd with "- a pam". - IMPORTANT: saslauthd usually establishes a UNIX domain socket in /var/run/ - saslauthd and waits for authentication requests. Postfix processes must - have read+execute permission to this directory or authentication attempts - will fail. - - Note: The directory where saslauthd puts the socket is configurable. See - the command-line option "-m /path/to/socket" in the saslauthd --help - listing. - * To authenticate against Cyrus SASL's own password database: - (Cyrus SASL version 1.5.x) + (Cyrus SASL version 1.5.5) /usr/local/lib/sasl/smtpd.conf: - pwcheck_method: sasldb + pwcheck_method: sasldb - (Cyrus SASL version 2.1.x) + (Cyrus SASL version 2.1.1) /usr/local/lib/sasl2/smtpd.conf: - pwcheck_method: auxprop - auxprop_plugin: sasldb - mech_list: PLAIN LOGIN CRAM-MD5 DIGEST-MD5 + pwcheck_method: auxprop This will use the Cyrus SASL password file (default: /etc/sasldb in version - 1.5.x, or /etc/sasldb2 in version 2.1.x), which is maintained with the + 1.5.5, or /etc/sasldb2 in version 2.1.1), which is maintained with the saslpasswd or saslpasswd2 command (part of the Cyrus SASL software). On some poorly-supported systems the saslpasswd command needs to be run multiple times before it stops complaining. The Postfix SMTP server needs @@ -291,17 +279,17 @@ Note: some Cyrus SASL distributions look for the smtpd.conf file in /etc/sasl2. EXAMPLE: - (Cyrus SASL version 1.5.x) + (Cyrus SASL version 1.5.5) % saslpasswd -c -u `postconf -h myhostname` exampleuser - (Cyrus SASL version 2.1.x) + (Cyrus SASL version 2.1.1) % saslpasswd2 -c -u `postconf -h myhostname` exampleuser You can find out SASL's idea about the realms of the users in sasldb with - sasldblistusers (Cyrus SASL version 1.5.x) or sasldblistusers2 (Cyrus SASL - version 2.1.x). + sasldblistusers (Cyrus SASL version 1.5.5) or sasldblistusers2 (Cyrus SASL + version 2.1.1). On the Postfix side, you can have only one realm per smtpd instance, and only the users belonging to that realm would be able to authenticate. The @@ -310,19 +298,21 @@ Note: some Cyrus SASL distributions look for the smtpd.conf file in /etc/sasl2. /etc/postfix/main.cf: smtpd_sasl_local_domain = $myhostname -IMPORTANT: The Cyrus SASL password verification services pwcheck and saslauthd -can only support the plaintext mechanisms PLAIN or LOGIN. However, the Cyrus -SASL library doesn't know this, and will happily advertise other authentication -mechanisms that the SASL library implements, such as DIGEST-MD5. As a result, -if an SMTP client chooses any mechanism other than PLAIN or LOGIN while pwcheck -or saslauthd are used, authentication will fail. Thus you may need to limit the -list of mechanisms advertised by Postfix. +IMPORTANT: all users must be able to authenticate using ALL authentication +mechanisms advertised by Postfix, otherwise the negotiation might end up with +an unsupported mechanism, and authentication would fail. For example if you +configure SASL to use saslauthd for authentication against PAM (pluggable +authentication modules), only the PLAIN and LOGIN mechanisms are supported and +stand a chance to succeed, yet the SASL library would also advertise other +mechanisms, such as DIGEST-MD5. This happens because those mechanisms are made +available by other plugins, and the SASL library have no way to know that your +only valid authentication source is PAM. Thus you might need to limit the list +of mechanisms advertised by Postfix. * With older Cyrus SASL versions you remove the corresponding library files from the SASL plug-in directory (and again whenever the system is updated). - * With Cyrus SASL version 2.1.x or later the mech_list variable can specify a - list of authentication mechanisms that Cyrus SASL may offer: + * With Cyrus SASL version 2.1.1 or later: /usr/local/lib/sasl2/smtpd.conf: mech_list: plain login @@ -330,14 +320,14 @@ list of mechanisms advertised by Postfix. For the same reasons you might want to limit the list of plugins used for authentication. - * With Cyrus SASL version 1.5.x your only choice is to delete the + * With Cyrus SASL version 1.5.5 your only choice is to delete the corresponding library files from the SASL plug-in directory. - * With SASL version 2.1.x: + * With SASL version 2.1.1: /usr/local/lib/sasl2/smtpd.conf: - pwcheck_method: auxprop - auxprop_plugin: sql + pwcheck_method: auxprop + auxprop_plugin: sql To run software chrooted with SASL support is an interesting exercise. It probably is not worth the trouble. @@ -381,17 +371,15 @@ base64-encoded form. TTrroouubbllee sshhoooottiinngg tthhee SSAASSLL iinntteerrnnaallss In the Cyrus SASL sources you'll find a subdirectory named "sample". Run make -there, then create a symbolic link from sample.conf to smtpd.conf in your Cyrus -SASL library directory /usr/local/lib/sasl2. "su" to the user postfix (or -whatever your mail_owner directive is set to): +there, "su" to the user postfix (or whatever your mail_owner directive is set +to): % su postfix -then run the resulting sample server and client in separate terminals. The -sample applications send log messages to the syslog facility auth. Check the -log to fix the problem or run strace / ktrace / truss on the server to see what -makes it unhappy. Repeat the previous step until you can successfully -authenticate with the sample client. Only then get back to Postfix. +then run the resulting sample server and client in separate terminals. Strace / +ktrace / truss the server to see what makes it unhappy, and fix the problem. +Repeat the previous step until you can successfully authenticate with the +sample client. Only then get back to Postfix. EEnnaabblliinngg SSAASSLL aauutthheennttiiccaattiioonn iinn tthhee PPoossttffiixx SSMMTTPP cclliieenntt @@ -413,11 +401,6 @@ that is specified with the relayhost parameter or with a transport(5) table. [mail.myisp.net] username:password [mail.myisp.net]:submission username:password -The Postfix SASL client password file is opened before the SMTP server enters -the optional chroot jail, so you can keep the file in /etc/postfix and set -permissions read / write only for root to keep the username:password -combinations away from other system users. - Postfix version 2.3 supports-per-sender SASL password information. To search the Postfix SASL password by sender before it searches by destination, specify: @@ -441,6 +424,9 @@ plaintext authentication specify, for example: /etc/postfix/main.cf: smtp_sasl_security_options = noanonymous +The Postfix SASL client password file is opened before the SMTP server enters +the optional chroot jail, so you can keep the file in /etc/postfix. + Note: Some SMTP servers support authentication mechanisms that, although available on the client system, may not in practice work or possess the appropriate credentials to authenticate to the server. It is possible via the @@ -451,7 +437,7 @@ mechanisms that the smtp(8) client will take into consideration: smtp_sasl_mechanism_filter = !gssapi, !external, static:all In the above example, Postfix will decline to use mechanisms that require -special infrastructure such as Kerberos or TLS. +special infrastructure such as Kerberos. The Postfix SMTP client is backwards compatible with SMTP servers that use the non-standard "AUTH=method..." syntax in response to the EHLO command; there is @@ -472,6 +458,4 @@ CCrreeddiittss smtpd_sasl_path. * The Dovecot SMTP server-only plug-in was originally implemented by Timo Sirainen of Procontrol, Finland. - * Patrick Ben Koetter revised this document for Postfix 2.4 and made much - needed updates. diff --git a/postfix/README_FILES/SMTPD_POLICY_README b/postfix/README_FILES/SMTPD_POLICY_README index 68e04db0c..7735aaeaa 100644 --- a/postfix/README_FILES/SMTPD_POLICY_README +++ b/postfix/README_FILES/SMTPD_POLICY_README @@ -17,11 +17,10 @@ Another example of policy delegation is the SPF policy server at http:// www.openspf.org/Software. Policy delegation is now the preferred method for adding policies to Postfix. -It's much easier to develop a new feature in few lines of Perl, Python, Ruby, -or TCL, than trying to do the same in C code. The difference in performance -will be unnoticeable except in the most demanding environments. On active -systems a policy daemon process is used multiple times, for up to $max_use -incoming SMTP connections. +It's much easier to develop a new feature in few lines of Perl, than trying to +do the same in C code. The difference in performance will be unnoticeable +except in the most demanding environments. On active systems a policy daemon +process is used multiple times, for up to $max_use incoming SMTP connections. This document covers the following topics: @@ -119,7 +118,7 @@ Notes: how the client was authenticated via TLS. These attributes are empty in case of no certificate authentication. As of Postfix 2.2.11 these attribute values are encoded as xtext: some characters are represented by +XX, where - XX is the two-digit hexadecimal representation of the character value. + XX is the two-digit hecadecimal representation of the character value. * The "encryption_*" attributes (Postfix 2.3 and later) specify information about how the connection is encrypted. With plaintext connections the diff --git a/postfix/README_FILES/SMTPD_PROXY_README b/postfix/README_FILES/SMTPD_PROXY_README index d92a9f9e6..f0c63f915 100644 --- a/postfix/README_FILES/SMTPD_PROXY_README +++ b/postfix/README_FILES/SMTPD_PROXY_README @@ -43,9 +43,7 @@ following: 1. Re-inject the mail back into Postfix via SMTP, perhaps after changing its content and/or destination. - 2. Discard or quarantine the mail. - - 3. Reject the mail by sending a suitable SMTP status code back to Postfix. + 2. Reject the mail by sending a suitable SMTP status code back to Postfix. Postfix passes the status back to the remote SMTP client. This way, Postfix does not have to send a bounce message. @@ -137,8 +135,9 @@ master.cf file: from using up all 20 SMTP server processes. This limit is not necessary if you receive all mail from a trusted relay host. - Note: this setting is available in Postfix version 2.2 and later. Earlier - Postfix versions will ignore it. + Note: this setting is ignored by the stable Postfix 2.1 release. The + feature will be available only in the experimental release until Postfix + 2.2. * The "-o smtpd_proxy_filter=127.0.0.1:10025" tells the before filter SMTP server that it should give incoming mail to the content filter that listens diff --git a/postfix/README_FILES/TLS_LEGACY_README b/postfix/README_FILES/TLS_LEGACY_README index 78d128521..c534beb48 100644 --- a/postfix/README_FILES/TLS_LEGACY_README +++ b/postfix/README_FILES/TLS_LEGACY_README @@ -558,7 +558,7 @@ Their DSA counterparts: /etc/postfix/main.cf: smtp_tls_dcert_file = /etc/postfix/client-dsa.pem - smtp_tls_dkey_file = $smtp_tls_dcert_file + smtp_tls_dkey_file = $smtpd_tls_cert_file To verify a remote SMTP server certificate, the Postfix SMTP client needs to trust the certificates of the issuing certification authorities. These @@ -578,7 +578,7 @@ files in the directory when the information is needed. Thus, the $smtp_tls_CApath directory needs to be accessible inside the optional chroot jail. -The choice between $smtp_tls_CAfile and $smtp_tls_CApath is a space/time +The choice between $smtp_tls_CAfile and $smtpd_tls_CApath is a space/time tradeoff. If there are many trusted CAs, the cost of preloading them all into memory may not pay off in reduced access time when the certificate is needed. diff --git a/postfix/README_FILES/TLS_README b/postfix/README_FILES/TLS_README index 17a757873..dc12a8ff7 100644 --- a/postfix/README_FILES/TLS_README +++ b/postfix/README_FILES/TLS_README @@ -673,7 +673,7 @@ Their DSA counterparts: /etc/postfix/main.cf: smtp_tls_dcert_file = /etc/postfix/client-dsa.pem - smtp_tls_dkey_file = $smtp_tls_dcert_file + smtp_tls_dkey_file = $smtpd_tls_cert_file To verify a remote SMTP server certificate, the Postfix SMTP client needs to trust the certificates of the issuing certification authorities. These @@ -693,7 +693,7 @@ files in the directory when the information is needed. Thus, the $smtp_tls_CApath directory needs to be accessible inside the optional chroot jail. -The choice between $smtp_tls_CAfile and $smtp_tls_CApath is a space/time +The choice between $smtp_tls_CAfile and $smtpd_tls_CApath is a space/time tradeoff. If there are many trusted CAs, the cost of preloading them all into memory may not pay off in reduced access time when the certificate is needed. @@ -868,8 +868,8 @@ Per destination settings may override this default setting, in which case TLS is used selectively, only with destinations explicitly configured for TLS. You can disable TLS for a subset of destinations, while leaving it enabled for -the rest. With the Postfix 2.3 and later TLS policy table, specify the "none" -security level. With the obsolete per-site table, specify the "NONE" keyword. +the rest. With the Postfix 2.3+ TLS policy table, specify the "none" security +level. With the obsolete per-site table, specify the "NONE" keyword. OOppppoorrttuunniissttiicc TTLLSS @@ -905,8 +905,8 @@ configure opportunistic encryption of LMTP sessions will be ignored with a warning written to the mail logs. You can enable opportunistic TLS just for selected destinations. With the -Postfix 2.3 and later TLS policy table, specify the "may" security level. With -the obsolete per-site table, specify the "MAY" keyword. +Postfix 2.3+ TLS policy table, specify the "may" security level. With the +obsolete per-site table, specify the "MAY" keyword. This is the most common security level for TLS protected SMTP sessions, stronger security is not generally available and, if needed, is typically only @@ -954,11 +954,10 @@ Internet, you should not configure mandatory TLS encryption as the default security level. You can enable mandatory TLS encryption just for specific destinations. With -the Postfix 2.3 and later TLS policy table, specify the "encrypt" security -level. With the obsolete per-site table, specify the "MUST_NOPEERMATCH" -keyword. While the obsolete approach still works with Postfix 2.3, it is -strongly discouraged: users of Postfix 2.3 and later should use the new TLS -policy settings. +the Postfix 2.3+ TLS policy table, specify the "encrypt" security level. With +the obsolete per-site table, specify the "MUST_NOPEERMATCH" keyword. While the +obsolete approach still works with Postfix 2.3, it is strongly discouraged: +users of Postfix 2.3+ should use the new TLS policy settings. Examples: @@ -976,7 +975,7 @@ default for all "encrypt" security level sessions. .example.com encrypt Postfix 2.2 syntax (no support for sub-domains without resorting to regexp -tables). With Postfix 2.3 and later, do not use the obsolete per-site table. +tables). With Postfix 2.3+, do not use the obsolete per-site table. /etc/postfix/main.cf: smtp_tls_per_site = hash:/etc/postfix/tls_per_site @@ -1017,8 +1016,8 @@ NNoottee:: Avoid policy lookups with the bare hostname (for example, "examp Instead, use the destination (for example, "[example.net]:587"), as the per- site table lookup key (a recipient domain or MX-enabled transport nexthop with no port suffix may look like a bare hostname, but is still a suitable -destination). With Postfix 2.3 and later, do not use the obsolete per-site -table; use the new policy table instead. +destination). With Postfix 2.3+, do not use the obsolete per-site table; use +the new policy table instead. /etc/postfix/main.cf: smtp_tls_per_site = hash:/etc/postfix/tls_per_site @@ -1064,11 +1063,10 @@ STARTTLS support. In such cases, you can often use a secure-channel configuration instead. You can enable mandatory server certificate verification just for specific -destinations. With the Postfix 2.3 and later TLS policy table, specify the -"verify" security level. With the obsolete per-site table, specify the "MUST" -keyword. While the obsolete approach still works with Postfix 2.3, it is -strongly discouraged: users of Postfix 2.3 and later should use the new TLS -policy settings. +destinations. With the Postfix 2.3+ TLS policy table, specify the "verify" +security level. With the obsolete per-site table, specify the "MUST" keyword. +While the obsolete approach still works with Postfix 2.3, it is strongly +discouraged: users of Postfix 2.3+ should use the new TLS policy settings. Example: @@ -1130,11 +1128,11 @@ would be a client that sends all email to a central mailhub that offers the necessary STARTTLS support. You can enable secure TLS verification just for specific destinations. With the -Postfix 2.3 and later TLS policy table, specify the "secure" security level. -With the obsolete per-site table, specify the "MUST" keyword and harden the -certificate verification against DNS forgery. While the obsolete approach still -works with Postfix 2.3, it is strongly discouraged: users of Postfix 2.3 and -later should use the new TLS policy settings. +Postfix 2.3+ TLS policy table, specify the "secure" security level. With the +obsolete per-site table, specify the "MUST" keyword and harden the certificate +verification against DNS forgery. While the obsolete approach still works with +Postfix 2.3, it is strongly discouraged: users of Postfix 2.3+ should use the +new TLS policy settings. Examples: @@ -1198,14 +1196,14 @@ has the potential to mis-deliver email if the related domains change hands. /etc/postfix/tls_policy: [tls.example.com] secure match=tls.example.com -Postfix 2.2.9 and later syntax: +Postfix 2.2.9+ syntax: NNoottee:: Avoid policy lookups with the bare hostname (for example, "tls.example.com"). Instead, use the destination (for example, " [tls.example.com]") as the per-site table lookup key (a recipient domain or MX- enabled transport nexthop with no port suffix may look like a bare hostname, -but is still a suitable destination). With Postfix 2.3 and later, do not use -the obsolete per-site table; use the new policy table instead. +but is still a suitable destination). With Postfix 2.3+, do not use the +obsolete per-site table; use the new policy table instead. /etc/postfix/main.cf: smtp_cname_overrides_servername = no @@ -1334,8 +1332,8 @@ Avoid policy lookups with the bare hostname. Instead, use the full destination nexthop (enclosed in [] with a possible ":port" suffix) as the per-site table lookup key (a recipient domain or MX-enabled transport nexthop with no port suffix may look like a bare hostname, but is still a suitable destination). -With Postfix 2.3 and later, use of the obsolete approach documented here is -strongly discouraged: use the new policy table instead. +With Postfix 2.3+, use of the obsolete approach documented here is strongly +discouraged: use the new policy table instead. Starting with Postfix 2.3, the underlying TLS enforcement levels are common to the obsolete per-site table and the new policy table. The main.cf @@ -1423,7 +1421,7 @@ CClloossiinngg aa DDNNSS lloooopphhoollee wwiitthh oobb For a general discussion of TLS security for SMTP see TLS limitations above. What follows applies only to Postfix 2.2.9 and subsequent Postfix 2.2 patch -levels. Do not use this approach with Postfix 2.3 and later; instead see the +levels. Do not use this approach with Postfix 2.3+; instead see the instructions under secure server certificate verification. As long as no secure DNS lookup mechanism is available, false hostnames in MX diff --git a/postfix/README_FILES/TUNING_README b/postfix/README_FILES/TUNING_README index e7cf35217..c544ffc2a 100644 --- a/postfix/README_FILES/TUNING_README +++ b/postfix/README_FILES/TUNING_README @@ -141,40 +141,37 @@ Postfix version 2.0 and earlier: MMeeaassuurreess aaggaaiinnsstt cclliieennttss tthhaatt mmaakkee ttoooo mmaannyy ccoonnnneeccttiioonnss -Note: these features use the Postfix anvil(8) service, introduced with Postfix -version 2.2. +Note: this feature is not included with Postfix version 2.1. The Postfix smtpd(8) server can limit the number of simultaneous connections -from the same SMTP client, as well as the connection rate and the rate of -certain SMTP commands from the same client. These statistics are maintained by -the anvil(8) server (translation: if anvil(8) breaks, then connection limits -stop working). - -IMPORTANT: These limits must not be used to regulate legitimate traffic: mail -will suffer grotesque delays if you do so. The limits are designed to protect -the smtpd(8) server against abuse by out-of-control clients. - - smtpd_client_connection_count_limit (default: 50) - The maximum number of connections than an SMTP client may make - simultaneously. - smtpd_client_connection_rate_limit (default: no limit) - The maximum number of connections that an SMTP client may make in the - time interval specified with anvil_rate_time_unit (default: 60s). - smtpd_client_message_rate_limit (default: no limit) - The maximum number of message delivery requests that an SMTP client may - make in the time interval specified with anvil_rate_time_unit (default: - 60s). - smtpd_client_recipient_rate_limit (default: no limit) - The maximum number of recipient addresses that an SMTP client may - specify in the time interval specified with anvil_rate_time_unit - (default: 60s). - smtpd_client_new_tls_session_rate_limit (default: no limit) - The maximum number of new TLS sessions (without using the TLS session - cache) that an SMTP client may negotiate in the time interval specified - with anvil_rate_time_unit (default: 60s). - smtpd_client_event_limit_exceptions (default: $mynetworks) - SMTP clients that are excluded from connection and rate limits - specified above. +from the same SMTP client, as well as the number of connections that a client +is allowed to make per unit time. These statistics are maintained by the anvil +(8) server (translation: if anvil(8) breaks, then connection limits stop +working). + +IMPORTANT: These limits are designed to protect the smtpd(8) server against +flagrant abuse. Do not use these limits to regulate legitimate traffic: mail +will suffer grotesque delays if you do so. + + * An SMTP client may make up to $smtpd_client_connection_count_limit + simultaneous connections (default: 50). This is half the default process + limit. + + * An SMTP client may make up to $smtpd_client_message_rate_limit message + delivery requests per unit time (default: no limit). + + * An SMTP client may send up to $smtpd_client_recipient_rate_limit recipient + addresses per unit time (default: no limit). + + * An SMTP client may make up to $smtpd_client_connection_rate_limit + connections per unit time (default: no limit). + + * These limits are not applied to SMTP clients in the networks specified with + $smtpd_client_event_limit_exceptions (default: clients in $mynetworks may + make an unlimited number of connections). + + * The anvil_rate_time_unit parameter specifies the time unit over which + client connection rates are computed (default: 60s). GGeenneerraall mmaaiill ddeelliivveerryy ppeerrffoorrmmaannccee ttiippss @@ -254,7 +251,7 @@ Examples of transport specific concurrency limits are: limit delivery concurrency to the same recipient: if the recipient has an expensive shell command in her .forward file, or if the recipient is a mailing list manager, you don't want to run too many instances of those - processes at the same time. + processes the same time. * The default smtp_destination_concurrency_limit of 20 seems enough to noticeably load a system without bringing it to its knees. Be careful when @@ -337,9 +334,9 @@ message it may blame the message itself, or it may blame the receiving party. This process is governed by a bunch of little parameters. - queue_run_delay (default: 300 seconds; before Postfix 2.4: 1000s) + queue_run_delay (default: 1000 seconds) How often the queue manager scans the queue for deferred mail. - minimal_backoff_time (default: 300 seconds; before Postfix 2.4: 1000s) + minimal_backoff_time (default: 1000 seconds) The minimal amount of time a message won't be looked at, and the minimal amount of time to stay away from a "dead" destination. maximal_backoff_time (default: 4000 seconds) @@ -377,8 +374,8 @@ mail delivery performance actually becomes worse. The symptoms are as follows: When mail is being deferred frequently, fixing the problem is always better than increasing the frequency of delivery attempts. However, if you can control only the delivery attempt frequency, consider using a dedicated fallback_relay -"graveyard" machine for bad destinations, so that these destinations do not -ruin the performance of normal mail deliveries. +"graveyard" machine for bad destinations so that they do not ruin the +performance of normal mail deliveries. TTuunniinngg tthhee nnuummbbeerr ooff PPoossttffiixx pprroocceesssseess @@ -417,16 +414,6 @@ TTuunniinngg tthhee nnuummbbeerr ooff ooppeenn ffiillee When Postfix opens too many files or sockets, processes will abort with fatal errors, and the system may log "file table full" errors. - * Depending on your Postfix and operating system versions you may need to - recompile Postfix if you need more than 1024 file descriptors per process: - - o No recompilation is needed for Postfix version 2.4 and later, when it - was compiled for systems that support BSD kqueue(2) (FreeBSD 4.1, - NetBSD 2.0, OpenBSD 2.9), Solaris 8 /dev/poll, or Linux 2.6 epoll(4). - - o Otherwise, Postfix needs to be recompiled to override the default - FD_SETSIZE value. - * Reduce the number of processes as described under "Tuning the number of Postfix processes" above. Fewer processes need fewer open files and sockets. @@ -436,8 +423,8 @@ errors, and the system may log "file table full" errors. sure to verify the following information with your system tuning guide: o Some FreeBSD kernel parameters can be specified in /boot/loader.conf, - and some can be specified in /etc/sysctl.conf or changed with sysctl - commands. Which is which depends on the version. + and some can be changed with sysctl commands. Which is which depends on + the version. kern.ipc.maxsockets="5000" kern.ipc.nmbclusters="65536" @@ -445,8 +432,8 @@ errors, and the system may log "file table full" errors. kern.maxfiles="16384" kern.maxfilesperproc="16384" - o Linux kernel parameters can be specified in /etc/sysctl.conf or changed - with sysctl commands: + o Linux kernel parameters can be specified in /etc/sysctl.conf and can + also be changed with sysctl commands: fs.file-max=16384 kernel.threads-max=2048 diff --git a/postfix/README_FILES/VIRTUAL_README b/postfix/README_FILES/VIRTUAL_README index 5b47482f7..9ee405dbd 100644 --- a/postfix/README_FILES/VIRTUAL_README +++ b/postfix/README_FILES/VIRTUAL_README @@ -316,14 +316,12 @@ Notes: NEVER list a virtual MAILBOX domain name as a virtual ALIAS domain! * Lines 4, 7-13: The virtual_mailbox_maps parameter specifies the lookup - table with all valid recipient addresses. The lookup result value is - ignored by Postfix. In the above example, info@example.com and - sales@example.com are listed as valid addresses; other mail for example.com - is rejected with "User unknown" by the Postfix SMTP server. It's left up to - the non-Postfix delivery agent to reject non-existent recipients from local - submission or from local alias expansion. If you intend to use LDAP, MySQL - or PgSQL instead of local files, be sure to review the "local files versus - databases" section at the top of this document! + table with all valid recipient addresses. The lookup result is ignored by + Postfix. In the above example, info@example.com and sales@example.com are + listed as valid addresses, and mail for anything else is rejected with + "User unknown". If you intend to use LDAP, MySQL or PgSQL instead of local + files, be sure to review the "local files versus databases" section at the + top of this document! * Line 12: The commented out entry (text after #) shows how one would inform Postfix of the existence of a catch-all address. Again, the lookup result diff --git a/postfix/TODO b/postfix/TODO new file mode 100644 index 000000000..68cb01571 --- /dev/null +++ b/postfix/TODO @@ -0,0 +1,17 @@ +What needs to be done before Postfix 2.4.0 is finished: + +- Update MILTER_README (dkim, application patches). + +- Create RELEASE_NOTES_2.4. + +- Update BACKSCATTER_README with PCRE rules. + +- Truncate wish list from HISTORY. + +- Spell check and double word check the proto files. + +- Parameter hyperlink check and HTML check the html outputs. + +- Replace SPF policy server script by link to SPF website. + +- Remove MacOS X examples. They have not been updated. diff --git a/postfix/auxiliary/MacOSX/Postfix.StartupItem/Postfix b/postfix/auxiliary/MacOSX/Postfix.StartupItem/Postfix new file mode 100755 index 000000000..5c6511426 --- /dev/null +++ b/postfix/auxiliary/MacOSX/Postfix.StartupItem/Postfix @@ -0,0 +1,46 @@ +#!/bin/sh + +# Gerben Wierda, Oct 2001. Adapted from an existing example. I waive every +# copyright on this and I also do not give any warranty. + +# Updated Sepember 29, 2002 +# To work properly, the POSTFIX variable needs to be set to -YES- +# in /etc/hostconfig + +. /etc/rc.common + +if [ "${POSTFIX:=-NO-}" = "-YES-" -a "${MAILSERVER:=-NO-}" = "-YES-" ] +then + ConsoleMessage "Cannot run concurrent postfix and sendmail" + sleep 2 + exit +fi + +## +# Start mail server +## + +if [ "$1" == "start" ] +then + if [ "${POSTFIX:=-NO-}" = "-YES-" ] + then + ConsoleMessage "Starting Postfix mail services" + /usr/sbin/postfix start + fi +elif [ "$1" == "stop" ] +then + ConsoleMessage "Stopping Postfix mail services" + /usr/sbin/postfix stop +elif [ "$1" == "restart" ] +then + if [ "${POSTFIX:=-NO-}" = "-YES-" ] + then + ConsoleMessage "Reloading Postfix configuration" + /usr/sbin/postfix reload + else + ConsoleMessage "Stopping Postfix mail services" + /usr/sbin/postfix stop + fi +fi + + diff --git a/postfix/auxiliary/MacOSX/Postfix.StartupItem/StartupParameters.plist b/postfix/auxiliary/MacOSX/Postfix.StartupItem/StartupParameters.plist new file mode 100644 index 000000000..b41a9a02b --- /dev/null +++ b/postfix/auxiliary/MacOSX/Postfix.StartupItem/StartupParameters.plist @@ -0,0 +1,13 @@ +{ + Description = "Postfix mail server"; + Provides = ("SMTP"); + Requires = ("Resolver"); + Uses = ("Network Time", "NFS"); + Preference = "None"; + Messages = + { + start = "Starting Postfix"; + stop = "Stopping Postfix"; + restart = "Reloading Postfix Configuration"; + }; +} diff --git a/postfix/auxiliary/MacOSX/README-INSTALL.OSX b/postfix/auxiliary/MacOSX/README-INSTALL.OSX new file mode 100644 index 000000000..aa8db9e5a --- /dev/null +++ b/postfix/auxiliary/MacOSX/README-INSTALL.OSX @@ -0,0 +1,74 @@ +# Adapted from an existing example by Gerben Wierda, Oct 2001. I waive every +# copyright on this and I also do not give any warranty. + +Let's start with the important warning: + +DO NOT USE THE MULTIPLE USERS APPLICATION TO CREATE THE POSTFIX USER! + +NOTE: Mac OS X as of version 10.3 comes with Postfix as the standard mailer +and it is supported in Server Admin on Mac OS X 10.3 Server . The instructions +below therefore only apply for Mac OS X 10.2.8. + +NOTE: As of 29 September 2002, these instructions and the scripts have changed +to make the solution more robust for Apple updates. + +Run the commands below in the order that they are presented + +A. INSTALLING POSTFIX for the first time and selecting it as the active + Mail Transfer Agent (MTA): + + # All these commands are written to be run from this directory. + + # This repairs the previous Oct 2001 setup if any + sudo ./repair-oldsetup + + # Prepare for reactivating sendmail + sudo ./backup-sendmail-binaries + + # this creates the necessary users & groups for proper operation + # of postfix: + sudo ./niscript + + # Install postfix: + # When the script asks you for setgid (the default will be no) tell it + # maildrop + (cd ../..; sudo make install) + + # Prepare for reactivating postfix + sudo ./backup-postfix-binaries + + # edit /etc/postfix/main.cf to suit your requirements + ### add your own commands here ### + + # Activate postfix startup at boot time. Deactivates sendmail. + sudo ./activate-postfix + + # Test. Read INSTALL for a series of suggested tests. + +B. DEACTIVATING POSTFIX + + # Deactivate postfix startup at boot time + sudo ./deactivate-postfix + +C. RESTORING Sendmail as the MTA when Postfix is the active MTA + + # This repairs the previous Oct 2001 setup if any + sudo ./repair-oldsetup + + # Deactivate postfix startup at boot time + sudo ./deactivate-postfix + + sudo ./activate-sendmail + + # Restart your computer + +D. RESTORING postfix as the MTA when Sendmail is the active MTA + + # NOTE: The first time you activate postfix you have to follow + # the steps of A. + + # This repairs the previous Oct 2001 setup if any + sudo ./repair-oldsetup + + sudo ./activate-postfix + diff --git a/postfix/auxiliary/MacOSX/activate-postfix b/postfix/auxiliary/MacOSX/activate-postfix new file mode 100755 index 000000000..9d7779e8d --- /dev/null +++ b/postfix/auxiliary/MacOSX/activate-postfix @@ -0,0 +1,43 @@ +#!/bin/sh + +# Written by Gerben Wierda, Oct 2001. I waive every copyright on this and +# I also do not give any warranty. + +. ./defines + +# Activate binaries +if [ ! -e ${POSTFIXBACKUPDIR}/sendmail ] +then + echo "Something is wrong: there is no existing postfix binary backup" + exit 1; +else + echo "Restoring postfix versions of sendmail programs from backup..." + (cd ${POSTFIXBACKUPDIR}; tar cf - sendmail) | (cd /usr/sbin; tar xf -) + (cd ${POSTFIXBACKUPDIR}; tar cf - newaliases) | (cd /usr/bin; tar xf -) + (cd ${POSTFIXBACKUPDIR}; tar cf - mailq) | (cd /usr/bin; tar xf -) +fi + +if [ -e "${PSI}" ] +then + echo "Postfix StartupItem already exists." +else + if [ -e "${PSIDISABLED}" ] + then + echo "Reinstating disabled Postfix StartupItem..." + mv "${PSIDISABLED}" "${PSI}" + else + echo "Installing new default Postfix StartupItem..." + cp -R Postfix.StartupItem "${PSI}" + fi +fi + +# De-activate sendmail in /etc/hostconfig +/usr/bin/perl -pi -e 's/MAILSERVER=-YES-/MAILSERVER=-NO-/g' /etc/hostconfig +# Activate postfix in /etc/hostconfig +if /usr/bin/grep '^POSTFIX=-NO-' /etc/hostconfig >/dev/null 2>&1; then + /usr/bin/perl -pi -e 's/POSTFIX=-NO-/POSTFIX=-YES-/g' /etc/hostconfig +else + echo "POSTFIX=-YES-" >>/etc/hostconfig +fi + +/usr/sbin/postfix start diff --git a/postfix/auxiliary/MacOSX/activate-sendmail b/postfix/auxiliary/MacOSX/activate-sendmail new file mode 100755 index 000000000..72adf94fc --- /dev/null +++ b/postfix/auxiliary/MacOSX/activate-sendmail @@ -0,0 +1,24 @@ +#!/bin/sh + +# Written by Gerben Wierda, Oct 2001. I waive every copyright on this and +# I also do not give any warranty. + +. ./defines + +. ./deactivate-postfix + +# Activate binaries +if [ ! -e ${SENDMAILBACKUPDIR}/sendmail ] +then + echo "Something is wrong: there is no existing sendmail binary backup" + exit 1; +else + echo "Restoring sendmail versions of sendmail programs from backup..." + (cd ${SENDMAILBACKUPDIR}; tar cf - sendmail) | (cd /usr/sbin; tar xf -) + (cd ${SENDMAILBACKUPDIR}; tar cf - newaliases) | (cd /usr/bin; tar xf -) + (cd ${SENDMAILBACKUPDIR}; tar cf - mailq) | (cd /usr/bin; tar xf -) +fi + +# Activate sendmail in /etc/hostconfig +/usr/bin/perl -pi -e 's/MAILSERVER=-NO-/MAILSERVER=-YES-/g' /etc/hostconfig + diff --git a/postfix/auxiliary/MacOSX/backup-postfix-binaries b/postfix/auxiliary/MacOSX/backup-postfix-binaries new file mode 100755 index 000000000..37c2b74c2 --- /dev/null +++ b/postfix/auxiliary/MacOSX/backup-postfix-binaries @@ -0,0 +1,20 @@ +#! /bin/sh + +# Written by Gerben Wierda, Oct 2001. I waive every copyright on this and +# I also do not give any warranty. + +# We use tar, as we do not know beforehand if we are dealing with real +# files or symbolic links. Since we use tar, we cannot change filenames +# we need to create a directory to hold our backup binaries. + +. ./defines + +if [ ! -d ${POSTFIXBACKUPDIR} ] +then + mkdir -p ${POSTFIXBACKUPDIR} +fi + +(cd /usr/sbin; tar cf - sendmail) | (cd ${POSTFIXBACKUPDIR}; tar xf -) +(cd /usr/bin; tar cf - newaliases) | (cd ${POSTFIXBACKUPDIR}; tar xf -) +(cd /usr/bin; tar cf - mailq) | (cd ${POSTFIXBACKUPDIR}; tar xf -) + diff --git a/postfix/auxiliary/MacOSX/backup-sendmail-binaries b/postfix/auxiliary/MacOSX/backup-sendmail-binaries new file mode 100755 index 000000000..ae624f8a2 --- /dev/null +++ b/postfix/auxiliary/MacOSX/backup-sendmail-binaries @@ -0,0 +1,20 @@ +#! /bin/sh + +# Written by Gerben Wierda, Oct 2001. I waive every copyright on this and +# I also do not give any warranty. + +# We use tar, as we do not know beforehand if we are dealing with real +# files or symbolic links. Since we use tar, we cannot change filenames +# we need to create a directory to hold our backup binaries. + +. ./defines + +if [ ! -d ${SENDMAILBACKUPDIR} ] +then + mkdir -p ${SENDMAILBACKUPDIR} +fi + +(cd /usr/sbin; tar cf - sendmail) | (cd ${SENDMAILBACKUPDIR}; tar xf -) +(cd /usr/bin; tar cf - newaliases) | (cd ${SENDMAILBACKUPDIR}; tar xf -) +(cd /usr/bin; tar cf - mailq) | (cd ${SENDMAILBACKUPDIR}; tar xf -) + diff --git a/postfix/auxiliary/MacOSX/deactivate-postfix b/postfix/auxiliary/MacOSX/deactivate-postfix new file mode 100755 index 000000000..8b398b176 --- /dev/null +++ b/postfix/auxiliary/MacOSX/deactivate-postfix @@ -0,0 +1,16 @@ +#!/bin/sh + +# Written by Gerben Wierda, Sep 2002. I waive every copyright on this and +# I also do not give any warranty. + +. ./defines + +if [ -e "${PSI}" ] +then + mv "${PSI}" "${PSIDISABLED}" +fi + +# De-activate postfix in /etc/hostconfig +/usr/bin/perl -pi -e 's/POSTFIX=-YES-/POSTFIX=-NO-/g' /etc/hostconfig + +/usr/sbin/postfix stop >/dev/null 2>&1 diff --git a/postfix/auxiliary/MacOSX/defines b/postfix/auxiliary/MacOSX/defines new file mode 100644 index 000000000..298a547e5 --- /dev/null +++ b/postfix/auxiliary/MacOSX/defines @@ -0,0 +1,12 @@ +#! /bin/sh + +# Written by Gerben Wierda, Oct 2001. I waive every copyright on this and +# I also do not give any warranty. + +SIDIR="/Library/StartupItems" + +PSI="${SIDIR}/Postfix" +PSIDISABLED="${PSI}.disabled" + +POSTFIXBACKUPDIR=/usr/sbin/.postfixbackup +SENDMAILBACKUPDIR=/usr/sbin/.sendmailbackup diff --git a/postfix/auxiliary/MacOSX/niscript b/postfix/auxiliary/MacOSX/niscript new file mode 100755 index 000000000..8031e380e --- /dev/null +++ b/postfix/auxiliary/MacOSX/niscript @@ -0,0 +1,164 @@ +#!/usr/bin/perl + +# niscript.pl by Gerben Wierda + +# This little script is an adaptation of the original niscript sh script by +# Joe Block +# instead of using fixed uid/gid and thus not robust if you run it on a +# system where groups and/or users have been added, this script checks +# if the users/groups are there and if not creates them with free id's. + +# 17 Jul 2002 GW: Fixed two bugs +# 1. Typo in createuser would always have uid 88 for postfix +# 2. Add to netinfo domain . instead of / so that it also works on systems +# where the / domain is actually network-wide (not very useful to add +# a postfix user to all systems in that netinfo domain...) + +print <<_WARNING + +This script massages your netinfo database. This can severely break +your system. If your netinfo database breaks, you get to keep the parts. + +No Warranty. Really. + +This script tries to create two groups (if they do not already exist): +- postfix +- maildrop +and tries to create a user (if it does not already exist) +- postfix +which is member of group postfix. + +_WARNING +; + +# The script starts to look at id 88 (both for user and group) and up to 65535 +# It dies if no free id is found. + +my $postfixgid = undef; +my $maildropgid = undef; +my $postfixuid = undef; + +# First create + +my @groups = readgroups(); +foreach $group (@groups) { + (my $groupname, undef, my $gid, undef) = split( ':', $group); + if ($groupname eq 'postfix') { + warn "You already have a postfix group (with gid $gid)\n"; + $postfixgid = $gid; + } + if ($groupname eq 'maildrop') { + warn "You already have a maildrop group (with gid $gid)\n"; + $maildropgid = $gid; + } +} + +if (not defined $postfixgid) { + $postfixgid = creategroup( 'postfix'); +} + +if (not defined $maildropgid) { + $maildropgid = creategroup( 'maildrop'); +} + +my @users = readusers(); +foreach $user (@users) { + (my $username, undef, my $uid, undef) = split( ':', $user); + if ($username eq 'postfix') { + warn "You already have a postfix user (with uid $uid)\n"; + $postfixuid = $uid; + } +} + +if (not defined $postfixuid) { + $postfixuid = createuser( 'postfix', '"Postfix User"', + '/usr/bin/false', '/etc/postfix', + $postfixgid); + addusertogroup( 'postfix', 'postfix'); +} + +warn "\n"; + +sub creategroup +{ + my $name = shift; + open( NIDUMP, "nidump group .|") or die "Cannot run nidump\n"; + my @groups=; + close( NIDUMP); + + my $tryno; + NEXTNO: for ($tryno = 88; $tryno <= 65535; $tryno++) { + foreach my $group (@groups) { + (my $groupname, undef, my $gid, undef) = + split( ':', $group); + next NEXTNO if $gid == $tryno; + } + last NEXTNO; + } + die "Cannot find free gid\n" if $tryno == 65536; + warn "Will create $name as gid $tryno\n"; + system "niutil -create . /groups/$name"; + system "niutil -createprop . /groups/$name name $name"; + system "niutil -createprop . /groups/$name gid $tryno"; + system "niutil -createprop . /groups/$name passwd '*'"; + return $tryno; +} + +sub addusertogroup +{ + my $user = shift; + my $group = shift; + system "niutil -appendprop . /groups/$group users $user"; +} + +sub readgroups +{ + open( NIDUMP, "nidump group .|") or die "Cannot run nidump\n"; + my @groups=; + close( NIDUMP); + return @groups; +} + +sub readusers +{ + my @passwd; + open( NIDUMP, "nidump passwd .|") or die "Cannot run nidump\n"; + @passwd=; + close( NIDUMP); + return @passwd; +} + +sub createuser +{ + my $name = shift; + my $realname = shift; + my $shell = shift; + my $home = shift; + my $gid = shift; + + open( NIDUMP, "nidump passwd .|") or die "Cannot run nidump\n"; + my @passwds=; + close( NIDUMP); + + my $tryno; + NEXTNO: for ($tryno = 88; $tryno <= 65535; $tryno++) { + foreach my $passwd (@passwds) { + (my $passwdname, undef, my $uid, undef) = + split( ':', $passwd); + next NEXTNO if $uid == $tryno; + } + last NEXTNO; + } + die "Cannot find free uid\n" if $tryno == 65536; + warn "Will create $name as uid $tryno\n"; + system "niutil -create . /users/$name"; + system "niutil -createprop . /users/$name realname $realname"; + system "niutil -createprop . /users/$name shell $shell"; + system "niutil -createprop . /users/$name uid $tryno"; + system "niutil -createprop . /users/$name gid $gid"; + system "niutil -createprop . /users/$name home $home"; + system "niutil -createprop . /users/$name _shadow_passwd"; + system "niutil -createprop . /users/$name passwd '*'"; + return $tryno; +} + diff --git a/postfix/auxiliary/MacOSX/repair-oldsetup b/postfix/auxiliary/MacOSX/repair-oldsetup new file mode 100755 index 000000000..a8e1840c8 --- /dev/null +++ b/postfix/auxiliary/MacOSX/repair-oldsetup @@ -0,0 +1,8 @@ +#!/bin/sh + +if [ -d /System/Library/DisabledStartupItems/Sendmail ] +then + mv /System/Library/DisabledStartupItems/Sendmail /System/Library/StartupItems + rmdir /System/Library/DisabledStartupItems/Sendmail + rm -rf /System/Library/StartupItems/Postfix +fi diff --git a/postfix/auxiliary/qshape/qshape.pl b/postfix/auxiliary/qshape/qshape.pl index 243df445a..67d378984 100644 --- a/postfix/auxiliary/qshape/qshape.pl +++ b/postfix/auxiliary/qshape/qshape.pl @@ -13,7 +13,6 @@ # \fBqshape\fR [\fB-s\fR] [\fB-p\fR] [\fB-m \fImin_subdomains\fR] # [\fB-b \fIbucket_count\fR] [\fB-t \fIbucket_time\fR] # [\fB-l\fR] [\fB-w \fIterminal_width\fR] -# [\fB-N \fIbatch_msg_count\fR] [\fB-n \fIbatch_top_domains\fR] # [\fB-c \fIconfig_directory\fR] [\fIqueue_name\fR ...] # DESCRIPTION # The \fBqshape\fR program helps the administrator understand the @@ -64,15 +63,6 @@ # parent domain rows are shown as '.+' followed by the last 16 bytes # of the domain name. If this is still too narrow to show the domain # name and all the counters, the terminal_width limit is violated. -# .IP "\fB-N \fIbatch_msg_count\fR" -# When the output device is a terminal, intermediate results are -# shown each "batch_msg_count" messages. This produces usable results -# in a reasonable time even when the deferred queue is large. The -# default is to show intermediate results every 1000 messages. -# .IP "\fB-n \fIbatch_top_domains\fR" -# When reporting intermediate or final results to a termainal, report -# only the top "batch_top_domains" domains. The default limit is 20 -# domains. # .IP "\fB-c \fIconfig_directory\fR" # The \fBmain.cf\fR configuration file is in the named directory # instead of the default configuration directory. @@ -114,9 +104,6 @@ use IO::File; use File::Find; use Getopt::Std; -my $cls; # Clear screen escape sequence -my $batch_msg_count; # Interim result frequency -my $batch_top_domains; # Interim result count my %opts; # Command line switches my %q; # domain counts for queues and buckets my %sub; # subdomain counts for parent domains @@ -133,7 +120,6 @@ do { warn "$0: $_[0]" unless exists($opts{"h"}); die "Usage: $0 [ -s ] [ -p ] [ -m ] [ -l ]\n". "\t[ -b ] [ -t ] [ -w ]\n". - "\t[ -N ] [ -n ]\n". "\t[ -c ] [ ... ]\n". "The 's' option shows sender domain counts.\n". "The 'p' option shows address counts by for parent domains.\n". @@ -156,7 +142,7 @@ do { "not supported. If necessary, use explicit absolute paths for all queues.\n"; }; - getopts("lhc:psw:b:t:m:n:N:", \%opts); + getopts("lhc:psw:b:t:m:", \%opts); warn "Help message" if (exists $opts{"h"}); @qlist = @ARGV if (@ARGV > 0); @@ -183,16 +169,6 @@ $bnum = $opts{"b"} if (exists $opts{"b"} && $opts{"b"} > 0); $tick = $opts{"t"} if (exists $opts{"t"} && $opts{"t"} > 0); $minsub = $opts{"m"} if (exists $opts{"m"} && $opts{"m"} > 0); -if ( -t STDOUT ) { - $batch_msg_count = 1000 unless defined($batch_msg_count = $opts{"N"}); - $batch_top_domains = 20 unless defined ($batch_top_domains = $opts{"n"}); - $cls = `clear`; -} else { - $batch_msg_count = 0; - $batch_top_domains = 0; - $cls = ""; -} - sub rec_get { my ($h) = @_; my $r = getc($h) || return; @@ -287,7 +263,6 @@ sub bucket { # Collate by age of message in the selected queues. # -my $msgs; sub wanted { if (my ($t, $s, @r) = qenv($_)) { my $b = bucket($t, $now); @@ -306,15 +281,26 @@ sub wanted { $new = ! $old; } while ($opts{"p"} && $a =~ s/^(?:\.)?[^.]+\.(.*\.)/.$1/); } - if ($batch_msg_count > 0 && ++$msgs % $batch_msg_count == 0) { - results(); - } } } +find(\&wanted, @qlist); my @heads; -my $fmt; -my $dw; +my $fmt = ""; +my $dw = $width; + +for (my $i = 0, my $t = 0; $i <= $bnum; ) { + $q{"TOTAL"}->[$i] ||= 0; + my $l = length($q{"TOTAL"}->[$i]); + my $h = ($i == 0) ? "T" : $t; + $l = length($h) if (length($h) >= $l); + $l = ($l > 2) ? $l + 1 : 3; + push(@heads, $h); + $fmt .= sprintf "%%%ds", $l; + $dw -= $l; + if (++$i < $bnum) { $t += ($t && !$opts{"l"}) ? $t : $tick; } else { $t = "$t+"; } +} +$dw = $dwidth if ($dw < $dwidth); sub pdomain { my ($d, @count) = @_; @@ -332,45 +318,18 @@ sub pdomain { printf "$fmt\n", @count; } -sub results { - @heads = (); - $dw = $width; - $fmt = ""; - for (my $i = 0, my $t = 0; $i <= $bnum; ) { - $q{"TOTAL"}->[$i] ||= 0; - my $l = length($q{"TOTAL"}->[$i]); - my $h = ($i == 0) ? "T" : $t; - $l = length($h) if (length($h) >= $l); - $l = ($l > 2) ? $l + 1 : 3; - push(@heads, $h); - $fmt .= sprintf "%%%ds", $l; - $dw -= $l; - if (++$i < $bnum) { $t += ($t && !$opts{"l"}) ? $t : $tick; } else { $t = "$t+"; } - } - $dw = $dwidth if ($dw < $dwidth); - - print $cls if ($batch_msg_count > 0); - - # Print headings - # - pdomain("", @heads); +# Print headings +# +pdomain("", @heads); - my $n = 0; +# Show per-domain totals +# +foreach my $d (sort { $q{$b}->[0] <=> $q{$a}->[0] || + length($a) <=> length($b) } keys %q) { - # Show per-domain totals + # Skip parent domains with < $minsub subdomains. # - foreach my $d (sort { $q{$b}->[0] <=> $q{$a}->[0] || - length($a) <=> length($b) } keys %q) { - - # Skip parent domains with < $minsub subdomains. - # - next if ($d =~ /^\./ && $sub{$d} < $minsub); + next if ($d =~ /^\./ && $sub{$d} < $minsub); - last if ($batch_top_domains > 0 && ++$n > $batch_top_domains); - - pdomain($d, @{$q{$d}}); - } + pdomain($d, @{$q{$d}}); } - -find(\&wanted, @qlist); -results(); diff --git a/postfix/conf/access b/postfix/conf/access index cda6ec84c..633f4d03b 100644 --- a/postfix/conf/access +++ b/postfix/conf/access @@ -1,7 +1,7 @@ # ACCESS(5) ACCESS(5) # # NAME -# access - Postfix SMTP server access table +# access - Postfix access table format # # SYNOPSIS # postmap /etc/postfix/access @@ -11,35 +11,36 @@ # postmap -q - /etc/postfix/access as the lookup key for such addresses. The value is -# specified with the smtpd_null_access_lookup_key parameter +# Note: lookup of the null sender address is not possible +# with some types of lookup table. By default, Postfix uses +# <> as the lookup key for such addresses. The value is +# specified with the smtpd_null_access_lookup_key parameter # in the Postfix main.cf file. # # EMAIL ADDRESS EXTENSION # When a mail address localpart contains the optional recip- -# ient delimiter (e.g., user+foo@domain), the lookup order -# becomes: user+foo@domain, user@domain, domain, user+foo@, +# ient delimiter (e.g., user+foo@domain), the lookup order +# becomes: user+foo@domain, user@domain, domain, user+foo@, # and user@. # # HOST NAME/ADDRESS PATTERNS # With lookups from indexed files such as DB or DBM, or from -# networked tables such as NIS, LDAP or SQL, the following +# networked tables such as NIS, LDAP or SQL, the following # lookup patterns are examined in the order as listed: # # domain.tld @@ -104,9 +105,9 @@ # # The pattern domain.tld also matches subdomains, but # only when the string smtpd_access_maps is listed in -# the Postfix parent_domain_matches_subdomains con- +# the Postfix parent_domain_matches_subdomains con- # figuration setting. Otherwise, specify .domain.tld -# (note the initial dot) in order to match subdo- +# (note the initial dot) in order to match subdo- # mains. # # net.work.addr.ess @@ -115,21 +116,21 @@ # # net.work # -# net Matches the specified IPv4 host address or subnet- -# work. An IPv4 host address is a sequence of four +# net Matches the specified IPv4 host address or subnet- +# work. An IPv4 host address is a sequence of four # decimal octets separated by ".". # -# Subnetworks are matched by repeatedly truncating +# Subnetworks are matched by repeatedly truncating # the last ".octet" from the remote IPv4 host address -# string until a match is found in the access table, +# string until a match is found in the access table, # or until further truncation is not possible. # -# NOTE 1: The access map lookup key must be in canon- -# ical form: do not specify unnecessary null charac- -# ters, and do not enclose network address informa- -# tion with "[]" characters. +# NOTE 1: The information in the access map should be +# in canonical form, with unnecessary null characters +# eliminated. Address information must not be +# enclosed with "[]" characters. # -# NOTE 2: use the cidr lookup table type to specify +# NOTE 2: use the cidr lookup table type to specify # network/netmask patterns. See cidr_table(5) for # details. # @@ -139,12 +140,12 @@ # # net:work # -# net Matches the specified IPv6 host address or subnet- -# work. An IPv6 host address is a sequence of three -# to eight hexadecimal octet pairs separated by ":". +# net Matches the specified IPv6 host address or subnet- +# work. An IPv6 host address is a sequence of three +# to eight hexadecimal octet pairs separated by ":". # -# Subnetworks are matched by repeatedly truncating -# the last ":octetpair" from the remote IPv6 host +# Subnetworks are matched by repeatedly truncating +# the last ":octetpair" from the remote IPv6 host # address string until a match is found in the access # table, or until further truncation is not possible. # @@ -152,12 +153,12 @@ # the string representation of the IPv6 host address. # Thus, not all the ":" subnetworks will be tried. # -# NOTE 2: The access map lookup key must be in canon- -# ical form: do not specify unnecessary null charac- -# ters, and do not enclose network address informa- -# tion with "[]" characters. +# NOTE 2: The information in the access map should be +# in canonical form, with unnecessary null characters +# eliminated. Address information must not be +# enclosed with "[]" characters. # -# NOTE 3: use the cidr lookup table type to specify +# NOTE 3: use the cidr lookup table type to specify # network/netmask patterns. See cidr_table(5) for # details. # @@ -168,49 +169,48 @@ # # all-numerical # An all-numerical result is treated as OK. This for- -# mat is generated by address-based relay authoriza- +# mat is generated by address-based relay authoriza- # tion schemes such as pop-before-smtp. # # REJECT ACTIONS -# Postfix version 2.3 and later support enhanced status -# codes as defined in RFC 3463. When no code is specified -# at the beginning of the text below, Postfix inserts a -# default enhanced status code of "5.7.1" in the case of -# reject actions, and "4.7.1" in the case of defer actions. +# Postfix version 2.3 and later support enhanced status +# codes as defined in RFC 3463. When no code is specified +# at the beginning of the text below, Postfix inserts a +# default enhanced status code of "5.7.1" in the case of +# reject actions, and "4.7.1" in the case of defer actions. # See "ENHANCED STATUS CODES" below. # # 4NN text # # 5NN text -# Reject the address etc. that matches the pattern, +# Reject the address etc. that matches the pattern, # and respond with the numerical three-digit code and -# text. 4NN means "try again later", while 5NN means +# text. 4NN means "try again later", while 5NN means # "do not try again". # -# The reply code "421" causes Postfix to disconnect +# The reply code "421" causes Postfix to disconnect # immediately (Postfix version 2.3 and later). # # REJECT optional text... -# Reject the address etc. that matches the pattern. -# Reply with $reject_code optional text... when the -# optional text is specified, otherwise reply with a +# Reject the address etc. that matches the pattern. +# Reply with $reject_code optional text... when the +# optional text is specified, otherwise reply with a # generic error response message. # # DEFER_IF_REJECT optional text... -# Defer the request if some later restriction would -# result in a REJECT action. Reply with "450 4.7.1 -# optional text... when the optional text is speci- -# fied, otherwise reply with a generic error response -# message. +# Defer the request if some later restriction would +# result in a REJECT action. Reply with "450 optional +# text... when the optional text is specified, other- +# wise reply with a generic error response message. # # This feature is available in Postfix 2.1 and later. # # DEFER_IF_PERMIT optional text... # Defer the request if some later restriction would # result in a an explicit or implicit PERMIT action. -# Reply with "450 4.7.1 optional text... when the -# optional text is specified, otherwise reply with a -# generic error response message. +# Reply with "450 optional text... when the optional +# text is specified, otherwise reply with a generic +# error response message. # # This feature is available in Postfix 2.1 and later. # @@ -247,9 +247,9 @@ # about external content filters is in the Postfix # FILTER_README file. # -# Note: this action overrides the content_filter set- -# ting, and currently affects all recipients of the -# message. +# Note: this action overrides the main.cf con- +# tent_filter setting, and currently affects all +# recipients of the message. # # This feature is available in Postfix 2.0 and later. # @@ -266,23 +266,25 @@ # Note: use "postsuper -r" to release mail that was # kept on hold for a significant fraction of $maxi- # mal_queue_lifetime or $bounce_queue_lifetime, or -# longer. Use "postsuper -H" only for mail that will -# not expire within a few delivery attempts. +# longer. # -# Note: this action currently affects all recipients +# Note: this action currently affects all recipients # of the message. # # This feature is available in Postfix 2.0 and later. # # PREPEND headername: headervalue -# Prepend the specified message header to the mes- -# sage. When more than one PREPEND action executes, -# the first prepended header appears before the sec- -# ond etc. prepended header. +# Prepend the specified message header to the mes- +# sage. When this action is used multiple times, the +# first prepended header appears before the second +# etc. prepended header. +# +# Note: this action does not support multi-line mes- +# sage headers. # -# Note: this action must execute before the message -# content is received; it cannot execute in the con- -# text of smtpd_end_of_data_restrictions. +# Note: this action must be used before the message +# content is received; it cannot be used in +# smtpd_end_of_data_restrictions. # # This feature is available in Postfix 2.1 and later. # @@ -353,7 +355,7 @@ # lookups are directed to a TCP-based server. For a descrip- # tion of the TCP client/server lookup protocol, see tcp_ta- # ble(5). This feature is not available up to and including -# Postfix version 2.4. +# Postfix version 2.3. # # Each lookup operation uses the entire query string once. # Depending on the application, that string is an entire diff --git a/postfix/conf/aliases b/postfix/conf/aliases index 8a19f8e5a..32d3f9797 100644 --- a/postfix/conf/aliases +++ b/postfix/conf/aliases @@ -114,8 +114,8 @@ decode: root # When the command fails, a limited amount of command # output is mailed back to the sender. The file # /usr/include/sysexits.h defines the expected exit -# status codes. For example, use "|exit 67" to simu- -# late a "user unknown" error, and "|exit 0" to +# status codes. For example, use |"exit 67" to simu- +# late a "user unknown" error, and |"exit 0" to # implement an expensive black hole. # # :include:/file/name diff --git a/postfix/conf/canonical b/postfix/conf/canonical index fc0c3ee6a..1dc739589 100644 --- a/postfix/conf/canonical +++ b/postfix/conf/canonical @@ -20,8 +20,8 @@ # file that serves as input to the postmap(1) command. The # result, an indexed file in dbm or db format, is used for # fast searching by the mail system. Execute the command -# "postmap /etc/postfix/canonical" to rebuild an indexed -# file after changing the corresponding text file. +# "postmap /etc/postfix/canonical" in order to rebuild the +# indexed file after changing the text file. # # When the table is provided via other means such as NIS, # LDAP or SQL, the same lookups are done as for ordinary @@ -30,9 +30,9 @@ # Alternatively, the table can be provided as a regular- # expression map where patterns are given as regular expres- # sions, or lookups can be directed to TCP-based server. In -# those cases, the lookups are done in a slightly different +# that case, the lookups are done in a slightly different # way as described below under "REGULAR EXPRESSION TABLES" -# or "TCP-BASED TABLES". +# and "TCP-BASED TABLES". # # By default the canonical(5) mapping affects both message # header addresses (i.e. addresses that appear inside mes- @@ -53,9 +53,11 @@ # addresses produced by legacy mail systems. # # The canonical(5) mapping is not to be confused with vir- -# tual alias support or with local aliasing. To change the -# destination but not the headers, use the virtual(5) or -# aliases(5) map instead. +# tual domain support. Use the virtual(5) map for that pur- +# pose. +# +# The canonical(5) mapping is not to be confused with local +# aliasing. Use the aliases(5) map for that purpose. # # CASE FOLDING # The search string is folded to lowercase before database @@ -107,13 +109,6 @@ # Replace other addresses in domain by address. This # form has the lowest precedence. # -# Note: @domain is a wild-card. When this form is -# applied to recipient addresses, the Postfix SMTP -# server accepts mail for any recipient in domain, -# regardless of whether that recipient exists. This -# may turn your mail system into a backscatter source -# that returns undeliverable spam to innocent people. -# # RESULT ADDRESS REWRITING # The lookup result is subject to address rewriting: # @@ -161,7 +156,7 @@ # lookups are directed to a TCP-based server. For a descrip- # tion of the TCP client/server lookup protocol, see tcp_ta- # ble(5). This feature is not available up to and including -# Postfix version 2.4. +# Postfix version 2.3. # # Each lookup operation uses the entire address once. Thus, # user@domain mail addresses are not broken up into their diff --git a/postfix/conf/generic b/postfix/conf/generic index f5e5a10e9..232e7b058 100644 --- a/postfix/conf/generic +++ b/postfix/conf/generic @@ -33,8 +33,8 @@ # that serves as input to the postmap(1) command. The # result, an indexed file in dbm or db format, is used for # fast searching by the mail system. Execute the command -# "postmap /etc/postfix/generic" to rebuild an indexed file -# after changing the corresponding text file. +# "postmap /etc/postfix/generic" in order to rebuild the +# indexed file after changing the text file. # # When the table is provided via other means such as NIS, # LDAP or SQL, the same lookups are done as for ordinary @@ -43,9 +43,9 @@ # Alternatively, the table can be provided as a regular- # expression map where patterns are given as regular expres- # sions, or lookups can be directed to TCP-based server. In -# those case, the lookups are done in a slightly different +# that case, the lookups are done in a slightly different # way as described below under "REGULAR EXPRESSION TABLES" -# or "TCP-BASED TABLES". +# and "TCP-BASED TABLES". # # CASE FOLDING # The search string is folded to lowercase before database @@ -136,7 +136,7 @@ # lookups are directed to a TCP-based server. For a descrip- # tion of the TCP client/server lookup protocol, see tcp_ta- # ble(5). This feature is not available up to and including -# Postfix version 2.4. +# Postfix version 2.3. # # Each lookup operation uses the entire address once. Thus, # user@domain mail addresses are not broken up into their diff --git a/postfix/conf/header_checks b/postfix/conf/header_checks index 4b03b9093..238599ffd 100644 --- a/postfix/conf/header_checks +++ b/postfix/conf/header_checks @@ -1,7 +1,7 @@ # HEADER_CHECKS(5) HEADER_CHECKS(5) # # NAME -# header_checks - Postfix built-in content inspection +# header_checks - Postfix built-in header/body inspection # # SYNOPSIS # header_checks = pcre:/etc/postfix/header_checks @@ -9,53 +9,48 @@ # nested_header_checks = pcre:/etc/postfix/nested_header_checks # body_checks = pcre:/etc/postfix/body_checks # -# postmap -q "string" pcre:/etc/postfix/filename -# postmap -q - pcre:/etc/postfix/filename "fatal_exit: @_"); + syslog(warning => "fatal_exit: @_"); + syslog(info => "fatal_exit: @_"); + die "fatal: @_"; +} + +# +# Unbuffer standard output. +# +select((select(STDOUT), $| = 1)[0]); + +# +# This process runs as a daemon, so it can't log to a terminal. Use +# syslog so that people can actually see our messages. +# +setlogsock $syslog_socktype; +openlog $syslog_ident, $syslog_options, $syslog_facility; + +# ---------------------------------------------------------- +# main +# ---------------------------------------------------------- + +# +# Receive a bunch of attributes, evaluate the policy, send the result. +# +my %attr; +while () { + chomp; + if (/=/) { my ($k, $v) = split (/=/, $_, 2); $attr{$k} = $v; next } + elsif (length) { syslog(warning => sprintf("warning: ignoring garbage: %.100s", $_)); next; } + + if ($VERBOSE) { + for (sort keys %attr) { + syslog(debug => "Attribute: %s=%s", $_, $attr{$_}); + } + } + + fatal_exit ("unrecognized request type: '$attr{request}'") unless $attr{request} eq "smtpd_access_policy"; + + my $action = $DEFAULT_RESPONSE; + my %responses; + foreach my $handler (@HANDLERS) { + no strict 'refs'; + my $response = $handler->(attr=>\%attr); + syslog(debug => "handler %s: %s", $handler, $response); + if ($response and $response !~ /^dunno/i) { + syslog(info => "handler %s: %s is decisive.", $handler, $response); + $action = $response; last; + } + } + + syslog(info => "decided action=%s", $action); + + print STDOUT "action=$action\n\n"; + %attr = (); +} + +# ---------------------------------------------------------- +# plugin: SPF +# ---------------------------------------------------------- +sub sender_permitted_from { + local %_ = @_; + my %attr = %{ $_{attr} }; + + my $query = eval { new Mail::SPF::Query (ip =>$attr{client_address}, + sender=>$attr{sender}, + helo =>$attr{helo_name}) }; + if ($@) { + syslog(info => "%s: Mail::SPF::Query->new(%s, %s, %s) failed: %s", + $attr{queue_id}, $attr{client_address}, $attr{sender}, $attr{helo_name}, $@); + return "DUNNO"; + } + my ($result, $smtp_comment, $header_comment) = $query->result(); + + syslog(info => "%s: SPF %s: smtp_comment=%s, header_comment=%s", + $attr{queue_id}, $result, $smtp_comment, $header_comment); + + if ($result eq "fail") { return "REJECT $smtp_comment"; } + elsif ($result eq "error") { return "DEFER_IF_PERMIT $smtp_comment"; } + else { return "PREPEND Received-SPF: $result ($header_comment)"; } +} + +# ---------------------------------------------------------- +# plugin: testing +# ---------------------------------------------------------- +sub testing { + local %_ = @_; + my %attr = %{ $_{attr} }; + + if (lc address_stripped($attr{sender}) eq + lc address_stripped($attr{recipient}) + and + $attr{recipient} =~ /policyblock/) { + + syslog(info => "%s: testing: will block as requested", $attr{queue_id}); + return "REJECT smtpd-policy blocking $attr{recipient}"; + } + else { + syslog(info => "%s: testing: stripped sender=%s, stripped rcpt=%s", + $attr{queue_id}, + address_stripped($attr{sender}), + address_stripped($attr{recipient}), + ); + + } + return "DUNNO"; +} + +sub address_stripped { + # my $foo = localpart_lhs('foo+bar@baz.com'); # returns 'foo@baz.com' + my $string = shift; + for ($string) { + s/[+-].*\@/\@/; + } + return $string; +} diff --git a/postfix/html/ADDRESS_CLASS_README.html b/postfix/html/ADDRESS_CLASS_README.html index 92ee9f0f8..4c5b9973d 100644 --- a/postfix/html/ADDRESS_CLASS_README.html +++ b/postfix/html/ADDRESS_CLASS_README.html @@ -53,11 +53,9 @@ address classes are very important for the operation of Postfix.

  • The list of domains that are a member of the class: for example, all local domains, or all relay domains.

    -

  • The default delivery transport. For example, the local, -virtual or relay delivery transport (delivery transports are defined -in master.cf). This helps to keep Postfix configurations simple, -by avoiding the need for explicit routing information in transport -maps.

    +

  • The default delivery method. For example, the local or +smtp delivery agent. This helps to keep Postfix configurations +simple.

  • The list of valid recipient addresses for that address class. The Postfix SMTP server rejects invalid recipients with @@ -97,7 +95,7 @@ empty, then the Postfix SMTP server accepts any address in the local domain class.

  • The mail delivery transport is specified with the -local_transport parameter. The default value is local:$myhostname +local_transport parameter. The default value is local:$myhostname for delivery with the local(8) delivery agent.

    @@ -267,7 +265,7 @@ default. The Postfix SMTP server uses this to reject mail for unknown local recipients. See the LOCAL_RECIPIENT_README file hints and tips.

    -

  • Introduction of the relay delivery transport in master.cf. +

  • Introduction of the relay delivery transport in master.cf. This helps to avoid mail delivery scheduling problems on inbound mail relays when there is a lot of outbound mail, but may require that you update your "defer_transports" setting.

    diff --git a/postfix/html/ADDRESS_VERIFICATION_README.html b/postfix/html/ADDRESS_VERIFICATION_README.html index ce38c1534..7f6ab85ca 100644 --- a/postfix/html/ADDRESS_VERIFICATION_README.html +++ b/postfix/html/ADDRESS_VERIFICATION_README.html @@ -21,8 +21,7 @@

    The sender/recipient address verification feature described in this document is suitable only for low-traffic sites. It performs poorly -under high load; excessive sender address verification activity may -even cause your site to be blacklisted by some +under high load and may cause your site to be blacklisted by some providers. See the "Limitations" section below for details.

    @@ -229,10 +228,7 @@ MAILER-DAEMON messages.

    Recipient address verification is relatively straightforward and there are no surprises. If a recipient probe fails, then Postfix rejects mail for the recipient address. If a recipient probe -succeeds, then Postfix accepts mail for the recipient address. -However, recipient address verification probes can increase the -load on down-stream MTAs when you're being flooded by backscatter -bounces, or when some spammer is mounting a dictionary attack.

    +succeeds, then Postfix accepts mail for the recipient address.

    By default, address verification results are not saved. To avoid probing the same address repeatedly, you can store the result in a diff --git a/postfix/html/CONNECTION_CACHE_README.html b/postfix/html/CONNECTION_CACHE_README.html index dd1a28bb2..2c741ced4 100644 --- a/postfix/html/CONNECTION_CACHE_README.html +++ b/postfix/html/CONNECTION_CACHE_README.html @@ -92,41 +92,28 @@ by the mail delivering process that creates the connection. To get the same performance improvement as with a shared connection cache, non-shared connections need to be kept open for a longer time.

    -

    The scache(8) server, introduced with Postfix version 2.2, -maintains the shared connection cache. With Postfix version 2.2, -only the smtp(8) client has support to access this cache.

    -
    - - - - - - - - - - - - + +
    /-- smtp(8) ---> Internet
    qmgr(8)   |
    |
    |
    |
    v    		  
    \-- smtp(8) ---> Internet
    ^
    |    		  
    scache(8)
    Internet <-- +
    smtp(8)
          		<->
    scache(8)
          		<-> +
    smtp(8)
          		--> Internet
    +

    The scache(8) server, introduced with Postfix version 2.2, +maintains the shared connection cache. With Postfix version 2.2, +only the smtp(8) client has support to access this cache.

    +

    When SMTP connection caching is enabled (see next section), the smtp(8) client does not disconnect after a mail transaction, but gives the connection to the scache(8) server which keeps the -connection open for a limited amount of time.

    +connection open for a limited amount of time.

    After handing over the open connection to the scache(8) server, the smtp(8) client continues with some other mail delivery request. @@ -157,7 +144,7 @@ destination has a high volume of mail in the main.cf: +/etc/postfix/main.cf: smtp_connection_cache_on_demand = yes @@ -180,7 +167,7 @@ right-hand side of an email address, without the [] around a numeric IP address),

  • if mail is sent via a relay host: a relay host name (without -the [] or non-default TCP port), as specified in main.cf or in the +the [] or non-default TCP port), as specified in main.cf or in the transport map,

  • a /file/name with domain names and/or relay host names as @@ -197,7 +184,7 @@ lookups is ignored. 

    -/etc/postfix/main.cf:
+/etc/postfix/main.cf:
     smtp_connection_cache_destinations = $relayhost
     smtp_connection_cache_destinations = hotmail.com, ...
     smtp_connection_cache_destinations = static:all (not recommended)
diff --git a/postfix/html/CYRUS_README.html b/postfix/html/CYRUS_README.html
new file mode 100644
index 000000000..30ad5bdca
--- /dev/null
+++ b/postfix/html/CYRUS_README.html
@@ -0,0 +1,24 @@
+
+
+
+
+
+
+Postfix Cyrus Howto
+
+
+
+
+
+
+
+
    Postfix Cyrus Howto
    
+
+
    
+
+
     This document will be made available via http://www.postfix.org/. 
    
+
+
+
+
diff --git a/postfix/html/DATABASE_README.html b/postfix/html/DATABASE_README.html
index 3ab4fa44e..84838b569 100644
--- a/postfix/html/DATABASE_README.html
+++ b/postfix/html/DATABASE_README.html
@@ -54,7 +54,7 @@ documentation: 
    
 
 
    
 
    -/etc/postfix/main.cf:
+/etc/postfix/main.cf:
     alias_maps = hash:/etc/postfix/aliases            (local aliasing)
     header_checks = regexp:/etc/postfix/header_checks (content filtering)
     transport_maps = hash:/etc/postfix/transport      (routing table)
@@ -80,8 +80,7 @@ below.
 
 
  •  You can use Berkeley DB files with fixed lookup strings for
 simple address rewriting operations and you can use regular expression
-tables for the more complicated work. In other words, you don't
-have to put everything into the same table.
+tables for the more complicated work.
 
 
 
@@ -190,9 +189,8 @@ because something else happens.  This is because commands such as
 postmap(1) or postalias(1) overwrite existing files. If the update
 fails in the middle then you have no usable database, and Postfix
 will stop working. This is not an issue with the CDB database type
-available with Postfix 2.2 and later: CDB
-creates a new file, and renames the file upon successful completion.
-
    
+available with Postfix 2.2 and later, because CDB
+database rebuilds are atomic. 
    
 
 
     With multi-file databases such as DBM, there is no simple
 solution. With Berkeley DB and other "one file" databases, it is
@@ -366,7 +364,7 @@ described in tcp_table(5). The lookup table name
 where "host" specifies a symbolic hostname or a numeric IP address,
 and "port" specifies a symbolic service name or a numeric port
 number. This protocol is not available up to and including Postfix
-version 2.4.  
+version 2.2.  
 
 
     unix (read-only) 
    
 
diff --git a/postfix/html/DB_README.html b/postfix/html/DB_README.html
index 421c7e7d3..d89fd5028 100644
--- a/postfix/html/DB_README.html
+++ b/postfix/html/DB_README.html
@@ -49,17 +49,15 @@ versions.  
    
 
    Building Postfix on systems without Berkeley
 DB
    
 
-
     Some UNIXes ship without Berkeley DB support; for historical
-reasons these use DBM files instead. A problem with DBM files is
-that they can store only limited amounts of data. To build Postfix
-with
+
     Many commercial UNIXes ship without Berkeley DB support. Examples
+are Solaris, HP-UX, IRIX, UNIXWARE. In order to build Postfix with
 Berkeley DB support you need to download and install the source
-code from http://www.oracle.com/database/berkeley-db/. 
    
+code from http://www.sleepycat.com/ 
    
 
 
     Warning: some Linux system libraries use Berkeley DB, as do
 some third-party libraries such as SASL. If you compile Postfix
 with a different Berkeley DB implementation, then every Postfix
-program will dump core because either the system library, the SASL
+program will dump core because either the system library, SASL
 library, or Postfix itself ends up using the wrong version. 
    
 
 
    The more recent Berkeley DB versions have a compile-time switch,
@@ -69,7 +67,7 @@ Although wasteful, this may be the only way to keep things from
 falling apart. 
    
 
 
     To build Postfix after you installed the Berkeley DB from
-source code, use something like: 
    
+http://www.sleepycat.com/, use something like: 
    
 
 
    
 
    @@ -216,8 +214,7 @@ undefined reference to `pthread_mutex_trylock'
 
    
 
    
 
-
     More information is available at
-http://www.oracle.com/database/berkeley-db/. 
    
+
     More information is available at http://www.sleepycat.com/. 
    
 
 
 
diff --git a/postfix/html/DEBUG_README.html b/postfix/html/DEBUG_README.html
index fd648c484..0f785d55b 100644
--- a/postfix/html/DEBUG_README.html
+++ b/postfix/html/DEBUG_README.html
@@ -100,9 +100,8 @@ is fixed. 
    
 permissions, incorrect configuration file settings that you can
 fix.  Postfix cannot proceed until this is fixed. 
    
 
-
  •  
     "error" reports an error condition. For safety
-reasons, a Postfix process will terminate when more than 13 of these
-happen. 
    
+
  •  
     "error" reports a fatal or non-fatal error condition.
+Postfix cannot proceed until this is fixed.  
    
 
 
  •  
     "warning" indicates a non-fatal error. These are
 problems that you may not be able to fix (such as a broken DNS
@@ -146,7 +145,7 @@ Mail Delivery Status Report will be mailed to <your login name>.
 
 
 
     These reports contain information that is generated by Postfix
-delivery agents. Since these run as daemon processes that cannot
+delivery agents. Since these run as daemon processes and do not
 interact with users directly, the result is sent as mail to the
 sender of the test message. The format of these reports is practically
 identical to that of ordinary non-delivery notifications. 
    
@@ -210,21 +209,18 @@ command "postfix reload". 
    
 
    Record the SMTP session with a network sniffer
    
 
 
     This example uses tcpdump. In order to record a conversation
-you need to specify a large enough buffer with the "-s"
-option or else you will miss some or all of the packet payload.
-
    
+you need to specify a large enough buffer with the "-s" option or
+else you will miss some or all of the packet payload. 
    
 
 
    
 
    -# tcpdump -w /file/name -s 0 host example.com and port 25
+# tcpdump -w /file/name -s 2000 host example.com and port 25
 
    
 
    
 
-
     Older tcpdump versions don't support "-s 0"; in that case,
-use "-s 2000" instead.  
    
-
 
     Run this for a while, stop with Ctrl-C when done. To view the
-data use a binary viewer, ethereal, or good old less.
+data use a binary viewer, or ethereal, or use my tcpdumpx
+utility that is available from ftp://ftp.porcupine.org/pub/debugging/.
 
    
 
 
    Making Postfix daemon programs more verbose
    
@@ -232,7 +228,7 @@ data use a binary viewer, ethereal, or good old less.
 
     Append one or more "-v" options to selected daemon
 definitions in /etc/postfix/master.cf and type "postfix reload".
 This will cause a lot of activity to be logged to the syslog daemon.
-For example, to make the Postfix SMTP server process more verbose: 
    
+Example: 
    
 
 
    
 
    @@ -241,9 +237,10 @@ For example, to make the Postfix SMTP server process more verbose: 
    
 
    
 
    
 
-
     To diagnose problems with address rewriting specify a "-v"
+
     This makes the Postfix SMTP server more verbose. To diagnose
+problems with address rewriting one would specify a "-v"
 option for the cleanup(8) and/or trivial-rewrite(8) daemon, and to
-diagnose problems with mail delivery specify a "-v"
+diagnose problems with mail delivery one would specify a "-v"
 option for the qmgr(8) or oqmgr(8) queue manager, or for the lmtp(8),
 local(8), pipe(8), smtp(8), or virtual(8) delivery agent.  
    
 
@@ -541,23 +538,20 @@ attachments, instead of reciting information from memory.
 
 
  •  
     Postfix logging. See the text at the top of the DEBUG_README
 document to find out where logging is stored. Please do not frustrate
-the helpers by word wrapping the logging. If the logging is more
-than a few kbytes of text, consider posting an URL on a web or ftp
-site. 
    
+the helpers by word wrapping the logging. 
    
 
 
  •  
     Consider using a test email address so that you don't have
 to reveal email addresses or passwords of innocent people. 
    
 
 
  •  
     If you can't use a test email address, please anonymize
-email addresses and host names consistently. Replace each letter
-by "A", each digit
+information consistently. Replace each letter by "A", each digit
 by "D" so that the helpers can still recognize syntactical errors.
 
    
 
 
  •  
     Output from "postconf -n". Please do not send your
-main.cf file, or 500+ lines of postconf output. 
    
+main.cf file or 400+ lines of postconf output. 
    
 
-
  •  
     Better, provide output from the postfinger tool.
+
  •  
      Better, provide output from the postfinger tool.
 This can be found at http://ftp.wl0.org/SOURCES/postfinger.  
    
 
 
  •  
     If the problem is SASL related, consider including the
@@ -568,7 +562,7 @@ output from the saslfinger tool. This can be found at
 including output from the qshape tool, as described in the
 QSHAPE_README file. 
    
 
-
  •  
     If the problem is protocol related (connections time out,
+
  •  
     If the problem is protocol related (connections time out
 or an SMTP server complains about syntax errors etc.) consider
 recording a session with tcpdump, as described in the DEBUG_README document.  
diff --git a/postfix/html/DSN_README.html b/postfix/html/DSN_README.html
index 6ca3d84d3..8a389498b 100644
--- a/postfix/html/DSN_README.html
+++ b/postfix/html/DSN_README.html
@@ -44,7 +44,7 @@ identifies the message content. 
    
 
 
 
     The implementation of DSN support involves extra parameters to
-the SMTP MAIL FROM and RCPT TO commands, as well as two Postfix
+the SMTP MAIL FROM and RCPT TO commands, as well as new Postfix
 sendmail command line options that provide a sub-set of the functions
 of the extra SMTP command parameters. 
    
 
diff --git a/postfix/html/ETRN_README.html b/postfix/html/ETRN_README.html
index 4322031c4..f064f3a00 100644
--- a/postfix/html/ETRN_README.html
+++ b/postfix/html/ETRN_README.html
@@ -27,6 +27,11 @@ searches the queue for mail to the customer, and delivers that mail
 not delivered via the connection that was used for sending ETRN.
 
    
 
+
     Postfix versions before 1.0 (also known as version 20010228)
+implemented the ETRN command in an inefficient manner: they simply
+attempted to deliver all queued mail.  This is slow on mail servers
+that queue mail for many customers.  
    
+
 
     As of version 1.0, Postfix has a fast ETRN implementation that
 does not require Postfix to examine every queue file.  Instead,
 Postfix maintains a record of what queue files contain mail for
@@ -69,11 +74,11 @@ font.  
    
 
    
 
     220 my.server.tld ESMTP Postfix
-HELO my.client.tld
+helo my.client.tld
 250 Ok
-ETRN some.customer.domain
+etrn some.customer.domain
 250 Queuing started
-QUIT
+quit
 221 Bye
 
    
 
    
@@ -85,8 +90,6 @@ the connection that was used to send the ETRN command. 
    
 
     The Postfix operator can request delivery for a specific customer
 by using the command "sendmail -qRdestination" and, with
 Postfix version 1.1 and later, "postqueue -sdestination".
-Access to this feature is controlled with the authorized_flush_users
-configuration parameter (Postfix version 2.2 and later).
 
    
 
 
    How Postfix fast ETRN works
    
@@ -146,13 +149,12 @@ want to turn on fast ETRN service for every possible destination.
 with queue file names. When a request to "deliver mail now" arrives,
 Postfix will attempt to deliver all recipients in the queue files
 that have mail for the destination in question.  This does not
-perform well with queue files that have recipients in many different
-domains, such as queue files with outbound mailing list traffic.
-
    
+perform well when queue files have recipients in many different
+domains.  
    
 
 
  •  
     The flush(8) daemon maintains per-destination logfiles
 only for destinations listed with $fast_flush_domains. With other
-destinations you cannot request delivery with "sendmail
+destinations it not possible to trigger delivery with "sendmail
 -qRdestination" or, with Postfix version 1.1 and later,
 "postqueue -sdestination". 
    
 
@@ -164,24 +166,19 @@ does not ignore the volatile in-memory list of dead domains, and
 the list of message delivery transports specified with the
 defer_transports configuration parameter.  
    
 
-
  •  
     Up to and including Postfix version 2.3, the "fast flush"
-service may not deliver some messages if the request to "deliver
-mail now" arrives while an incoming queue scan is already in progress.
-
    
-
 
 
 
    Configuring the Postfix fast ETRN service
    
 
 
     The behavior of the flush(8) daemon is controlled by parameters
-in the main.cf configuration file. 
    
+in the main.cf configuration file. 
    
 
 
     By default, Postfix "fast ETRN" service is available only for
 destinations that Postfix is willing to relay mail to:  
    
 
 
    
 
    -/etc/postfix/main.cf:
+/etc/postfix/main.cf:
     fast_flush_domains = $relay_domains
     smtpd_etrn_restrictions = permit_mynetworks, reject
 
    
@@ -206,7 +203,7 @@ may execute the ETRN command. By default, any client has permission.
 
 
    
 
    -/etc/postfix/main.cf:
+/etc/postfix/main.cf:
     fast_flush_domains = $relay_domains, some.other.domain
 
    
 
    
@@ -216,7 +213,7 @@ and so that it maintains no per-destination logfiles, specify: 
    
 
 
    
 
    -/etc/postfix/main.cf:
+/etc/postfix/main.cf:
     fast_flush_domains =
 
    
 
    
@@ -243,7 +240,7 @@ for this delivery transport is deferred as soon as it arrives.
 
 
    
 
    - 1 /etc/postfix/master.cf:
+ 1 /etc/postfix/master.cf:
  2   # =============================================================
  3   # service type  private unpriv  chroot  wakeup  maxproc command
  4   #               (yes)   (yes)   (yes)   (never) (100)
@@ -252,7 +249,7 @@ for this delivery transport is deferred as soon as it arrives.
  7   relay     unix  -       -       n       -       -       smtp
  8   etrn-only unix  -       -       n       -       -       smtp
  9 
-10 /etc/postfix/main.cf:
+10 /etc/postfix/main.cf:
 11   relay_domains = customer.tld ...other domains...
 12   defer_transports = etrn-only
 13   transport_maps = hash:/etc/postfix/transport
@@ -305,9 +302,9 @@ boldface: 
    
 
    
 
     220 my.server.tld ESMTP Postfix
-HELO my.client.tld
+helo my.client.tld
 250 Ok
-ETRN some.customer.domain
+etrn some.customer.domain
 250 Queuing started
 
    
 
    
@@ -341,9 +338,9 @@ commands that you type: 
    
 
    
 
     220 my.server.tld ESMTP Postfix
-HELO my.client.tld
+helo my.client.tld
 250 Ok
-ETRN some.other.customer.domain
+etrn some.other.customer.domain
 250 Queuing started
 
    
 
    
@@ -359,9 +356,9 @@ server has mail queued for that destination. 
    
 
    
 
     220 my.server.tld ESMTP Postfix
-HELO my.client.tld
+helo my.client.tld
 250 Ok
-ETRN not.a.customer.domain
+etrn not.a.customer.domain
 459 <not.a.customer.domain>: service unavailable
 
    
 
    
diff --git a/postfix/html/FILTER_README.html b/postfix/html/FILTER_README.html
index 0bb4332d0..b678175bc 100644
--- a/postfix/html/FILTER_README.html
+++ b/postfix/html/FILTER_README.html
@@ -71,8 +71,7 @@ mail.  Applications that use two separate Postfix instances will
 be covered by a later version of this document.  
    
 
 
     The after-queue content filter is not to be confused with the
-approaches described in the SMTPD_PROXY_README or MILTER_README
-documents,
+approach that is described in the SMTPD_PROXY_README document,
 where incoming SMTP mail is filtered BEFORE it is stored into the
 Postfix queue.  
    
 
@@ -126,18 +125,16 @@ all email, as well as several options to filter mail selectively: 
    
 
 
    Principles of operation 
    
 
-
     An after-queue content filter receives unfiltered mail from Postfix
-(as described further below) and can do one of the following: 
    
+
     An external content filter receives unfiltered mail from Postfix
+(as described further below) and does one of the following: 
    
 
 
      
 
 
    1.  
       Re-inject the mail back into Postfix, perhaps after changing
     content and/or destination. 
      
 
-
    2.  
       Discard or quarantine the mail. 
      
-
 
    3.  
       Reject the mail (by sending a suitable status code back to
-    Postfix). Postfix will send the mail back to the sender address. 
      
+    Postfix). Postfix will return the mail to the sender. 
      
 
 
    
 
@@ -149,8 +146,7 @@ suspect so that a human can decide what to do with it. 
    
 
 
    Simple content filter example
    
 
-
     The first example is simple to set up, but has major limitations
-that will be addressed in a second example.  Postfix receives
+
     The first example is simple to set up.  Postfix receives
 unfiltered mail from the network with the smtpd(8) server, and
 delivers unfiltered mail to a content filter with the Postfix
 pipe(8) delivery agent.  The content filter injects filtered mail
@@ -286,23 +282,21 @@ document for an introduction to the Postfix architecture. 
    
 
 
      
 
-
    •  
       Line 8: The -G option says the filter output is not a local
-mail submission: don't do silly things like appending the local
-domain name to addresses in message headers.  This option does
-nothing before Postfix version 2.3.  
      
+
    •  
       Line 8: The -G option does nothing before Postfix 2.3,
+otherwise it disables address rewriting of message headers. 
      
 
 
    •  
       Line 8: The -i option says don't stop reading input when
 a line contains "." only.  
      
 
 
    •  
       Line 8: NEVER NEVER NEVER use the "-t" command-line option
-here. It will mis-deliver mail, like sending messages from a mailing
-list back to the mailing list. 
      
+here. It will mis-deliver mail, like sending mailing list mail back
+to the mailing list. 
      
 
 
    •  
       Line 21: The idea is to first capture the message to
 file and then run the content through a third-party content filter
 program. 
      
 
-
    •  
       Line 22: If the message cannot be captured to file, mail
+
    •  
       Line 22: If the mail cannot be captured to file, mail
 delivery is deferred by terminating with exit status 75 (EX_TEMPFAIL).
 Postfix places the message in the deferred mail queue and tries
 again later.  
      
@@ -312,14 +306,13 @@ program here that receives the content on standard input. 
      
 
 
    •  
       Line 26: If the content filter program finds a problem,
 the mail is bounced by terminating with exit status 69 (EX_UNAVAILABLE).
-Postfix will send the message back to the sender as undeliverable
-mail.
+Postfix will return the message to the sender as undeliverable.
 
      
 
-
    •  
       NOTE: in this time of mail worms and spam, it is a BAD
+
    •  
       Note: in this time of mail worms and spam, it is a BAD
 IDEA to send known viruses or spam back to the sender, because that
-address is likely to be forged. It is safer to discard known viruses
-and to quarantine suspicious content so that it can
+address is likely to be forged. It is safer to discard known to be
+bad content and to quarantine suspicious content so that it can
 be inspected by a human being. 
      
 
 
    •  
       Line 28: If the content is OK, it is given as input to
@@ -338,7 +331,7 @@ as input: 
      
 
 
      
 
      -% /path/to/script -f sender -- recipient... <message-file
+% /path/to/script -f sender recipient... <message-file
 
      
 
      
 
@@ -388,7 +381,7 @@ entry that defines the Postfix SMTP server: 
      
         -o content_filter=filter:dummy
 
    
 
-
     The "-o content_filter" line causes Postfix to add one content
+
     The "content_filter" line causes Postfix to add one content
 filter request record to each incoming mail message, with content
 "filter:dummy". This record overrides the normal mail routing
 and causes mail to be given to the content filter instead. 
    
@@ -439,7 +432,7 @@ for filtered mail. 
    
 Postfix SMTP server. 
    
 
 
  •  
     Execute "postsuper -r ALL" to remove content
-filter request records from existing queue files. 
    
+filter information from existing queue files. 
    
 
 
  •  
     Execute another "postfix reload". 
    
 
@@ -560,9 +553,7 @@ document for an introduction to the Postfix architecture. 
    
 
 
     The example given here filters all mail, including mail that
 arrives via SMTP and mail that is locally submitted via the Postfix
-sendmail command (local submissions enter Postfix via the pickup(8)
-server; to keep the figure simple we omit local submission details).
-See examples near the end of this document for
+sendmail command. See examples near the end of this document for
 how to exclude local users from filtering, or how to configure a
 destination dependent content filter. 
    
 
@@ -647,7 +638,7 @@ for more information. 
    
 
  •  
     The "-o disable_mime_output_conversion=yes" is a workaround
 that prevents the breaking of domainkeys and other digital signatures.
 This is needed because some SMTP-based content filters don't announce
-8BITMIME support, even though they can handle 8-bit mail. 
    
+8BITMIME support, even though they can handle it just fine.  
    
 
 
  •  
     The "-o smtp_generic_maps=" is a workaround that prevents
 local address rewriting with generic(5) maps. Such rewriting should
@@ -681,10 +672,6 @@ shell and home directory.  This user handles all potentially
 dangerous mail content - that is why it should be a separate account.
 
    
 
-
  •  
     By default, Postfix will terminate a command that runs
-longer than command_time_limit seconds (default: 1000s). This is a
-safety measure that prevents filters from running forever. 
    
-
 
 
 
     If you want to have your filter listening on port localhost:10025
@@ -724,14 +711,15 @@ that injects mail back into Postfix. 
    
 
 
      
 
-
    •  
       NOTE: do not use spaces around the "=" or "," characters. 
      
+
    •  
       Note: do not use spaces around the "=" or "," characters. 
      
 
-
    •  
       NOTE: the SMTP server must not have a smaller process
+
    •  
       Note: the SMTP server must not have a smaller process
 limit than the "filter" master.cf entry. 
      
 
 
    •  
       The "-o content_filter=" overrides main.cf settings, and
 requests no content filtering for mail from the content filter.
-This is required or else mail will loop. 
      
+This is required or else mail will stay in the content filtering
+loop. 
      
 
 
    •  
       The "-o receive_override_options" overrides main.cf settings
 to avoid duplicating work that was already done before the content
@@ -749,7 +737,7 @@ specified in main.cf: 
      
     
    •  
       We specify "no_milters" to disable Milter applications
     (this option is available only in Postfix 2.3 and later).  
      
 
-    
    •  
       We don't specify "no_address_mappings" here.  This
+    
    •  
       We don't specify "no_address_mapping" here.  This
     enables virtual alias expansion, canonical mappings, address
     masquerading, and other address mappings after the content
     filter. The main.cf setting of "receive_override_options"
@@ -806,7 +794,7 @@ when content filtering is turned off. 
      
 
    • 
 
 
  •  
     Execute "postsuper -r ALL" to remove content
-filter request records from existing queue files. 
    
+filter information from existing queue files. 
    
 
 
  •  
     Execute another "postfix reload". 
    
 
diff --git a/postfix/html/INSTALL.html b/postfix/html/INSTALL.html
index 49da3ddc1..d5f03a4e3 100644
--- a/postfix/html/INSTALL.html
+++ b/postfix/html/INSTALL.html
@@ -20,12 +20,12 @@ Installation From Source Code 
 
 
     1 - Purpose of this document 
    
 
-
     If you are using a pre-compiled version of Postfix, you should
-start with BASIC_CONFIGURATION_README and the general documentation
-referenced by it.  INSTALL is only a bootstrap document to get
-Postfix up and running from scratch with the minimal number of
-steps; it should not be considered part of the general documentation.
-
    
+
     This is a bootstrap document that helps you get Postfix up and
+running from scratch with the minimal number of steps.  If you are
+using a pre-compiled version of Postfix, you should be reading the
+general Postfix documentation which aims to describe the system in
+more detail.  This bootstrap document should not be considered part
+of the general Postfix documentation.  
    
 
 
     This document describes how to build, install and configure a
 Postfix system so that it can do one of the following: 
    
@@ -126,7 +126,7 @@ be sure to use an absolute path.  
    
 
    • 
 
 
     Of particular interest is the postconf(5) manual page that
-lists all the 500+ configuration parameters. The HTML version of
+lists all the 400+ configuration parameters. The HTML version of
 this text makes it easy to navigate around.  
    
 
 
     All Postfix source files have their own built-in manual page.
@@ -156,8 +156,8 @@ OPENSTEP 4.x 
    
 OSF1.V3 - OSF1.V5 (Digital UNIX) 
    
 Reliant UNIX 5.x 
    
 Rhapsody 5.x 
    
-SunOS 4.1.4 (March 2007) 
    
-SunOS 5.4 - 5.10 (Solaris 2.4..10) 
    
+SunOS 4.1.4 (July 2006) 
    
+SunOS 5.4 - 5.9 (Solaris 2.4..9) 
    
 Ultrix 4.x (well, that was long ago) 
    
 
    
 
    • 
@@ -168,10 +168,7 @@ Ultrix 4.x (well, that was long ago) 
    
 
 
     On Solaris, the "make" command and other utilities for software
 development are in /usr/ccs/bin, so you MUST have /usr/ccs/bin in
-your command search path. If these files do not exist, install the
-development packages first. See the Solaris FAQ item "Which
-packages do I need to install to support a C compiler?". 
    
+your command search path. 
    
 
 
     If you need to build Postfix for multiple architectures, use the
 "lndir" command to build a shadow tree with symbolic links to the
@@ -334,33 +331,10 @@ default 
 
 
    4.5 - Support for thousands of processes
    
 
-
     The number of connections that Postfix can manage simultaneously
-is limited by the number of processes that it can run.  This number
-in turn is limited by the number of files and sockets that a single
-process can open. For example, the Postfix queue manager has a
-separate connection to each delivery process, and the anvil(8)
-server has one connection per smtpd(8) process. 
    
-
-
     Postfix version 2.4 and later have no built-in limits on the
-number of open files or sockets, when compiled on systems that
-support one of the following: 
    
-
-
      
-
-
    •  BSD kqueue(2) (FreeBSD 4.1, NetBSD 2.0, OpenBSD 2.9),
-
-
    •  Solaris 8 /dev/poll,
-
-
    •  Linux 2.6 epoll(4).
-
-
    
-
-
-
     With other Postfix versions or operating systems, the number
-of file descriptors per process is limited by the value of the
-FD_SETSIZE macro. If you expect to run more than 1000 mail delivery
-processes, you may need to override the definition of the FD_SETSIZE
-macro to make select() work correctly: 
    
+
     In order to build Postfix for very large applications, where you
+expect to run more than 1000 mail delivery processes, you may need to
+override the definition of the FD_SETSIZE macro to make select()
+work correctly: 
    
 
 
    
 
    @@ -375,11 +349,6 @@ including <bits/types.h> directly (which is not allowed) and
 overriding the __FD_SETSIZE macro. Beware, undocumented interfaces
 can change at any time and without warning. 
    
 
-
     But wait, there is more: none of this will work unless the
-operating system is configured to handle thousands of connections.
-See the TUNING_README guide for examples of how to increase the
-number of open sockets or files. 
    
-
 
    4.6 - Compiling Postfix, at last
    
 
 
     If the command 
    
@@ -431,28 +400,19 @@ compilation
 
 
     This text describes how to install Postfix from source code.
 See the PACKAGE_README file if you are building a package for
-distribution to other systems. 
    
+distribution to other systems. See auxiliary/MacOSX/README-INSTALL.OSX
+for information about installing Postfix from source on Mac OS X.
+
    
 
 
    6.1 - Save existing Sendmail binaries
    
 
 
     IMPORTANT: if you are REPLACING an existing
 Sendmail installation with Postfix, you may need to keep the old
 sendmail program running for some time in order to flush the mail
-queue. 
    
-
-
      
-
-
    •  
       Some systems implement a mail switch mechanism where
-different MTAs (Postfix, Sendmail, etc.) can be installed at the
-same time, while only one of them is actually being used. Examples
-of such switching mechanisms are the FreeBSD mailwrapper(8) or the
-Linux mail switch.  In this case you should try to "flip" the switch
-to "Postfix" before installing Postfix. 
      
-
-
    •  
       If your system has no mail switch mechanism, execute the
-following commands (your sendmail, newaliases and mailq programs
-may be in a different place): 
      
+queue.  As superuser, execute the following commands (your sendmail,
+newaliases and mailq programs may be in a different place): 
      
 
+
      
 
       # mv /usr/sbin/sendmail /usr/sbin/sendmail.OFF
 # mv /usr/bin/newaliases /usr/bin/newaliases.OFF
@@ -460,8 +420,7 @@ may be in a different place): 
      
 # chmod 755 /usr/sbin/sendmail.OFF /usr/bin/newaliases.OFF \
     /usr/bin/mailq.OFF
 
      
-
-
    
+
    
 
 
    6.2 - Create account and groups
    
 
@@ -518,17 +477,15 @@ one of the following commands as the super-user:
    
 
 
      
 
-
    •  
       The interactive version ("make install") asks for pathnames
-for Postfix data and program files, and stores your preferences in
-the main.cf file.  If you don't want Postfix to overwrite
-non-Postfix "sendmail", "mailq" and "newaliases" files, specify
-pathnames that end in ".postfix". 
      
-
 
    •  
       The non-interactive version ("make upgrade") needs the
 /etc/postfix/main.cf file from a previous installation. If the file
 does not exist, use interactive installation ("make install")
 instead. 
      
 
+
    •  
       The interactive version offers suggestions for pathnames
+that you can override interactively, and stores your preferences
+in /etc/postfix/main.cf for convenient future upgrades. 
      
+
 
    
 
 
    6.4 - Configure Postfix
    
@@ -628,17 +585,6 @@ receive mail while leaving your Sendmail setup intact, by running
 Postfix on a virtual interface address.  Simply configure your mail
 user agent to directly invoke the Postfix sendmail program.  
    
 
-
     To create a virtual network interface address, study your
-system ifconfig manual page. The command syntax could be any
-of: 
    
-
-
    
-
    -# ifconfig le0:1 <address> netmask <mask> up
-# ifconfig en0 alias <address> netmask 255.255.255.255
-
    
-
    
-
 
     In the /etc/postfix/main.cf file, I would specify 
    
 
 
    
diff --git a/postfix/html/LDAP_README.html b/postfix/html/LDAP_README.html
index b3367b013..e828b2848 100644
--- a/postfix/html/LDAP_README.html
+++ b/postfix/html/LDAP_README.html
@@ -41,8 +41,6 @@ it to each. 
    
 
 
  • Example: virtual domains/addresses
 
-
  • Example: expanding LDAP groups
-
 
  • Other uses of LDAP lookups
 
 
  • Notes and things to think about
@@ -126,7 +124,7 @@ option (e.g. '-R') so the executables can find it at runtime. 
    
 
    Configuring LDAP lookups
    
 
 
     In order to use LDAP lookups, define an LDAP source
-as a table lookup in main.cf, for example: 
    
+as a table lookup in main.cf, for example: 
    
 
 
    
 
    @@ -142,7 +140,7 @@ page. 
    
 
    Example: local(8) aliases
    
 
 
     Here's a basic example for using LDAP to look up local(8)
-aliases. Assume that in main.cf, you have: 
    
+aliases. Assume that in main.cf, you have: 
    
 
 
     
 
    @@ -154,14 +152,14 @@ aliases. Assume that in main.cf, you have: 
    
 
 
     
 
    -server_host = ldap.example.com
-search_base = dc=example, dc=com
+server_host = ldap.my.com
+search_base = dc=my, dc=com
 
    
 
     
 
 
     Upon receiving mail for a local address "ldapuser" that isn't
 found in the /etc/aliases database, Postfix will search the LDAP
-server listening at port 389 on ldap.example.com. It will bind anonymously,
+server listening at port 389 on ldap.my.com. It will bind anonymously,
 search for any directory entries whose mailacceptinggeneralid
 attribute is "ldapuser", read the "maildrop" attributes of those
 found, and build a list of their maildrops, which will be treated
@@ -178,7 +176,7 @@ of your virtual recipient's mailacceptinggeneralid attributes are
 fully qualified with their virtual domains. Finally, if you want
 to designate a directory entry as the default user for a virtual
 domain, just give it an additional mailacceptinggeneralid (or the
-equivalent in your directory) of "@fake.dom". That's right, no
+equivalent in your directory) of "@virtual.dom". That's right, no
 user part. If you don't want a catchall user, omit this step and
 mail to unknown users in the domain will simply bounce. 
    
 
@@ -214,241 +212,12 @@ go to this entry ... 
    
 maildrop, e.g. "normaluser@fake.dom" and "normaluser@real.dom".
 
    
 
-
    Example: expanding LDAP groups
    
-
-
    
-LDAP is frequently used to store group member information.  There are a
-number of ways of handling LDAP groups.  We will show a few examples in
-order of increasing complexity, but owing to the number of independent
-variables, we can only present a tiny portion of the solution space.
-We show how to:
-
    
-
-
      
-
-
    1.  
       query groups as lists of addresses; 
      
-
-
    2.  
       query groups as lists of user objects containing addresses; 
      
-
-
    3.  
       forward special lists unexpanded to a separate list server,
-for moderation or other processing; 
      
-
-
    4.  
       handle complex schemas by controlling expansion and by treating
-leaf nodes specially, using features that are new in Postfix 2.4. 
      
-
-
    
-
-
    
-The example LDAP entries and implied schema below show two group entries
-("agroup" and "bgroup") and four user entries ("auser", "buser", "cuser"
-and "duser"). The group "agroup" has the users "auser" (1) and "buser" (2)
-as members via DN references in the multi-valued attribute "memberdn", and
-direct email addresses of two external users "auser@example.org" (3) and
-"buser@example.org" (4) stored in the multi-valued attribute "memberaddr".
-The same is true of "bgroup" and "cuser"/"duser" (6)/(7)/(8)/(9), but
-"bgroup" also has a "maildrop" attribute of "bgroup@mlm.example.com"
-(5): 
    
-
-
     
-
    -     dn: cn=agroup, dc=example, dc=com
-     objectclass: top
-     objectclass: ldapgroup
-     cn: agroup
-     mail: agroup@example.com
-1 -> memberdn: uid=auser, dc=example, dc=com
-2 -> memberdn: uid=buser, dc=example, dc=com
-3 -> memberaddr: auser@example.org
-4 -> memberaddr: buser@example.org
-
    
-
    
-
-
    -     dn: cn=bgroup, dc=example, dc=com
-     objectclass: top
-     objectclass: ldapgroup
-     cn: bgroup
-     mail: bgroup@example.com
-5 -> maildrop: bgroup@mlm.example.com
-6 -> memberdn: uid=cuser, dc=example, dc=com
-7 -> memberdn: uid=duser, dc=example, dc=com
-8 -> memberaddr: cuser@example.org
-9 -> memberaddr: duser@example.org
-
    
-
    
-
-
    -     dn: uid=auser, dc=example, dc=com
-     objectclass: top
-     objectclass: ldapuser
-     uid: auser
-10 -> mail: auser@example.com
-11 -> maildrop: auser@mailhub.example.com
-
    
-
    
-
-
    -     dn: uid=buser, dc=example, dc=com
-     objectclass: top
-     objectclass: ldapuser
-     uid: buser
-12 -> mail: buser@example.com
-13 -> maildrop: buser@mailhub.example.com
-
    
-
    
-
-
    -     dn: uid=cuser, dc=example, dc=com
-     objectclass: top
-     objectclass: ldapuser
-     uid: cuser
-14 -> mail: cuser@example.com
-
    
-
    
-
-
    -     dn: uid=duser, dc=example, dc=com
-     objectclass: top
-     objectclass: ldapuser
-     uid: duser
-15 -> mail: duser@example.com
-
    
-
    
-
-
     
-
-
     Our first use case ignores the "memberdn" attributes, and assumes
-that groups hold only direct "memberaddr" strings as in (3), (4), (8) and
-(9). The goal is to map the group address to the list of constituent
-"memberaddr" values. This is simple, ignoring the various connection
-related settings (hosts, ports, bind settings, timeouts, ...) we have:
-
    
-
-
     
-
    -    simple.cf:
-        ...
-        search_base = dc=example, dc=com
-        query_filter = mail=%s
-        result_attribute = memberaddr
-    $ postmap -q agroup@example.com ldap:simple.cf
-    auser@example.org,buser@example.org
-
    
-
     
-
-
     We search "dc=example, dc=com". The "mail" attribute is used in the
-query_filter to locate the right group, the "result_attribute" setting
-described in ldap_table(5) is used to specify that "memberaddr" values
-from the matching group are to be returned as a comma separated list.
-Always check tables using postmap(1) with the "-q" option, before
-deploying them into production use in main.cf. 
    
-
-
     Our second use case instead expands "memberdn" attributes (1), (2),
-(6) and (7), follows the DN references and returns the "maildrop" of the
-referenced user entries. Here we use the "special_result_attribute"
-setting from ldap_table(5) to designate the "memberdn" attribute
-as holding DNs of the desired member entries. The "result_attribute"
-setting selects which attributes are returned from the selected DNs. It
-is important to choose a result attribute that is not also present in
-the group object, because result attributes are collected from both
-the group and the member DNs. In this case we choose "maildrop" and
-assume for the moment that groups never have a "maildrop" (the "bgroup"
-"maildrop" attribute is for a different use case). The returned data for
-"auser" and "buser" is from items (11) and (13) in the example data. 
    
-
-
     
-
    -    special.cf:
-        ...
-        search_base = dc=example, dc=com
-        query_filter = mail=%s
-        result_attribute = maildrop
-        special_result_attribute = memberdn
-    $ postmap -q agroup@example.com ldap:special.cf
-    auser@mailhub.example.com,buser@mailhub.example.com
-
    
-
     
-
-
     Note: if the desired member object result attribute is always also
-present in the group, you get surprising results: the expansion also
-returns the address of the group. This is a known limitation of Postfix
-releases prior to 2.4, and is addressed in the new with Postfix 2.4
-"leaf_result_attribute" feature described in ldap_table(5). 
    
-
-
     Our third use case has some groups that are expanded immediately,
-and other groups that are forwarded to a dedicated mailing list manager
-host for delayed expansion. This uses two LDAP tables, one for users
-and forwarded groups and a second for groups that can be expanded
-immediately. It is assumed that groups that require forwarding are
-never nested members of groups that are directly expanded. 
    
-
-
     
-
    -    no_expand.cf:
-        ...
-        search_base = dc=example, dc=com
-        query_filter = mail=%s
-        result_attribute = maildrop
-    expand.cf
-        ...
-        search_base = dc=example, dc=com
-        query_filter = mail=%s
-        result_attribute = maildrop
-        special_result_attribute = memberdn
-    $ postmap -q auser@example.com ldap:no_expand.cf ldap:expand.cf
-    auser@mailhub.example.com
-    $ postmap -q agroup@example.com ldap:no_expand.cf ldap:expand.cf
-    auser@mailhub.example.com,buser@mailhub.example.com
-    $ postmap -q bgroup@example.com ldap:no_expand.cf ldap:expand.cf
-    bgroup@mlm.example.com
-
    
-
     
-
-
     Non-group objects and groups with delayed expansion (those that have a
-maildrop attribute) are rewritten to a single maildrop value. Groups that
-don't have a maildrop are expanded as the second use case. This admits
-a more elegant solution with Postfix 2.4 and later. 
    
-
-
     Our final use case is the same as the third, but this time uses new
-features in Postfix 2.4. We now are able to use just one LDAP table and
-no longer need to assume that forwarded groups are never nested inside
-expanded groups. 
    
-
-
     
-
    -    fancy.cf:
-        ...
-        search_base = dc=example, dc=com
-        query_filter = mail=%s
-        result_attribute = memberaddr
-        special_result_attribute = memberdn
-        terminal_result_attribute = maildrop
-        leaf_result_attribute = mail
-    $ postmap -q auser@example.com ldap:fancy.cf
-    auser@mailhub.example.com
-    $ postmap -q cuser@example.com ldap:fancy.cf
-    cuser@example.com
-    $ postmap -q agroup@example.com ldap:fancy.cf
-    auser@mailhub.example.com,buser@mailhub.example.com,auser@example.org,buser@example.org
-    $ postmap -q bgroup@example.com ldap:fancy.cf
-    bgroup@mlm.example.com
-
    
-
     
-
-
     Above, delayed expansion is enabled via "terminal_result_attribute",
-which, if present, is used as the sole result and all other expansion is
-suppressed. Otherwise, the "leaf_result_attribute" is only returned for
-leaf objects that don't have a "special_result_attribute" (non-groups),
-while the "result_attribute" (direct member address of groups) is returned
-at every level of recursive expansion, not just the leaf nodes. This fancy
-example illustrates all the features of Postfix 2.4 group expansion. 
    
-
 
    Other uses of LDAP lookups
    
 
 Other common uses for LDAP lookups include rewriting senders and
 recipients with Postfix's canonical lookups, for example in order
 to make mail leaving your site appear to be coming from
-"First.Last@example.com" instead of "userid@example.com".
+"First.Last@site.dom" instead of "userid@site.dom".
 
 
    Notes and things to think about
    
 
@@ -471,9 +240,9 @@ to make mail leaving your site appear to be coming from
 
 
    
 
    -dn: cn=Accounting Staff List, dc=example, dc=com
+dn: cn=Accounting Staff List, dc=my, dc=com
 cn: Accounting Staff List
-o: example.com
+o: my.com
 objectclass: maillist
 mailacceptinggeneralid: accountingstaff
 mailacceptinggeneralid: accounting-staff
@@ -572,17 +341,13 @@ contents, please include the applicable bits of some directory entries. 
    
             external files (ldap:/path/ldap.cf) needed to securely store
             passwords for plain auth.
 
-
  • Liviu Daia revised the configuration interface and added the main.cf
+
  • Liviu Daia revised the configuration interface and added the main.cf
     configuration feature.
    • 
     
 
  • Liviu Daia with further refinements from Jose Luis Tallon and
 Victor Duchovni developed the common query, result_format, domain and
 expansion_limit interface for LDAP, MySQL and PosgreSQL.
    • 
 
-
  • Gunnar Wrobel provided a first implementation of a feature to
-limit LDAP search results to leaf nodes only. Victor generalized
-this into the Postfix 2.4 "leaf_result_attribute" feature. 
    • 
-
 
 
 And of course Wietse.
diff --git a/postfix/html/LINUX_README.html b/postfix/html/LINUX_README.html
index 507cc7c3b..65519b6b0 100644
--- a/postfix/html/LINUX_README.html
+++ b/postfix/html/LINUX_README.html
@@ -19,7 +19,7 @@
 
 
    Berkeley DB issues
    
 
-
     If you can't compile Postfix because the file "db.h"
+
     Warning: if you can't compile Postfix because the file "db.h"
 isn't found, then you MUST install the Berkeley DB development
 package (name: db???-devel-???) that matches your system library.
 You can find out what is installed with the rpm command. For example:
@@ -33,7 +33,7 @@ db4-4.3.29-2
 
    
 
 
     This means that you need to install db4-devel-4.3.29-2 (on
-some systems, specify "rpm -qf /lib/libdb.so" instead). 
    
+some systems, specify /lib/libdb.so in the rpm query). 
    
 
 
     DO NOT download some Berkeley DB version from the network.
 Every Postfix program will dump core when it is built with a different
@@ -45,13 +45,9 @@ library routines.  See the DB_README file for furth
 
 
     On RedHat Linux 7.1 and later procmail no longer has
 permission
-to write the mail spool directory. Workaround: 
    
-
-
    
-
    -# chmod 1777 /var/spool/mail
-
    
-
    
+to write the mail spool directory. Workaround: chmod 1777
+/var/spool/mail.
+
    
 
 
    Syslogd performance
    
 
diff --git a/postfix/html/LOCAL_RECIPIENT_README.html b/postfix/html/LOCAL_RECIPIENT_README.html
index 3f2e04200..e5f471ba8 100644
--- a/postfix/html/LOCAL_RECIPIENT_README.html
+++ b/postfix/html/LOCAL_RECIPIENT_README.html
@@ -64,7 +64,7 @@ recipients are either UNIX accounts or local aliases: 
    
 
 
    
 
    -/etc/postfix/main.cf:
+/etc/postfix/main.cf:
     local_recipient_maps = proxy:unix:passwd.byname $alias_maps
 
    
 
    
@@ -74,18 +74,14 @@ specify: 
    
 
 
    
 
    -/etc/postfix/main.cf:
+/etc/postfix/main.cf:
     local_recipient_maps =
 
    
 
    
 
 
     That is, an empty value. With this setting, the Postfix SMTP
 server will not reject mail with "User unknown in local recipient
-table".  Don't do this on systems that receive mail directly 
-from the Internet. With today's worms and viruses, Postfix will
-become a backscatter source: it accepts mail for non-existent
-recipients and then tries to return that mail as "undeliverable"
-to the often forged sender address. 
    
+table". 
    
 
 
    When you need to change the local_recipient_maps
 setting in main.cf
    
@@ -95,7 +91,7 @@ setting in main.cf
     
  •  
     Problem: you don't use the default Postfix local(8)
     delivery agent for domains matching $mydestination, $inet_interfaces,
     or $proxy_interfaces. For example, you redefined the
-    "local_transport" setting in main.cf.  
    
+    "local_transport" setting in main.cf.  
    
 
     
     Solution: your local_recipient_maps setting needs to specify
     a database that lists all the known user names or addresses
@@ -104,7 +100,7 @@ setting in main.cf
     specify: 
    
 
 
    -/etc/postfix/main.cf
+/etc/postfix/main.cf
     mydestination = $myhostname localhost.$mydomain localhost ...
     local_transport = virtual
     local_recipient_maps = $virtual_mailbox_maps
@@ -123,7 +119,7 @@ setting in main.cf
     non-UNIX users: 
    
 
 
    -/etc/postfix/main.cf
+/etc/postfix/main.cf
     local_recipient_maps = proxy:unix:passwd.byname, $alias_maps,
         <the database with non-UNIX accounts>
 
    
@@ -140,7 +136,7 @@ setting in main.cf
     
    
 
 
    -/etc/postfix/main.cf
+/etc/postfix/main.cf
     local_recipient_maps =
 
    
 
diff --git a/postfix/html/MAILDROP_README.html b/postfix/html/MAILDROP_README.html
index ad95a4e93..20f9b5422 100644
--- a/postfix/html/MAILDROP_README.html
+++ b/postfix/html/MAILDROP_README.html
@@ -41,9 +41,7 @@ file processing. You would typically do this for main.cf file: 
    
+and for someother.domain.  
    
 
 
    
 
    @@ -98,8 +96,6 @@ to deliver the mail.  
    
 
 
     Note: Do not use the postfix user as the maildrop user. 
    
 
-
     Part 2 describes changes to the master.cf file: 
    
-
 
    
 
     /etc/postfix/master.cf:
diff --git a/postfix/html/MILTER_README.html b/postfix/html/MILTER_README.html
index 76816476d..1bbb5cce0 100644
--- a/postfix/html/MILTER_README.html
+++ b/postfix/html/MILTER_README.html
@@ -28,13 +28,9 @@ this happens before mail is queued.  
    
 
     The reason for adding Milter support to Postfix is that there
 exists a large collection of applications, not only to block unwanted
 mail, but also to verify authenticity (examples: Domain keys
-identified mail, SenderID+SPF and
 Domain keys)
-or to digitally sign mail (examples: Domain keys
-identified mail, Domain keys).
 Having yet another Postfix-specific version of all that software
 is a poor use of human and system resources. 
    
@@ -206,14 +202,14 @@ does. 
    
 
 
     On some Linux and *BSD distributions, the Sendmail libmilter
 library is installed by default. With this, applications such as
-dkim-milter
+dk-milter
 and sid-milter
 build out of the box without requiring any tinkering:
    
 
 
    
 
    -$ gzcat dkim-milter-x.y.z.tar.gz | tar xf -
-$ cd dkim-milter-x.y.z
+$ gzcat dk-milter-x.y.z.tar.gz | tar xf -
+$ cd dk-milter-x.y.z
 $ make
 [...lots of output omitted...]
 
    
@@ -264,7 +260,7 @@ for options.  A typical command looks like this:
    
 
 
    
 
    -# /some/where/dkim-filter -u userid -p inet:portnumber@localhost ...other options...
+# /some/where/dk-filter -u userid -p inet:portnumber@localhost ...other options...
 
    
 
    
 
@@ -656,49 +652,42 @@ X-SenderID: Sendmail Sender-ID Filter vx.y.z host.example.com <unknown-msgid&
 
    
 
    
 
-
     This happens because those Milter applications expect that the
+
     This happens because some Milter applications expect that the
 queue ID is known before the MTA accepts the MAIL FROM
 (sender) command.  Postfix, on the other hand, does not choose a
 queue file name until after it accepts the first valid RCPT
-TO (recipient) command (Postfix queue file names must be unique
+TO (recipient) command. Postfix queue file names must be unique
 across multiple directories, so the name can't be chosen before the
-file is created; if multiple messages were to use the same queue
-ID simultaneously, mail would be lost).  
    
+file is created.  If multiple messages were to use the same queue
+ID simultaneously, mail would be lost.  
    
 
-
-
-
     If you experience the ugly header problem, see if a recent
-version of the Milter application fixes it. For example, current
-versions of dkim-filter and dk-filter already have code that looks
-up the Postfix queue ID at a later protocol stage. 
    
-
-
     To fix the ugly message header with sid-filter applications,
-we change the source code, so that it does the queue ID lookup after
-Postfix receives the end of the message. 
    
+
     To work around the ugly message header from Milter applications,
+we add a little code to the Milter source to look up the queue ID
+after Postfix receives the end of the message. 
    
 
 
      
 
-
    •  
       Edit the filter source file (named
-sid-filter/sid-filter.c). 
      
-
-
    •  
       Look up the smfilter table and replace
-mlfi_eoh by NULL.
-
      
+
    •  
       Edit the filter source file (typically named
+dk-filter/dk-filter.c or similar). 
      
 
 
    •  
       Look up the mlfi_eom() function and add code near
-the top that calls mlfi_eoh() as shown by the bold
-text below: 
      
+the top shown as bold text below: 
      
 
 
    
 
 
    
 
    -        assert(ctx != NULL);
-#endif /* !DEBUG */
+dfc = cc->cctx_msg;
+assert(dfc != NULL);
 
-        ret = mlfi_eoh(ctx);
-        if (ret != SMFIS_CONTINUE)
-                return ret;
+/* Determine the job ID for logging. */
+if (dfc->mctx_jobid == 0 || strcmp(dfc->mctx_jobid, JOBIDUNKNOWN) == 0) {
+        char *jobid = smfi_getsymval(ctx, "i");
+        if (jobid != 0)
+                dfc->mctx_jobid = jobid;
+}
+
+/* get hostname; used in the X header and in new MIME boundaries */
 
    
 
    
 
@@ -706,52 +695,48 @@ text below: 
    
 
 
      
 
-
    •  
       This was tested with sid-milter-0.2.10 and sid-milter-0.2.14. 
      
+
    •  
       Different mail filters use slightly different names for
+variables. If the above code does not compile, look for the code
+at the start of the mlfi_eoh() routine. 
      
 
 
    •  
       This fixes only the ugly message header, but not the WARNING
-message.  Fortunately, sid-milter logs that message only once. 
      
+message.  Fortunately, dk-filter logs that message only once. 
      
 
 
    
 
-
     To fix the ugly message header with other Milter applications,
-you will need to do something like this: 
    
+
     With some Milter applications we can fix both the WARNING and
+the "unknown-msgid" by postponing the call of mlfi_eoh()
+(or whatever routine logs the WARNING) until the end of the message.
+
    
 
 
      
 
 
    •  
       Edit the filter source file (typically named
-xxx-filter/xxx-filter.c or similar). 
      
+sid-filter/sid-filter.c or similar). 
      
+
+
    •  
       Look up the smfilter table and replace
+mlfi_eoh (or whatever routine logs the WARNING) by NULL.
+
      
 
 
    •  
       Look up the mlfi_eom() function and add code near
-the top shown as bold text below: 
      
+the top that calls mlfi_eoh() as shown by the bold
+text below: 
      
 
 
    
 
 
    
 
    -dfc = cc->cctx_msg;
-assert(dfc != NULL);
+        assert(ctx != NULL);
+#endif /* !DEBUG */
 
-/* Determine the job ID for logging. */
-if (dfc->mctx_jobid == 0 || strcmp(dfc->mctx_jobid, JOBIDUNKNOWN) == 0) {
-        char *jobid = smfi_getsymval(ctx, "i");
-        if (jobid != 0)
-                dfc->mctx_jobid = jobid;
-}
-
-/* get hostname; used in the X header and in new MIME boundaries */
+        ret = mlfi_eoh(ctx);
+        if (ret != SMFIS_CONTINUE)
+                return ret;
 
    
 
    
 
-
     NOTES: 
    
-
-
      
-
-
    •  
       Different mail filters use slightly different names for
-variables. If the above code does not compile, look for the code
-at the start of the mlfi_eoh() routine. 
      
-
-
    •  
       This fixes only the ugly message header, but not the WARNING
-message.  Fortunately, many Milters log that message only once. 
      
+
       This works with sid-milter-0.2.10. Other Milter applications
+will dump core when you do this. 
      
 
 
    
 
@@ -810,7 +795,8 @@ operation will log a warning like this: 
    
 
    
 
    
 
-
     The solution is to use Postfix version 2.4 or later. 
    
+
     The solution is to use a Postfix version that supports the
+missing functionality. 
    
 
 
  •  
     Most Milter configuration options are global. Future Postfix
 versions may support per-Milter timeouts, per-Milter error handling,
diff --git a/postfix/html/Makefile.in b/postfix/html/Makefile.in
index 1b0c11947..22f7c23fb 100644
--- a/postfix/html/Makefile.in
+++ b/postfix/html/Makefile.in
@@ -39,7 +39,7 @@ bounce.8.html: ../src/bounce/bounce.c
 
 defer.8.html: bounce.8.html
 	rm -f $@
-	ln $? $@
+	ln -s $? $@
 
 discard.8.html: ../src/discard/discard.c
 	PATH=../mantools:$$PATH; \
@@ -67,7 +67,7 @@ scache.8.html: ../src/scache/scache.c
 
 lmtp.8.html: smtp.8.html
 	rm -f $@
-	ln $? $@
+	ln -s $? $@
 
 local.8.html: ../src/local/local.c
 	PATH=../mantools:$$PATH; \
@@ -130,7 +130,7 @@ tlsmgr.8.html: ../src/tlsmgr/tlsmgr.c
 
 trace.8.html: bounce.8.html
 	rm -f $@
-	ln $? $@
+	ln -s $? $@
 
 trivial-rewrite.8.html: ../src/trivial-rewrite/trivial-rewrite.c
 	PATH=../mantools:$$PATH; \
@@ -190,12 +190,12 @@ sendmail.1.html: ../src/sendmail/sendmail.c
 
 mailq.1.html: sendmail.1.html
 	rm -f $@
-	ln $? $@
+	ln -s $? $@
 
 newaliases.1.html: sendmail.1.html
 	PATH=../mantools:$$PATH; \
 	rm -f $@
-	ln $? $@
+	ln -s $? $@
 
 smtp-source.1.html: ../src/smtpstone/smtp-source.c
 	PATH=../mantools:$$PATH; \
diff --git a/postfix/html/OVERVIEW.html b/postfix/html/OVERVIEW.html
index 2c7f23538..015f6e940 100644
--- a/postfix/html/OVERVIEW.html
+++ b/postfix/html/OVERVIEW.html
@@ -549,30 +549,15 @@ of times that a connection may be reused.  
    
 
 
     When delivering mail to a destination with multiple mail servers,
 connection caching can help to skip over a non-responding server,
-and thus dramatically speed up delivery. SMTP connection caching
-is available in Postfix version 2.2 and later.  More information
-about this feature is in the CONNECTION_CACHE_README document. 
    
+and thus dramatically speed up delivery.  
    
 
 
 
-
- 
-
-
-
- 
-
- 
-
-
- 
-
+
         /--    smtp(8)   
--->  Internet  
      qmgr(8)       |
    |
    |
    |
    v    		    
         \--    smtp(8)   
--->  Internet  
       ^
    |    		    
        scache(8)  
      
     smtp(8) 
    
+      		   <->    
     scache(8) 
           		  
+<->    
    
+smtp(8) 
           		
 
 
    
 
diff --git a/postfix/html/PACKAGE_README.html b/postfix/html/PACKAGE_README.html
index d06e8810d..9d385cbfd 100644
--- a/postfix/html/PACKAGE_README.html
+++ b/postfix/html/PACKAGE_README.html
@@ -26,9 +26,9 @@ Postfix distributions for general use.  
    
 
    General distributions: please provide a small default main.cf
 file
    
 
-
     The installed main.cf file must be small. PLEASE resist the
-temptation to list all parameters in the main.cf file.  Postfix
-is supposed to be easy to configure. Listing all parameters in main.cf
+
     The installed main.cf file must be small. PLEASE resist the
+temptation to list all 400+ parameters in the main.cf file.  Postfix
+is supposed to be easy to configure. Listing all 400+ in main.cf
 defeats the purpose. It is an invitation for hobbyists to make
 random changes without understanding what they do, and gets them
 into endless trouble.  
    
@@ -70,7 +70,7 @@ script directly (% sh post-install). 
    
 
 
     You will be prompted for installation parameters.  Specify an
 install_root directory other than /.  The mail_owner and setgid_group
-installation parameter settings will be recorded in the main.cf
+installation parameter settings will be recorded in the main.cf
 file, but they won't take effect until the package is unpacked and
 installed on the destination machine. 
    
 
diff --git a/postfix/html/QMQP_README.html b/postfix/html/QMQP_README.html
new file mode 100644
index 000000000..e91045a04
--- /dev/null
+++ b/postfix/html/QMQP_README.html
@@ -0,0 +1,24 @@
+
+
+
+
+
+
+Postfix qmail and ezmlm support
+
+
+
+
+
+
+
+
    Postfix qmail and ezmlm support
    
+
+
    
+
+
     This document will be made available via http://www.postfix.org/. 
    
+
+
+
+
diff --git a/postfix/html/QSHAPE_README.html b/postfix/html/QSHAPE_README.html
index 905bc5ebb..c15d95efd 100644
--- a/postfix/html/QSHAPE_README.html
+++ b/postfix/html/QSHAPE_README.html
@@ -19,11 +19,17 @@
 
 
    Purpose of this document 
    
 
-
     This document is an introduction to Postfix queue congestion analysis.
-It explains how the qshape(1) program can help to track down the
-reason for queue congestion.  qshape(1) is bundled with Postfix
-2.1 and later source code, under the "auxiliary" directory. This
-document describes qshape(1) as bundled with Postfix 2.4.  
    
+
     This document describes the qshape(1) program which helps the
+administrator understand the Postfix queue message distribution
+sorted by time and by sender or recipient domain. qshape(1) is
+bundled with the Postfix 2.1 source under the "auxiliary" directory.
+
    
+
+
     In order to understand the output of qshape(1), it useful to
+understand the various Postfix queues. To this end the role of each
+Postfix queue directory is described briefly in the "Background
+info:  Postfix queue directories" section near the end of this
+document.  
    
 
 
     This document covers the following topics: 
    
 
@@ -43,7 +49,7 @@ queue
    • 
 
 
  • Example 4: High volume destination backlog
 
-
  • Postfix queue directories
+
  • Background info: Postfix queue directories
 
 
      
 
@@ -65,6 +71,7 @@ queue
 
 
      Introducing the qshape tool
      
 
+
 
       When mail is draining slowly or the queue is unexpectedly large,
 run qshape(1) as the super-user (root) to help zero in on the problem.
 The qshape(1) program displays a tabular view of the Postfix queue
@@ -117,12 +124,6 @@ minutes old and 12 older than 1280 minutes (1440 minutes in a day).
 
 
    
 
-
     When the output is a terminal intermediate results showing the top 20
-domains (-n option) are displayed after every 1000 messages (-N option)
-and the final output also shows only the top 20 domains. This makes
-qshape useful even when the deferred queue is very large and it may
-otherwise take prohibitively long to read the entire deferred queue. 
    
-
 
     By default, qshape shows statistics for the union of both the
 incoming and active queues which are the most relevant queues to
 look at when analyzing performance. 
    
@@ -131,8 +132,8 @@ look at when analyzing performance. 
    
 
 
    
 
    -$ qshape deferred
-$ qshape incoming active deferred
+$ qshape deferred | less
+$ qshape incoming active deferred | less
 
    
 
    
 
@@ -156,11 +157,11 @@ a burst of mail started, and when it stopped. 
    
 
     The problem destinations or sender domains appear near the top
 left corner of the output table. Remember that the active queue
 can accommodate up to 20000 ($qmgr_message_active_limit) messages.
-To check whether this limit has been reached, use: 
    
+To check wether this limit has been reached, use: 
    
 
 
    
 
    -$ qshape -s active       (show sender statistics)
+$ qshape -s active | head       (show sender statistics)
 
    
 
    
 
@@ -168,13 +169,13 @@ $ qshape -s active       (show sender statistics)
 not yet saturated, any high volume sender domains show near the
 top of the output.
 
-
     With oqmgr(8) the active queue is also limited to at most 20000
-recipient addresses ($qmgr_message_recipient_limit). To check for
-exhaustion of this limit use: 
    
+
     The active queue is also limited to at most 20000 recipient
+addresses ($qmgr_message_recipient_limit). To check for exhaustion
+of this limit use: 
    
 
 
    
 
    -$ qshape active          (show recipient statistics)
+$ qshape active | head          (show recipient statistics)
 
    
 
    
 
@@ -380,17 +381,14 @@ queue congestion is a greater cause for alarm; one might need to
 take measures to ensure that the mail is deferred instead or even
 add an access(5) rule asking the sender to try again later. 
    
 
-
     If a high volume destination exhibits frequent bursts of consecutive
-connections refused by all MX hosts or "421 Server busy errors", it
-is possible for the queue manager to mark the destination as "dead"
-despite the transient nature of the errors. The destination will be
-retried again after the expiration of a $minimal_backoff_time timer.
-If the error bursts are frequent enough it may be that only a small
-quantity of email is delivered before the destination is again marked
-"dead". In some cases enabling static (not on demand) connection
-caching by listing the appropriate nexthop domain in a table included in
-"smtp_connection_cache_destinations" may help to reduce the error rate,
-because most messages will re-use existing connections. 
    
+
     If a high volume destination exhibits frequent bursts of
+consecutive connections refused by all MX hosts or "421 Server busy
+errors", it is possible for the queue manager to mark the destination
+as "dead" despite the transient nature of the errors. The destination
+will be retried again after the expiration of a $minimal_backoff_time
+timer.  If the error bursts are frequent enough it may be that only
+a small quantity of email is delivered before the destination is
+again marked "dead". 
    
 
 
     The MTA that has been observed most frequently to exhibit such
 bursts of errors is Microsoft Exchange, which refuses connections
@@ -398,44 +396,47 @@ under load. Some proxy virus scanners in front of the Exchange
 server propagate the refused connection to the client as a "421"
 error. 
    
 
-
     Note that it is now possible to configure Postfix to exhibit similarly
-erratic behavior by misconfiguring the anvil(8) service.  Do not use
-anvil(8) for steady-state rate limiting, its purpose is (unintentional)
-DoS prevention and the rate limits set should be very generous! 
    
+
     Note that it is now possible to configure Postfix to exhibit
+similarly erratic behavior by misconfiguring the anvil(8) server
+(not included in Postfix 2.1.). Do not use anvil(8) for steady-state
+rate limiting, its purpose is DoS prevention and the rate limits
+set should be very generous! 
    
 
-
     If one finds oneself needing to deliver a high volume of mail to a
-destination that exhibits frequent brief bursts of errors and connection
-caching does not solve the problem, there is a subtle workaround. 
    
+
     In the long run it is hoped that the Postfix dead host detection
+and concurrency control mechanism will be tuned to be more "noise"
+tolerant.  If one finds oneself needing to deliver a high volume
+of mail to a destination that exhibits frequent brief bursts of
+errors, there is a subtle workaround. 
    
 
 
      
 
-
    •  
       In master.cf set up a dedicated clone of the "smtp"
+
    •  
       In master.cf set up a dedicated clone of the "smtp"
 transport for the destination in question. 
      
 
-
    •  
       In master.cf configure a reasonable process limit for the
+
    •  
       In master.cf configure a reasonable process limit for the
 transport (a number in the 10-20 range is typical). 
      
 
-
    •  
       IMPORTANT!!! In main.cf configure a very large initial
-and destination concurrency limit for this transport (say 2000). 
      
+
    •  
       IMPORTANT!!! In main.cf configure a very large initial
+and destination concurrency limit for this transport (say 200). 
      
 
 
      -/etc/postfix/main.cf:
-    initial_destination_concurrency = 2000
-    transportname_destination_concurrency_limit = 2000
+/etc/postfix/main.cf:
+    initial_destination_concurrency = 200
+    transportname_destination_concurrency_limit = 200
 
      
 
-
       Where transportname is the name of the master.cf entry
+
       Where transportname is the name of the master.cf entry
 in question. 
      
 
 
    
 
-
     The effect of this surprising configuration is that up to 2000
+
     The effect of this surprising configuration is that up to 200
 consecutive errors are tolerated without marking the destination
 dead, while the total concurrency remains reasonable (10-20
 processes). This trick is only for a very specialized situation:
 high volume delivery into a channel with multi-error bursts
 that is capable of high throughput, but is repeatedly throttled by
-the bursts of errors. 
    
+the bursts of errors.
 
 
     When a destination is unable to handle the load even after the
 Postfix process limit is reduced to 1, a desperate measure is to
@@ -446,7 +447,7 @@ insert brief delays between delivery attempts. 
    
 
  •  
      In the transport map entry for the problem destination,
 specify a dead host as the primary nexthop. 
    
 
-
  •  
     In the master.cf entry for the transport specify the
+
  •  
     In the master.cf entry for the transport specify the
 problem destination as the fallback_relay and specify a small
 smtp_connect_timeout value. 
    
 
@@ -454,7 +455,7 @@ problem destination as the fallback_rel
 /etc/postfix/transport:
     problem.example.com  slow:[dead.host]
 
-/etc/postfix/master.cf:
+/etc/postfix/master.cf:
     # service type  private unpriv  chroot  wakeup  maxproc command
     slow      unix     -       -       n       -       1    smtp
         -o fallback_relay=problem.example.com
@@ -471,7 +472,7 @@ updated when SMTP connection caching is introduced.  
    
 
     Hopefully a more elegant solution to these problems will be
 found in the future. 
    
 
-
    Postfix queue directories
    
+
    Background info: Postfix queue directories
    
 
 
     The following sections describe Postfix queues: their purpose,
 what normal behavior looks like, and how to diagnose abnormal
@@ -496,8 +497,8 @@ to notify the pickup(8) service of its arrival. 
    
 
     All mail that enters the main Postfix queue does so via the
 cleanup(8) service. The cleanup service is responsible for envelope
 and header rewriting, header and body regular expression checks,
-automatic bcc recipient processing, milter content processing, and
-reliable insertion of the message into the Postfix "incoming" queue. 
    
+automatic bcc recipient processing and guaranteed insertion of the
+message into the Postfix "incoming" queue. 
    
 
 
     In the absence of excessive CPU consumption in cleanup(8) header
 or body regular expression checks or other software consuming all
@@ -513,10 +514,9 @@ one message at a time at a rate that does not exceed the reciprocal
 disk I/O latency (+ CPU if not negligible) of the cleanup service.
 
    
 
-
     Congestion in this queue is indicative of an excessive local message
-submission rate or perhaps excessive CPU consumption in the cleanup(8)
-service due to excessive body_checks, or (Postfix ≥ 2.3) high latency
-milters. 
    
+
     Congestion in this queue is indicative of an excessive local
+message submission rate or perhaps excessive CPU consumption in
+the cleanup(8) service due to excessive body_checks. 
    
 
 
     Note, that once the active queue is full, the cleanup service
 will attempt to slow down message injection by pausing $in_flow_delay
@@ -524,10 +524,10 @@ for each message. In this case "mail
 a consequence of congestion downstream, rather than a problem in
 its own right. 
    
 
-
     Note, you should not attempt to deliver large volumes of mail via
-the pickup(8) service. High volume sites should avoid using "simple"
-content filters that re-inject scanned mail via Postfix sendmail(1)
-and postdrop(1). 
    
+
     Note also, that one should not attempt to deliver large volumes
+of mail via the pickup(8) service. High volume sites must avoid
+using content filters that reinject scanned mail via Postfix
+sendmail(1) and postdrop(1). 
    
 
 
     A high arrival rate of locally submitted mail may be an indication
 of an uncaught forwarding loop, or a run-away notification program.
@@ -545,19 +545,20 @@ size of the "maildrop" queue.  The administrator can define "smtpd" access(5) policies, or
 cleanup(8) header/body checks that cause messages to be automatically
 diverted from normal processing and placed indefinitely in the
-"hold" queue. Messages placed in the "hold" queue stay there until
+"hold" queue.  Messages placed in the "hold" queue stay there until
 the administrator intervenes. No periodic delivery attempts are
 made for messages in the "hold" queue. The postsuper(1) command
 can be used to manually release messages into the "deferred" queue.
 
    
 
-
     Messages can potentially stay in the "hold" queue longer than
-$maximal_queue_lifetime. If such "old" messages need to be released from
-the "hold" queue, they should typically be moved into the "maildrop"
-queue using "postsuper -r", so that the message gets a new timestamp and
-is given more than one opportunity to be delivered.  Messages that are
-"young" can be moved directly into the "deferred" queue using
-"postsuper -H". 
    
+
     Messages can potentially stay in the "hold" queue for a time
+exceeding the normal maximal queue lifetime (after which undelivered
+messages are bounced back to the sender). If such "old" messages
+need to be released from the "hold" queue, they should typically
+be moved into the "maildrop" queue, so that the message gets a new
+timestamp and is given more than one opportunity to be delivered.
+Messages that are "young" can be moved directly into the "deferred"
+queue. 
    
 
 
     The "hold" queue plays little role in Postfix performance, and
 monitoring of the "hold" queue is typically more closely motivated
@@ -588,15 +589,11 @@ messages into the active queue as
 
 
     The incoming queue grows when the message input rate spikes
 above the rate at which the queue manager can import messages into
-the active queue. The main factors slowing down the queue manager
-are disk I/O and lookup queries to the trivial-rewrite service. If the queue
+the active queue. The main factor slowing down the queue manager
+is transport queries to the trivial-rewrite service. If the queue
 manager is routinely not keeping up, consider not using "slow"
 lookup services (MySQL, LDAP, ...) for transport lookups or speeding
-up the hosts that provide the lookup service.  If the problem is I/O
-starvation, consider striping the queue over more disks, faster controllers
-with a battery write cache, or other hardware improvements. At the very
-least, make sure that the queue directory is mounted with the "noatime"
-option if applicable to the underlying filesystem. 
    
+up the hosts that provide the lookup service.  
    
 
 
     The in_flow_delay parameter is used to clamp the input rate
 when the queue manager starts to fall behind. The cleanup(8) service
@@ -648,40 +645,26 @@ combination; the group size is capped by the transport's recipient
 concurrency limit.  
    
 
 
     Multiple recipient groups (from one or more messages) are queued
-for delivery grouped by transport/nexthop combination. The
-destination concurrency limit for the transports caps the number
+for delivery via the common transport/nexthop combination. The
+destination concurrency limit for the transports caps the number
 of simultaneous delivery attempts for each nexthop. Transports with
-a recipient concurrency limit of 1 are special: these are grouped
-by the actual recipient address rather than the nexthop, yielding
-per-recipient concurrency limits rather than per-domain
+a recipient concurrency limit of 1 are special: these are grouped
+by the actual recipient address rather than the nexthop, thereby
+enabling per-recipient concurrency limits rather than per-domain
 concurrency limits. Per-recipient limits are appropriate when
 performing final delivery to mailboxes rather than when relaying
 to a remote server.  
    
 
 
     Congestion occurs in the active queue when one or more destinations
-drain slower than the corresponding message input rate. 
    
-
-
     Input into the active queue comes both from new mail in the "incoming"
-queue, and retries of mail in the "deferred" queue. Should the "deferred"
-queue get really large, retries of old mail can dominate the arrival
-rate of new mail. Systems with more CPU, faster disks and more network
-bandwidth can deal with larger deferred queues, but as a rule of thumb
-the deferred queue scales to somewhere between 100,000 and 1,000,000
-messages with good performance unlikely above that "limit". Systems with
-queues this large should typically stop accepting new mail, or put the
-backlog "on hold" until the underlying issue is fixed (provided that
-there is enough capacity to handle just the new mail). 
    
-
-
     When a destination is down for some time, the queue manager will
-mark it dead, and immediately defer all mail for the destination without
+drain slower than the corresponding message input rate. If a
+destination is down for some time, the queue manager will mark it
+dead, and immediately defer all mail for the destination without
 trying to assign it to a delivery agent. In this case the messages
-will quickly leave the active queue and end up in the deferred queue
-(with Postfix < 2.4, this is done directly by the queue manager,
-with Postfix ≥ 2.4 this is done via the "retry" delivery agent). 
    
-
-
     When the destination is instead simply slow, or there is a problem
-causing an excessive arrival rate the active queue will grow and will
-become dominated by mail to the congested destination.  
    
+will quickly leave the active queue and end up in the deferred
+queue. If the destination is instead simply slow, or there is a
+problem causing an excessive arrival rate the active queue will
+grow and will become dominated by mail to the congested destination.
+
    
 
 
     The only way to reduce congestion is to either reduce the input
 rate or increase the throughput. Increasing the throughput requires
@@ -708,56 +691,28 @@ a high average latency. If the number of outbound SMTP connections
 is draining slowly and the system and network are not loaded, raise
 the "smtp" and/or "relay" process limits!  
    
 
-
     When a high volume destination is served by multiple MX hosts with
-typically low delivery latency, performance can suffer dramatically when
-one of the MX hosts is unresponsive and SMTP connections to that host
-timeout. For example, if there are 2 equal weight MX hosts, the SMTP
-connection timeout is 30 seconds and one of the MX hosts is down, the
-average SMTP connection will take approximately 15 seconds to complete.
-With a default per-destination concurrency limit of 20 connections,
-throughput falls to just over 1 message per second. 
    
-
-
     The best way to avoid bottlenecks when one or more MX hosts is
-non-responsive is to use connection caching. Connection caching was
-introduced with Postfix 2.2 and is by default enabled on demand for
-destinations with a backlog of mail in the active queue. When connection
-caching is in effect for a particular destination, established connections
-are re-used to send additional messages, this reduces the number of
-connections made per message delivery and maintains good throughput even
-in the face of partial unavailability of the destination's MX hosts. 
    
-
-
     If connection caching is not available (Postfix < 2.2) or does
-not provide a sufficient latency reduction, especially for the "relay"
-transport used to forward mail to "your own" domains, consider setting
-lower than default SMTP connection timeouts (1-5 seconds) and higher
-than default destination concurrency limits. This will further reduce
-latency and provide more concurrency to maintain throughput should
-latency rise. 
    
-
-
     Setting high concurrency limits to domains that are not your own may
-be viewed as hostile by the receiving system, and steps may be taken
-to prevent you from monopolizing the destination system's resources.
-The defensive measures may substantially reduce your throughput or block
-access entirely. Do not set aggressive concurrency limits to remote
-domains without coordinating with the administrators of the target
-domain. 
    
-
-
     If necessary, dedicate and tune custom transports for selected high
-volume destinations. The "relay" transport is provided for forwarding mail
-to domains for which your server is a primary or backup MX host. These can
-make up a substantial fraction of your email traffic. Use the "relay" and
-not the "smtp" transport to send email to these domains. Using the "relay"
-transport allocates a separate delivery agent pool to these destinations
-and allows separate tuning of timeouts and concurrency limits. 
    
-
-
     Another common cause of congestion is unwarranted flushing of the
-entire deferred queue. The deferred queue holds messages that are likely
-to fail to be delivered and are also likely to be slow to fail delivery
-(time out). As a result the most common reaction to a large deferred queue
-(flush it!) is more than likely counter-productive, and typically makes
-the congestion worse. Do not flush the deferred queue unless you expect
-that most of its content has recently become deliverable (e.g. relayhost
-back up after an outage)!  
    
+
     Especially for the "relay" transport, consider lower SMTP
+connection timeouts (1-5 seconds) and higher than default destination
+concurrency limits. Compute the expected latency when 1 out of N
+of the MX hosts for a high volume site is down and not responding,
+and make sure that the configured concurrency divided by this
+latency exceeds the required steady-state message rate. If the
+destination is managed by you, consider load balancers in front of
+groups of MX hosts. Load balancers have higher uptime and will be
+able to hide individual MX host failures.  
    
+
+
     If necessary, dedicate and tune custom transports for high
+volume destinations.  
    
+
+
     Another common cause of congestion is unwarranted flushing of
+the entire deferred queue. The deferred queue holds messages that
+are likely to fail to be delivered and are also likely to be slow
+to fail delivery (timeouts). This means that the most common reaction
+to a large deferred queue (flush it!) is more than likely counter-
+productive, and is likely to make the problem worse. Do not flush
+the deferred queue unless you expect that most of its content has
+recently become deliverable (e.g. relayhost back up after an outage)!
+
    
 
 
     Note that whenever the queue manager is restarted, there may
 already be messages in the active queue directory, but the "real"
@@ -768,7 +723,7 @@ queue scan to refill the active queue<
 the messages back and forth, redoing transport table (trivial-rewrite(8)
 resolve service) lookups, and re-importing the messages back into
 memory is expensive. At all costs, avoid frequent restarts of the
-queue manager (e.g. via frequent execution of "postfix reload").  
    
+queue manager.  
    
 
 
      The "deferred" queue  
    
 
@@ -777,19 +732,20 @@ and for some recipients delivery failed for a transient reason (it
 might succeed later), the message is placed in the deferred queue.
 
    
 
-
     The queue manager scans the deferred queue periodically. The scan
-interval is controlled by the queue_run_delay parameter.  While a deferred
-queue scan is in progress, if an incoming queue scan is also in progress
-(ideally these are brief since the incoming queue should be short), the
-queue manager alternates between looking for messages in the "incoming"
-queue and in the "deferred" queue. This "round-robin" strategy prevents
-starvation of either the incoming or the deferred queues.  
    
+
     The queue manager scans the deferred queue periodically. The
+scan interval is controlled by the queue_run_delay parameter.
+While a deferred queue scan is in progress, if an incoming queue
+scan is also in progress (ideally these are brief since the incoming
+queue should be short), the queue manager alternates between bringing
+a new "incoming" message and a new "deferred" message into the
+queue.  This "round-robin" strategy prevents starvation of either
+the incoming or the deferred queues.  
    
 
 
     Each deferred queue scan only brings a fraction of the deferred
 queue back into the active queue for a retry. This is because each
 message in the deferred queue is assigned a "cool-off" time when
 it is deferred.  This is done by time-warping the modification
-time of the queue file into the future. The queue file is not
+times of the queue file into the future. The queue file is not
 eligible for a retry if its modification time is not yet reached.
 
    
 
@@ -800,34 +756,28 @@ within the limits. This means that young messages are initially
 retried more often than old messages.  
    
 
 
     If a high volume site routinely has large deferred queues, it
-may be useful to adjust the queue_run_delay, minimal_backoff_time and
-maximal_backoff_time to provide short enough delays on first failure
-(Postfix ≥ 2.4 has a sensibly low minimal backoff time by default),
-with perhaps longer delays after multiple failures, to reduce the
-retransmission rate of old messages and thereby reduce the quantity
-of previously deferred mail in the active queue.  If you want a really
-low minimal_backoff_time, you may also want to lower queue_run_delay,
-but understand that more frequent scans will increase the demand for
-disk I/O. 
    
+may be useful to adjust the queue_run_delay, minimal_backoff_time
+and maximal_backoff_time to provide short enough delays on first
+failure, with perhaps longer delays after multiple failures, to
+reduce the retransmission rate of old messages and thereby reduce
+the quantity of previously deferred mail in the active queue.  
    
 
 
     One common cause of large deferred queues is failure to validate
 recipients at the SMTP input stage. Since spammers routinely launch
 dictionary attacks from unrepliable sender addresses, the bounces
-for invalid recipient addresses clog the deferred queue (and at high
-volumes proportionally clog the active queue). Recipient validation
-is strongly recommended through use of the local_recipient_maps and
-relay_recipient_maps parameters. Even when bounces drain quickly they
-inundate innocent victims of forgery with unwanted email. To avoid
-this, do not accept mail for invalid recipients. 
    
+for invalid recipient addresses clog the deferred queue (and at
+high volumes proportionally clog the active queue). Recipient
+validation is strongly recommended through use of the local_recipient_maps
+and relay_recipient_maps parameters.  
    
 
 
     When a host with lots of deferred mail is down for some time,
 it is possible for the entire deferred queue to reach its retry
 time simultaneously. This can lead to a very full active queue once
 the host comes back up. The phenomenon can repeat approximately
 every maximal_backoff_time seconds if the messages are again deferred
-after a brief burst of congestion. Perhaps, a future Postfix release
+after a brief burst of congestion. Ideally, in the future Postfix
 will add a random offset to the retry time (or use a combination
-of strategies) to reduce the odds of repeated complete deferred
+of strategies) to reduce the chances of repeated complete deferred
 queue flushes.  
    
 
 
    Credits
    
diff --git a/postfix/html/SASL_README.html b/postfix/html/SASL_README.html
index 3824e7de2..20b1a562f 100644
--- a/postfix/html/SASL_README.html
+++ b/postfix/html/SASL_README.html
@@ -149,7 +149,7 @@ their CCARGS and AUXLIBS into the above command line. 
    
 
 
    Building the Cyrus SASL library
    
 
-
     Postfix appears to work with cyrus-sasl-1.5.x or cyrus-sasl-2.1.x, 
+
     Postfix appears to work with cyrus-sasl-1.5.5 or cyrus-sasl-2.1.1, 
 which are available from: 
    
 
 
    
@@ -160,11 +160,11 @@ which are available from: 
    
 
 
     IMPORTANT: if you install the Cyrus SASL libraries as per the
 default, you will have to symlink /usr/lib/sasl -> /usr/local/lib/sasl
-for version 1.5.x or /usr/lib/sasl2 -> /usr/local/lib/sasl2 for
-version 2.1.x. 
    
+for version 1.5.5 or /usr/lib/sasl2 -> /usr/local/lib/sasl2 for
+version 2.1.1. 
    
 
-
     Reportedly, Microsoft Outlook (Express) requires the
-non-standard LOGIN authentication method. To enable this
+
     Reportedly, Microsoft Internet Explorer version 5 requires the
+non-standard SASL LOGIN authentication method. To enable this
 authentication method, specify ``./configure --enable-login''. 
    
 
 
    Building Postfix with Cyrus SASL support
    
@@ -178,7 +178,7 @@ and that the Cyrus SASL libraries are in /usr/local/lib. 
    
 
 
    
 
-
     (for Cyrus SASL version 1.5.x):
+
     (for Cyrus SASL version 1.5.5):
 
    
 
     % make tidy # if you have left-over files from a previous build
@@ -186,7 +186,7 @@ and that the Cyrus SASL libraries are in /usr/local/lib. 
    
     -I/usr/local/include" AUXLIBS="-L/usr/local/lib -lsasl"
 
    
 
-
     (for Cyrus SASL version 2.1.x):
+
     (for Cyrus SASL version 2.1.1):
 
    
 
     % make tidy # if you have left-over files from a previous build
@@ -201,7 +201,7 @@ otherwise ld.so will not find the SASL shared library: 
    
 
 
    
 
-
     (for Cyrus SASL version 1.5.x):
+
     (for Cyrus SASL version 1.5.5):
 
    
 
     % make tidy # if you have left-over files from a previous build
@@ -210,7 +210,7 @@ otherwise ld.so will not find the SASL shared library: 
    
     -R/usr/local/lib -lsasl"
 
    
 
-
     (for Cyrus SASL version 2.1.x):
+
     (for Cyrus SASL version 2.1.1):
 
    
 
     % make tidy # if you have left-over files from a previous build
@@ -258,9 +258,8 @@ SMTP server
 
 
     Older Microsoft SMTP client software implements a non-standard
 version of the AUTH protocol syntax, and expects that the SMTP
-server replies to EHLO with "250 AUTH=mechanism-list" instead of
-"250 AUTH mechanism-list".  To accommodate such clients (in addition
-to conformant
+server replies to EHLO with "250 AUTH=stuff" instead of "250 AUTH
+stuff".  To accommodate such clients (in addition to conformant
 clients) use the following: 
    
 
 
    
@@ -319,41 +318,22 @@ the Dovecot authentication server. 
    
 
    Cyrus SASL configuration for the Postfix
 SMTP server
    
 
-
     You need to configure how the Cyrus SASL library should
-authenticate a client's username and password. These settings must
-be stored in a separate configuration file. 
    
-
-
     The name of the configuration file (default: smtpd.conf) will
-be constructed from a value sent by Postfix to the Cyrus SASL
-library, which adds the suffix .conf. The value is configured using
-one of the following variables: 
    
-
-
    
-
    -/etc/postfix/main.cf:
-    # Postfix 2.3 and later
-    smtpd_sasl_path = smtpd
-    # Postfix < 2.3
-    smtpd_sasl_application_name = smtpd
-
    
-
    
-
-
     Cyrus SASL searches for the configuration file in /usr/local/lib/sasl/
-(Cyrus SASL version 1.5.5) or /usr/local/lib/sasl2/ (Cyrus SASL
-version 2.1.x). 
    
+
     In /usr/local/lib/sasl/smtpd.conf (Cyrus SASL version 1.5.5) or
+/usr/local/lib/sasl2/smtpd.conf (Cyrus SASL version 2.1.1) you need to
+specify how the server should validate client passwords. 
    
 
 
     Note: some Postfix distributions are modified and look for 
-the smtpd.conf file in /etc/postfix/sasl. 
    
+the smtpd.conf file in /etc/postfix. 
    
 
 
     Note: some Cyrus SASL distributions look for the smtpd.conf
 file in /etc/sasl2. 
    
 
 
      
 
-
    •  
       To authenticate against the UNIX password database, use: 
      
+
    •  
       To authenticate against the UNIX password database, try: 
      
 
 
      
-
       (Cyrus SASL version 1.5.x)
+
       (Cyrus SASL version 1.5.5)
 
      
 
       /usr/local/lib/sasl/smtpd.conf:
@@ -361,13 +341,39 @@ file in /etc/sasl2. 
      
 
 
      
 
-
       IMPORTANT: pwcheck establishes a UNIX domain socket in /var/pwcheck
-and waits for authentication requests. Postfix processes must have
-read+execute permission to this directory or authentication attempts
-will fail. 
      
+
       (Cyrus SASL version 2.1.1)
+
      
+
      +/usr/local/lib/sasl2/smtpd.conf:
+    pwcheck_method: pwcheck
+
      
+
+
      
+
+
       The name of the file in /usr/local/lib/sasl (Cyrus SASL version
+1.5.5) or /usr/local/lib/sasl2 (Cyrus SASL version 2.1.1) used by
+the SASL
+library for configuration can be set with: 
      
+
+
      
+
      +/etc/postfix/main.cf:
+    smtpd_sasl_application_name = smtpd (Postfix < 2.3)
+    smtpd_sasl_path = smtpd (Postfix 2.3 and later)
+
      
+
      
 
 
       The pwcheck daemon is contained in the cyrus-sasl source tarball. 
      
 
+
       IMPORTANT: postfix processes need to have group read+execute
+permission for the /var/pwcheck directory, otherwise authentication
+attempts will fail. 
      
+
+
    •  
       Alternately, in Cyrus SASL 1.5.26 and later (including
+2.1.1), try: 
      
+
+
      
+
 
       (Cyrus SASL version 1.5.26)
 
      
 
      @@ -375,12 +381,11 @@ will fail. 
      
     pwcheck_method: saslauthd
 
      
 
-
       (Cyrus SASL version 2.1.x)
+
       (Cyrus SASL version 2.1.1)
 
      
 
       /usr/local/lib/sasl2/smtpd.conf:
     pwcheck_method: saslauthd
-    mech_list: PLAIN LOGIN
 
      
 
 
      
@@ -390,38 +395,27 @@ tarball.  It is more flexible than the pwcheck daemon, in that it
 can authenticate against PAM and various other sources. To use PAM,
 start saslauthd with "-a pam". 
      
 
-
       IMPORTANT: saslauthd usually establishes a UNIX domain socket
-in /var/run/saslauthd and waits for authentication requests. Postfix
-processes must have read+execute permission to this directory or
-authentication attempts will fail. 
      
-
-
       Note: The directory where saslauthd puts the socket is configurable.
-See the command-line option "-m /path/to/socket" in the saslauthd
---help listing. 
      
-
 
    •  
       To authenticate against Cyrus SASL's own password database: 
      
 
 
      
-
       (Cyrus SASL version 1.5.x)
+
       (Cyrus SASL version 1.5.5)
 
      
 
       /usr/local/lib/sasl/smtpd.conf:
-    pwcheck_method: sasldb
+    pwcheck_method:  sasldb
 
      
 
-
       (Cyrus SASL version 2.1.x)
+
       (Cyrus SASL version 2.1.1)
 
      
 
       /usr/local/lib/sasl2/smtpd.conf:
-    pwcheck_method: auxprop
-    auxprop_plugin: sasldb
-    mech_list: PLAIN LOGIN CRAM-MD5 DIGEST-MD5
+    pwcheck_method:  auxprop
 
      
 
 
      
 
 
       This will use the Cyrus SASL password file (default: /etc/sasldb in
-version 1.5.x, or /etc/sasldb2 in version 2.1.x), which is maintained
+version 1.5.5, or /etc/sasldb2 in version 2.1.1), which is maintained
 with the saslpasswd or saslpasswd2 command (part of the Cyrus SASL
 software). On some poorly-supported systems the saslpasswd command needs
 to be run multiple times before it stops complaining.  The Postfix SMTP
@@ -436,13 +430,13 @@ domain (realm) to a fully qualified domain name. 
      
 
       EXAMPLE: 
      
 
 
      
-
       (Cyrus SASL version 1.5.x)
+
       (Cyrus SASL version 1.5.5)
 
      
 
       % saslpasswd -c -u `postconf -h myhostname` exampleuser
 
      
 
-
       (Cyrus SASL version 2.1.x)
+
       (Cyrus SASL version 2.1.1)
 
      
 
       % saslpasswd2 -c -u `postconf -h myhostname` exampleuser
@@ -451,8 +445,8 @@ domain (realm) to a fully qualified domain name. 
      
 
      
 
 
       You can find out SASL's idea about the realms of the users
-in sasldb with sasldblistusers (Cyrus SASL version 1.5.x) or
-sasldblistusers2 (Cyrus SASL version 2.1.x). 
      
+in sasldb with sasldblistusers (Cyrus SASL version 1.5.5) or
+sasldblistusers2 (Cyrus SASL version 2.1.1). 
      
 
 
       On the Postfix side, you can have only one realm per smtpd
 instance, and only the users belonging to that realm would be able to
@@ -468,14 +462,18 @@ realm used by smtpd: 
      
 
 
    
 
-
     IMPORTANT: The Cyrus SASL password verification services pwcheck
-and saslauthd can only support the plaintext mechanisms PLAIN or
-LOGIN.  However, the Cyrus SASL library doesn't know this, and will
-happily advertise other authentication mechanisms that the SASL
-library implements, such as DIGEST-MD5. As a result, if an SMTP
-client chooses any mechanism other than PLAIN or LOGIN while pwcheck
-or saslauthd are used, authentication will fail. Thus you may need
-to limit the list of mechanisms advertised by Postfix. 
    
+
     IMPORTANT: all users must be able to authenticate using ALL
+authentication mechanisms advertised by Postfix, otherwise the
+negotiation might end up with an unsupported mechanism, and
+authentication would fail.  For example if you configure SASL to
+use saslauthd for authentication against PAM (pluggable
+authentication modules), only the PLAIN and LOGIN mechanisms are
+supported and stand a chance to succeed, yet the SASL library would also
+advertise other mechanisms, such as DIGEST-MD5.  This happens because
+those mechanisms are made available by other plugins, and the SASL
+library have no way to know that your only valid authentication source
+is PAM.  Thus you might need to limit the list of mechanisms advertised
+by Postfix. 
    
 
 
       
 
@@ -483,9 +481,7 @@ to limit the list of mechanisms advertised by Postfix. 
      
 library files from the SASL plug-in directory (and again whenever
 the system is updated). 
      
 
-
    •  
       With Cyrus SASL version 2.1.x or later the mech_list variable
-can specify a list of authentication mechanisms that Cyrus SASL may
-offer: 
      
+
    •  
       With Cyrus SASL version 2.1.1 or later: 
      
 
 
      
 
      @@ -501,17 +497,17 @@ used for authentication. 
      
 
 
        
 
-
      •  
         With Cyrus SASL version 1.5.x your only choice is to
+
      •  
         With Cyrus SASL version 1.5.5 your only choice is to
 delete the corresponding library files from the SASL plug-in 
 directory. 
        
 
-
      •  
         With SASL version 2.1.x: 
        
+
      •  
         With SASL version 2.1.1: 
        
 
 
        
 
         /usr/local/lib/sasl2/smtpd.conf:
-    pwcheck_method: auxprop
-    auxprop_plugin: sql
+    pwcheck_method:  auxprop
+    auxprop_plugin:  sql
 
        
 
        
 
@@ -574,10 +570,8 @@ to recover from the base64-encoded form. 
        
 
        Trouble shooting the SASL internals
        
 
 
         In the Cyrus SASL sources you'll find a subdirectory named
-"sample".  Run make there, then create a symbolic link from sample.conf
-to smtpd.conf in your Cyrus SASL library directory /usr/local/lib/sasl2.
-"su" to the user postfix (or whatever your mail_owner
-directive is set to): 
        
+"sample".  Run make there, "su" to the user postfix (or
+whatever your mail_owner directive is set to):
 
 
        
 
        @@ -586,11 +580,10 @@ directive is set to): 
        
 
        
 
 
         then run the resulting sample server and client in separate
-terminals.  The sample applications send log messages to the syslog
-facility auth.  Check the log to fix the problem or run strace /
-ktrace / truss on the server to see what makes it unhappy. Repeat
-the previous step until you can successfully authenticate with the
-sample client. Only then get back to Postfix. 
        
+terminals.  Strace / ktrace / truss the server to see what makes
+it unhappy, and fix the problem.  Repeat the previous step until
+you can successfully authenticate with the sample client.  Only
+then get back to Postfix. 
        
 
 
        Enabling SASL authentication in the
 Postfix SMTP client
        
@@ -619,12 +612,6 @@ table. 
        
 
      
 
      
 
-
       The Postfix SASL client password file is opened before the SMTP
-server enters the optional chroot jail, so you can keep the file
-in /etc/postfix and set permissions read / write only for root to
-keep the username:password combinations away from other system
-users. 
      
-
 
       Postfix version 2.3 supports-per-sender SASL password
 information. To search the Postfix SASL password by sender 
 before it searches by destination, specify: 
      
@@ -658,6 +645,10 @@ for example: 
      
 
    
 
    
 
+
     The Postfix SASL client password file is opened before the SMTP server
+enters the optional chroot jail, so you can keep the file in
+/etc/postfix. 
    
+
 
     Note: Some SMTP servers support authentication mechanisms that,
 although available on the client system, may not in practice work or
 possess the appropriate credentials to authenticate to the server. It
@@ -673,7 +664,7 @@ into consideration:  
    
 
    • 
 
 
     In the above example, Postfix will decline to use mechanisms
-that require special infrastructure such as Kerberos or TLS. 
    
+that require special infrastructure such as Kerberos. 
    
 
 
     The Postfix SMTP client is backwards compatible with SMTP
 servers that use the non-standard "AUTH=method..." syntax in response
@@ -703,9 +694,6 @@ smtpd_sasl_application_name into smtpd
 
  •  The Dovecot SMTP server-only plug-in was originally implemented by
 Timo Sirainen of Procontrol, Finland.
 
-
  •  Patrick Ben Koetter revised this document for Postfix 2.4 and
-made much needed updates.
-
 
 
 
diff --git a/postfix/html/SMTPD_POLICY_README.html b/postfix/html/SMTPD_POLICY_README.html
index 9962eae6f..0e0a21c45 100644
--- a/postfix/html/SMTPD_POLICY_README.html
+++ b/postfix/html/SMTPD_POLICY_README.html
@@ -35,8 +35,7 @@ at http://www.openspf.org/Software
 
 
     Policy delegation is now the preferred method for adding policies
 to Postfix. It's much easier to develop a new feature in few lines
-of Perl, Python, Ruby, or TCL, than trying to do the same in C code.
-The difference in
+of Perl, than trying to do the same in C code. The difference in
 performance will be unnoticeable except in the most demanding
 environments. On active systems a policy daemon process is used
 multiple times, for up to $max_use incoming SMTP connections. 
    
@@ -165,7 +164,7 @@ etrn_domain=
     These attributes are empty in case of no certificate authentication.
     As of Postfix 2.2.11 these attribute values are encoded as
     xtext: some characters are represented by +XX, where XX is the
-    two-digit hexadecimal representation of the character value.
+    two-digit hecadecimal representation of the character value.
     
    
 
     
  •  
     The "encryption_*" attributes (Postfix 2.3 and later)
diff --git a/postfix/html/SMTPD_PROXY_README.html b/postfix/html/SMTPD_PROXY_README.html
index 53fdb5a44..646ddca7d 100644
--- a/postfix/html/SMTPD_PROXY_README.html
+++ b/postfix/html/SMTPD_PROXY_README.html
@@ -118,8 +118,6 @@ Postfix and does one of the following:  
    
     
  •  
     Re-inject the mail back into Postfix via SMTP, perhaps
     after changing its content and/or destination. 
    
 
-    
  •  
     Discard or quarantine the mail. 
    
-
     
  •  
     Reject the mail by sending a suitable SMTP status code
     back to Postfix. Postfix passes the status back to the remote
     SMTP client. This way, Postfix does not have to send a bounce
@@ -270,8 +268,9 @@ the top of the master.cf file: 
    
     This limit is not necessary if you receive all mail from a
     trusted relay host. 
    
 
-    
     Note: this setting is available in Postfix version 2.2 and
-    later.  Earlier Postfix versions will ignore it.  
    
+    
     Note: this setting is ignored by the stable Postfix 2.1
+    release. The feature will be available only in the experimental
+    release until Postfix 2.2.  
    
 
     
  •  
     The "-o smtpd_proxy_filter=127.0.0.1:10025" tells the
     before filter SMTP server that it should give incoming mail to
diff --git a/postfix/html/TLS_LEGACY_README.html b/postfix/html/TLS_LEGACY_README.html
index d9862b104..634c3828b 100644
--- a/postfix/html/TLS_LEGACY_README.html
+++ b/postfix/html/TLS_LEGACY_README.html
@@ -829,7 +829,7 @@ is correctly configured to supply its intermediate CA certificate). 
    
 
     /etc/postfix/main.cf:
     smtp_tls_dcert_file = /etc/postfix/client-dsa.pem
-    smtp_tls_dkey_file = $smtp_tls_dcert_file
+    smtp_tls_dkey_file = $smtpd_tls_cert_file
 
      
 
    • 
 
@@ -857,7 +857,7 @@ privileges) from the files in the directory when the information
 is needed. Thus, the $smtp_tls_CApath directory needs to be accessible
 inside the optional chroot jail.  
    
 
-
     The choice between $smtp_tls_CAfile and $smtp_tls_CApath is
+
     The choice between $smtp_tls_CAfile and $smtpd_tls_CApath is
 a space/time tradeoff. If there are many trusted CAs, the cost of
 preloading them all into memory may not pay off in reduced access time
 when the certificate is needed.  
    
diff --git a/postfix/html/TLS_README.html b/postfix/html/TLS_README.html
index 1cbe97e32..4ad918612 100644
--- a/postfix/html/TLS_README.html
+++ b/postfix/html/TLS_README.html
@@ -969,7 +969,7 @@ is correctly configured to supply its intermediate CA certificate). 
    
 
     /etc/postfix/main.cf:
     smtp_tls_dcert_file = /etc/postfix/client-dsa.pem
-    smtp_tls_dkey_file = $smtp_tls_dcert_file
+    smtp_tls_dkey_file = $smtpd_tls_cert_file
 
      
 
    • 
 
@@ -997,7 +997,7 @@ privileges) from the files in the directory when the information
 is needed. Thus, the $smtp_tls_CApath directory needs to be accessible
 inside the optional chroot jail.  
    
 
-
     The choice between $smtp_tls_CAfile and $smtp_tls_CApath is
+
     The choice between $smtp_tls_CAfile and $smtpd_tls_CApath is
 a space/time tradeoff. If there are many trusted CAs, the cost of
 preloading them all into memory may not pay off in reduced access time
 when the certificate is needed.  
    
@@ -1222,7 +1222,7 @@ TLS is used selectively, only with destinations explicitly configured
 for TLS. 
    
 
 
     You can disable TLS for a subset of destinations, while leaving
-it enabled for the rest. With the Postfix 2.3 and later TLS policy table, specify the "none"
 security level. With the obsolete per-site
 table, specify the "NONE" keyword. 
    
@@ -1267,7 +1267,7 @@ Attempts to configure opportunistic encryption of LMTP sessions will
 be ignored with a warning written to the mail logs. 
    
 
 
     You can enable opportunistic TLS just for selected destinations. With
-the Postfix 2.3 and later TLS policy table,
+the Postfix 2.3+ TLS policy table,
 specify the "may" security level. With the obsolete per-site table, specify the "MAY" keyword.
    
 
@@ -1329,11 +1329,11 @@ that delivers mail to the Internet, you should not configure mandatory
 TLS encryption as the default security level. 
    
 
 
     You can enable mandatory TLS encryption just for specific destinations.
-With the Postfix 2.3 and later TLS policy
+With the Postfix 2.3+ TLS policy
 table, specify the "encrypt" security level. With the
 obsolete per-site table, specify the
 "MUST_NOPEERMATCH" keyword. While the obsolete approach still works
-with Postfix 2.3, it is strongly discouraged: users of Postfix 2.3 and later
+with Postfix 2.3, it is strongly discouraged: users of Postfix 2.3+
 should use the new TLS policy settings. 
    
 
 
     Examples: 
    
@@ -1357,7 +1357,7 @@ level sessions.

    Postfix 2.2 syntax (no support for sub-domains without resorting to -regexp tables). With Postfix 2.3 and later, do not use the obsolete per-site table.

    @@ -1408,8 +1408,7 @@ example, "example.net"). Instead, use the destination (for example, "[example.net]:587"), as the per-site table lookup key (a recipient domain or MX-enabled transport nexthop with no port suffix may look like a bare -hostname, but is still a suitable destination). With Postfix 2.3 -and later, +hostname, but is still a suitable destination). With Postfix 2.3+, do not use the obsolete per-site table; use the new policy table instead.

    @@ -1469,12 +1468,12 @@ href="#client_tls_secure">secure-channel configuration instead.

    You can enable mandatory server certificate verification just -for specific destinations. With the Postfix 2.3 and later TLS policy table, specify the "verify" security level. With the obsolete per-site table, specify the "MUST" keyword. While the obsolete approach still works with Postfix 2.3, it is strongly discouraged: users of -Postfix 2.3 and later should use the new TLS policy settings.

    +Postfix 2.3+ should use the new TLS policy settings.

    Example:

    @@ -1551,13 +1550,12 @@ sends all email to a central mailhub that offers the necessary STARTTLS support.

    You can enable secure TLS verification just for specific destinations. -With the Postfix 2.3 and later TLS policy table, +With the Postfix 2.3+ TLS policy table, specify the "secure" security level. With the obsolete per-site table, specify the "MUST" keyword and harden the certificate verification against DNS forgery. While the obsolete approach still -works with Postfix 2.3, it is strongly discouraged: users of Postfix 2.3 -and later +works with Postfix 2.3, it is strongly discouraged: users of Postfix 2.3+ should use the new TLS policy settings.

    Examples:

    @@ -1636,15 +1634,14 @@ email if the related domains change hands.

    -

    Postfix 2.2.9 and later syntax:

    +

    Postfix 2.2.9+ syntax:

    Note: Avoid policy lookups with the bare hostname (for example, "tls.example.com"). Instead, use the destination (for example, "[tls.example.com]") as the per-site table lookup key (a recipient domain or MX-enabled transport nexthop with no port suffix may look like a bare -hostname, but is still a suitable destination). With Postfix 2.3 -and later, +hostname, but is still a suitable destination). With Postfix 2.3+, do not use the obsolete per-site table; use the new policy table instead.

    @@ -1812,8 +1809,7 @@ for sessions with mandatory encryption.

    full destination nexthop (enclosed in [] with a possible ":port" suffix) as the per-site table lookup key (a recipient domain or MX-enabled transport nexthop with no port suffix may look like a bare -hostname, but is still a suitable destination). With Postfix 2.3 -and later, +hostname, but is still a suitable destination). With Postfix 2.3+, use of the obsolete approach documented here is strongly discouraged: use the new policy table instead.

    @@ -1930,8 +1926,7 @@ obsolete per-site TLS policies

    For a general discussion of TLS security for SMTP see TLS limitations above. What follows applies only to Postfix 2.2.9 and subsequent Postfix 2.2 patch levels. Do -not use this approach with Postfix 2.3 -and later; instead see the instructions under secure server certificate verification.

    As long as no secure DNS lookup mechanism is available, false diff --git a/postfix/html/TUNING_README.html b/postfix/html/TUNING_README.html index 8b5f47a9d..cf7e2a3ea 100644 --- a/postfix/html/TUNING_README.html +++ b/postfix/html/TUNING_README.html @@ -134,7 +134,7 @@ file contains bad information, or some packet filter is blocking the DNS requests or replies.

  • If the number of smtpd(8) processes has reached the process -limit as specified in master.cf, new SMTP clients must wait until +limit as specified in master.cf, new SMTP clients must wait until a process becomes available. Increase the number of processes if memory permits. See the instructions given under "Tuning the number of Postfix processes". @@ -159,7 +159,7 @@ by turning off the delay: 

    -/etc/postfix/main.cf:
+/etc/postfix/main.cf:
     # Not needed with Postfix 2.1
     smtpd_error_sleep_time = 0
    @@ -224,56 +224,42 @@ seconds or $smtpd_error_sleep_t

    Measures against clients that make too many connections

    -

    Note: these features use the Postfix anvil(8) service, introduced -with Postfix version 2.2.

    +

    Note: this feature is not included with Postfix version 2.1.

    The Postfix smtpd(8) server can limit the number of simultaneous -connections from the same SMTP client, as well as the connection -rate and the rate of certain SMTP commands from the same client. +connections from the same SMTP client, as well as the number of +connections that a client is allowed to make per unit time. These statistics are maintained by the anvil(8) server (translation: if anvil(8) breaks, then connection limits stop working).

    -

    IMPORTANT: These limits must not be used to regulate legitimate -traffic: mail will suffer grotesque delays if you do so. The limits -are designed to protect the smtpd(8) server against abuse by -out-of-control clients.

    +

    IMPORTANT: These limits are designed to protect the smtpd(8) server +against flagrant abuse. Do not use these limits to regulate legitimate +traffic: mail will suffer grotesque delays if you do so.

    -
    - -
    - -
    smtpd_client_connection_count_limit (default: 50)
    -The maximum number of connections than an SMTP client may make -simultaneously.
    +
    +

  • The anvil_rate_time_unit parameter specifies the time +unit over which client connection rates are computed (default: +60s). -

    • +

    General mail delivery performance tips

    @@ -356,7 +342,7 @@ channel.

  • The default_destination_concurrency_limit parameter (default: 20) controls how many messages may be sent to the same destination simultaneously. You can override this setting for specific message -delivery transports by taking the name of the master.cf entry +delivery transports by taking the name of the master.cf entry and appending "_destination_concurrency_limit".

    @@ -373,7 +359,7 @@ is not useful. Another good reason to limit delivery concurrency to the same recipient: if the recipient has an expensive shell command in her .forward file, or if the recipient is a mailing list manager, you don't want to run too many instances of those processes -at the same time.

    +the same time.

  • The default smtp_destination_concurrency_limit of 20 seems enough to noticeably load a system without bringing it to its knees. @@ -418,8 +404,8 @@ as 5s or even 1s can be used to prevent congestion when one or more, but not all MX hosts are down.

    If necessary, set a higher transport_destination_concurrency_limit -(in main.cf since this is a queue manager parameter) and a lower -smtp_connection_timeout (with a "-o" override in master.cf since +(in main.cf since this is a queue manager parameter) and a lower +smtp_connection_timeout (with a "-o" override in master.cf since this parameter has no per-transport name) for the relay transport and any transports dedicated for specific high volume destinations.

    @@ -478,12 +464,10 @@ some amount of time.

    -
    queue_run_delay (default: 300 seconds; before Postfix 2.4: -1000s)
    How often +
    queue_run_delay (default: 1000 seconds)
    How often the queue manager scans the queue for deferred mail.
    -
    minimal_backoff_time (default: 300 seconds; before Postfix -2.4: 1000s)
    The +
    minimal_backoff_time (default: 1000 seconds)
    The minimal amount of time a message won't be looked at, and the minimal amount of time to stay away from a "dead" destination.
    @@ -534,8 +518,7 @@ that usually requires timing out one or more SMTP connections.

    always better than increasing the frequency of delivery attempts. However, if you can control only the delivery attempt frequency, consider using a dedicated fallback_relay "graveyard" machine for -bad destinations, so that these destinations do not ruin the -performance of normal +bad destinations so that they do not ruin the performance of normal mail deliveries.

    Tuning the number of Postfix processes

    @@ -547,30 +530,30 @@ smtp server processes, and so on. This may overwhelm systems with little memory, as well as networks with low bandwidth.

    You can change the global process limit by specifying a -non-default default_process_limit in the main.cf file. For example, +non-default default_process_limit in the main.cf file. For example, to run up to 10 smtp client processes, 10 smtp server processes, and so on: 

    -/etc/postfix/main.cf:
+/etc/postfix/main.cf:
     default_process_limit = 10

    You need to execute "postfix reload" to make the change effective. The limits are enforced by the Postfix master(8) daemon which does -not automatically read main.cf when it changes.

    +not automatically read main.cf when it changes.

    You can override the process limit for specific Postfix daemons -by editing the master.cf file. For example, if you do not wish to +by editing the master.cf file. For example, if you do not wish to receive 100 SMTP messages at the same time, but do not want to change the process limits for local mail deliveries, you could specify: 

    -/etc/postfix/master.cf:
+/etc/postfix/master.cf:
     # ====================================================================
     # service type  private unpriv  chroot  wakeup  maxproc command + args
     #               (yes)   (yes)   (yes)   (never) (100)
@@ -589,20 +572,6 @@ errors. 
    
 
 
      
 
-
    •  
       Depending on your Postfix and operating system versions
-you may need to recompile Postfix if you need more than 1024 file
-descriptors per process: 
      
-
-
         
      •  
         No recompilation is needed for Postfix version 2.4
-and later, when it was compiled for systems that support BSD kqueue(2)
-(FreeBSD 4.1, NetBSD 2.0, OpenBSD 2.9), Solaris 8 /dev/poll, or
-Linux 2.6 epoll(4).  
        
-
-
      •  
         Otherwise, Postfix needs to be recompiled to override the
-default FD_SETSIZE value. 
        
-
-
      
-
 
    •  
       Reduce the number of processes as described under "Tuning the number of Postfix processes" above. 
 Fewer processes need fewer open files and sockets. 
      
@@ -615,8 +584,7 @@ with your system tuning guide:  
      
 
        
 
 
      •  
         Some FreeBSD kernel parameters can be specified in
-/boot/loader.conf, and some can be specified in /etc/sysctl.conf
-or changed with sysctl commands.
+/boot/loader.conf, and some can be changed with sysctl commands.
 Which is which depends on the version.
 
        
 
@@ -629,7 +597,7 @@ kern.maxfilesperproc="16384"

  • Linux kernel parameters can be specified in /etc/sysctl.conf -or changed with sysctl commands:

    +and can also be changed with sysctl commands: 

     fs.file-max=16384
@@ -638,7 +606,7 @@ kernel.threads-max=2048
 
 
  •  
     Solaris kernel parameters can be specified in /etc/system,
 as described in the Solaris
+href="http://www.science.uva.nl/pub/solaris/solaris2.html#q3.46">Solaris
 FAQ entry titled "How can I increase the number of file
 descriptors per process?" 
    
 
diff --git a/postfix/html/ULTRIX_README.html b/postfix/html/ULTRIX_README.html
new file mode 100644
index 000000000..b2fb39c4e
--- /dev/null
+++ b/postfix/html/ULTRIX_README.html
@@ -0,0 +1,71 @@
+
+
+
+
+
+
+Postfix and Ultrix 
+
+
+
+
+
+
+
+
    Postfix and Ultrix 
    
+
+
    
+
+
     Postfix on Ultrix 
    
+
+
     This document is probably only of historical value, because
+Ultrix version 4 dates from the early 1990s. However, as long as
+Wietse keeps Postfix alive for SunOS 4, it is likely to run on
+Ultrix 4 with very little change. Feedback is welcome if anyone
+actually still uses Postfix on any version of Ultrix. 
    
+
+
     The source of this document is an email message by Christian von Roques
+that was sent on Jun 2, 1999. 
    
+
+
     
+
+
     I've upgraded the MTA of our DECstation-3100 running Ultrix4.3a to
+postfix-19990317-pl05 and am sending you the patches I needed to get
+it running under Ultrix. 
    
+
+
     . . . 
    
+
+
     One of the bugs of Ultrix's /bin/sh is that shell-variables
+set in arguments of `:' expand to garbage if expanded in here-documents.
+Using a different shell helps.  I needed to replace all calls of
+``sh .../makedefs'' by ``$(SHELL) .../makedefs'' in all the
+Makefile.in and am now able to use ``make SHELL=/bin/sh5'' or zsh.
+
+
     . . . 
    
+
+
     Ultrix's FD_SET_SIZE is 4096, but getdtablesize()
+returns 64 by default, if not increased when building a new
+kernel.  getrlimit() doesn't know RLIMIT_NOFILE.  This makes
+event_init() always log the warning: `could allocate space for
+only 64 open files'. 
    
+
+
     I just reduced the threshold from 256 to 64, but this is not good.
+The initial problem still remains: How to disable this warning on
+Ultrix without making the source ugly?   
    
+
+
    
+
+
     To work around the first problem, all the Makefile.in files
+have been updated to use `$(SHELL)' instead of `sh'. So you only
+need to supply a non-default shell in order to eliminate Ultrix
+shell trouble.  
    
+
+
     To work around the latter, util/sys_defs.h was updated for
+Ultrix, with a default FD_SETSIZE of 100.  This should be sufficient
+for a workstation. Even in 1999, no-one would run a major mail hub
+on Ultrix 4. 
    
+
+
+
+
diff --git a/postfix/html/VIRTUAL_README.html b/postfix/html/VIRTUAL_README.html
index 6b0d3abc0..81bf4d90a 100644
--- a/postfix/html/VIRTUAL_README.html
+++ b/postfix/html/VIRTUAL_README.html
@@ -129,7 +129,7 @@ being hosted on the local Postfix machine. 
    
 
 
    
 
    -/etc/postfix/main.cf:
+/etc/postfix/main.cf:
     mydestination = $myhostname localhost.$mydomain ... example.com
 
    
 
    
@@ -163,11 +163,11 @@ below shows how to use this mechanism for the example.com domain.
 
 
    
 
    - 1 /etc/postfix/main.cf:
+ 1 /etc/postfix/main.cf:
  2     virtual_alias_domains = example.com ...other hosted domains...
  3     virtual_alias_maps = hash:/etc/postfix/virtual
  4 
- 5 /etc/postfix/virtual:
+ 5 /etc/postfix/virtual:
  6     postmaster@example.com postmaster
  7     info@example.com       joe
  8     sales@example.com      jane
@@ -210,7 +210,7 @@ for spam messages that were sent in the name of anything@example.com.
 
 
    Execute the command "postmap /etc/postfix/virtual" after
 changing the virtual file, and execute the command "postfix
-reload" after changing the main.cf file. 
    
+reload" after changing the main.cf file. 
    
 
 
     Note: virtual aliases can resolve to a local address or to a
 remote address, or both.  They don't have to resolve to UNIX system
@@ -255,7 +255,7 @@ section at the top of this document.
    
 
 
    
 
    - 1 /etc/postfix/main.cf:
+ 1 /etc/postfix/main.cf:
  2     virtual_mailbox_domains = example.com ...more domains...
  3     virtual_mailbox_base = /var/mail/vhosts
  4     virtual_mailbox_maps = hash:/etc/postfix/vmailbox
@@ -271,7 +271,7 @@ section at the top of this document.
    
 14     # @example.com      example.com/catchall
 15     ...virtual mailboxes for more domains...
 16 
-17 /etc/postfix/virtual:
+17 /etc/postfix/virtual:
 18     postmaster@example.com postmaster
 
    
 
    
@@ -329,7 +329,7 @@ mail for example.com's postmaster address to the local postmaster.
 You can use the same mechanism to redirect an address to a remote
 address.  
    
 
-
  •  
     Line 18: This example assumes that in main.cf, $myorigin
+
  •  
     Line 18: This example assumes that in main.cf, $myorigin
 is listed under the mydestination parameter setting.  If that is
 not the case, specify an explicit domain name on the right-hand
 side of the virtual alias table entries or else mail will go to
@@ -340,7 +340,7 @@ the wrong domain. 
    
 
     Execute the command "postmap /etc/postfix/virtual" after
 changing the virtual file, execute "postmap /etc/postfix/vmailbox"
 after changing the vmailbox file, and execute the command "postfix
-reload" after changing the main.cf file. 
    
+reload" after changing the main.cf file. 
    
 
 
     Note: mail delivery happens with the recipient's UID/GID
 privileges specified with virtual_uid_maps and virtual_gid_maps.
@@ -375,7 +375,7 @@ to a non-Postfix delivery agent: 
    
 
 
    
 
    - 1 /etc/postfix/main.cf:
+ 1 /etc/postfix/main.cf:
  2     virtual_transport = ...see below...
  3     virtual_mailbox_domains = example.com ...more domains...
  4     virtual_mailbox_maps = hash:/etc/postfix/vmailbox
@@ -389,7 +389,7 @@ to a non-Postfix delivery agent: 
    
 12     # @example.com      whatever
 13     ...virtual mailboxes for more domains...
 14 
-15 /etc/postfix/virtual:
+15 /etc/postfix/virtual:
 16     postmaster@example.com postmaster
 
    
 
    
@@ -400,7 +400,7 @@ to a non-Postfix delivery agent: 
    
 
 
  •  
     Line 2: With delivery to a non-Postfix mailbox store for
 hosted domains, the virtual_transport parameter usually specifies
-the Postfix LMTP client, or the name of a master.cf entry that
+the Postfix LMTP client, or the name of a master.cf entry that
 executes non-Postfix software via the pipe delivery agent.  Typical
 examples (use only one): 
    
 
@@ -414,7 +414,7 @@ examples (use only one): 
    
 
 
     Postfix comes ready with support for LMTP.  And an example
 maildrop delivery method is already defined in the default Postfix
-master.cf file. See the MAILDROP_README document for more details.
+master.cf file. See the MAILDROP_README document for more details.
 
    
 
 
  •  
     Line 3: The virtual_mailbox_domains setting tells Postfix
@@ -432,13 +432,9 @@ domain!  
    
 
 
  •  
     Lines 4, 7-13: The virtual_mailbox_maps parameter specifies
 the lookup table with all valid recipient addresses. The lookup
-result value is ignored by Postfix.  In the above example,
-info@example.com
-and sales@example.com are listed as valid addresses; other mail for
-example.com is rejected with "User unknown" by the Postfix SMTP
-server. It's left up to the non-Postfix delivery agent to reject
-non-existent recipients from local submission or from local alias
-expansion.  If you intend to
+result is ignored by Postfix.  In the above example, info@example.com
+and sales@example.com are listed as valid addresses, and mail for
+anything else is rejected with "User unknown". If you intend to
 use LDAP, MySQL or PgSQL instead of local files, be sure to review
 the  "local files versus databases"
 section at the top of this document! 
    
@@ -460,7 +456,7 @@ redirect mail for example.com's postmaster address to the local
 postmaster. You can use the same mechanism to redirect any addresses
 to a local or remote address.  
    
 
-
  •  
     Line 16: This example assumes that in main.cf, $myorigin
+
  •  
     Line 16: This example assumes that in main.cf, $myorigin
 is listed under the mydestination parameter setting.  If that is
 not the case, specify an explicit domain name on the right-hand
 side of the virtual alias table entries or else mail will go to
@@ -471,7 +467,7 @@ the wrong domain. 
    
 
     Execute the command "postmap /etc/postfix/virtual" after
 changing the virtual file, execute "postmap /etc/postfix/vmailbox"
 after changing the vmailbox file, and execute the command "postfix
-reload" after changing the main.cf file. 
    
+reload" after changing the main.cf file. 
    
 
 
    Mail forwarding domains
    
 
@@ -482,11 +478,11 @@ as a mail forwarding domain: 
    
 
 
    
 
    - 1 /etc/postfix/main.cf:
+ 1 /etc/postfix/main.cf:
  2     virtual_alias_domains = example.com ...other hosted domains...
  3     virtual_alias_maps = hash:/etc/postfix/virtual
  4 
- 5 /etc/postfix/virtual:
+ 5 /etc/postfix/virtual:
  6     postmaster@example.com postmaster
  7     joe@example.com        joe@somewhere
  8     jane@example.com       jane@somewhere-else
@@ -530,7 +526,7 @@ for spam messages that were sent in the name of anything@example.com.
 
 
     Execute the command "postmap /etc/postfix/virtual" after
 changing the virtual file, and execute the command "postfix
-reload" after changing the main.cf file. 
    
+reload" after changing the main.cf file. 
    
 
 
     More details about the virtual alias file are given in the
 virtual(5) manual page, including multiple addresses on the right-hand
@@ -550,10 +546,10 @@ virtual addresses to the local delivery agent: 
    
 
 
    
 
    -/etc/postfix/main.cf:
+/etc/postfix/main.cf:
     virtual_alias_maps = hash:/etc/postfix/virtual
 
-/etc/postfix/virtual:
+/etc/postfix/virtual:
     listname-request@example.com listname-request
     listname@example.com         listname
     owner-listname@example.com   owner-listname
@@ -565,7 +561,7 @@ virtual addresses to the local delivery agent: 
    
 
    
 
    
 
-
     This example assumes that in main.cf, $myorigin is listed under
+
     This example assumes that in main.cf, $myorigin is listed under
 the mydestination parameter setting.  If that is not the case,
 specify an explicit domain name on the right-hand side of the
 virtual alias table entries or else mail will go to the wrong
@@ -598,10 +594,10 @@ table: 
    
 
 
    
 
    -/etc/postfix/main.cf:
+/etc/postfix/main.cf:
     virtual_alias_maps = hash:/etc/postfix/virtual
 
-/etc/postfix/virtual:
+/etc/postfix/virtual:
     user@domain.tld user@domain.tld, user@domain.tld@autoreply.mydomain.tld
 
    
 
    
@@ -617,13 +613,13 @@ reply back to the sender. 
    
 
 
    
 
    -/etc/postfix/main.cf:
+/etc/postfix/main.cf:
     transport_maps = hash:/etc/postfix/transport
 
 /etc/postfix/transport:
     autoreply.mydomain.tld  autoreply:
 
-/etc/postfix/master.cf:
+/etc/postfix/master.cf:
     # =============================================================
     # service type  private unpriv  chroot  wakeup  maxproc command
     #               (yes)   (yes)   (yes)   (never) (100)
@@ -637,7 +633,7 @@ reply back to the sender. 
    
 the user@domain.tld recipient address on the command line. 
    
 
 
     For more information, see the pipe(8) manual page, and the
-comments in the Postfix master.cf file. 
    
+comments in the Postfix master.cf file. 
    
 
 
 
diff --git a/postfix/html/access.5.html b/postfix/html/access.5.html
index 8cde22633..1500b784a 100644
--- a/postfix/html/access.5.html
+++ b/postfix/html/access.5.html
@@ -7,7 +7,7 @@
 ACCESS(5)                                                            ACCESS(5)
 
 NAME
-       access - Postfix SMTP server access table
+       access - Postfix access table format
 
 SYNOPSIS
        postmap /etc/postfix/access
@@ -17,35 +17,36 @@ ACCESS(5)                                                            ACCESS(5)
        postmap -q - /etc/postfix/access <inputfile
 
 DESCRIPTION
-       This  document  describes  access  control  on remote SMTP
-       client information: host  names,  network  addresses,  and
-       envelope  sender or recipient addresses; it is implemented
-       by the  Postfix  SMTP  server.   See  header_checks(5)  or
-       body_checks(5)  for access control on the content of email
-       messages.
-
-       Normally, the access(5) table is specified as a text  file
-       that  serves  as  input  to  the  postmap(1) command.  The
-       result, an indexed file in dbm or db format, is  used  for
-       fast  searching  by  the  mail system. Execute the command
-       "postmap /etc/postfix/access" to rebuild an  indexed  file
-       after changing the corresponding text file.
-
-       When  the  table  is provided via other means such as NIS,
-       LDAP or SQL, the same lookups are  done  as  for  ordinary
+       The  optional  access(5)  table  directs  the Postfix SMTP
+       server to selectively reject or accept mail. Access can be
+       allowed  or  denied for specific host names, domain names,
+       networks, host addresses or mail addresses.
+
+       For an example, see the EXAMPLE section at the end of this
+       manual page.
+
+       Normally,  the access(5) table is specified as a text file
+       that serves as  input  to  the  postmap(1)  command.   The
+       result,  an  indexed file in dbm or db format, is used for
+       fast searching by the mail  system.  Execute  the  command
+       "postmap  /etc/postfix/access"  in  order  to  rebuild the
+       indexed file after changing the access table.
+
+       When the table is provided via other means  such  as  NIS,
+       LDAP  or  SQL,  the  same lookups are done as for ordinary
        indexed files.
 
-       Alternatively,  the  table  can  be provided as a regular-
+       Alternatively, the table can be  provided  as  a  regular-
        expression map where patterns are given as regular expres-
-       sions,  or lookups can be directed to TCP-based server. In
-       those cases, the lookups are done in a slightly  different
-       way  as  described below under "REGULAR EXPRESSION TABLES"
-       or "TCP-BASED TABLES".
+       sions, or lookups can be directed to TCP-based server.  In
+       that  case,  the  lookups are done in a slightly different
+       way as described below under "REGULAR  EXPRESSION  TABLES"
+       and "TCP-BASED TABLES".
 
 CASE FOLDING
-       The search string is folded to lowercase  before  database
-       lookup.  As  of Postfix 2.3, the search string is not case
-       folded with database types such as regexp: or pcre:  whose
+       The  search  string is folded to lowercase before database
+       lookup. As of Postfix 2.3, the search string is  not  case
+       folded  with database types such as regexp: or pcre: whose
        lookup fields can match both upper and lower case.
 
 TABLE FORMAT
@@ -56,53 +57,53 @@ ACCESS(5)                                                            ACCESS(5)
               address, perform the corresponding action.
 
        blank lines and comments
-              Empty  lines and whitespace-only lines are ignored,
-              as are lines whose first  non-whitespace  character
+              Empty lines and whitespace-only lines are  ignored,
+              as  are  lines whose first non-whitespace character
               is a `#'.
 
        multi-line text
-              A  logical  line starts with non-whitespace text. A
-              line that starts with whitespace continues a  logi-
+              A logical line starts with non-whitespace  text.  A
+              line  that starts with whitespace continues a logi-
               cal line.
 
 EMAIL ADDRESS PATTERNS
        With lookups from indexed files such as DB or DBM, or from
-       networked tables such as NIS, LDAP or  SQL,  patterns  are
+       networked  tables  such  as NIS, LDAP or SQL, patterns are
        tried in the order as listed below:
 
        user@domain
               Matches the specified mail address.
 
        domain.tld
-              Matches  domain.tld  as the domain part of an email
+              Matches domain.tld as the domain part of  an  email
               address.
 
               The pattern domain.tld also matches subdomains, but
               only when the string smtpd_access_maps is listed in
-              the Postfix  parent_domain_matches_subdomains  con-
-              figuration  setting  (note that this is the default
-              for some versions of Postfix).  Otherwise,  specify
-              .domain.tld  (note  the  initial  dot)  in order to
+              the  Postfix  parent_domain_matches_subdomains con-
+              figuration setting (note that this is  the  default
+              for  some versions of Postfix).  Otherwise, specify
+              .domain.tld (note the  initial  dot)  in  order  to
               match subdomains.
 
-       user@  Matches all mail addresses with the specified  user
+       user@  Matches  all mail addresses with the specified user
               part.
 
-       Note:  lookup  of  the null sender address is not possible
-       with some types of lookup table. By default, Postfix  uses
-       <>  as  the  lookup  key  for such addresses. The value is
-       specified with the smtpd_null_access_lookup_key  parameter
+       Note: lookup of the null sender address  is  not  possible
+       with  some types of lookup table. By default, Postfix uses
+       <> as the lookup key for  such  addresses.  The  value  is
+       specified  with the smtpd_null_access_lookup_key parameter
        in the Postfix main.cf file.
 
 EMAIL ADDRESS EXTENSION
        When a mail address localpart contains the optional recip-
-       ient delimiter (e.g., user+foo@domain), the  lookup  order
-       becomes:  user+foo@domain, user@domain, domain, user+foo@,
+       ient  delimiter  (e.g., user+foo@domain), the lookup order
+       becomes: user+foo@domain, user@domain, domain,  user+foo@,
        and user@.
 
 HOST NAME/ADDRESS PATTERNS
        With lookups from indexed files such as DB or DBM, or from
-       networked  tables  such as NIS, LDAP or SQL, the following
+       networked tables such as NIS, LDAP or SQL,  the  following
        lookup patterns are examined in the order as listed:
 
        domain.tld
@@ -110,9 +111,9 @@ ACCESS(5)                                                            ACCESS(5)
 
               The pattern domain.tld also matches subdomains, but
               only when the string smtpd_access_maps is listed in
-              the Postfix  parent_domain_matches_subdomains  con-
+              the  Postfix  parent_domain_matches_subdomains con-
               figuration setting.  Otherwise, specify .domain.tld
-              (note the initial dot) in  order  to  match  subdo-
+              (note  the  initial  dot)  in order to match subdo-
               mains.
 
        net.work.addr.ess
@@ -121,21 +122,21 @@ ACCESS(5)                                                            ACCESS(5)
 
        net.work
 
-       net    Matches  the specified IPv4 host address or subnet-
-              work. An IPv4 host address is a  sequence  of  four
+       net    Matches the specified IPv4 host address or  subnet-
+              work.  An  IPv4  host address is a sequence of four
               decimal octets separated by ".".
 
-              Subnetworks  are  matched  by repeatedly truncating
+              Subnetworks are matched  by  repeatedly  truncating
               the last ".octet" from the remote IPv4 host address
-              string  until a match is found in the access table,
+              string until a match is found in the access  table,
               or until further truncation is not possible.
 
-              NOTE 1: The access map lookup key must be in canon-
-              ical  form: do not specify unnecessary null charac-
-              ters, and do not enclose network  address  informa-
-              tion with "[]" characters.
+              NOTE 1: The information in the access map should be
+              in canonical form, with unnecessary null characters
+              eliminated.    Address   information  must  not  be
+              enclosed with "[]" characters.
 
-              NOTE  2:  use the cidr lookup table type to specify
+              NOTE 2: use the cidr lookup table type  to  specify
               network/netmask  patterns.  See  cidr_table(5)  for
               details.
 
@@ -145,12 +146,12 @@ ACCESS(5)                                                            ACCESS(5)
 
        net:work
 
-       net    Matches  the specified IPv6 host address or subnet-
-              work. An IPv6 host address is a sequence  of  three
-              to  eight hexadecimal octet pairs separated by ":".
+       net    Matches the specified IPv6 host address or  subnet-
+              work.  An  IPv6 host address is a sequence of three
+              to eight hexadecimal octet pairs separated by  ":".
 
-              Subnetworks are matched  by  repeatedly  truncating
-              the  last  ":octetpair"  from  the remote IPv6 host
+              Subnetworks  are  matched  by repeatedly truncating
+              the last ":octetpair" from  the  remote  IPv6  host
               address string until a match is found in the access
               table, or until further truncation is not possible.
 
@@ -158,12 +159,12 @@ ACCESS(5)                                                            ACCESS(5)
               the string representation of the IPv6 host address.
               Thus, not all the ":" subnetworks will be tried.
 
-              NOTE 2: The access map lookup key must be in canon-
-              ical  form: do not specify unnecessary null charac-
-              ters, and do not enclose network  address  informa-
-              tion with "[]" characters.
+              NOTE 2: The information in the access map should be
+              in canonical form, with unnecessary null characters
+              eliminated.    Address   information  must  not  be
+              enclosed with "[]" characters.
 
-              NOTE  3:  use the cidr lookup table type to specify
+              NOTE 3: use the cidr lookup table type  to  specify
               network/netmask  patterns.  See  cidr_table(5)  for
               details.
 
@@ -174,49 +175,48 @@ ACCESS(5)                                                            ACCESS(5)
 
        all-numerical
               An all-numerical result is treated as OK. This for-
-              mat  is generated by address-based relay authoriza-
+              mat is generated by address-based relay  authoriza-
               tion schemes such as pop-before-smtp.
 
 REJECT ACTIONS
-       Postfix version 2.3  and  later  support  enhanced  status
-       codes  as  defined in RFC 3463.  When no code is specified
-       at the beginning of the  text  below,  Postfix  inserts  a
-       default  enhanced  status  code  of "5.7.1" in the case of
-       reject actions, and "4.7.1" in the case of defer  actions.
+       Postfix  version  2.3  and  later  support enhanced status
+       codes as defined in RFC 3463.  When no code  is  specified
+       at  the  beginning  of  the  text below, Postfix inserts a
+       default enhanced status code of "5.7.1"  in  the  case  of
+       reject  actions, and "4.7.1" in the case of defer actions.
        See "ENHANCED STATUS CODES" below.
 
        4NN text
 
        5NN text
-              Reject  the  address etc. that matches the pattern,
+              Reject the address etc. that matches  the  pattern,
               and respond with the numerical three-digit code and
-              text.  4NN means "try again later", while 5NN means
+              text. 4NN means "try again later", while 5NN  means
               "do not try again".
 
-              The reply code "421" causes Postfix  to  disconnect
+              The  reply  code "421" causes Postfix to disconnect
               immediately (Postfix version 2.3 and later).
 
        REJECT optional text...
-              Reject  the  address etc. that matches the pattern.
-              Reply with $reject_code optional text...  when  the
-              optional  text is specified, otherwise reply with a
+              Reject the address etc. that matches  the  pattern.
+              Reply  with  $reject_code optional text... when the
+              optional text is specified, otherwise reply with  a
               generic error response message.
 
        DEFER_IF_REJECT optional text...
-              Defer the request if some later  restriction  would
-              result  in  a  REJECT action. Reply with "450 4.7.1
-              optional text... when the optional text  is  speci-
-              fied, otherwise reply with a generic error response
-              message.
+              Defer  the  request if some later restriction would
+              result in a REJECT action. Reply with "450 optional
+              text... when the optional text is specified, other-
+              wise reply with a generic error response message.
 
               This feature is available in Postfix 2.1 and later.
 
        DEFER_IF_PERMIT optional text...
               Defer  the  request if some later restriction would
               result in a an explicit or implicit PERMIT  action.
-              Reply  with  "450  4.7.1  optional text... when the
-              optional text is specified, otherwise reply with  a
-              generic error response message.
+              Reply  with "450 optional text... when the optional
+              text is specified, otherwise reply with  a  generic
+              error response message.
 
               This feature is available in Postfix 2.1 and later.
 
@@ -253,9 +253,9 @@ ACCESS(5)                                                            ACCESS(5)
               about external content filters is  in  the  Postfix
               FILTER_README file.
 
-              Note: this action overrides the content_filter set-
-              ting, and currently affects all recipients  of  the
-              message.
+              Note:   this  action  overrides  the  main.cf  con-
+              tent_filter  setting,  and  currently  affects  all
+              recipients of the message.
 
               This feature is available in Postfix 2.0 and later.
 
@@ -272,23 +272,25 @@ ACCESS(5)                                                            ACCESS(5)
               Note:  use  "postsuper -r" to release mail that was
               kept on hold for a significant fraction  of  $maxi-
               mal_queue_lifetime  or  $bounce_queue_lifetime,  or
-              longer. Use "postsuper -H" only for mail that  will
-              not expire within a few delivery attempts.
+              longer.
 
-              Note:  this action currently affects all recipients
+              Note: this action currently affects all  recipients
               of the message.
 
               This feature is available in Postfix 2.0 and later.
 
        PREPEND headername: headervalue
-              Prepend  the  specified  message header to the mes-
-              sage.  When more than one PREPEND action  executes,
-              the  first prepended header appears before the sec-
-              ond etc. prepended header.
+              Prepend the specified message header  to  the  mes-
+              sage.  When this action is used multiple times, the
+              first prepended header appears  before  the  second
+              etc. prepended header.
+
+              Note:  this action does not support multi-line mes-
+              sage headers.
 
-              Note: this action must execute before  the  message
-              content  is received; it cannot execute in the con-
-              text of smtpd_end_of_data_restrictions.
+              Note: this action must be used before  the  message
+              content   is   received;   it  cannot  be  used  in
+              smtpd_end_of_data_restrictions.
 
               This feature is available in Postfix 2.1 and later.
 
@@ -359,7 +361,7 @@ ACCESS(5)                                                            ACCESS(5)
        lookups are directed to a TCP-based server. For a descrip-
        tion of the TCP client/server lookup protocol, see tcp_ta-
        ble(5).  This feature is not available up to and including
-       Postfix version 2.4.
+       Postfix version 2.3.
 
        Each  lookup  operation uses the entire query string once.
        Depending on the application, that  string  is  an  entire
diff --git a/postfix/html/aliases.5.html b/postfix/html/aliases.5.html
index 30cddaa27..ab5cae5bd 100644
--- a/postfix/html/aliases.5.html
+++ b/postfix/html/aliases.5.html
@@ -82,8 +82,8 @@ ALIASES(5)                                                          ALIASES(5)
               When the command fails, a limited amount of command
               output is mailed back  to  the  sender.   The  file
               /usr/include/sysexits.h  defines  the expected exit
-              status codes. For example, use "|exit 67" to  simu-
-              late  a  "user  unknown"  error,  and  "|exit 0" to
+              status codes. For example, use |"exit 67" to  simu-
+              late  a  "user  unknown"  error,  and  |"exit 0" to
               implement an expensive black hole.
 
        :include:/file/name
diff --git a/postfix/html/anvil.8.html b/postfix/html/anvil.8.html
index 7717dd908..b8f45190c 100644
--- a/postfix/html/anvil.8.html
+++ b/postfix/html/anvil.8.html
@@ -140,8 +140,8 @@ ANVIL(8)                                                              ANVIL(8)
 
        In this preliminary implementation, a count (or rate) lim-
        ited  server can have only one remote client at a time. If
-       a server reports multiple simultaneous clients,  state  is
-       kept only for the last reported client.
+       a server reports multiple simultaneous  clients,  all  but
+       the last reported client are ignored.
 
        The  anvil(8) server automatically discards client request
        information after it expires.   To  prevent  the  anvil(8)
@@ -182,28 +182,27 @@ ANVIL(8)                                                              ANVIL(8)
 
        max_idle (100s)
               The maximum amount of time  that  an  idle  Postfix
-              daemon  process  waits  for  an incoming connection
-              before terminating voluntarily.
+              daemon  process  waits for the next service request
+              before exiting.
 
        max_use (100)
-              The maximal number of incoming connections  that  a
-              Postfix  daemon  process will service before termi-
-              nating voluntarily.
+              The maximal number of connection requests before  a
+              Postfix daemon process terminates.
 
        process_id (read-only)
-              The process ID  of  a  Postfix  command  or  daemon
+              The  process  ID  of  a  Postfix  command or daemon
               process.
 
        process_name (read-only)
-              The  process  name  of  a Postfix command or daemon
+              The process name of a  Postfix  command  or  daemon
               process.
 
        syslog_facility (mail)
               The syslog facility of Postfix logging.
 
        syslog_name (postfix)
-              The mail system  name  that  is  prepended  to  the
-              process  name  in  syslog  records, so that "smtpd"
+              The  mail  system  name  that  is  prepended to the
+              process name in syslog  records,  so  that  "smtpd"
               becomes, for example, "postfix/smtpd".
 
 SEE ALSO
@@ -215,7 +214,7 @@ ANVIL(8)                                                              ANVIL(8)
        TUNING_README, performance tuning
 
 LICENSE
-       The  Secure  Mailer  license must be distributed with this
+       The Secure Mailer license must be  distributed  with  this
        software.
 
 HISTORY
diff --git a/postfix/html/bounce.5.html b/postfix/html/bounce.5.html
index 261a91cc3..e6c23320c 100644
--- a/postfix/html/bounce.5.html
+++ b/postfix/html/bounce.5.html
@@ -31,8 +31,8 @@ BOUNCE(5)                                                            BOUNCE(5)
        bounce template formats.
 
 GENERAL PROCEDURE
-       To create a customized bounce template file, create a tem-
-       porary copy of the file /etc/postfix/bounce.cf.default and
+       To create customized bounce template file, create a tempo-
+       rary  copy  of the file /etc/postfix/bounce.cf.default and
        edit the temporary file.
 
        To preview the results of $name expansions in the template
diff --git a/postfix/html/bounce.8.html b/postfix/html/bounce.8.html
index 5d8aef4d7..6256c3efc 100644
--- a/postfix/html/bounce.8.html
+++ b/postfix/html/bounce.8.html
@@ -26,20 +26,19 @@ BOUNCE(8)                                                            BOUNCE(8)
        o      Append a recipient (non-)delivery status record  to
               a per-message log file.
 
-       o      Enqueue  a  delivery  status  notification message,
-              with a copy of a per-message log file  and  of  the
-              corresponding  message.   When  the delivery status
-              notification message is enqueued successfully,  the
-              per-message log file is deleted.
+       o      Enqueue a bounce message, with a copy of a per-mes-
+              sage log file and  of  the  corresponding  message.
+              When  the  bounce message is enqueued successfully,
+              the per-message log file is deleted.
 
        The software does a best notification effort. A non-deliv-
-       ery notification is sent even when the  log  file  or  the
+       ery  notification  is  sent  even when the log file or the
        original message cannot be read.
 
-       Optionally,  a  bounce  (defer,  trace) client can request
-       that  the  per-message  log  file  be  deleted  when   the
-       requested  operation  fails.  This is used by clients that
-       cannot retry transactions by themselves, and  that  depend
+       Optionally, a bounce (defer,  trace)  client  can  request
+       that   the  per-message  log  file  be  deleted  when  the
+       requested operation fails.  This is used by  clients  that
+       cannot  retry  transactions by themselves, and that depend
        on retry logic in their own client.
 
 STANDARDS
@@ -54,25 +53,25 @@ BOUNCE(8)                                                            BOUNCE(8)
        Problems and transactions are logged to syslogd(8).
 
 CONFIGURATION PARAMETERS
-       Changes   to  main.cf  are  picked  up  automatically,  as
+       Changes  to  main.cf  are  picked  up  automatically,   as
        bounce(8) processes run for only a limited amount of time.
        Use the command "postfix reload" to speed up a change.
 
-       The  text  below  provides  only  a parameter summary. See
+       The text below provides  only  a  parameter  summary.  See
        postconf(5) for more details including examples.
 
        2bounce_notice_recipient (postmaster)
-              The recipient of undeliverable mail that cannot  be
+              The  recipient of undeliverable mail that cannot be
               returned to the sender.
 
        backwards_bounce_logfile_compatibility (yes)
-              Produce  additional  bounce(8) logfile records that
+              Produce additional bounce(8) logfile  records  that
               can be read by Postfix versions before 2.0.
 
        bounce_notice_recipient (postmaster)
-              The recipient of postmaster notifications with  the
+              The  recipient of postmaster notifications with the
               message  headers  of  mail  that  Postfix  did  not
-              deliver and of  SMTP  conversation  transcripts  of
+              deliver  and  of  SMTP  conversation transcripts of
               mail that Postfix did not receive.
 
        bounce_size_limit (50000)
@@ -80,21 +79,21 @@ BOUNCE(8)                                                            BOUNCE(8)
               sent in a non-delivery notification.
 
        bounce_template_file (empty)
-              Pathname of a configuration file with  bounce  mes-
+              Pathname  of  a configuration file with bounce mes-
               sage templates.
 
        config_directory (see 'postconf -d' output)
-              The  default  location  of  the Postfix main.cf and
+              The default location of  the  Postfix  main.cf  and
               master.cf configuration files.
 
        daemon_timeout (18000s)
-              How much time a Postfix daemon process may take  to
-              handle  a  request  before  it  is  terminated by a
+              How  much time a Postfix daemon process may take to
+              handle a request  before  it  is  terminated  by  a
               built-in watchdog timer.
 
        delay_notice_recipient (postmaster)
-              The recipient of postmaster notifications with  the
-              message  headers  of  mail that cannot be delivered
+              The  recipient of postmaster notifications with the
+              message headers of mail that  cannot  be  delivered
               within $delay_warning_time time units.
 
        deliver_lock_attempts (20)
@@ -102,7 +101,7 @@ BOUNCE(8)                                                            BOUNCE(8)
               sive lock on a mailbox file or bounce(8) logfile.
 
        deliver_lock_delay (1s)
-              The  time  between attempts to acquire an exclusive
+              The time between attempts to acquire  an  exclusive
               lock on a mailbox file or bounce(8) logfile.
 
        ipc_timeout (3600s)
@@ -110,8 +109,8 @@ BOUNCE(8)                                                            BOUNCE(8)
               over an internal communication channel.
 
        internal_mail_filter_classes (empty)
-              What  categories of Postfix-generated mail are sub-
-              ject  to   before-queue   content   inspection   by
+              What categories of Postfix-generated mail are  sub-
+              ject   to   before-queue   content   inspection  by
               non_smtpd_milters, header_checks and body_checks.
 
        mail_name (Postfix)
@@ -120,14 +119,13 @@ BOUNCE(8)                                                            BOUNCE(8)
               bounced mail.
 
        max_idle (100s)
-              The  maximum  amount  of  time that an idle Postfix
-              daemon process waits  for  an  incoming  connection
-              before terminating voluntarily.
+              The maximum amount of time  that  an  idle  Postfix
+              daemon  process  waits for the next service request
+              before exiting.
 
        max_use (100)
-              The  maximal  number of incoming connections that a
-              Postfix daemon process will service  before  termi-
-              nating voluntarily.
+              The maximal number of connection requests before  a
+              Postfix daemon process terminates.
 
        notify_classes (resource, software)
               The  list of error classes that are reported to the
diff --git a/postfix/html/canonical.5.html b/postfix/html/canonical.5.html
index c43a1df35..8ee71e649 100644
--- a/postfix/html/canonical.5.html
+++ b/postfix/html/canonical.5.html
@@ -26,8 +26,8 @@ CANONICAL(5)                                                      CANONICAL(5)
        file  that serves as input to the postmap(1) command.  The
        result, an indexed file in dbm or db format, is  used  for
        fast  searching  by  the  mail system. Execute the command
-       "postmap /etc/postfix/canonical"  to  rebuild  an  indexed
-       file after changing the corresponding text file.
+       "postmap /etc/postfix/canonical" in order to  rebuild  the
+       indexed file after changing the text file.
 
        When  the  table  is provided via other means such as NIS,
        LDAP or SQL, the same lookups are  done  as  for  ordinary
@@ -36,9 +36,9 @@ CANONICAL(5)                                                      CANONICAL(5)
        Alternatively,  the  table  can  be provided as a regular-
        expression map where patterns are given as regular expres-
        sions,  or lookups can be directed to TCP-based server. In
-       those cases, the lookups are done in a slightly  different
+       that case, the lookups are done in  a  slightly  different
        way  as  described below under "REGULAR EXPRESSION TABLES"
-       or "TCP-BASED TABLES".
+       and "TCP-BASED TABLES".
 
        By default the canonical(5) mapping affects  both  message
        header  addresses  (i.e. addresses that appear inside mes-
@@ -59,9 +59,11 @@ CANONICAL(5)                                                      CANONICAL(5)
        addresses produced by legacy mail systems.
 
        The canonical(5) mapping is not to be confused  with  vir-
-       tual  alias  support or with local aliasing. To change the
-       destination but not the headers,  use  the  virtual(5)  or
-       aliases(5) map instead.
+       tual  domain support. Use the virtual(5) map for that pur-
+       pose.
+
+       The canonical(5) mapping is not to be confused with  local
+       aliasing.  Use the aliases(5) map for that purpose.
 
 CASE FOLDING
        The  search  string is folded to lowercase before database
@@ -113,13 +115,6 @@ CANONICAL(5)                                                      CANONICAL(5)
               Replace other addresses in domain by address.  This
               form has the lowest precedence.
 
-              Note:  @domain  is  a  wild-card. When this form is
-              applied to recipient addresses,  the  Postfix  SMTP
-              server  accepts  mail  for any recipient in domain,
-              regardless of whether that recipient exists.   This
-              may turn your mail system into a backscatter source
-              that returns undeliverable spam to innocent people.
-
 RESULT ADDRESS REWRITING
        The lookup result is subject to address rewriting:
 
@@ -167,7 +162,7 @@ CANONICAL(5)                                                      CANONICAL(5)
        lookups are directed to a TCP-based server. For a descrip-
        tion of the TCP client/server lookup protocol, see tcp_ta-
        ble(5).  This feature is not available up to and including
-       Postfix version 2.4.
+       Postfix version 2.3.
 
        Each lookup operation uses the entire address once.  Thus,
        user@domain  mail  addresses  are not broken up into their
diff --git a/postfix/html/cidr_table.5.html b/postfix/html/cidr_table.5.html
index fb721fd02..d869dbb9e 100644
--- a/postfix/html/cidr_table.5.html
+++ b/postfix/html/cidr_table.5.html
@@ -18,62 +18,59 @@ CIDR_TABLE(5)                                                    CIDR_TABLE(5)
        The  Postfix  mail  system  uses  optional  lookup tables.
        These tables are usually in dbm or  db  format.   Alterna-
        tively,  lookup tables can be specified in CIDR (Classless
-       Inter-Domain Routing) form. In this case,  each  input  is
-       compared  against  a  list  of  patterns.  When a match is
-       found, the corresponding result is returned and the search
-       is terminated.
+       Inter-Domain Routing) form.
 
-       To  find out what types of lookup tables your Postfix sys-
+       To find out what types of lookup tables your Postfix  sys-
        tem supports use the "postconf -m" command.
 
-       To test lookup tables, use the  "postmap  -q"  command  as
+       To  test  lookup  tables,  use the "postmap -q" command as
        described in the SYNOPSIS above.
 
 TABLE FORMAT
        The general form of a Postfix CIDR table is:
 
        network_address/network_mask     result
-              When  a search string matches the specified network
-              block, use the corresponding result value.  Specify
-              0.0.0.0/0  to match every IPv4 address, and ::/0 to
+              When a search string matches the specified  network
+              block,  use the corresponding result value. Specify
+              0.0.0.0/0 to match every IPv4 address, and ::/0  to
               match every IPv6 address.
 
               An IPv4 network address is a sequence of four deci-
-              mal  octets  separated  by ".", and an IPv6 network
+              mal octets separated by ".", and  an  IPv6  network
               address is a sequence of three to eight hexadecimal
               octet pairs separated by ":".
 
-              Before  comparisons are made, lookup keys and table
+              Before comparisons are made, lookup keys and  table
               entries are converted from string to binary. There-
-              fore  table  entries  will be matched regardless of
+              fore table entries will be  matched  regardless  of
               redundant zero characters.
 
-              Note: address information may  be  enclosed  inside
-              "[]" but this form is not required.
+              Note:  address  information  may be enclosed inside
+              "[]" but this form is not recommended.
 
               IPv6 support is available in Postfix 2.2 and later.
 
        network_address     result
-              When a search string matches the specified  network
+              When  a search string matches the specified network
               address, use the corresponding result value.
 
        blank lines and comments
-              Empty  lines and whitespace-only lines are ignored,
-              as are lines whose first  non-whitespace  character
+              Empty lines and whitespace-only lines are  ignored,
+              as  are  lines whose first non-whitespace character
               is a `#'.
 
        multi-line text
-              A  logical  line starts with non-whitespace text. A
-              line that starts with whitespace continues a  logi-
+              A logical line starts with non-whitespace  text.  A
+              line  that starts with whitespace continues a logi-
               cal line.
 
 TABLE SEARCH ORDER
-       Patterns  are applied in the order as specified in the ta-
-       ble, until a pattern is  found  that  matches  the  search
+       Patterns are applied in the order as specified in the  ta-
+       ble,  until  a  pattern  is  found that matches the search
        string.
 
 EXAMPLE SMTPD ACCESS MAP
-       /etc/postfix/main.cf:
+       /etc/postfix/main.cf:
            smtpd_client_restrictions = ... cidr:/etc/postfix/client.cidr ...
 
        /etc/postfix/client.cidr:
@@ -93,6 +90,7 @@ CIDR_TABLE(5)                                                    CIDR_TABLE(5)
 AUTHOR(S)
        The CIDR table lookup code was originally written by:
        Jozsef Kadlecsik
+       kadlec@blackhole.kfki.hu
        KFKI Research Institute for Particle and Nuclear Physics
        POB. 49
        1525 Budapest, Hungary
diff --git a/postfix/html/cleanup.8.html b/postfix/html/cleanup.8.html
index 2cd0ceec3..d207e4703 100644
--- a/postfix/html/cleanup.8.html
+++ b/postfix/html/cleanup.8.html
@@ -412,32 +412,31 @@ CLEANUP(8)                                                          CLEANUP(8)
 
        max_idle (100s)
               The  maximum  amount  of  time that an idle Postfix
-              daemon process waits  for  an  incoming  connection
-              before terminating voluntarily.
+              daemon process waits for the next  service  request
+              before exiting.
 
        max_use (100)
-              The  maximal  number of incoming connections that a
-              Postfix daemon process will service  before  termi-
-              nating voluntarily.
+              The  maximal number of connection requests before a
+              Postfix daemon process terminates.
 
        myhostname (see 'postconf -d' output)
               The internet hostname of this mail system.
 
        myorigin ($myhostname)
               The domain name that locally-posted mail appears to
-              come from, and that locally posted mail  is  deliv-
+              come  from,  and that locally posted mail is deliv-
               ered to.
 
        process_id (read-only)
-              The  process  ID  of  a  Postfix  command or daemon
+              The process ID  of  a  Postfix  command  or  daemon
               process.
 
        process_name (read-only)
-              The process name of a  Postfix  command  or  daemon
+              The  process  name  of  a Postfix command or daemon
               process.
 
        queue_directory (see 'postconf -d' output)
-              The  location of the Postfix top-level queue direc-
+              The location of the Postfix top-level queue  direc-
               tory.
 
        soft_bounce (no)
@@ -448,14 +447,14 @@ CLEANUP(8)                                                          CLEANUP(8)
               The syslog facility of Postfix logging.
 
        syslog_name (postfix)
-              The  mail  system  name  that  is  prepended to the
-              process name in syslog  records,  so  that  "smtpd"
+              The mail system  name  that  is  prepended  to  the
+              process  name  in  syslog  records, so that "smtpd"
               becomes, for example, "postfix/smtpd".
 
        Available in Postfix version 2.1 and later:
 
        enable_original_recipient (yes)
-              Enable   support   for  the  X-Original-To  message
+              Enable  support  for  the   X-Original-To   message
               header.
 
 FILES
@@ -479,7 +478,7 @@ CLEANUP(8)                                                          CLEANUP(8)
        CONTENT_INSPECTION_README content inspection
 
 LICENSE
-       The  Secure  Mailer  license must be distributed with this
+       The Secure Mailer license must be  distributed  with  this
        software.
 
 AUTHOR(S)
diff --git a/postfix/html/defer.8.html b/postfix/html/defer.8.html
deleted file mode 100644
index 5d8aef4d7..000000000
--- a/postfix/html/defer.8.html
+++ /dev/null
@@ -1,180 +0,0 @@
-
- 
-
- Postfix manual - bounce(8) 
-  
    -BOUNCE(8)                                                            BOUNCE(8)
-
-NAME
-       bounce - Postfix delivery status reports
-
-SYNOPSIS
-       bounce [generic Postfix daemon options]
-
-DESCRIPTION
-       The  bounce(8) daemon maintains per-message log files with
-       delivery status information. Each log file is named  after
-       the  queue  file  that it corresponds to, and is kept in a
-       queue subdirectory named after the  service  name  in  the
-       master.cf file (either bounce, defer or trace).  This pro-
-       gram expects to be run from the master(8) process manager.
-
-       The  bounce(8)  daemon  processes  two  types  of  service
-       requests:
-
-       o      Append a recipient (non-)delivery status record  to
-              a per-message log file.
-
-       o      Enqueue  a  delivery  status  notification message,
-              with a copy of a per-message log file  and  of  the
-              corresponding  message.   When  the delivery status
-              notification message is enqueued successfully,  the
-              per-message log file is deleted.
-
-       The software does a best notification effort. A non-deliv-
-       ery notification is sent even when the  log  file  or  the
-       original message cannot be read.
-
-       Optionally,  a  bounce  (defer,  trace) client can request
-       that  the  per-message  log  file  be  deleted  when   the
-       requested  operation  fails.  This is used by clients that
-       cannot retry transactions by themselves, and  that  depend
-       on retry logic in their own client.
-
-STANDARDS
-       RFC 822 (ARPA Internet Text Messages)
-       RFC 2045 (Format of Internet Message Bodies)
-       RFC 2822 (ARPA Internet Text Messages)
-       RFC 3462 (Delivery Status Notifications)
-       RFC 3464 (Delivery Status Notifications)
-       RFC 3834 (Auto-Submitted: message header)
-
-DIAGNOSTICS
-       Problems and transactions are logged to syslogd(8).
-
-CONFIGURATION PARAMETERS
-       Changes   to  main.cf  are  picked  up  automatically,  as
-       bounce(8) processes run for only a limited amount of time.
-       Use the command "postfix reload" to speed up a change.
-
-       The  text  below  provides  only  a parameter summary. See
-       postconf(5) for more details including examples.
-
-       2bounce_notice_recipient (postmaster)
-              The recipient of undeliverable mail that cannot  be
-              returned to the sender.
-
-       backwards_bounce_logfile_compatibility (yes)
-              Produce  additional  bounce(8) logfile records that
-              can be read by Postfix versions before 2.0.
-
-       bounce_notice_recipient (postmaster)
-              The recipient of postmaster notifications with  the
-              message  headers  of  mail  that  Postfix  did  not
-              deliver and of  SMTP  conversation  transcripts  of
-              mail that Postfix did not receive.
-
-       bounce_size_limit (50000)
-              The maximal amount of original message text that is
-              sent in a non-delivery notification.
-
-       bounce_template_file (empty)
-              Pathname of a configuration file with  bounce  mes-
-              sage templates.
-
-       config_directory (see 'postconf -d' output)
-              The  default  location  of  the Postfix main.cf and
-              master.cf configuration files.
-
-       daemon_timeout (18000s)
-              How much time a Postfix daemon process may take  to
-              handle  a  request  before  it  is  terminated by a
-              built-in watchdog timer.
-
-       delay_notice_recipient (postmaster)
-              The recipient of postmaster notifications with  the
-              message  headers  of  mail that cannot be delivered
-              within $delay_warning_time time units.
-
-       deliver_lock_attempts (20)
-              The maximal number of attempts to acquire an exclu-
-              sive lock on a mailbox file or bounce(8) logfile.
-
-       deliver_lock_delay (1s)
-              The  time  between attempts to acquire an exclusive
-              lock on a mailbox file or bounce(8) logfile.
-
-       ipc_timeout (3600s)
-              The time limit for sending or receiving information
-              over an internal communication channel.
-
-       internal_mail_filter_classes (empty)
-              What  categories of Postfix-generated mail are sub-
-              ject  to   before-queue   content   inspection   by
-              non_smtpd_milters, header_checks and body_checks.
-
-       mail_name (Postfix)
-              The mail system name that is displayed in Received:
-              headers,  in  the  SMTP  greeting  banner,  and  in
-              bounced mail.
-
-       max_idle (100s)
-              The  maximum  amount  of  time that an idle Postfix
-              daemon process waits  for  an  incoming  connection
-              before terminating voluntarily.
-
-       max_use (100)
-              The  maximal  number of incoming connections that a
-              Postfix daemon process will service  before  termi-
-              nating voluntarily.
-
-       notify_classes (resource, software)
-              The  list of error classes that are reported to the
-              postmaster.
-
-       process_id (read-only)
-              The process ID  of  a  Postfix  command  or  daemon
-              process.
-
-       process_name (read-only)
-              The  process  name  of  a Postfix command or daemon
-              process.
-
-       queue_directory (see 'postconf -d' output)
-              The location of the Postfix top-level queue  direc-
-              tory.
-
-       syslog_facility (mail)
-              The syslog facility of Postfix logging.
-
-       syslog_name (postfix)
-              The  mail  system  name  that  is  prepended to the
-              process name in syslog  records,  so  that  "smtpd"
-              becomes, for example, "postfix/smtpd".
-
-FILES
-       /var/spool/postfix/bounce/* non-delivery records
-       /var/spool/postfix/defer/* non-delivery records
-       /var/spool/postfix/trace/* delivery status records
-
-SEE ALSO
-       bounce(5), bounce message template format
-       qmgr(8), queue manager
-       postconf(5), configuration parameters
-       master(5), generic daemon options
-       master(8), process manager
-       syslogd(8), system logging
-
-LICENSE
-       The  Secure  Mailer  license must be distributed with this
-       software.
-
-AUTHOR(S)
-       Wietse Venema
-       IBM T.J. Watson Research
-       P.O. Box 704
-       Yorktown Heights, NY 10598, USA
-
-                                                                     BOUNCE(8)
-
      
diff --git a/postfix/html/defer.8.html b/postfix/html/defer.8.html
new file mode 120000
index 000000000..4de6cc212
--- /dev/null
+++ b/postfix/html/defer.8.html
@@ -0,0 +1 @@
+bounce.8.html
\ No newline at end of file
diff --git a/postfix/html/discard.8.html b/postfix/html/discard.8.html
index 9325692c5..2fb77c2e1 100644
--- a/postfix/html/discard.8.html
+++ b/postfix/html/discard.8.html
@@ -77,32 +77,31 @@ DISCARD(8)                                                          DISCARD(8)
 
        max_idle (100s)
               The maximum amount of time  that  an  idle  Postfix
-              daemon  process  waits  for  an incoming connection
-              before terminating voluntarily.
+              daemon  process  waits for the next service request
+              before exiting.
 
        max_use (100)
-              The maximal number of incoming connections  that  a
-              Postfix  daemon  process will service before termi-
-              nating voluntarily.
+              The maximal number of connection requests before  a
+              Postfix daemon process terminates.
 
        process_id (read-only)
-              The process ID  of  a  Postfix  command  or  daemon
+              The  process  ID  of  a  Postfix  command or daemon
               process.
 
        process_name (read-only)
-              The  process  name  of  a Postfix command or daemon
+              The process name of a  Postfix  command  or  daemon
               process.
 
        queue_directory (see 'postconf -d' output)
-              The location of the Postfix top-level queue  direc-
+              The  location of the Postfix top-level queue direc-
               tory.
 
        syslog_facility (mail)
               The syslog facility of Postfix logging.
 
        syslog_name (postfix)
-              The  mail  system  name  that  is  prepended to the
-              process name in syslog  records,  so  that  "smtpd"
+              The mail system  name  that  is  prepended  to  the
+              process  name  in  syslog  records, so that "smtpd"
               becomes, for example, "postfix/smtpd".
 
 SEE ALSO
@@ -115,7 +114,7 @@ DISCARD(8)                                                          DISCARD(8)
        syslogd(8), system logging
 
 LICENSE
-       The  Secure  Mailer  license must be distributed with this
+       The Secure Mailer license must be  distributed  with  this
        software.
 
 HISTORY
diff --git a/postfix/html/error.8.html b/postfix/html/error.8.html
index d66f9ead4..849a55641 100644
--- a/postfix/html/error.8.html
+++ b/postfix/html/error.8.html
@@ -15,8 +15,8 @@ ERROR(8)                                                              ERROR(8)
 DESCRIPTION
        The  Postfix  error(8)  delivery  agent processes delivery
        requests from the queue manager. Each request specifies  a
-       queue  file, a sender address, the reason for non-delivery
-       (specified as the  next-hop  destination),  and  recipient
+       queue  file,  a sender address, a domain or host name that
+       is treated as the reason for non-delivery,  and  recipient
        information.   The  reason  may  be  prefixed  with an RFC
        3463-compatible detail code.  This program expects  to  be
        run from the master(8) process manager.
@@ -86,36 +86,35 @@ ERROR(8)                                                              ERROR(8)
 
        max_idle (100s)
               The  maximum  amount  of  time that an idle Postfix
-              daemon process waits  for  an  incoming  connection
-              before terminating voluntarily.
+              daemon process waits for the next  service  request
+              before exiting.
 
        max_use (100)
-              The  maximal  number of incoming connections that a
-              Postfix daemon process will service  before  termi-
-              nating voluntarily.
+              The  maximal number of connection requests before a
+              Postfix daemon process terminates.
 
        notify_classes (resource, software)
-              The  list of error classes that are reported to the
+              The list of error classes that are reported to  the
               postmaster.
 
        process_id (read-only)
-              The process ID  of  a  Postfix  command  or  daemon
+              The  process  ID  of  a  Postfix  command or daemon
               process.
 
        process_name (read-only)
-              The  process  name  of  a Postfix command or daemon
+              The process name of a  Postfix  command  or  daemon
               process.
 
        queue_directory (see 'postconf -d' output)
-              The location of the Postfix top-level queue  direc-
+              The  location of the Postfix top-level queue direc-
               tory.
 
        syslog_facility (mail)
               The syslog facility of Postfix logging.
 
        syslog_name (postfix)
-              The  mail  system  name  that  is  prepended to the
-              process name in syslog  records,  so  that  "smtpd"
+              The mail system  name  that  is  prepended  to  the
+              process  name  in  syslog  records, so that "smtpd"
               becomes, for example, "postfix/smtpd".
 
 SEE ALSO
@@ -128,7 +127,7 @@ ERROR(8)                                                              ERROR(8)
        syslogd(8), system logging
 
 LICENSE
-       The  Secure  Mailer  license must be distributed with this
+       The Secure Mailer license must be  distributed  with  this
        software.
 
 AUTHOR(S)
diff --git a/postfix/html/flush.8.html b/postfix/html/flush.8.html
index c5f3bb405..cba373e9e 100644
--- a/postfix/html/flush.8.html
+++ b/postfix/html/flush.8.html
@@ -120,38 +120,37 @@ FLUSH(8)                                                              FLUSH(8)
 
        max_idle (100s)
               The maximum amount of time  that  an  idle  Postfix
-              daemon  process  waits  for  an incoming connection
-              before terminating voluntarily.
+              daemon  process  waits for the next service request
+              before exiting.
 
        max_use (100)
-              The maximal number of incoming connections  that  a
-              Postfix  daemon  process will service before termi-
-              nating voluntarily.
+              The maximal number of connection requests before  a
+              Postfix daemon process terminates.
 
-       parent_domain_matches_subdomains (see 'postconf  -d'  out-
+       parent_domain_matches_subdomains  (see  'postconf -d' out-
        put)
               What   Postfix   features   match   subdomains   of
               "domain.tld" automatically, instead of requiring an
               explicit ".domain.tld" pattern.
 
        process_id (read-only)
-              The process ID  of  a  Postfix  command  or  daemon
+              The  process  ID  of  a  Postfix  command or daemon
               process.
 
        process_name (read-only)
-              The  process  name  of  a Postfix command or daemon
+              The process name of a  Postfix  command  or  daemon
               process.
 
        queue_directory (see 'postconf -d' output)
-              The location of the Postfix top-level queue  direc-
+              The  location of the Postfix top-level queue direc-
               tory.
 
        syslog_facility (mail)
               The syslog facility of Postfix logging.
 
        syslog_name (postfix)
-              The  mail  system  name  that  is  prepended to the
-              process name in syslog  records,  so  that  "smtpd"
+              The mail system  name  that  is  prepended  to  the
+              process  name  in  syslog  records, so that "smtpd"
               becomes, for example, "postfix/smtpd".
 
 FILES
@@ -169,7 +168,7 @@ FLUSH(8)                                                              FLUSH(8)
        ETRN_README, Postfix ETRN howto
 
 LICENSE
-       The Secure Mailer license must be  distributed  with  this
+       The  Secure  Mailer  license must be distributed with this
        software.
 
 HISTORY
diff --git a/postfix/html/generic.5.html b/postfix/html/generic.5.html
index 9b0ffc2e4..e0c2a5e00 100644
--- a/postfix/html/generic.5.html
+++ b/postfix/html/generic.5.html
@@ -39,8 +39,8 @@ GENERIC(5)                                                          GENERIC(5)
        that serves as  input  to  the  postmap(1)  command.   The
        result,  an  indexed file in dbm or db format, is used for
        fast searching by the mail  system.  Execute  the  command
-       "postmap  /etc/postfix/generic" to rebuild an indexed file
-       after changing the corresponding text file.
+       "postmap  /etc/postfix/generic"  in  order  to rebuild the
+       indexed file after changing the text file.
 
        When the table is provided via other means  such  as  NIS,
        LDAP  or  SQL,  the  same lookups are done as for ordinary
@@ -49,9 +49,9 @@ GENERIC(5)                                                          GENERIC(5)
        Alternatively, the table can be  provided  as  a  regular-
        expression map where patterns are given as regular expres-
        sions, or lookups can be directed to TCP-based server.  In
-       those  case,  the lookups are done in a slightly different
+       that  case,  the  lookups are done in a slightly different
        way as described below under "REGULAR  EXPRESSION  TABLES"
-       or "TCP-BASED TABLES".
+       and "TCP-BASED TABLES".
 
 CASE FOLDING
        The  search  string is folded to lowercase before database
@@ -142,7 +142,7 @@ GENERIC(5)                                                          GENERIC(5)
        lookups are directed to a TCP-based server. For a descrip-
        tion of the TCP client/server lookup protocol, see tcp_ta-
        ble(5).  This feature is not available up to and including
-       Postfix version 2.4.
+       Postfix version 2.3.
 
        Each lookup operation uses the entire address once.  Thus,
        user@domain  mail  addresses  are not broken up into their
diff --git a/postfix/html/header_checks.5.html b/postfix/html/header_checks.5.html
index c47f19bdc..4fd5a9ed0 100644
--- a/postfix/html/header_checks.5.html
+++ b/postfix/html/header_checks.5.html
@@ -7,7 +7,7 @@
 HEADER_CHECKS(5)                                              HEADER_CHECKS(5)
 
 NAME
-       header_checks - Postfix built-in content inspection
+       header_checks - Postfix built-in header/body inspection
 
 SYNOPSIS
        header_checks = pcre:/etc/postfix/header_checks
@@ -15,53 +15,48 @@ HEADER_CHECKS(5)                                              HEADER_CHECKS(5)
        nested_header_checks = pcre:/etc/postfix/nested_header_checks
        body_checks = pcre:/etc/postfix/body_checks
 
-       postmap -q "string" pcre:/etc/postfix/filename
-       postmap -q - pcre:/etc/postfix/filename <inputfile
+       postmap -fq "string" pcre:/etc/postfix/filename
+       postmap -fq - pcre:/etc/postfix/filename <inputfile
 
 DESCRIPTION
-       This  document  describes access control on the content of
-       message headers and message body lines; it is  implemented
-       by  the  Postfix  cleanup(8) server before mail is queued.
-       See access(5) for access control  on  remote  SMTP  client
-       information.
-
-       Each  message  header  or  message  body  line is compared
-       against a list of patterns.  When a  match  is  found  the
-       corresponding action is executed, and the matching process
-       is repeated for the next message header  or  message  body
-       line.
-
-       For  examples, see the EXAMPLES section at the end of this
+       Postfix  provides  a  simple  built-in  content inspection
+       mechanism that examines incoming mail one  message  header
+       or one message body line at a time. Each input is compared
+       against a list of patterns, and when a match is found  the
+       corresponding  action is executed.  This feature is imple-
+       mented by the Postfix cleanup(8) server.
+
+       For examples, see the EXAMPLES section at the end of  this
        manual page.
 
        Postfix header or body_checks are designed to stop a flood
-       of  mail from worms or viruses; they do not decode attach-
-       ments, and they do not unzip archives. See  the  documents
-       referenced  below  in the README FILES section if you need
+       of mail from worms or viruses; they do not decode  attach-
+       ments,  and  they do not unzip archives. See the documents
+       referenced below in the README FILES section if  you  need
        more sophisticated content analysis.
 
        Postfix supports four built-in content inspection classes:
 
        header_checks
-              These   are  applied  to  initial  message  headers
-              (except for the headers  that  are  processed  with
+              These  are  applied  to  initial  message   headers
+              (except  for  the  headers  that are processed with
               mime_header_checks).
 
        mime_header_checks (default: $header_checks)
-              These  are  applied to MIME related message headers
+              These are applied to MIME related  message  headers
               only.
 
               This feature is available in Postfix 2.0 and later.
 
        nested_header_checks (default: $header_checks)
-              These  are  applied  to message headers of attached
-              email messages (except for  the  headers  that  are
+              These are applied to message  headers  of  attached
+              email  messages  (except  for  the headers that are
               processed with mime_header_checks).
 
               This feature is available in Postfix 2.0 and later.
 
        body_checks
-              These are applied to all other  content,  including
+              These  are  applied to all other content, including
               multi-part message boundaries.
 
               With Postfix versions before 2.0, all content after
@@ -69,73 +64,73 @@ HEADER_CHECKS(5)                                              HEADER_CHECKS(5)
               tent.
 
        Note: message headers are examined one logical header at a
-       time, even when a message  header  spans  multiple  lines.
+       time,  even  when  a  message header spans multiple lines.
        Body lines are always examined one line at a time.
 
 TABLE FORMAT
-       This  document  assumes  that header and body_checks rules
-       are specified in the form of  Postfix  regular  expression
-       lookup  tables.  Usually  the best performance is obtained
+       This document assumes that header  and  body_checks  rules
+       are  specified  in  the form of Postfix regular expression
+       lookup tables. Usually the best  performance  is  obtained
        with pcre (Perl Compatible Regular Expression) tables, but
-       the  slower  regexp (POSIX regular expressions) support is
-       more widely available.  Use the command "postconf  -m"  to
-       find  out what lookup table types your Postfix system sup-
+       the slower regexp (POSIX regular expressions)  support  is
+       more  widely  available.  Use the command "postconf -m" to
+       find out what lookup table types your Postfix system  sup-
        ports.
 
        The general format of Postfix regular expression tables is
-       given  below.   For  a  discussion  of specific pattern or
-       flags  syntax,  see  pcre_table(5)   or   regexp_table(5),
+       given below.  For a  discussion  of  specific  pattern  or
+       flags   syntax,   see  pcre_table(5)  or  regexp_table(5),
        respectively.
 
        /pattern/flags action
-              When  pattern matches the input string, execute the
-              corresponding action. See below for a list of  pos-
+              When pattern matches the input string, execute  the
+              corresponding  action. See below for a list of pos-
               sible actions.
 
        !/pattern/flags action
-              When  pattern does not match the input string, exe-
+              When pattern does not match the input string,  exe-
               cute the corresponding action.
 
        if /pattern/flags
 
        endif  Match the input string against the patterns between
-              if  and endif, if and only if the same input string
-              also matches pattern. The if..endif can nest.
+              if and endif, if and only if the input string  also
+              matches pattern. The if..endif can nest.
 
-              Note: do not prepend whitespace to patterns  inside
+              Note:  do not prepend whitespace to patterns inside
               if..endif.
 
        if !/pattern/flags
 
        endif  Match the input string against the patterns between
-              if and endif, if and only if the same input  string
-              does not match pattern. The if..endif can nest.
+              if  and endif, if and only if the input string does
+              not match pattern. The if..endif can nest.
 
        blank lines and comments
-              Empty  lines and whitespace-only lines are ignored,
-              as are lines whose first  non-whitespace  character
+              Empty lines and whitespace-only lines are  ignored,
+              as  are  lines whose first non-whitespace character
               is a `#'.
 
        multi-line text
-              A  pattern/action  line  starts with non-whitespace
-              text. A line that starts with whitespace  continues
+              A pattern/action line  starts  with  non-whitespace
+              text.  A line that starts with whitespace continues
               a logical line.
 
 TABLE SEARCH ORDER
-       For  each  line of message input, the patterns are applied
-       in the order as specified in the table. When a pattern  is
-       found  that  matches  the  input  line,  the corresponding
-       action is  executed  and  then  the  next  input  line  is
+       For each line of message input, the patterns  are  applied
+       in  the order as specified in the table. When a pattern is
+       found that  matches  the  input  line,  the  corresponding
+       action  is  executed  and  then  the  next  input  line is
        inspected.
 
 TEXT SUBSTITUTION
-       Substitution  of  substrings  from  the matched expression
-       into the action string is possible using the  conventional
-       Perl  syntax  ($1,  $2,  etc.).   The macros in the result
-       string may need to be written as  ${n}  or  $(n)  if  they
+       Substitution of substrings  from  the  matched  expression
+       into  the action string is possible using the conventional
+       Perl syntax ($1, $2, etc.).   The  macros  in  the  result
+       string  may  need  to  be  written as ${n} or $(n) if they
        aren't followed by whitespace.
 
-       Note:  since negated patterns (those preceded by !) return
+       Note: since negated patterns (those preceded by !)  return
        a result when the expression does not match, substitutions
        are not available for negated patterns.
 
@@ -144,12 +139,12 @@ HEADER_CHECKS(5)                                              HEADER_CHECKS(5)
        case for consistency with other Postfix documentation.
 
        DISCARD optional text...
-              Claim successful delivery and silently discard  the
-              message.   Log the optional text if specified, oth-
+              Claim  successful delivery and silently discard the
+              message.  Log the optional text if specified,  oth-
               erwise log a generic message.
 
-              Note:  this  action  disables  further  header   or
-              body_checks  inspection  of the current message and
+              Note:   this  action  disables  further  header  or
+              body_checks inspection of the current  message  and
               affects all recipients.  To discard only one recip-
               ient without discarding the entire message, use the
               transport(5) table to direct mail to the discard(8)
@@ -157,58 +152,57 @@ HEADER_CHECKS(5)                                              HEADER_CHECKS(5)
 
               This feature is available in Postfix 2.0 and later.
 
-       DUNNO  Pretend that the input line did not match any  pat-
-              tern,  and inspect the next input line. This action
+       DUNNO  Pretend  that the input line did not match any pat-
+              tern, and inspect the next input line. This  action
               can be used to shorten the table search.
 
-              For backwards compatibility reasons,  Postfix  also
-              accepts  OK but it is (and always has been) treated
+              For  backwards  compatibility reasons, Postfix also
+              accepts OK but it is (and always has been)  treated
               as DUNNO.
 
               This feature is available in Postfix 2.1 and later.
 
        FILTER transport:destination
-              Write  a  content filter request to the queue file,
-              and inspect the next input line.   After  the  com-
-              plete  message  is received it will be sent through
+              Write a content filter request to  the  queue  file
+              and  inspect  the  next input line.  After the com-
+              plete message is received it will be  sent  through
               the specified external content filter.  More infor-
-              mation  about  external  content  filters is in the
+              mation about external content  filters  is  in  the
               Postfix FILTER_README file.
 
-              Note: this action overrides the content_filter set-
-              ting, and affects all recipients of the message. In
-              the case that multiple FILTER  actions  fire,  only
-              the last one is executed.
+              Note:   this  action  overrides  the  main.cf  con-
+              tent_filter setting, and affects all recipients  of
+              the  message.  In  the  case  that  multiple FILTER
+              actions fire, only the last one is executed.
 
               This feature is available in Postfix 2.0 and later.
 
        HOLD optional text...
-              Arrange for the message to be placed  on  the  hold
-              queue,  and  inspect the next input line.  The mes-
-              sage remains on hold until someone  either  deletes
-              it  or  releases it for delivery.  Log the optional
+              Arrange  for  the  message to be placed on the hold
+              queue, and inspect the next input line.   The  mes-
+              sage  remains  on hold until someone either deletes
+              it or releases it for delivery.  Log  the  optional
               text if specified, otherwise log a generic message.
 
-              Mail  that  is  placed on hold can be examined with
-              the postcat(1) command, and  can  be  destroyed  or
+              Mail that is placed on hold can  be  examined  with
+              the  postcat(1)  command,  and  can be destroyed or
               released with the postsuper(1) command.
 
-              Note:  use  "postsuper -r" to release mail that was
-              kept on hold for a significant fraction  of  $maxi-
+              Note: use "postsuper -r" to release mail  that  was
+              kept  on  hold for a significant fraction of $maxi-
               mal_queue_lifetime  or  $bounce_queue_lifetime,  or
-              longer. Use "postsuper -H" only for mail that  will
-              not expire within a few delivery attempts.
+              longer.
 
               Note:  this  action  affects  all recipients of the
               message.
 
               This feature is available in Postfix 2.0 and later.
 
-       IGNORE Delete the current line from the input, and inspect
+       IGNORE Delete  the current line from the input and inspect
               the next input line.
 
        PREPEND text...
-              Prepend one  line  with  the  specified  text,  and
+              Prepend  one  line  with  the  specified  text  and
               inspect the next input line.
 
               Notes:
@@ -234,7 +228,7 @@ HEADER_CHECKS(5)                                              HEADER_CHECKS(5)
 
        REDIRECT user@domain
               Write  a  message  redirection request to the queue
-              file, and inspect the next input  line.  After  the
+              file and inspect the next  input  line.  After  the
               message is queued, it will be sent to the specified
               address instead of the intended recipient(s).
 
@@ -246,7 +240,7 @@ HEADER_CHECKS(5)                                              HEADER_CHECKS(5)
               This feature is available in Postfix 2.1 and later.
 
        REPLACE text...
-              Replace the current line with the  specified  text,
+              Replace the current line with  the  specified  text
               and inspect the next input line.
 
               This feature is available in Postfix 2.2 and later.
@@ -282,25 +276,19 @@ HEADER_CHECKS(5)                                              HEADER_CHECKS(5)
 
        WARN optional text...
               Log  a  warning with the optional text... (or log a
-              generic message), and inspect the next input  line.
+              generic message) and inspect the next  input  line.
               This action is useful for debugging and for testing
               a pattern before applying more drastic actions.
 
 BUGS
        Many people overlook the main limitations  of  header  and
-       body_checks rules.
-
-       o      These  rules  operate on one logical message header
-              or one body line at a time. A decision made for one
-              line is not carried over to the next line.
-
-       o      If  text  in the message body is encoded (RFC 2045)
-              then the rules have to specified  for  the  encoded
-              form.
-
-       o      Likewise,  when  message  headers  are encoded (RFC
-              2047) then the rules need to be specified  for  the
-              encoded form.
+       body_checks  rules.   These  rules  operate on one logical
+       message header or one body line at a time, and a  decision
+       made  for  one  line is not carried over to the next line.
+       If text in the message body is encoded (RFC 2045) then the
+       rules  have  to specified for the encoded form.  Likewise,
+       when message headers are encoded (RFC 2047) then the rules
+       need to be specified for the encoded form.
 
        Message  headers added by the cleanup(8) daemon itself are
        excluded from inspection. Examples of such message headers
@@ -356,7 +344,7 @@ HEADER_CHECKS(5)                                              HEADER_CHECKS(5)
        Header pattern to block attachments  with  bad  file  name
        extensions.
 
-       /etc/postfix/main.cf:
+       /etc/postfix/main.cf:
            header_checks = regexp:/etc/postfix/header_checks
 
        /etc/postfix/header_checks:
@@ -366,7 +354,7 @@ HEADER_CHECKS(5)                                              HEADER_CHECKS(5)
        Body pattern to stop a specific HTML browser vulnerability
        exploit.
 
-       /etc/postfix/main.cf:
+       /etc/postfix/main.cf:
            body_checks = regexp:/etc/postfix/body_checks
 
        /etc/postfix/body_checks:
diff --git a/postfix/html/index.html b/postfix/html/index.html
index 4107fc0e1..350e42402 100644
--- a/postfix/html/index.html
+++ b/postfix/html/index.html
@@ -58,6 +58,8 @@ configuration examples 
 
 
  •   Debugging strategies  
 
+
  •  Error messages (*)
+
 
 
 
    Content inspection 
    
@@ -132,6 +134,8 @@ Per-client/user/etc. access 
 
 
@@ -148,14 +152,20 @@ Per-client/user/etc. access 
 
 
  •   NFS issues 
 
+
  •   Ultrix support 
+
 
 
 
     Other mail delivery agents 
    
 
 
 
 
     Other topics 
    
@@ -190,6 +200,10 @@ Recipients 
 
 
 
+   (*) These documents will be
+made available via 
+http://www.postfix.org/ and mirror sites.   
+
 
 
 
diff --git a/postfix/html/ldap_table.5.html b/postfix/html/ldap_table.5.html
index 8342ab8a6..ef9d1cf53 100644
--- a/postfix/html/ldap_table.5.html
+++ b/postfix/html/ldap_table.5.html
@@ -24,7 +24,6 @@ LDAP_TABLE(5)                                                    LDAP_TABLE(5)
 
        In order to use LDAP lookups, define an LDAP source  as  a
        lookup table in main.cf, for example:
-
            alias_maps = ldap:/etc/postfix/ldap-aliases.cf
 
        The  file /etc/postfix/ldap-aliases.cf has the same format
@@ -88,12 +87,10 @@ LDAP_TABLE(5)                                                    LDAP_TABLE(5)
 
        For example, NEVER do this in a map  defining  $mydestina-
        tion:
-
            query_filter = domain=*
            result_attribute = domain
 
        Do this instead:
-
            query_filter = domain=%s
            result_attribute = domain
 
@@ -105,7 +102,6 @@ LDAP_TABLE(5)                                                    LDAP_TABLE(5)
 
        server_host (default: localhost)
               The name of the host running the LDAP server,  e.g.
-
                   server_host = ldap.example.com
 
               Depending  on the LDAP client library you're using,
@@ -114,12 +110,10 @@ LDAP_TABLE(5)                                                    LDAP_TABLE(5)
               the first one fail. It should also be  possible  to
               give  each  server  in  the  list  a different port
               (overriding server_port below), by naming them like
-
                   server_host = ldap.example.com:1444
 
               With OpenLDAP, a (list of) LDAP URLs can be used to
               specify both the hostname(s) and the port(s):
-
                   server_host = ldap://ldap.example.com:1444
                               ldap://ldap2.example.com:1444
 
@@ -127,25 +121,21 @@ LDAP_TABLE(5)                                                    LDAP_TABLE(5)
               supported,  including  connections over UNIX domain
               sockets, and LDAP SSL (the last one  provided  that
               OpenLDAP was compiled with support for SSL):
-
                   server_host = ldapi://%2Fsome%2Fpath
                               ldaps://ldap.example.com:636
 
        server_port (default: 389)
               The port the LDAP server listens on, e.g.
-
                   server_port = 778
 
        timeout (default: 10 seconds)
               The number of seconds a search can take before tim-
               ing out, e.g.
-
                   timeout = 5
 
        search_base (No default; you must configure this)
               The RFC2253 base DN at which to conduct the search,
               e.g.
-
                   search_base = dc=your, dc=com
 
               With  Postfix 2.2 and later this parameter supports
@@ -158,16 +148,16 @@ LDAP_TABLE(5)                                                    LDAP_TABLE(5)
                      key  does not add unexpected metacharacters.
 
               %u     When the input key is an address of the form
-                     user@domain,  %u  is  replaced  by  the (RFC
-                     2253) quoted  local  part  of  the  address.
+                     user@domain,  %u  is  replaced  by  the (RFC
+                     2253) quoted  local  part  of  the  address.
                      Otherwise,  %u  is  replaced  by  the entire
                      search string.  If the localpart  is  empty,
                      the  search  is  suppressed  and  returns no
                      results.
 
               %d     When the input key is an address of the form
-                     user@domain,  %d  is  replaced  by  the (RFC
-                     2253) quoted domain  part  of  the  address.
+                     user@domain,  %d  is  replaced  by  the (RFC
+                     2253) quoted domain  part  of  the  address.
                      Otherwise,  the  search  is  suppressed  and
                      returns no results.
 
@@ -194,7 +184,6 @@ LDAP_TABLE(5)                                                    LDAP_TABLE(5)
               The  RFC2254  filter  used to search the directory,
               where %s is a substitute for the address Postfix is
               trying to resolve, e.g.
-
                   query_filter = (&(mail=%s)(paid_up=true))
 
               This  parameter  supports  the following '%' expan-
@@ -208,16 +197,16 @@ LDAP_TABLE(5)                                                    LDAP_TABLE(5)
                      key  does not add unexpected metacharacters.
 
               %u     When the input key is an address of the form
-                     user@domain,  %u  is  replaced  by  the (RFC
-                     2254) quoted  local  part  of  the  address.
+                     user@domain,  %u  is  replaced  by  the (RFC
+                     2254) quoted  local  part  of  the  address.
                      Otherwise,  %u  is  replaced  by  the entire
                      search string.  If the localpart  is  empty,
                      the  search  is  suppressed  and  returns no
                      results.
 
               %d     When the input key is an address of the form
-                     user@domain,  %d  is  replaced  by  the (RFC
-                     2254) quoted domain  part  of  the  address.
+                     user@domain,  %d  is  replaced  by  the (RFC
+                     2254) quoted domain  part  of  the  address.
                      Otherwise,  the  search  is  suppressed  and
                      returns no results.
 
@@ -240,7 +229,7 @@ LDAP_TABLE(5)                                                    LDAP_TABLE(5)
                      is example and %3 is mail. If the input  key
                      is  unqualified  or  does  not  have  enough
                      domain components to satisfy all the  speci-
-                     fied  patterns, the search is suppressed and
+                     fied  patterns, the saerch is suppressed and
                      returns no results.
 
                      The above %1, ..., %9 expansions are  avail-
@@ -326,7 +315,6 @@ LDAP_TABLE(5)                                                    LDAP_TABLE(5)
               lookups,  bare domain lookups and "@domain" lookups
               are not performed. This  can  significantly  reduce
               the query load on the LDAP server.
-
                   domain = postfix.org, hash:/etc/postfix/search-
               domains
 
@@ -342,15 +330,13 @@ LDAP_TABLE(5)                                                    LDAP_TABLE(5)
               The  attribute(s) Postfix will read from any direc-
               tory entries returned by the lookup, to be resolved
               to an email address.
-
                   result_attribute = mailbox, maildrop
 
-       special_result_attribute (default: empty)
+       special_result_attribute (No default)
               The attribute(s) of directory entries that can con-
               tain DNs or URLs. If found, a recursive  subsequent
               search is done using their values.
-
-                  special_result_attribute = memberdn
+                  special_result_attribute = member
 
               DN  recursion  retrieves the same result_attributes
               as the main query, including the special attributes
@@ -361,53 +347,6 @@ LDAP_TABLE(5)                                                    LDAP_TABLE(5)
               map's  special  result  attributes,  these are also
               retrieved and used recursively.
 
-       terminal_result_attribute (default: empty)
-              When one or more  terminal  result  attributes  are
-              found in an LDAP entry, all other result attributes
-              are ignored and only the terminal result attributes
-              are  returned. This is useful for delegating expan-
-              sion of group members  to  a  particular  host,  by
-              using  an optional "maildrop" attribute on selected
-              groups to route the group to a specific host, where
-              the  group  is  expanded, possibly via mailing-list
-              manager or other special processing.
-
-                  terminal_result_attribute = maildrop
-
-              This feature  is  available  with  Postfix  2.4  or
-              later.
-
-       leaf_result_attribute (default: empty)
-              When  one  or  more  special  result attributes are
-              found in a non-terminal  (see  above)  LDAP  entry,
-              leaf result attributes are excluded from the expan-
-              sion of that entry. This is useful  when  expanding
-              groups and the desired mail address attribute(s) of
-              the member objects obtained via DN or URI recursion
-              are  also  present  in  the  group  object. To only
-              return the attribute values from the  leaf  objects
-              and  not the containing group, add the attribute to
-              the  leaf_result_attribute  list,   and   not   the
-              result_attribute  list,  which  is always expanded.
-              Note, the default value  of  "result_attribute"  is
-              not  empty, you may want to set it explicitly empty
-              when using "leaf_result_attribute"  to  expand  the
-              group  to  a list of member DN addresses. If groups
-              have both member DN references AND attributes  that
-              hold  multiple string valued rfc822 addresses, then
-              the string  attributes  go  in  "result_attribute".
-              The  attributes  that represent the email addresses
-              of objects referenced via a DN (or LDAP URI) go  in
-              "leaf_result_attribute".
-
-                  result_attribute = memberaddr
-                  special_result_attribute = memberdn
-                  terminal_result_attribute = maildrop
-                  leaf_result_attribute = mail
-
-              This  feature  is  available  with  Postfix  2.4 or
-              later.
-
        scope (default: sub)
               The LDAP search scope: sub, base,  or  one.   These
               translate into LDAP_SCOPE_SUBTREE, LDAP_SCOPE_BASE,
@@ -417,7 +356,6 @@ LDAP_TABLE(5)                                                    LDAP_TABLE(5)
               Whether or not to bind to the  LDAP  server.  Newer
               LDAP implementations don't require clients to bind,
               which saves time. Example:
-
                   bind = no
 
               If you do need to bind, you might consider  config-
@@ -431,7 +369,6 @@ LDAP_TABLE(5)                                                    LDAP_TABLE(5)
        bind_dn (default: empty)
               If  you  do  have  to bind, do it with this distin-
               guished name. Example:
-
                   bind_dn = uid=postfix, dc=your, dc=com
 
        bind_pw (default: empty)
@@ -444,7 +381,6 @@ LDAP_TABLE(5)                                                    LDAP_TABLE(5)
               because main.cf needs to be world readable to allow
               local accounts to submit mail via the sendmail com-
               mand. Example:
-
                   bind_pw = postfixpw
 
        cache (IGNORED with a warning)
@@ -523,16 +459,13 @@ LDAP_TABLE(5)                                                    LDAP_TABLE(5)
 
        LDAP SSL service can be requested by using a LDAP SSL  URL
        in the server_host parameter:
-
            server_host = ldaps://ldap.example.com:636
 
        STARTTLS can be turned on with the start_tls parameter:
-
            start_tls = yes
 
        Both  forms  require LDAP protocol version 3, which has to
        be set explicitly with:
-
            version = 3
 
        If any of the Postfix programs querying the map is config-
@@ -597,24 +530,22 @@ LDAP_TABLE(5)                                                    LDAP_TABLE(5)
 EXAMPLE
        Here's  a basic example for using LDAP to look up local(8)
        aliases.  Assume that in main.cf, you have:
-
            alias_maps = hash:/etc/aliases,
                ldap:/etc/postfix/ldap-aliases.cf
 
        and in ldap:/etc/postfix/ldap-aliases.cf you have:
-
-           server_host = ldap.example.com
-           search_base = dc=example, dc=com
+           server_host = ldap.my.com
+           search_base = dc=my, dc=com
 
        Upon receiving mail for a local  address  "ldapuser"  that
        isn't  found  in  the  /etc/aliases database, Postfix will
-       search the LDAP server listening at port 389 on ldap.exam-
-       ple.com.   It will bind anonymously, search for any direc-
-       tory entries  whose  mailacceptinggeneralid  attribute  is
-       "ldapuser", read the "maildrop" attributes of those found,
-       and build a list of their maildrops, which will be treated
-       as  RFC822  addresses  to which the message will be deliv-
-       ered.
+       search  the  LDAP  server  listening  at   port   389   on
+       ldap.my.com.   It  will  bind  anonymously, search for any
+       directory entries whose  mailacceptinggeneralid  attribute
+       is  "ldapuser",  read  the  "maildrop" attributes of those
+       found, and build a list of their maildrops, which will  be
+       treated  as  RFC822 addresses to which the message will be
+       delivered.
 
 SEE ALSO
        postmap(1), Postfix lookup table manager
diff --git a/postfix/html/lmtp.8.html b/postfix/html/lmtp.8.html
deleted file mode 100644
index d991668be..000000000
--- a/postfix/html/lmtp.8.html
+++ /dev/null
@@ -1,773 +0,0 @@
-
- 
-
- Postfix manual - smtp(8) 
-  
    -SMTP(8)                                                                SMTP(8)
-
-NAME
-       smtp - Postfix SMTP+LMTP client
-
-SYNOPSIS
-       smtp [generic Postfix daemon options]
-
-DESCRIPTION
-       The  Postfix SMTP+LMTP client implements the SMTP and LMTP
-       mail delivery protocols.  It  processes  message  delivery
-       requests  from the queue manager. Each request specifies a
-       queue file, a sender address, a domain or host to  deliver
-       to, and recipient information.  This program expects to be
-       run from the master(8) process manager.
-
-       The SMTP+LMTP client updates  the  queue  file  and  marks
-       recipients  as  finished,  or it informs the queue manager
-       that delivery should be  tried  again  at  a  later  time.
-       Delivery   status  reports  are  sent  to  the  bounce(8),
-       defer(8) or trace(8) daemon as appropriate.
-
-       The SMTP+LMTP client looks up a  list  of  mail  exchanger
-       addresses  for  the  destination  host,  sorts the list by
-       preference, and connects to each listed address  until  it
-       finds a server that responds.
-
-       When  a  server  is  not  reachable, or when mail delivery
-       fails due to a recoverable error condition, the  SMTP+LMTP
-       client  will try to deliver the mail to an alternate host.
-
-       After a successful mail transaction, a connection  may  be
-       saved to the scache(8) connection cache server, so that it
-       may be used by  any  SMTP+LMTP  client  for  a  subsequent
-       transaction.
-
-       By  default, connection caching is enabled temporarily for
-       destinations that have a high volume of mail in the active
-       queue.  Connection  caching can be enabled permanently for
-       specific destinations.
-
-SMTP DESTINATION SYNTAX
-       SMTP destinations have the following form:
-
-       domainname
-
-       domainname:port
-              Look up  the  mail  exchangers  for  the  specified
-              domain, and connect to the specified port (default:
-              smtp).
-
-       [hostname]
-
-       [hostname]:port
-              Look up the address(es) of the specified host,  and
-              connect to the specified port (default: smtp).
-
-       [address]
-
-       [address]:port
-              Connect  to  the host at the specified address, and
-              connect to the specified port (default:  smtp).  An
-              IPv6 address must be formatted as [ipv6:address].
-
-LMTP DESTINATION SYNTAX
-       LMTP destinations have the following form:
-
-       unix:pathname
-              Connect  to  the  local  UNIX-domain server that is
-              bound to the specified  pathname.  If  the  process
-              runs  chrooted, an absolute pathname is interpreted
-              relative to the Postfix queue directory.
-
-       inet:hostname
-
-       inet:hostname:port
-
-       inet:[address]
-
-       inet:[address]:port
-              Connect to the specified TCP port on the  specified
-              local or remote host. If no port is specified, con-
-              nect to the port defined as  lmtp  in  services(4).
-              If no such service is found, the lmtp_tcp_port con-
-              figuration parameter (default value of 24) will  be
-              used.    An  IPv6  address  must  be  formatted  as
-              [ipv6:address].
-
-SECURITY
-       The SMTP+LMTP client is moderately security-sensitive.  It
-       talks  to  SMTP  or LMTP servers and to DNS servers on the
-       network. The SMTP+LMTP client can be run chrooted at fixed
-       low privilege.
-
-STANDARDS
-       RFC 821 (SMTP protocol)
-       RFC 822 (ARPA Internet Text Messages)
-       RFC 1651 (SMTP service extensions)
-       RFC 1652 (8bit-MIME transport)
-       RFC 1870 (Message Size Declaration)
-       RFC 2033 (LMTP protocol)
-       RFC 2034 (SMTP Enhanced Error Codes)
-       RFC 2045 (MIME: Format of Internet Message Bodies)
-       RFC 2046 (MIME: Media Types)
-       RFC 2554 (AUTH command)
-       RFC 2821 (SMTP protocol)
-       RFC 2920 (SMTP Pipelining)
-       RFC 3207 (STARTTLS command)
-       RFC 3461 (SMTP DSN Extension)
-       RFC 3463 (Enhanced Status Codes)
-
-DIAGNOSTICS
-       Problems  and transactions are logged to syslogd(8).  Cor-
-       rupted message files are marked so that the queue  manager
-       can move them to the corrupt queue for further inspection.
-
-       Depending on the setting of the notify_classes  parameter,
-       the  postmaster is notified of bounces, protocol problems,
-       and of other trouble.
-
-BUGS
-       SMTP and LMTP connection caching does not work  with  TLS.
-       The  necessary  support for TLS object passivation and re-
-       activation does not exist  without  closing  the  session,
-       which defeats the purpose.
-
-       SMTP and LMTP connection caching assumes that SASL creden-
-       tials are valid for all destinations  that  map  onto  the
-       same IP address and TCP port.
-
-CONFIGURATION PARAMETERS
-       Before  Postfix version 2.3, the LMTP client is a separate
-       program that implements only a subset of the functionality
-       available with SMTP: there is no support for TLS, and con-
-       nections are cached in-process, making it ineffective when
-       the client is used for multiple domains.
-
-       Most  smtp_xxx  configuration  parameters have an lmtp_xxx
-       "mirror" parameter for the equivalent LMTP  feature.  This
-       document describes only those LMTP-related parameters that
-       aren't simply "mirror" parameters.
-
-       Changes to main.cf are picked up automatically, as smtp(8)
-       processes  run  for only a limited amount of time. Use the
-       command "postfix reload" to speed up a change.
-
-       The text below provides  only  a  parameter  summary.  See
-       postconf(5) for more details including examples.
-
-COMPATIBILITY CONTROLS
-       ignore_mx_lookup_error (no)
-              Ignore DNS MX lookups that produce no response.
-
-       smtp_always_send_ehlo (yes)
-              Always send EHLO at the start of an SMTP session.
-
-       smtp_never_send_ehlo (no)
-              Never send EHLO at the start of an SMTP session.
-
-       smtp_defer_if_no_mx_address_found (no)
-              Defer  mail  delivery when no MX record resolves to
-              an IP address.
-
-       smtp_line_length_limit (990)
-              The maximal length of message header and body lines
-              that Postfix will send via SMTP.
-
-       smtp_pix_workaround_delay_time (10s)
-              How  long  the  Postfix  SMTP  client pauses before
-              sending ".<CR><LF>" in order to work around the PIX
-              firewall "<CR><LF>.<CR><LF>" bug.
-
-       smtp_pix_workaround_threshold_time (500s)
-              How  long a message must be queued before the Post-
-              fix  SMTP  client  turns  on   the   PIX   firewall
-              "<CR><LF>.<CR><LF>"  bug  workaround  for  delivery
-              through firewalls with "smtp fixup" mode turned on.
-
-       smtp_pix_workarounds (disable_esmtp, delay_dotcrlf)
-              A  list that specifies zero or more workarounds for
-              CISCO PIX firewall bugs.
-
-       smtp_pix_workaround_maps (empty)
-              Lookup tables, indexed by the  remote  SMTP  server
-              address, with per-destination workarounds for CISCO
-              PIX firewall bugs.
-
-       smtp_quote_rfc821_envelope (yes)
-              Quote addresses in SMTP MAIL FROM and RCPT TO  com-
-              mands as required by RFC 821.
-
-       smtp_skip_5xx_greeting (yes)
-              Skip SMTP servers that greet with a 5XX status code
-              (go away, do not try again later).
-
-       smtp_skip_quit_response (yes)
-              Do not wait for the response to the SMTP QUIT  com-
-              mand.
-
-       Available in Postfix version 2.0 and earlier:
-
-       smtp_skip_4xx_greeting (yes)
-              Skip SMTP servers that greet with a 4XX status code
-              (go away, try again later).
-
-       Available in Postfix version 2.2 and later:
-
-       smtp_discard_ehlo_keyword_address_maps (empty)
-              Lookup tables, indexed by the  remote  SMTP  server
-              address,  with  case insensitive lists of EHLO key-
-              words (pipelining, starttls, auth, etc.)  that  the
-              Postfix   SMTP  client  will  ignore  in  the  EHLO
-              response from a remote SMTP server.
-
-       smtp_discard_ehlo_keywords (empty)
-              A case insensitive list of EHLO keywords  (pipelin-
-              ing,  starttls,  auth,  etc.) that the Postfix SMTP
-              client will ignore in  the  EHLO  response  from  a
-              remote SMTP server.
-
-       smtp_generic_maps (empty)
-              Optional lookup tables that perform address rewrit-
-              ing in the SMTP client, typically  to  transform  a
-              locally valid address into a globally valid address
-              when sending mail across the Internet.
-
-       Available in Postfix version 2.2.9 and later:
-
-       smtp_cname_overrides_servername (version dependent)
-              Allow DNS CNAME records to override the  servername
-              that the Postfix SMTP client uses for logging, SASL
-              password lookup, TLS policy decisions, or TLS  cer-
-              tificate verification.
-
-       Available in Postfix version 2.3 and later:
-
-       lmtp_discard_lhlo_keyword_address_maps (empty)
-              Lookup  tables,  indexed  by the remote LMTP server
-              address, with case insensitive lists of  LHLO  key-
-              words  (pipelining,  starttls, auth, etc.) that the
-              LMTP client will ignore in the LHLO response from a
-              remote LMTP server.
-
-       lmtp_discard_lhlo_keywords (empty)
-              A  case insensitive list of LHLO keywords (pipelin-
-              ing, starttls, auth, etc.)  that  the  LMTP  client
-              will ignore in the LHLO response from a remote LMTP
-              server.
-
-MIME PROCESSING CONTROLS
-       Available in Postfix version 2.0 and later:
-
-       disable_mime_output_conversion (no)
-              Disable the conversion of 8BITMIME format  to  7BIT
-              format.
-
-       mime_boundary_length_limit (2048)
-              The  maximal  length  of  MIME  multipart  boundary
-              strings.
-
-       mime_nesting_limit (100)
-              The maximal recursion level that the MIME processor
-              will handle.
-
-EXTERNAL CONTENT INSPECTION CONTROLS
-       Available in Postfix version 2.1 and later:
-
-       smtp_send_xforward_command (no)
-              Send  the  non-standard  XFORWARD  command when the
-              Postfix SMTP server EHLO response  announces  XFOR-
-              WARD support.
-
-SASL AUTHENTICATION CONTROLS
-       smtp_sasl_auth_enable (no)
-              Enable  SASL  authentication  in  the  Postfix SMTP
-              client.
-
-       smtp_sasl_password_maps (empty)
-              Optional SMTP client lookup tables with  one  user-
-              name:password  entry per remote hostname or domain,
-              or sender address when sender-dependent authentica-
-              tion is enabled.
-
-       smtp_sasl_security_options (noplaintext, noanonymous)
-              SASL  security  options; as of Postfix 2.3 the list
-              of available features depends on  the  SASL  client
-              implementation     that     is     selected    with
-              smtp_sasl_type.
-
-       Available in Postfix version 2.2 and later:
-
-       smtp_sasl_mechanism_filter (empty)
-              If non-empty, a Postfix SMTP client filter for  the
-              remote  SMTP  server's  list of offered SASL mecha-
-              nisms.
-
-       Available in Postfix version 2.3 and later:
-
-       smtp_sender_dependent_authentication (no)
-              Enable sender-dependent authentication in the Post-
-              fix  SMTP  client; this is available only with SASL
-              authentication,  and   disables   SMTP   connection
-              caching  to ensure that mail from different senders
-              will use the appropriate credentials.
-
-       smtp_sasl_path (empty)
-              Implementation-specific information that is  passed
-              through  to the SASL plug-in implementation that is
-              selected with smtp_sasl_type.
-
-       smtp_sasl_type (cyrus)
-              The SASL plug-in type that the Postfix SMTP  client
-              should use for authentication.
-
-STARTTLS SUPPORT CONTROLS
-       Detailed  information  about STARTTLS configuration may be
-       found in the TLS_README document.
-
-       smtp_tls_security_level (empty)
-              The default SMTP TLS security level for the Postfix
-              SMTP  client;  when a non-empty value is specified,
-              this    overrides    the    obsolete     parameters
-              smtp_use_tls,         smtp_enforce_tls,         and
-              smtp_tls_enforce_peername.
-
-       smtp_sasl_tls_security_options           ($smtp_sasl_secu-
-       rity_options)
-              The SASL authentication security options  that  the
-              Postfix  SMTP  client  uses  for TLS encrypted SMTP
-              sessions.
-
-       smtp_starttls_timeout (300s)
-              Time limit for Postfix SMTP client write  and  read
-              operations  during  TLS  startup and shutdown hand-
-              shake procedures.
-
-       smtp_tls_CAfile (empty)
-              The file with the certificate of the  certification
-              authority  (CA) that issued the Postfix SMTP client
-              certificate.
-
-       smtp_tls_CApath (empty)
-              Directory with  PEM  format  certificate  authority
-              certificates  that  the Postfix SMTP client uses to
-              verify a remote SMTP server certificate.
-
-       smtp_tls_cert_file (empty)
-              File with the Postfix SMTP client  RSA  certificate
-              in PEM format.
-
-       smtp_tls_mandatory_ciphers (medium)
-              The  minimum TLS cipher grade that the Postfix SMTP
-              client will use with mandatory TLS encryption.
-
-       smtp_tls_exclude_ciphers (empty)
-              List of ciphers or cipher types to exclude from the
-              Postfix SMTP client cipher list at all TLS security
-              levels.
-
-       smtp_tls_mandatory_exclude_ciphers (empty)
-              Additional list  of  ciphers  or  cipher  types  to
-              exclude  from the SMTP client cipher list at manda-
-              tory TLS security levels.
-
-       smtp_tls_dcert_file (empty)
-              File with the Postfix SMTP client  DSA  certificate
-              in PEM format.
-
-       smtp_tls_dkey_file ($smtp_tls_dcert_file)
-              File  with  the Postfix SMTP client DSA private key
-              in PEM format.
-
-       smtp_tls_key_file ($smtp_tls_cert_file)
-              File with the Postfix SMTP client RSA  private  key
-              in PEM format.
-
-       smtp_tls_loglevel (0)
-              Enable  additional  Postfix  SMTP client logging of
-              TLS activity.
-
-       smtp_tls_note_starttls_offer (no)
-              Log the hostname  of  a  remote  SMTP  server  that
-              offers  STARTTLS,  when  TLS is not already enabled
-              for that server.
-
-       smtp_tls_policy_maps (empty)
-              Optional lookup tables with the Postfix SMTP client
-              TLS security policy by next-hop destination; when a
-              non-empty value is specified,  this  overrides  the
-              obsolete smtp_tls_per_site parameter.
-
-       smtp_tls_mandatory_protocols (SSLv3, TLSv1)
-              List  of TLS protocols that the Postfix SMTP client
-              will use with mandatory TLS encryption.
-
-       smtp_tls_scert_verifydepth (5)
-              The verification depth for remote SMTP server  cer-
-              tificates.
-
-       smtp_tls_secure_cert_match (nexthop, dot-nexthop)
-              The server certificate peername verification method
-              for the "secure" TLS security level.
-
-       smtp_tls_session_cache_database (empty)
-              Name of the file containing  the  optional  Postfix
-              SMTP client TLS session cache.
-
-       smtp_tls_session_cache_timeout (3600s)
-              The expiration time of Postfix SMTP client TLS ses-
-              sion cache information.
-
-       smtp_tls_verify_cert_match (hostname)
-              The server certificate peername verification method
-              for the "verify" TLS security level.
-
-       tls_daemon_random_bytes (32)
-              The  number  of pseudo-random bytes that an smtp(8)
-              or smtpd(8) process  requests  from  the  tlsmgr(8)
-              server  in order to seed its internal pseudo random
-              number generator (PRNG).
-
-       tls_high_cipherlist
-       (ALL:!EXPORT:!LOW:!MEDIUM:+RC4:@STRENGTH)
-              The OpenSSL cipherlist for "HIGH" grade ciphers.
-
-       tls_medium_cipherlist (ALL:!EXPORT:!LOW:+RC4:@STRENGTH)
-              The OpenSSL cipherlist for "MEDIUM" or higher grade
-              ciphers.
-
-       tls_low_cipherlist (ALL:!EXPORT:+RC4:@STRENGTH)
-              The  OpenSSL  cipherlist  for "LOW" or higher grade
-              ciphers.
-
-       tls_export_cipherlist (ALL:+RC4:@STRENGTH)
-              The OpenSSL cipherlist for "EXPORT" or higher grade
-              ciphers.
-
-       tls_null_cipherlist (eNULL:!aNULL)
-              The  OpenSSL  cipherlist  for  "NULL" grade ciphers
-              that provide authentication without encryption.
-
-       Available in Postfix version 2.4 and later:
-
-       smtp_sasl_tls_verified_security_options
-       ($smtp_sasl_tls_security_options)
-              The SASL authentication security options  that  the
-              Postfix  SMTP  client  uses  for TLS encrypted SMTP
-              sessions with a verified server certificate.
-
-OBSOLETE STARTTLS CONTROLS
-       The following configuration parameters exist for  compati-
-       bility with Postfix versions before 2.3. Support for these
-       will be removed in a future release.
-
-       smtp_use_tls (no)
-              Opportunistic mode: use  TLS  when  a  remote  SMTP
-              server  announces  STARTTLS support, otherwise send
-              the mail in the clear.
-
-       smtp_enforce_tls (no)
-              Enforcement mode: require that remote SMTP  servers
-              use  TLS  encryption,  and  never  send mail in the
-              clear.
-
-       smtp_tls_enforce_peername (yes)
-              With mandatory TLS  encryption,  require  that  the
-              remote SMTP server hostname matches the information
-              in the remote SMTP server certificate.
-
-       smtp_tls_per_site (empty)
-              Optional lookup tables with the Postfix SMTP client
-              TLS  usage  policy  by  next-hop destination and by
-              remote SMTP server hostname.
-
-       smtp_tls_cipherlist (empty)
-              Obsolete Postfix < 2.3 control for the Postfix SMTP
-              client TLS cipher list.
-
-RESOURCE AND RATE CONTROLS
-       smtp_destination_concurrency_limit      ($default_destina-
-       tion_concurrency_limit)
-              The  maximal  number  of parallel deliveries to the
-              same destination  via  the  smtp  message  delivery
-              transport.
-
-       smtp_destination_recipient_limit        ($default_destina-
-       tion_recipient_limit)
-              The  maximal  number of recipients per delivery via
-              the smtp message delivery transport.
-
-       smtp_connect_timeout (30s)
-              The SMTP client time limit  for  completing  a  TCP
-              connection,  or  zero  (use  the  operating  system
-              built-in time limit).
-
-       smtp_helo_timeout (300s)
-              The SMTP client time limit for sending the HELO  or
-              EHLO  command, and for receiving the initial server
-              response.
-
-       lmtp_lhlo_timeout (300s)
-              The LMTP client time limit  for  sending  the  LHLO
-              command,  and  for  receiving  the  initial  server
-              response.
-
-       smtp_xforward_timeout (300s)
-              The SMTP client time limit for sending the XFORWARD
-              command, and for receiving the server response.
-
-       smtp_mail_timeout (300s)
-              The  SMTP  client  time  limit for sending the MAIL
-              FROM  command,  and  for   receiving   the   server
-              response.
-
-       smtp_rcpt_timeout (300s)
-              The  SMTP  client  time  limit for sending the SMTP
-              RCPT TO  command,  and  for  receiving  the  server
-              response.
-
-       smtp_data_init_timeout (120s)
-              The  SMTP  client  time  limit for sending the SMTP
-              DATA  command,  and  for   receiving   the   server
-              response.
-
-       smtp_data_xfer_timeout (180s)
-              The  SMTP  client  time  limit for sending the SMTP
-              message content.
-
-       smtp_data_done_timeout (600s)
-              The SMTP client time limit  for  sending  the  SMTP
-              ".", and for receiving the server response.
-
-       smtp_quit_timeout (300s)
-              The  SMTP  client  time  limit for sending the QUIT
-              command, and for receiving the server response.
-
-       Available in Postfix version 2.1 and later:
-
-       smtp_mx_address_limit (5)
-              The  maximal  number  of  MX  (mail  exchanger)  IP
-              addresses  that  can  result  from  mail  exchanger
-              lookups, or zero (no limit).
-
-       smtp_mx_session_limit (2)
-              The maximal number of SMTP  sessions  per  delivery
-              request  before  giving up or delivering to a fall-
-              back relay host, or zero (no limit).
-
-       smtp_rset_timeout (20s)
-              The SMTP client time limit  for  sending  the  RSET
-              command, and for receiving the server response.
-
-       Available in Postfix version 2.2 and earlier:
-
-       lmtp_cache_connection (yes)
-              Keep Postfix LMTP client connections open for up to
-              $max_idle seconds.
-
-       Available in Postfix version 2.2 and later:
-
-       smtp_connection_cache_destinations (empty)
-              Permanently enable SMTP connection caching for  the
-              specified destinations.
-
-       smtp_connection_cache_on_demand (yes)
-              Temporarily  enable SMTP connection caching while a
-              destination has a high volume of mail in the active
-              queue.
-
-       smtp_connection_reuse_time_limit (300s)
-              The amount of time during which Postfix will use an
-              SMTP connection repeatedly.
-
-       smtp_connection_cache_time_limit (2s)
-              When SMTP connection caching is enabled, the amount
-              of  time  that an unused SMTP client socket is kept
-              open before it is closed.
-
-       Available in Postfix version 2.3 and later:
-
-       connection_cache_protocol_timeout (5s)
-              Time limit for connection cache  connect,  send  or
-              receive operations.
-
-TROUBLE SHOOTING CONTROLS
-       debug_peer_level (2)
-              The  increment  in  verbose  logging  level  when a
-              remote client or server matches a  pattern  in  the
-              debug_peer_list parameter.
-
-       debug_peer_list (empty)
-              Optional  list  of remote client or server hostname
-              or network address patterns that cause the  verbose
-              logging  level  to increase by the amount specified
-              in $debug_peer_level.
-
-       error_notice_recipient (postmaster)
-              The recipient  of  postmaster  notifications  about
-              mail  delivery  problems that are caused by policy,
-              resource, software or protocol errors.
-
-       internal_mail_filter_classes (empty)
-              What categories of Postfix-generated mail are  sub-
-              ject   to   before-queue   content   inspection  by
-              non_smtpd_milters, header_checks and body_checks.
-
-       notify_classes (resource, software)
-              The list of error classes that are reported to  the
-              postmaster.
-
-MISCELLANEOUS CONTROLS
-       best_mx_transport (empty)
-              Where  the  Postfix SMTP client should deliver mail
-              when it detects a "mail loops back to myself" error
-              condition.
-
-       config_directory (see 'postconf -d' output)
-              The  default  location  of  the Postfix main.cf and
-              master.cf configuration files.
-
-       daemon_timeout (18000s)
-              How much time a Postfix daemon process may take  to
-              handle  a  request  before  it  is  terminated by a
-              built-in watchdog timer.
-
-       delay_logging_resolution_limit (2)
-              The maximal number  of  digits  after  the  decimal
-              point when logging sub-second delay values.
-
-       disable_dns_lookups (no)
-              Disable  DNS  lookups  in the Postfix SMTP and LMTP
-              clients.
-
-       inet_interfaces (all)
-              The network interface addresses that this mail sys-
-              tem receives mail on.
-
-       inet_protocols (ipv4)
-              The  Internet protocols Postfix will attempt to use
-              when making or accepting connections.
-
-       ipc_timeout (3600s)
-              The time limit for sending or receiving information
-              over an internal communication channel.
-
-       lmtp_tcp_port (24)
-              The  default  TCP port that the Postfix LMTP client
-              connects to.
-
-       max_idle (100s)
-              The maximum amount of time  that  an  idle  Postfix
-              daemon  process  waits  for  an incoming connection
-              before terminating voluntarily.
-
-       max_use (100)
-              The maximal number of incoming connections  that  a
-              Postfix  daemon  process will service before termi-
-              nating voluntarily.
-
-       process_id (read-only)
-              The process ID  of  a  Postfix  command  or  daemon
-              process.
-
-       process_name (read-only)
-              The  process  name  of  a Postfix command or daemon
-              process.
-
-       proxy_interfaces (empty)
-              The network interface addresses that this mail sys-
-              tem  receives  mail on by way of a proxy or network
-              address translation unit.
-
-       smtp_bind_address (empty)
-              An optional  numerical  network  address  that  the
-              Postfix  SMTP  client should bind to when making an
-              IPv4 connection.
-
-       smtp_bind_address6 (empty)
-              An optional  numerical  network  address  that  the
-              Postfix  SMTP  client should bind to when making an
-              IPv6 connection.
-
-       smtp_helo_name ($myhostname)
-              The hostname to send in the SMTP EHLO or HELO  com-
-              mand.
-
-       lmtp_lhlo_name ($myhostname)
-              The hostname to send in the LMTP LHLO command.
-
-       smtp_host_lookup (dns)
-              What  mechanisms  when the Postfix SMTP client uses
-              to look up a host's IP address.
-
-       smtp_randomize_addresses (yes)
-              Randomize the order  of  equal-preference  MX  host
-              addresses.
-
-       syslog_facility (mail)
-              The syslog facility of Postfix logging.
-
-       syslog_name (postfix)
-              The  mail  system  name  that  is  prepended to the
-              process name in syslog  records,  so  that  "smtpd"
-              becomes, for example, "postfix/smtpd".
-
-       Available with Postfix 2.2 and earlier:
-
-       fallback_relay (empty)
-              Optional  list of relay hosts for SMTP destinations
-              that can't be found or that are unreachable.
-
-       Available with Postfix 2.3 and later:
-
-       smtp_fallback_relay ($fallback_relay)
-              Optional list of relay hosts for SMTP  destinations
-              that can't be found or that are unreachable.
-
-SEE ALSO
-       qmgr(8), queue manager
-       bounce(8), delivery status reports
-       scache(8), connection cache server
-       postconf(5), configuration parameters
-       master(5), generic daemon options
-       master(8), process manager
-       tlsmgr(8), TLS session and PRNG management
-       syslogd(8), system logging
-
-README FILES
-       SASL_README, Postfix SASL howto
-       TLS_README, Postfix STARTTLS howto
-
-LICENSE
-       The Secure Mailer license must be  distributed  with  this
-       software.
-
-AUTHOR(S)
-       Wietse Venema
-       IBM T.J. Watson Research
-       P.O. Box 704
-       Yorktown Heights, NY 10598, USA
-
-       Command pipelining in cooperation with:
-       Jon Ribbens
-       Oaktree Internet Solutions Ltd.,
-       Internet House,
-       Canal Basin,
-       Coventry,
-       CV1 4LY, United Kingdom.
-
-       SASL support originally by:
-       Till Franke
-       SuSE Rhein/Main AG
-       65760 Eschborn, Germany
-
-       Connection caching in cooperation with:
-       Victor Duchovni
-       Morgan Stanley
-
-       TLS support originally by:
-       Lutz Jaenicke
-       BTU Cottbus
-       Allgemeine Elektrotechnik
-       Universitaetsplatz 3-4
-       D-03044 Cottbus, Germany
-
-                                                                       SMTP(8)
-
      
diff --git a/postfix/html/lmtp.8.html b/postfix/html/lmtp.8.html
new file mode 120000
index 000000000..6ec40f8f3
--- /dev/null
+++ b/postfix/html/lmtp.8.html
@@ -0,0 +1 @@
+smtp.8.html
\ No newline at end of file
diff --git a/postfix/html/local.8.html b/postfix/html/local.8.html
index de3fd4f54..0e512a166 100644
--- a/postfix/html/local.8.html
+++ b/postfix/html/local.8.html
@@ -560,34 +560,33 @@ LOCAL(8)                                                              LOCAL(8)
 
        max_idle (100s)
               The maximum amount of time  that  an  idle  Postfix
-              daemon  process  waits  for  an incoming connection
-              before terminating voluntarily.
+              daemon  process  waits for the next service request
+              before exiting.
 
        max_use (100)
-              The maximal number of incoming connections  that  a
-              Postfix  daemon  process will service before termi-
-              nating voluntarily.
+              The maximal number of connection requests before  a
+              Postfix daemon process terminates.
 
        prepend_delivered_header (command, file, forward)
-              The message delivery  contexts  where  the  Postfix
-              local(8)  delivery  agent  prepends a Delivered-To:
-              message header with the address that the  mail  was
+              The  message  delivery  contexts  where the Postfix
+              local(8) delivery agent  prepends  a  Delivered-To:
+              message  header  with the address that the mail was
               delivered to.
 
        process_id (read-only)
-              The  process  ID  of  a  Postfix  command or daemon
+              The process ID  of  a  Postfix  command  or  daemon
               process.
 
        process_name (read-only)
-              The process name of a  Postfix  command  or  daemon
+              The  process  name  of  a Postfix command or daemon
               process.
 
        propagate_unmatched_extensions (canonical, virtual)
-              What  address  lookup tables copy an address exten-
+              What address lookup tables copy an  address  exten-
               sion from the lookup key to the lookup result.
 
        queue_directory (see 'postconf -d' output)
-              The location of the Postfix top-level queue  direc-
+              The  location of the Postfix top-level queue direc-
               tory.
 
        recipient_delimiter (empty)
@@ -595,15 +594,15 @@ LOCAL(8)                                                              LOCAL(8)
               sions (user+foo).
 
        require_home_directory (no)
-              Whether or not a local(8) recipient's  home  direc-
-              tory  must exist before mail delivery is attempted.
+              Whether  or  not a local(8) recipient's home direc-
+              tory must exist before mail delivery is  attempted.
 
        syslog_facility (mail)
               The syslog facility of Postfix logging.
 
        syslog_name (postfix)
-              The mail system  name  that  is  prepended  to  the
-              process  name  in  syslog  records, so that "smtpd"
+              The  mail  system  name  that  is  prepended to the
+              process name in syslog  records,  so  that  "smtpd"
               becomes, for example, "postfix/smtpd".
 
 FILES
@@ -623,14 +622,14 @@ LOCAL(8)                                                              LOCAL(8)
        syslogd(8), system logging
 
 LICENSE
-       The Secure Mailer license must be  distributed  with  this
+       The  Secure  Mailer  license must be distributed with this
        software.
 
 HISTORY
        The Delivered-To: message header appears in the qmail sys-
        tem by Daniel Bernstein.
 
-       The maildir structure  appears  in  the  qmail  system  by
+       The  maildir  structure  appears  in  the  qmail system by
        Daniel Bernstein.
 
 AUTHOR(S)
diff --git a/postfix/html/mailq.1.html b/postfix/html/mailq.1.html
deleted file mode 100644
index 52a9a8645..000000000
--- a/postfix/html/mailq.1.html
+++ /dev/null
@@ -1,480 +0,0 @@
-
- 
-
- Postfix manual - sendmail(1) 
-  
    -SENDMAIL(1)                                                        SENDMAIL(1)
-
-NAME
-       sendmail - Postfix to Sendmail compatibility interface
-
-SYNOPSIS
-       sendmail [option ...] [recipient ...]
-
-       mailq
-       sendmail -bp
-
-       newaliases
-       sendmail -I
-
-DESCRIPTION
-       The  Postfix sendmail(1) command implements the Postfix to
-       Sendmail compatibility interface.  For the sake of compat-
-       ibility with existing applications, some Sendmail command-
-       line options are recognized but silently ignored.
-
-       By default, Postfix sendmail(1) reads a message from stan-
-       dard  input until EOF or until it reads a line with only a
-       . character, and arranges  for  delivery.   Postfix  send-
-       mail(1)  relies  on  the  postdrop(1)  command to create a
-       queue file in the maildrop directory.
-
-       Specific command aliases are  provided  for  other  common
-       modes of operation:
-
-       mailq  List  the  mail  queue.  Each entry shows the queue
-              file ID, message size, arrival  time,  sender,  and
-              the recipients that still need to be delivered.  If
-              mail could not be delivered upon the last  attempt,
-              the reason for failure is shown. This mode of oper-
-              ation is implemented by executing the  postqueue(1)
-              command.
-
-       newaliases
-              Initialize the alias database.  If no input file is
-              specified (with the -oA  option,  see  below),  the
-              program  processes  the  file(s) specified with the
-              alias_database  configuration  parameter.   If   no
-              alias  database type is specified, the program uses
-              the type specified with  the  default_database_type
-              configuration parameter.  This mode of operation is
-              implemented by running the postalias(1) command.
-
-              Note: it may take a minute or so  before  an  alias
-              database  update  becomes visible. Use the "postfix
-              reload" command to eliminate this delay.
-
-       These and other features can be selected by specifying the
-       appropriate combination of command-line options. Some fea-
-       tures are controlled by parameters in the main.cf configu-
-       ration file.
-
-       The following options are recognized:
-
-       -Am (ignored)
-
-       -Ac (ignored)
-              Postfix  sendmail  uses the same configuration file
-              regardless of whether or not a message is  an  ini-
-              tial submission.
-
-       -B body_type
-              The message body MIME type: 7BIT or 8BITMIME.
-
-       -bd    Go  into  daemon  mode.  This  mode of operation is
-              implemented by executing the "postfix  start"  com-
-              mand.
-
-       -bh (ignored)
-
-       -bH (ignored)
-              Postfix has no persistent host status database.
-
-       -bi    Initialize  alias database. See the newaliases com-
-              mand above.
-
-       -bm    Read mail  from  standard  input  and  arrange  for
-              delivery.  This is the default mode of operation.
-
-       -bp    List the mail queue. See the mailq command above.
-
-       -bs    Stand-alone  SMTP  server  mode. Read SMTP commands
-              from standard input, and write responses  to  stan-
-              dard output.  In stand-alone SMTP server mode, mail
-              relaying and other access controls are disabled  by
-              default.  To  enable  them,  run the process as the
-              mail_owner user.
-
-              This mode of operation is  implemented  by  running
-              the smtpd(8) daemon.
-
-       -bv    Do  not collect or deliver a message. Instead, send
-              an email  report  after  verifying  each  recipient
-              address.    This  is  useful  for  testing  address
-              rewriting and routing configurations.
-
-              This feature is available in  Postfix  version  2.1
-              and later.
-
-       -C config_file
-
-       -C config_dir
-              The  path  name  of the Postfix main.cf file, or of
-              its parent directory. This information  is  ignored
-              with Postfix versions before 2.3.
-
-              With all Postfix versions, you can specify a direc-
-              tory  pathname  with  the  MAIL_CONFIG  environment
-              variable  to override the location of configuration
-              files.
-
-       -F full_name
-              Set the sender full name. This overrides  the  NAME
-              environment  variable,  and  is used only with mes-
-              sages that have no From: message header.
-
-       -f sender
-              Set  the  envelope  sender  address.  This  is  the
-              address  where  delivery problems are sent to. With
-              Postfix versions before 2.1, the Errors-To: message
-              header overrides the error return address.
-
-       -G     Gateway  (relay)  submission, as opposed to initial
-              user submission.  Either do not  rewrite  addresses
-              at  all,  or  update  incomplete addresses with the
-              domain information specified with remote_header_re-
-              write_domain.
-
-              This  option is ignored before Postfix version 2.3.
-
-       -h hop_count (ignored)
-              Hop count limit. Use the hopcount_limit  configura-
-              tion parameter instead.
-
-       -I     Initialize  alias database. See the newaliases com-
-              mand above.
-
-       -i     When reading a message from standard  input,  don't
-              treat  a line with only a . character as the end of
-              input.
-
-       -L label (ignored)
-              The logging label. Use the  syslog_name  configura-
-              tion parameter instead.
-
-       -m (ignored)
-              Backwards compatibility.
-
-       -N dsn (default: 'delay, failure')
-              Delivery   status   notification  control.  Specify
-              either a comma-separated list with one or  more  of
-              failure  (send  notification  when delivery fails),
-              delay (send notification when delivery is delayed),
-              or  success  (send notification when the message is
-              delivered); or specify never (don't send any  noti-
-              fications at all).
-
-              This feature is available in Postfix 2.3 and later.
-
-       -n (ignored)
-              Backwards compatibility.
-
-       -oAalias_database
-              Non-default alias  database.  Specify  pathname  or
-              type:pathname. See postalias(1) for details.
-
-       -O option=value (ignored)
-              Backwards compatibility.
-
-       -o7 (ignored)
-
-       -o8 (ignored)
-              To send 8-bit or binary content, use an appropriate
-              MIME encapsulation and specify the  appropriate  -B
-              command-line option.
-
-       -oi    When  reading  a message from standard input, don't
-              treat a line with only a . character as the end  of
-              input.
-
-       -om (ignored)
-              The  sender  is  never  eliminated  from alias etc.
-              expansions.
-
-       -o x value (ignored)
-              Set option x to value. Use the equivalent  configu-
-              ration parameter in main.cf instead.
-
-       -r sender
-              Set  the  envelope  sender  address.  This  is  the
-              address where delivery problems are sent  to.  With
-              Postfix versions before 2.1, the Errors-To: message
-              header overrides the error return address.
-
-       -R return_limit (ignored)
-              Limit  the  size   of   bounced   mail.   Use   the
-              bounce_size_limit  configuration parameter instead.
-
-       -q     Attempt to deliver all queued mail. This is  imple-
-              mented by executing the postqueue(1) command.
-
-              Warning:  flushing  undeliverable  mail  frequently
-              will result in poor  delivery  performance  of  all
-              other mail.
-
-       -qinterval (ignored)
-              The   interval   between   queue   runs.   Use  the
-              queue_run_delay configuration parameter instead.
-
-       -qIqueueid
-              Schedule immediate delivery of mail with the speci-
-              fied  queue ID.  This option is implemented by exe-
-              cuting the postqueue(1) command, and  is  available
-              with Postfix version 2.4 and later.
-
-       -qRsite
-              Schedule  immediate  delivery  of  all mail that is
-              queued for the named site. This option accepts only
-              site  names  that are eligible for the "fast flush"
-              service,  and  is  implemented  by  executing   the
-              postqueue(1) command.  See flush(8) for more infor-
-              mation about the "fast flush" service.
-
-       -qSsite
-              This command is not  implemented.  Use  the  slower
-              "sendmail -q" command instead.
-
-       -t     Extract  recipients from message headers. These are
-              added to any recipients specified  on  the  command
-              line.
-
-              With  Postfix  versions  prior  to 2.1, this option
-              requires that no recipient addresses are  specified
-              on the command line.
-
-       -U (ignored)
-              Initial user submission.
-
-       -V envid
-              Specify the envelope ID for notification by servers
-              that support DSN.
-
-              This feature is available in Postfix 2.3 and later.
-
-       -XV (Postfix 2.2 and earlier: -V)
-              Variable  Envelope  Return  Path. Given an envelope
-              sender address of the  form  owner-listname@origin,
-              each  recipient  user@domain  receives  mail with a
-              personalized envelope sender address.
-
-              By  default,  the  personalized   envelope   sender
-              address  is  owner-listname+user=domain@origin. The
-              default + and = characters  are  configurable  with
-              the  default_verp_delimiters  configuration parame-
-              ter.
-
-       -XVxy (Postfix 2.2 and earlier: -Vxy)
-              As -XV, but uses x and  y  as  the  VERP  delimiter
-              characters,  instead  of  the  characters specified
-              with  the   default_verp_delimiters   configuration
-              parameter.
-
-       -v     Send  an email report of the first delivery attempt
-              (Postfix versions 2.1  and  later).  Mail  delivery
-              always  happens in the background. When multiple -v
-              options  are  given,  enable  verbose  logging  for
-              debugging purposes.
-
-       -X log_file (ignored)
-              Log  mailer  traffic.  Use  the debug_peer_list and
-              debug_peer_level configuration parameters  instead.
-
-SECURITY
-       By  design,  this  program  is not set-user (or group) id.
-       However, it must  handle  data  from  untrusted,  possibly
-       remote,  users.   Thus,  the  usual precautions need to be
-       taken against malicious inputs.
-
-DIAGNOSTICS
-       Problems are logged to  syslogd(8)  and  to  the  standard
-       error stream.
-
-ENVIRONMENT
-       MAIL_CONFIG
-              Directory with Postfix configuration files.
-
-       MAIL_VERBOSE (value does not matter)
-              Enable verbose logging for debugging purposes.
-
-       MAIL_DEBUG (value does not matter)
-              Enable debugging with an external command, as spec-
-              ified  with  the   debugger_command   configuration
-              parameter.
-
-       NAME   The  sender  full name. This is used only with mes-
-              sages that have no From: message header.  See  also
-              the -F option above.
-
-CONFIGURATION PARAMETERS
-       The  following  main.cf parameters are especially relevant
-       to this program.  The text below provides only a parameter
-       summary.  See postconf(5) for more details including exam-
-       ples.
-
-TROUBLE SHOOTING CONTROLS
-       The DEBUG_README file gives examples  of  how  to  trouble
-       shoot a Postfix system.
-
-       debugger_command (empty)
-              The external command to execute when a Postfix dae-
-              mon program is invoked with the -D option.
-
-       debug_peer_level (2)
-              The increment  in  verbose  logging  level  when  a
-              remote  client  or  server matches a pattern in the
-              debug_peer_list parameter.
-
-       debug_peer_list (empty)
-              Optional list of remote client or  server  hostname
-              or  network address patterns that cause the verbose
-              logging level to increase by the  amount  specified
-              in $debug_peer_level.
-
-ACCESS CONTROLS
-       Available in Postfix version 2.2 and later:
-
-       authorized_flush_users (static:anyone)
-              List  of  users  who  are  authorized  to flush the
-              queue.
-
-       authorized_mailq_users (static:anyone)
-              List of users who are authorized to view the queue.
-
-       authorized_submit_users (static:anyone)
-              List  of  users  who  are authorized to submit mail
-              with the sendmail(1) command (and with  the  privi-
-              leged postdrop(1) helper command).
-
-RESOURCE AND RATE CONTROLS
-       bounce_size_limit (50000)
-              The maximal amount of original message text that is
-              sent in a non-delivery notification.
-
-       fork_attempts (5)
-              The maximal number of attempts to  fork()  a  child
-              process.
-
-       fork_delay (1s)
-              The  delay  between  attempts  to  fork()  a  child
-              process.
-
-       hopcount_limit (50)
-              The maximal number of  Received:   message  headers
-              that is allowed in the primary message headers.
-
-       queue_run_delay (version dependent)
-              The  time between deferred queue scans by the queue
-              manager.
-
-FAST FLUSH CONTROLS
-       The ETRN_README file describes configuration and operation
-       details for the Postfix "fast flush" service.
-
-       fast_flush_domains ($relay_domains)
-              Optional list of destinations that are eligible for
-              per-destination logfiles with mail that  is  queued
-              to those destinations.
-
-VERP CONTROLS
-       The VERP_README file describes configuration and operation
-       details of Postfix support for  variable  envelope  return
-       path addresses.
-
-       default_verp_delimiters (+=)
-              The two default VERP delimiter characters.
-
-       verp_delimiter_filter (-=+)
-              The  characters  Postfix  accepts as VERP delimiter
-              characters on the Postfix sendmail(1) command  line
-              and in SMTP commands.
-
-MISCELLANEOUS CONTROLS
-       alias_database (see 'postconf -d' output)
-              The  alias databases for local(8) delivery that are
-              updated with "newaliases" or with "sendmail -bi".
-
-       command_directory (see 'postconf -d' output)
-              The location of  all  postfix  administrative  com-
-              mands.
-
-       config_directory (see 'postconf -d' output)
-              The  default  location  of  the Postfix main.cf and
-              master.cf configuration files.
-
-       daemon_directory (see 'postconf -d' output)
-              The directory with  Postfix  support  programs  and
-              daemon programs.
-
-       default_database_type (see 'postconf -d' output)
-              The default database type for use in newaliases(1),
-              postalias(1) and postmap(1) commands.
-
-       delay_warning_time (0h)
-              The time after which the sender receives  the  mes-
-              sage headers of mail that is still queued.
-
-       enable_errors_to (no)
-              Report  mail  delivery errors to the address speci-
-              fied  with  the  non-standard  Errors-To:   message
-              header,  instead  of  the  envelope  sender address
-              (this feature is removed with Postfix version  2.2,
-              is  turned off by default with Postfix version 2.1,
-              and is always turned on  with  older  Postfix  ver-
-              sions).
-
-       mail_owner (postfix)
-              The UNIX system account that owns the Postfix queue
-              and most Postfix daemon processes.
-
-       queue_directory (see 'postconf -d' output)
-              The location of the Postfix top-level queue  direc-
-              tory.
-
-       remote_header_rewrite_domain (empty)
-              Don't  rewrite  message headers from remote clients
-              at all when this parameter is empty; otherwise, re-
-              write  message  headers  and  append  the specified
-              domain name to incomplete addresses.
-
-       syslog_facility (mail)
-              The syslog facility of Postfix logging.
-
-       syslog_name (postfix)
-              The mail system  name  that  is  prepended  to  the
-              process  name  in  syslog  records, so that "smtpd"
-              becomes, for example, "postfix/smtpd".
-
-FILES
-       /var/spool/postfix, mail queue
-       /etc/postfix, configuration files
-
-SEE ALSO
-       pickup(8), mail pickup daemon
-       qmgr(8), queue manager
-       smtpd(8), SMTP server
-       flush(8), fast flush service
-       postsuper(1), queue maintenance
-       postalias(1), create/update/query alias database
-       postdrop(1), mail posting utility
-       postfix(1), mail system control
-       postqueue(1), mail queue control
-       syslogd(8), system logging
-
-README_FILES
-       DEBUG_README, Postfix debugging howto
-       ETRN_README, Postfix ETRN howto
-       VERP_README, Postfix VERP howto
-
-LICENSE
-       The Secure Mailer license must be  distributed  with  this
-       software.
-
-AUTHOR(S)
-       Wietse Venema
-       IBM T.J. Watson Research
-       P.O. Box 704
-       Yorktown Heights, NY 10598, USA
-
-                                                                   SENDMAIL(1)
-
      
diff --git a/postfix/html/mailq.1.html b/postfix/html/mailq.1.html
new file mode 120000
index 000000000..781db46a9
--- /dev/null
+++ b/postfix/html/mailq.1.html
@@ -0,0 +1 @@
+sendmail.1.html
\ No newline at end of file
diff --git a/postfix/html/master.8.html b/postfix/html/master.8.html
index 859474805..221984c85 100644
--- a/postfix/html/master.8.html
+++ b/postfix/html/master.8.html
@@ -27,12 +27,12 @@ MASTER(8)                                                            MASTER(8)
        number server.
 
        The behavior of the master(8) daemon is controlled by  the
-       master.cf configuration file, as described in master(5).
+       master.cf configuration file, as described in master(5).
 
        Options:
 
        -c config_dir
-              Read  the main.cf and master.cf configuration files
+              Read  the main.cf and master.cf configuration files
               in the named directory instead of the default  con-
               figuration directory.  This also overrides the con-
               figuration files  for  other  Postfix  daemon  pro-
@@ -40,7 +40,7 @@ MASTER(8)                                                            MASTER(8)
 
        -D     After  initialization, run a debugger on the master
               process. The debugging command  is  specified  with
-              the debugger_command in the main.cf global configu-
+              the debugger_command in the main.cf global configu-
               ration file.
 
        -d     Do  not  redirect  stdin,  stdout  or   stderr   to
@@ -66,7 +66,7 @@ MASTER(8)                                                            MASTER(8)
        SIGHUP Upon  receipt of a HUP signal (e.g., after "postfix
               reload"), the master process re-reads its  configu-
               ration  files.  If  a service has been removed from
-              the master.cf file, its running processes are  ter-
+              the master.cf file, its running processes are  ter-
               minated  immediately.  Otherwise, running processes
               are allowed to terminate as soon as is  convenient,
               so  that  changes  in configuration settings affect
@@ -87,15 +87,15 @@ MASTER(8)                                                            MASTER(8)
        MAIL_DEBUG
               After initialization, start a debugger as specified
               with the debugger_command  configuration  parameter
-              in the main.cf configuration file.
+              in the main.cf configuration file.
 
        MAIL_CONFIG
               Directory with Postfix configuration files.
 
 CONFIGURATION PARAMETERS
        Unlike most Postfix daemon processes, the master(8) server
-       does not automatically pick up changes to main.cf. Changes
-       to  master.cf  are never picked up automatically.  Use the
+       does not automatically pick up changes to main.cf. Changes
+       to  master.cf  are never picked up automatically.  Use the
        "postfix reload" command after a configuration change.
 
 RESOURCE AND RATE CONTROLS
@@ -105,13 +105,12 @@ MASTER(8)                                                            MASTER(8)
 
        max_idle (100s)
               The  maximum  amount  of  time that an idle Postfix
-              daemon process waits  for  an  incoming  connection
-              before terminating voluntarily.
+              daemon process waits for the next  service  request
+              before exiting.
 
        max_use (100)
-              The  maximal  number of incoming connections that a
-              Postfix daemon process will service  before  termi-
-              nating voluntarily.
+              The  maximal number of connection requests before a
+              Postfix daemon process terminates.
 
        service_throttle_time (60s)
               How long the Postfix master(8) waits before forking
@@ -119,11 +118,11 @@ MASTER(8)                                                            MASTER(8)
 
 MISCELLANEOUS CONTROLS
        config_directory (see 'postconf -d' output)
-              The default location of  the  Postfix  main.cf  and
-              master.cf configuration files.
+              The  default  location  of  the Postfix main.cf and
+              master.cf configuration files.
 
        daemon_directory (see 'postconf -d' output)
-              The  directory  with  Postfix  support programs and
+              The directory with  Postfix  support  programs  and
               daemon programs.
 
        debugger_command (empty)
@@ -135,11 +134,11 @@ MASTER(8)                                                            MASTER(8)
               tem receives mail on.
 
        inet_protocols (ipv4)
-              The Internet protocols Postfix will attempt to  use
+              The  Internet protocols Postfix will attempt to use
               when making or accepting connections.
 
        import_environment (see 'postconf -d' output)
-              The  list  of environment parameters that a Postfix
+              The list of environment parameters that  a  Postfix
               process  will  import  from  a  non-Postfix  parent
               process.
 
@@ -148,39 +147,39 @@ MASTER(8)                                                            MASTER(8)
               and most Postfix daemon processes.
 
        process_id (read-only)
-              The process ID  of  a  Postfix  command  or  daemon
+              The  process  ID  of  a  Postfix  command or daemon
               process.
 
        process_name (read-only)
-              The  process  name  of  a Postfix command or daemon
+              The process name of a  Postfix  command  or  daemon
               process.
 
        queue_directory (see 'postconf -d' output)
-              The location of the Postfix top-level queue  direc-
+              The  location of the Postfix top-level queue direc-
               tory.
 
        syslog_facility (mail)
               The syslog facility of Postfix logging.
 
        syslog_name (postfix)
-              The  mail  system  name  that  is  prepended to the
-              process name in syslog  records,  so  that  "smtpd"
+              The mail system  name  that  is  prepended  to  the
+              process  name  in  syslog  records, so that "smtpd"
               becomes, for example, "postfix/smtpd".
 
 FILES
-       /etc/postfix/main.cf, global configuration file.
-       /etc/postfix/master.cf, master server configuration file.
+       /etc/postfix/main.cf, global configuration file.
+       /etc/postfix/master.cf, master server configuration file.
        /var/spool/postfix/pid/master.pid, master lock file.
 
 SEE ALSO
        qmgr(8), queue manager
        verify(8), address verification
-       master(5), master.cf configuration file syntax
-       postconf(5), main.cf configuration parameter syntax
+       master(5), master.cf configuration file syntax
+       postconf(5), main.cf configuration parameter syntax
        syslogd(8), system logging
 
 LICENSE
-       The  Secure  Mailer  license must be distributed with this
+       The Secure Mailer license must be  distributed  with  this
        software.
 
 AUTHOR(S)
diff --git a/postfix/html/newaliases.1.html b/postfix/html/newaliases.1.html
deleted file mode 100644
index 52a9a8645..000000000
--- a/postfix/html/newaliases.1.html
+++ /dev/null
@@ -1,480 +0,0 @@
-
- 
-
- Postfix manual - sendmail(1) 
-  
    -SENDMAIL(1)                                                        SENDMAIL(1)
-
-NAME
-       sendmail - Postfix to Sendmail compatibility interface
-
-SYNOPSIS
-       sendmail [option ...] [recipient ...]
-
-       mailq
-       sendmail -bp
-
-       newaliases
-       sendmail -I
-
-DESCRIPTION
-       The  Postfix sendmail(1) command implements the Postfix to
-       Sendmail compatibility interface.  For the sake of compat-
-       ibility with existing applications, some Sendmail command-
-       line options are recognized but silently ignored.
-
-       By default, Postfix sendmail(1) reads a message from stan-
-       dard  input until EOF or until it reads a line with only a
-       . character, and arranges  for  delivery.   Postfix  send-
-       mail(1)  relies  on  the  postdrop(1)  command to create a
-       queue file in the maildrop directory.
-
-       Specific command aliases are  provided  for  other  common
-       modes of operation:
-
-       mailq  List  the  mail  queue.  Each entry shows the queue
-              file ID, message size, arrival  time,  sender,  and
-              the recipients that still need to be delivered.  If
-              mail could not be delivered upon the last  attempt,
-              the reason for failure is shown. This mode of oper-
-              ation is implemented by executing the  postqueue(1)
-              command.
-
-       newaliases
-              Initialize the alias database.  If no input file is
-              specified (with the -oA  option,  see  below),  the
-              program  processes  the  file(s) specified with the
-              alias_database  configuration  parameter.   If   no
-              alias  database type is specified, the program uses
-              the type specified with  the  default_database_type
-              configuration parameter.  This mode of operation is
-              implemented by running the postalias(1) command.
-
-              Note: it may take a minute or so  before  an  alias
-              database  update  becomes visible. Use the "postfix
-              reload" command to eliminate this delay.
-
-       These and other features can be selected by specifying the
-       appropriate combination of command-line options. Some fea-
-       tures are controlled by parameters in the main.cf configu-
-       ration file.
-
-       The following options are recognized:
-
-       -Am (ignored)
-
-       -Ac (ignored)
-              Postfix  sendmail  uses the same configuration file
-              regardless of whether or not a message is  an  ini-
-              tial submission.
-
-       -B body_type
-              The message body MIME type: 7BIT or 8BITMIME.
-
-       -bd    Go  into  daemon  mode.  This  mode of operation is
-              implemented by executing the "postfix  start"  com-
-              mand.
-
-       -bh (ignored)
-
-       -bH (ignored)
-              Postfix has no persistent host status database.
-
-       -bi    Initialize  alias database. See the newaliases com-
-              mand above.
-
-       -bm    Read mail  from  standard  input  and  arrange  for
-              delivery.  This is the default mode of operation.
-
-       -bp    List the mail queue. See the mailq command above.
-
-       -bs    Stand-alone  SMTP  server  mode. Read SMTP commands
-              from standard input, and write responses  to  stan-
-              dard output.  In stand-alone SMTP server mode, mail
-              relaying and other access controls are disabled  by
-              default.  To  enable  them,  run the process as the
-              mail_owner user.
-
-              This mode of operation is  implemented  by  running
-              the smtpd(8) daemon.
-
-       -bv    Do  not collect or deliver a message. Instead, send
-              an email  report  after  verifying  each  recipient
-              address.    This  is  useful  for  testing  address
-              rewriting and routing configurations.
-
-              This feature is available in  Postfix  version  2.1
-              and later.
-
-       -C config_file
-
-       -C config_dir
-              The  path  name  of the Postfix main.cf file, or of
-              its parent directory. This information  is  ignored
-              with Postfix versions before 2.3.
-
-              With all Postfix versions, you can specify a direc-
-              tory  pathname  with  the  MAIL_CONFIG  environment
-              variable  to override the location of configuration
-              files.
-
-       -F full_name
-              Set the sender full name. This overrides  the  NAME
-              environment  variable,  and  is used only with mes-
-              sages that have no From: message header.
-
-       -f sender
-              Set  the  envelope  sender  address.  This  is  the
-              address  where  delivery problems are sent to. With
-              Postfix versions before 2.1, the Errors-To: message
-              header overrides the error return address.
-
-       -G     Gateway  (relay)  submission, as opposed to initial
-              user submission.  Either do not  rewrite  addresses
-              at  all,  or  update  incomplete addresses with the
-              domain information specified with remote_header_re-
-              write_domain.
-
-              This  option is ignored before Postfix version 2.3.
-
-       -h hop_count (ignored)
-              Hop count limit. Use the hopcount_limit  configura-
-              tion parameter instead.
-
-       -I     Initialize  alias database. See the newaliases com-
-              mand above.
-
-       -i     When reading a message from standard  input,  don't
-              treat  a line with only a . character as the end of
-              input.
-
-       -L label (ignored)
-              The logging label. Use the  syslog_name  configura-
-              tion parameter instead.
-
-       -m (ignored)
-              Backwards compatibility.
-
-       -N dsn (default: 'delay, failure')
-              Delivery   status   notification  control.  Specify
-              either a comma-separated list with one or  more  of
-              failure  (send  notification  when delivery fails),
-              delay (send notification when delivery is delayed),
-              or  success  (send notification when the message is
-              delivered); or specify never (don't send any  noti-
-              fications at all).
-
-              This feature is available in Postfix 2.3 and later.
-
-       -n (ignored)
-              Backwards compatibility.
-
-       -oAalias_database
-              Non-default alias  database.  Specify  pathname  or
-              type:pathname. See postalias(1) for details.
-
-       -O option=value (ignored)
-              Backwards compatibility.
-
-       -o7 (ignored)
-
-       -o8 (ignored)
-              To send 8-bit or binary content, use an appropriate
-              MIME encapsulation and specify the  appropriate  -B
-              command-line option.
-
-       -oi    When  reading  a message from standard input, don't
-              treat a line with only a . character as the end  of
-              input.
-
-       -om (ignored)
-              The  sender  is  never  eliminated  from alias etc.
-              expansions.
-
-       -o x value (ignored)
-              Set option x to value. Use the equivalent  configu-
-              ration parameter in main.cf instead.
-
-       -r sender
-              Set  the  envelope  sender  address.  This  is  the
-              address where delivery problems are sent  to.  With
-              Postfix versions before 2.1, the Errors-To: message
-              header overrides the error return address.
-
-       -R return_limit (ignored)
-              Limit  the  size   of   bounced   mail.   Use   the
-              bounce_size_limit  configuration parameter instead.
-
-       -q     Attempt to deliver all queued mail. This is  imple-
-              mented by executing the postqueue(1) command.
-
-              Warning:  flushing  undeliverable  mail  frequently
-              will result in poor  delivery  performance  of  all
-              other mail.
-
-       -qinterval (ignored)
-              The   interval   between   queue   runs.   Use  the
-              queue_run_delay configuration parameter instead.
-
-       -qIqueueid
-              Schedule immediate delivery of mail with the speci-
-              fied  queue ID.  This option is implemented by exe-
-              cuting the postqueue(1) command, and  is  available
-              with Postfix version 2.4 and later.
-
-       -qRsite
-              Schedule  immediate  delivery  of  all mail that is
-              queued for the named site. This option accepts only
-              site  names  that are eligible for the "fast flush"
-              service,  and  is  implemented  by  executing   the
-              postqueue(1) command.  See flush(8) for more infor-
-              mation about the "fast flush" service.
-
-       -qSsite
-              This command is not  implemented.  Use  the  slower
-              "sendmail -q" command instead.
-
-       -t     Extract  recipients from message headers. These are
-              added to any recipients specified  on  the  command
-              line.
-
-              With  Postfix  versions  prior  to 2.1, this option
-              requires that no recipient addresses are  specified
-              on the command line.
-
-       -U (ignored)
-              Initial user submission.
-
-       -V envid
-              Specify the envelope ID for notification by servers
-              that support DSN.
-
-              This feature is available in Postfix 2.3 and later.
-
-       -XV (Postfix 2.2 and earlier: -V)
-              Variable  Envelope  Return  Path. Given an envelope
-              sender address of the  form  owner-listname@origin,
-              each  recipient  user@domain  receives  mail with a
-              personalized envelope sender address.
-
-              By  default,  the  personalized   envelope   sender
-              address  is  owner-listname+user=domain@origin. The
-              default + and = characters  are  configurable  with
-              the  default_verp_delimiters  configuration parame-
-              ter.
-
-       -XVxy (Postfix 2.2 and earlier: -Vxy)
-              As -XV, but uses x and  y  as  the  VERP  delimiter
-              characters,  instead  of  the  characters specified
-              with  the   default_verp_delimiters   configuration
-              parameter.
-
-       -v     Send  an email report of the first delivery attempt
-              (Postfix versions 2.1  and  later).  Mail  delivery
-              always  happens in the background. When multiple -v
-              options  are  given,  enable  verbose  logging  for
-              debugging purposes.
-
-       -X log_file (ignored)
-              Log  mailer  traffic.  Use  the debug_peer_list and
-              debug_peer_level configuration parameters  instead.
-
-SECURITY
-       By  design,  this  program  is not set-user (or group) id.
-       However, it must  handle  data  from  untrusted,  possibly
-       remote,  users.   Thus,  the  usual precautions need to be
-       taken against malicious inputs.
-
-DIAGNOSTICS
-       Problems are logged to  syslogd(8)  and  to  the  standard
-       error stream.
-
-ENVIRONMENT
-       MAIL_CONFIG
-              Directory with Postfix configuration files.
-
-       MAIL_VERBOSE (value does not matter)
-              Enable verbose logging for debugging purposes.
-
-       MAIL_DEBUG (value does not matter)
-              Enable debugging with an external command, as spec-
-              ified  with  the   debugger_command   configuration
-              parameter.
-
-       NAME   The  sender  full name. This is used only with mes-
-              sages that have no From: message header.  See  also
-              the -F option above.
-
-CONFIGURATION PARAMETERS
-       The  following  main.cf parameters are especially relevant
-       to this program.  The text below provides only a parameter
-       summary.  See postconf(5) for more details including exam-
-       ples.
-
-TROUBLE SHOOTING CONTROLS
-       The DEBUG_README file gives examples  of  how  to  trouble
-       shoot a Postfix system.
-
-       debugger_command (empty)
-              The external command to execute when a Postfix dae-
-              mon program is invoked with the -D option.
-
-       debug_peer_level (2)
-              The increment  in  verbose  logging  level  when  a
-              remote  client  or  server matches a pattern in the
-              debug_peer_list parameter.
-
-       debug_peer_list (empty)
-              Optional list of remote client or  server  hostname
-              or  network address patterns that cause the verbose
-              logging level to increase by the  amount  specified
-              in $debug_peer_level.
-
-ACCESS CONTROLS
-       Available in Postfix version 2.2 and later:
-
-       authorized_flush_users (static:anyone)
-              List  of  users  who  are  authorized  to flush the
-              queue.
-
-       authorized_mailq_users (static:anyone)
-              List of users who are authorized to view the queue.
-
-       authorized_submit_users (static:anyone)
-              List  of  users  who  are authorized to submit mail
-              with the sendmail(1) command (and with  the  privi-
-              leged postdrop(1) helper command).
-
-RESOURCE AND RATE CONTROLS
-       bounce_size_limit (50000)
-              The maximal amount of original message text that is
-              sent in a non-delivery notification.
-
-       fork_attempts (5)
-              The maximal number of attempts to  fork()  a  child
-              process.
-
-       fork_delay (1s)
-              The  delay  between  attempts  to  fork()  a  child
-              process.
-
-       hopcount_limit (50)
-              The maximal number of  Received:   message  headers
-              that is allowed in the primary message headers.
-
-       queue_run_delay (version dependent)
-              The  time between deferred queue scans by the queue
-              manager.
-
-FAST FLUSH CONTROLS
-       The ETRN_README file describes configuration and operation
-       details for the Postfix "fast flush" service.
-
-       fast_flush_domains ($relay_domains)
-              Optional list of destinations that are eligible for
-              per-destination logfiles with mail that  is  queued
-              to those destinations.
-
-VERP CONTROLS
-       The VERP_README file describes configuration and operation
-       details of Postfix support for  variable  envelope  return
-       path addresses.
-
-       default_verp_delimiters (+=)
-              The two default VERP delimiter characters.
-
-       verp_delimiter_filter (-=+)
-              The  characters  Postfix  accepts as VERP delimiter
-              characters on the Postfix sendmail(1) command  line
-              and in SMTP commands.
-
-MISCELLANEOUS CONTROLS
-       alias_database (see 'postconf -d' output)
-              The  alias databases for local(8) delivery that are
-              updated with "newaliases" or with "sendmail -bi".
-
-       command_directory (see 'postconf -d' output)
-              The location of  all  postfix  administrative  com-
-              mands.
-
-       config_directory (see 'postconf -d' output)
-              The  default  location  of  the Postfix main.cf and
-              master.cf configuration files.
-
-       daemon_directory (see 'postconf -d' output)
-              The directory with  Postfix  support  programs  and
-              daemon programs.
-
-       default_database_type (see 'postconf -d' output)
-              The default database type for use in newaliases(1),
-              postalias(1) and postmap(1) commands.
-
-       delay_warning_time (0h)
-              The time after which the sender receives  the  mes-
-              sage headers of mail that is still queued.
-
-       enable_errors_to (no)
-              Report  mail  delivery errors to the address speci-
-              fied  with  the  non-standard  Errors-To:   message
-              header,  instead  of  the  envelope  sender address
-              (this feature is removed with Postfix version  2.2,
-              is  turned off by default with Postfix version 2.1,
-              and is always turned on  with  older  Postfix  ver-
-              sions).
-
-       mail_owner (postfix)
-              The UNIX system account that owns the Postfix queue
-              and most Postfix daemon processes.
-
-       queue_directory (see 'postconf -d' output)
-              The location of the Postfix top-level queue  direc-
-              tory.
-
-       remote_header_rewrite_domain (empty)
-              Don't  rewrite  message headers from remote clients
-              at all when this parameter is empty; otherwise, re-
-              write  message  headers  and  append  the specified
-              domain name to incomplete addresses.
-
-       syslog_facility (mail)
-              The syslog facility of Postfix logging.
-
-       syslog_name (postfix)
-              The mail system  name  that  is  prepended  to  the
-              process  name  in  syslog  records, so that "smtpd"
-              becomes, for example, "postfix/smtpd".
-
-FILES
-       /var/spool/postfix, mail queue
-       /etc/postfix, configuration files
-
-SEE ALSO
-       pickup(8), mail pickup daemon
-       qmgr(8), queue manager
-       smtpd(8), SMTP server
-       flush(8), fast flush service
-       postsuper(1), queue maintenance
-       postalias(1), create/update/query alias database
-       postdrop(1), mail posting utility
-       postfix(1), mail system control
-       postqueue(1), mail queue control
-       syslogd(8), system logging
-
-README_FILES
-       DEBUG_README, Postfix debugging howto
-       ETRN_README, Postfix ETRN howto
-       VERP_README, Postfix VERP howto
-
-LICENSE
-       The Secure Mailer license must be  distributed  with  this
-       software.
-
-AUTHOR(S)
-       Wietse Venema
-       IBM T.J. Watson Research
-       P.O. Box 704
-       Yorktown Heights, NY 10598, USA
-
-                                                                   SENDMAIL(1)
-
      
diff --git a/postfix/html/newaliases.1.html b/postfix/html/newaliases.1.html
new file mode 120000
index 000000000..781db46a9
--- /dev/null
+++ b/postfix/html/newaliases.1.html
@@ -0,0 +1 @@
+sendmail.1.html
\ No newline at end of file
diff --git a/postfix/html/nisplus_table.5.html b/postfix/html/nisplus_table.5.html
index 8ccd9e4d1..cc87e0d54 100644
--- a/postfix/html/nisplus_table.5.html
+++ b/postfix/html/nisplus_table.5.html
@@ -41,7 +41,7 @@ NISPLUS_TABLE(5)                                              NISPLUS_TABLE(5)
 
        o      Postfix  NIS+  map  names  use  ";" instead of ",",
               because the latter  character  is  special  in  the
-              Postfix main.cf file.  Postfix replaces ";" charac-
+              Postfix main.cf file.  Postfix replaces ";" charac-
               ters in the map name  by  ","  before  making  NIS+
               queries.
 
@@ -76,6 +76,8 @@ NISPLUS_TABLE(5)                                              NISPLUS_TABLE(5)
        Cambridge
        CB10 1SB, UK
 
+       Based on the NIS client code:
+
        Adopted and adapted by:
        Wietse Venema
        IBM T.J. Watson Research
diff --git a/postfix/html/pcre_table.5.html b/postfix/html/pcre_table.5.html
index 7cf9d614c..8698d02a8 100644
--- a/postfix/html/pcre_table.5.html
+++ b/postfix/html/pcre_table.5.html
@@ -10,9 +10,9 @@ PCRE_TABLE(5)                                                    PCRE_TABLE(5)
        pcre_table - format of Postfix PCRE tables
 
 SYNOPSIS
-       postmap -q "string" pcre:/etc/postfix/filename
+       postmap -fq "string" pcre:/etc/postfix/filename
 
-       postmap -q - pcre:/etc/postfix/filename <inputfile
+       postmap -fq - pcre:/etc/postfix/filename <inputfile
 
 DESCRIPTION
        The  Postfix  mail system uses optional tables for address
@@ -21,21 +21,15 @@ PCRE_TABLE(5)                                                    PCRE_TABLE(5)
 
        Alternatively, lookup tables can be specified in Perl Com-
        patible Regular Expression form. In this case, each  input
-       is  compared  against  a list of patterns. When a match is
-       found, the corresponding result is returned and the search
-       is terminated.
+       is  compared  against a list of patterns, and when a match
+       is found the corresponding result is returned.
 
-       To  find out what types of lookup tables your Postfix sys-
+       To find out what types of lookup tables your Postfix  sys-
        tem supports use the "postconf -m" command.
 
-       To test lookup tables, use the  "postmap  -q"  command  as
+       To  test  lookup  tables, use the "postmap -fq" command as
        described in the SYNOPSIS above.
 
-COMPATIBILITY
-       With Postfix version 2.2 and earlier specify "postmap -fq"
-       to query a table that contains  case  sensitive  patterns.
-       Patterns are case insensitive by default.
-
 TABLE FORMAT
        The general form of a PCRE table is:
 
@@ -44,16 +38,16 @@ PCRE_TABLE(5)                                                    PCRE_TABLE(5)
               responding result value.
 
        !/pattern/flags result
-              When pattern does not match the input  string,  use
+              When  pattern  does not match the input string, use
               the corresponding result value.
 
        if /pattern/flags
 
        endif  Match the input string against the patterns between
-              if and endif, if and only if the input string  also
+              if  and endif, if and only if the input string also
               matches pattern. The if..endif can nest.
 
-              Note:  do not prepend whitespace to patterns inside
+              Note: do not prepend whitespace to patterns  inside
               if..endif.
 
               This feature is available in Postfix 2.1 and later.
@@ -61,117 +55,117 @@ PCRE_TABLE(5)                                                    PCRE_TABLE(5)
        if !/pattern/flags
 
        endif  Match the input string against the patterns between
-              if and endif, if and only if the input string  does
+              if  and endif, if and only if the input string does
               not match pattern. The if..endif can nest.
 
-              Note:  do not prepend whitespace to patterns inside
+              Note: do not prepend whitespace to patterns  inside
               if..endif.
 
               This feature is available in Postfix 2.1 and later.
 
        blank lines and comments
-              Empty  lines and whitespace-only lines are ignored,
-              as are lines whose first  non-whitespace  character
+              Empty lines and whitespace-only lines are  ignored,
+              as  are  lines whose first non-whitespace character
               is a `#'.
 
        multi-line text
-              A  logical  line starts with non-whitespace text. A
-              line that starts with whitespace continues a  logi-
+              A logical line starts with non-whitespace  text.  A
+              line  that starts with whitespace continues a logi-
               cal line.
 
        Each  pattern  is  a  perl-like  regular  expression.  The
-       expression delimiter can be any character,  except  white-
-       space  or characters that have special meaning (tradition-
-       ally the forward slash is used).  The  regular  expression
+       expression  delimiter  can be any character, except white-
+       space or characters that have special meaning  (tradition-
+       ally  the  forward slash is used).  The regular expression
        can contain whitespace.
 
        By default, matching is case-insensitive, and newlines are
-       not treated as special characters. The  behavior  is  con-
-       trolled  by  flags,  which are toggled by appending one or
+       not  treated  as  special characters. The behavior is con-
+       trolled by flags, which are toggled by  appending  one  or
        more of the following characters after the pattern:
 
        i (default: on)
-              Toggles the  case  sensitivity  flag.  By  default,
+              Toggles  the  case  sensitivity  flag.  By default,
               matching is case insensitive.
 
        m (default: off)
-              Toggles  the PCRE_MULTILINE flag. When this flag is
-              on, the ^ and $  metacharacters  match  immediately
-              after  and  immediately before a newline character,
-              respectively, in addition to matching at the  start
+              Toggles the PCRE_MULTILINE flag. When this flag  is
+              on,  the  ^  and $ metacharacters match immediately
+              after and immediately before a  newline  character,
+              respectively,  in addition to matching at the start
               and end of the subject string.
 
        s (default: on)
               Toggles the PCRE_DOTALL flag. When this flag is on,
               the .  metacharacter matches the newline character.
               With Postfix versions prior to 2.0, The flag is off
-              by default, which is  inconvenient  for  multi-line
+              by  default,  which  is inconvenient for multi-line
               message header matching.
 
        x (default: off)
-              Toggles  the  pcre extended flag. When this flag is
-              on, whitespace in the  pattern  (other  than  in  a
+              Toggles the pcre extended flag. When this  flag  is
+              on,  whitespace  in  the  pattern  (other than in a
               character class) and characters between a # outside
-              a character class and the  next  newline  character
-              are  ignored.  An escaping backslash can be used to
-              include a whitespace or # character as part of  the
+              a  character  class  and the next newline character
+              are ignored. An escaping backslash can be  used  to
+              include  a whitespace or # character as part of the
               pattern.
 
        A (default: off)
-              Toggles  the PCRE_ANCHORED flag.  When this flag is
-              on, the pattern is forced to  be  "anchored",  that
+              Toggles the PCRE_ANCHORED flag.  When this flag  is
+              on,  the  pattern  is forced to be "anchored", that
               is, it is constrained to match only at the start of
-              the string which is being  searched  (the  "subject
-              string").  This  effect  can  also  be  achieved by
+              the  string  which  is being searched (the "subject
+              string"). This  effect  can  also  be  achieved  by
               appropriate constructs in the pattern itself.
 
        E (default: off)
-              Toggles the  PCRE_DOLLAR_ENDONLY  flag.  When  this
-              flag  is  on,  a  $  metacharacter  in  the pattern
-              matches only at the  end  of  the  subject  string.
-              Without  this  flag,  a dollar also matches immedi-
+              Toggles  the  PCRE_DOLLAR_ENDONLY  flag.  When this
+              flag is  on,  a  $  metacharacter  in  the  pattern
+              matches  only  at  the  end  of the subject string.
+              Without this flag, a dollar  also  matches  immedi-
               ately before the final character if it is a newline
               character (but not before any other newline charac-
-              ters). This flag is ignored if PCRE_MULTILINE  flag
+              ters).  This flag is ignored if PCRE_MULTILINE flag
               is set.
 
        U (default: off)
               Toggles the ungreedy matching flag.  When this flag
-              is on, the  pattern  matching  engine  inverts  the
-              "greediness"  of  the  quantifiers so that they are
-              not greedy by default, but become  greedy  if  fol-
-              lowed  by  "?".   This  flag can also set by a (?U)
+              is  on,  the  pattern  matching  engine inverts the
+              "greediness" of the quantifiers so  that  they  are
+              not  greedy  by  default, but become greedy if fol-
+              lowed by "?".  This flag can also  set  by  a  (?U)
               modifier within the pattern.
 
        X (default: off)
               Toggles the PCRE_EXTRA flag.  When this flag is on,
-              any  backslash  in  a pattern that is followed by a
+              any backslash in a pattern that is  followed  by  a
               letter that has no special meaning causes an error,
               thus reserving these combinations for future expan-
               sion.
 
 SEARCH ORDER
-       Patterns are applied in the order as specified in the  ta-
-       ble,  until  a  pattern  is  found  that matches the input
+       Patterns  are applied in the order as specified in the ta-
+       ble, until a pattern  is  found  that  matches  the  input
        string.
 
-       Each pattern  is  applied  to  the  entire  input  string.
-       Depending  on  the  application,  that string is an entire
+       Each  pattern  is  applied  to  the  entire  input string.
+       Depending on the application, that  string  is  an  entire
        client hostname, an entire client IP address, or an entire
-       mail  address.   Thus,  no parent domain or parent network
-       search is done, and user@domain  mail  addresses  are  not
-       broken  up  into  their user and domain constituent parts,
+       mail address.  Thus, no parent domain  or  parent  network
+       search  is  done,  and  user@domain mail addresses are not
+       broken up into their user and  domain  constituent  parts,
        nor is user+foo broken up into user and foo.
 
 TEXT SUBSTITUTION
-       Substitution of substrings  from  the  matched  expression
-       into  the result string is possible using the conventional
-       perl syntax ($1, $2, etc.); specify  $$  to  produce  a  $
-       character  as output.  The macros in the result string may
+       Substitution  of  substrings  from  the matched expression
+       into the result string is possible using the  conventional
+       perl  syntax  ($1,  $2,  etc.);  specify $$ to produce a $
+       character as output.  The macros in the result string  may
        need to be written as ${n} or $(n) if they aren't followed
        by whitespace.
 
-       Note:  since negated patterns (those preceded by !) return
+       Note: since negated patterns (those preceded by !)  return
        a result when the expression does not match, substitutions
        are not available for negated patterns.
 
diff --git a/postfix/html/pickup.8.html b/postfix/html/pickup.8.html
index b4f72d493..d64cb5bf1 100644
--- a/postfix/html/pickup.8.html
+++ b/postfix/html/pickup.8.html
@@ -81,32 +81,31 @@ PICKUP(8)                                                            PICKUP(8)
 
        max_idle (100s)
               The maximum amount of time  that  an  idle  Postfix
-              daemon  process  waits  for  an incoming connection
-              before terminating voluntarily.
+              daemon  process  waits for the next service request
+              before exiting.
 
        max_use (100)
-              The maximal number of incoming connections  that  a
-              Postfix  daemon  process will service before termi-
-              nating voluntarily.
+              The maximal number of connection requests before  a
+              Postfix daemon process terminates.
 
        process_id (read-only)
-              The process ID  of  a  Postfix  command  or  daemon
+              The  process  ID  of  a  Postfix  command or daemon
               process.
 
        process_name (read-only)
-              The  process  name  of  a Postfix command or daemon
+              The process name of a  Postfix  command  or  daemon
               process.
 
        queue_directory (see 'postconf -d' output)
-              The location of the Postfix top-level queue  direc-
+              The  location of the Postfix top-level queue direc-
               tory.
 
        syslog_facility (mail)
               The syslog facility of Postfix logging.
 
        syslog_name (postfix)
-              The  mail  system  name  that  is  prepended to the
-              process name in syslog  records,  so  that  "smtpd"
+              The mail system  name  that  is  prepended  to  the
+              process  name  in  syslog  records, so that "smtpd"
               becomes, for example, "postfix/smtpd".
 
 SEE ALSO
@@ -119,7 +118,7 @@ PICKUP(8)                                                            PICKUP(8)
        syslogd(8), system logging
 
 LICENSE
-       The  Secure  Mailer  license must be distributed with this
+       The Secure Mailer license must be  distributed  with  this
        software.
 
 AUTHOR(S)
diff --git a/postfix/html/pipe.8.html b/postfix/html/pipe.8.html
index 6eff2edd0..26de9e7ed 100644
--- a/postfix/html/pipe.8.html
+++ b/postfix/html/pipe.8.html
@@ -139,11 +139,11 @@ PIPE(8)                                                                PIPE(8)
                      ware.
 
        null_sender=replacement (default: MAILER-DAEMON)
-              Replace the null sender address (typically used for
-              delivery status notifications) with  the  specified
-              text when expanding the $sender command-line macro,
-              and when generating a From_ or Return-Path: message
-              header.
+              Replace the null sender address, which is typically
+              used for delivery status  notifications,  with  the
+              specified  text when expanding the $sender command-
+              line macro, and when generating a From_ or  Return-
+              Path: message header.
 
               If  the null sender replacement text is a non-empty
               string then it  is  affected  by  the  q  flag  for
@@ -406,24 +406,23 @@ PIPE(8)                                                                PIPE(8)
 
        max_idle (100s)
               The maximum amount of time  that  an  idle  Postfix
-              daemon  process  waits  for  an incoming connection
-              before terminating voluntarily.
+              daemon  process  waits for the next service request
+              before exiting.
 
        max_use (100)
-              The maximal number of incoming connections  that  a
-              Postfix  daemon  process will service before termi-
-              nating voluntarily.
+              The maximal number of connection requests before  a
+              Postfix daemon process terminates.
 
        process_id (read-only)
-              The process ID  of  a  Postfix  command  or  daemon
+              The  process  ID  of  a  Postfix  command or daemon
               process.
 
        process_name (read-only)
-              The  process  name  of  a Postfix command or daemon
+              The process name of a  Postfix  command  or  daemon
               process.
 
        queue_directory (see 'postconf -d' output)
-              The location of the Postfix top-level queue  direc-
+              The  location of the Postfix top-level queue direc-
               tory.
 
        recipient_delimiter (empty)
@@ -434,8 +433,8 @@ PIPE(8)                                                                PIPE(8)
               The syslog facility of Postfix logging.
 
        syslog_name (postfix)
-              The mail system  name  that  is  prepended  to  the
-              process  name  in  syslog  records, so that "smtpd"
+              The  mail  system  name  that  is  prepended to the
+              process name in syslog  records,  so  that  "smtpd"
               becomes, for example, "postfix/smtpd".
 
 SEE ALSO
@@ -447,7 +446,7 @@ PIPE(8)                                                                PIPE(8)
        syslogd(8), system logging
 
 LICENSE
-       The Secure Mailer license must be  distributed  with  this
+       The  Secure  Mailer  license must be distributed with this
        software.
 
 AUTHOR(S)
diff --git a/postfix/html/postconf.5.html b/postfix/html/postconf.5.html
index a2d5b12f0..3a882ce59 100644
--- a/postfix/html/postconf.5.html
+++ b/postfix/html/postconf.5.html
@@ -674,8 +674,8 @@ are calculated.
 
    
 
 
    
-This feature is implemented by the anvil(8) service which is available
-in Postfix version 2.2 and later.
+This feature is implemented by the anvil(8) service which is not
+part of the stable Postfix version 2.1 release.
 
    
 
 
    
@@ -2012,9 +2012,9 @@ precision.  
    
 
 
      
 
-
    •  a = time from message arrival to last active queue entry
+
    •  a = time before the queue manager, including message transmission
 
-
    •  b = time from last active queue entry to connection setup
+
    •  b = time in queue manager
 
 
    •  c = time in connection setup, including DNS, EHLO and TLS
 
@@ -2877,7 +2877,7 @@ Note 1: you need to stop and start Postfix when this parameter changes.
 
      
 
 
       Note 2: address information may be enclosed inside [],
-but this form is not required here. 
      
+but this form is not recommended here. 
      
 
 
       When inet_interfaces specifies just one IPv4 and/or IPv6 address
 that is not a loopback address, the Postfix SMTP client will use
@@ -3347,7 +3347,7 @@ details. The table is not indexed by hostname for consistency with
 
 
 
      lmtp_discard_lhlo_keywords
-(default: empty)
      
+(default: $myhostname)
      
 
 
       A case insensitive list of LHLO keywords (pipelining, starttls,
 auth, etc.) that the LMTP client will ignore in the LHLO response
@@ -4875,9 +4875,8 @@ Examples:
 (default: 100s)
      
 
 
      
-The maximum amount of time that an idle Postfix daemon process waits
-for an incoming connection before terminating voluntarily.  This
-parameter
+The maximum amount of time that an idle Postfix daemon process
+waits for the next service request before exiting.  This parameter
 is ignored by the Postfix queue manager and by other long-lived
 Postfix daemon processes.
 
      
@@ -4894,9 +4893,8 @@ The default time unit is s (seconds).
 (default: 100)
      
 
 
      
-The maximal number of incoming connections that a Postfix daemon
-process will service before terminating voluntarily.  This parameter
-is ignored by the Postfix queue
+The maximal number of connection requests before a Postfix daemon
+process terminates. This parameter is ignored by the Postfix queue
 manager and by other long-lived Postfix daemon processes.
 
      
 
@@ -5254,18 +5252,17 @@ This feature is available in Postfix 2.0 and later.
 
      
 
 
      minimal_backoff_time
-(default: 300s)
      
-
-
      
-The minimal time between attempts to deliver a deferred message;
-prior to Postfix 2.4 the default value was 1000s.
-
      
+(default: version dependent)
      
 
 
      
+The minimal time between attempts to deliver a deferred message.
 This parameter also limits the time an unreachable destination is
 kept in the short-term, in-memory, destination status cache.
 
      
 
+
       With Postfix 2.4 the default value was reduced from 1000s to
+300s.  
      
+
 
       This parameter should be set greater than or equal to
 $queue_run_delay. See also $maximal_backoff_time.  
      
 
@@ -6058,11 +6055,14 @@ zero means there is no minimum required amount of free space.
 
      
 
 
      queue_run_delay
-(default: 300s)
      
+(default: version dependent)
      
 
 
      
-The time between deferred queue scans by the queue manager;
-prior to Postfix 2.4 the default value was 1000s.
+The time between deferred queue scans by the queue manager.
+
      
+
+
      
+With Postfix 2.4 the default value was reduced from 1000s to 300s.
 
      
 
 
       This parameter should be set less than or equal to
@@ -6436,10 +6436,7 @@ Do not change this unless you have a complete understanding of relay_domains. Specify @domain as a wild-card for
-domains that have no valid recipient list, and become a source of
-backscatter mail: Postfix accepts spam for non-existent recipients
-and then floods innocent people with undeliverable mail.  Technically,
-tables
+domains that do not have a valid recipient list. Technically, tables
 listed with $relay_recipient_maps are used as lists: Postfix needs
 to know only if a lookup string is found or not, but it does not
 use the result from table lookup.  
      
@@ -6934,7 +6931,7 @@ IP hosting, but can be a problem on multi-homed firewalls. See the
 inet_interfaces documentation for more detail. 
      
 
 
       Note 2: address information may be enclosed inside [],
-but this form is not required here. 
      
+but this form is not recommended here. 
      
 
 
 
      
@@ -8474,7 +8471,7 @@ and higher the optional "ciphers" attribute overrides the smtp_tls_mandatory_ciphers parameter and the optional "protocols"
 keyword overrides the main.cf smtp_tls_mandatory_protocols parameter.
 In the policy table, multiple protocols must be separated by colons,
-as attribute values may not contain whitespace or commas. 
+as attribute values may not contain whitespace or commas. 
      
 
 
      verify
       
      Mandatory TLS verification.  At this security
 level, DNS MX lookups are trusted to be secure enough, and the name
diff --git a/postfix/html/postfix.1.html b/postfix/html/postfix.1.html
index aa6796442..f8bc251b4 100644
--- a/postfix/html/postfix.1.html
+++ b/postfix/html/postfix.1.html
@@ -306,11 +306,5 @@ POSTFIX(1)                                                          POSTFIX(1)
        P.O. Box 830688, MC34
        Richardson, TX 75083, USA
 
-       IPv6 support originally by:
-       Mark Huizer, Eindhoven University, The Netherlands
-       Jun-ichiro 'itojun' Hagino, KAME project, Japan
-       The Linux PLD project
-       Dean Strik, Eindhoven University, The Netherlands
-
                                                                     POSTFIX(1)
 
    •   
diff --git a/postfix/html/postlog.1.html b/postfix/html/postlog.1.html
index 86a1378f8..80c851872 100644
--- a/postfix/html/postlog.1.html
+++ b/postfix/html/postlog.1.html
@@ -10,42 +10,42 @@ POSTLOG(1)                                                          POSTLOG(1)
        postlog - Postfix-compatible logging utility
 
 SYNOPSIS
-       postlog  [-iv]  [-c  config_dir]  [-p  priority]  [-t tag]
-       [text...]
+       postlog [-iv] [-c config_dir]
+               [-p priority] [-t tag] [text...]
 
 DESCRIPTION
-       The postlog(1)  command  implements  a  Postfix-compatible
-       logging  interface for use in, for example, shell scripts.
+       The  postlog(1)  command  implements  a Postfix-compatible
+       logging interface for use in, for example, shell  scripts.
 
-       By default, postlog(1) logs the text given on the  command
+       By  default, postlog(1) logs the text given on the command
        line as one record. If no text is specified on the command
-       line, postlog(1) reads from standard input and  logs  each
+       line,  postlog(1)  reads from standard input and logs each
        input line as one record.
 
-       Logging  is  sent  to  syslogd(8); when the standard error
-       stream is connected to a terminal, logging is  sent  there
+       Logging is sent to syslogd(8);  when  the  standard  error
+       stream  is  connected to a terminal, logging is sent there
        as well.
 
        The following options are implemented:
 
        -c config_dir
-              Read  the  main.cf  configuration file in the named
+              Read the main.cf configuration file  in  the  named
               directory  instead  of  the  default  configuration
               directory.
 
        -i     Include the process ID in the logging tag.
 
        -p priority
-              Specifies  the  logging  severity:  info (default),
+              Specifies the  logging  severity:  info  (default),
               warn, error, fatal, or panic.
 
        -t tag Specifies the logging tag, that is, the identifying
-              name  that appears at the beginning of each logging
-              record. A default tag is used when none  is  speci-
+              name that appears at the beginning of each  logging
+              record.  A  default tag is used when none is speci-
               fied.
 
        -v     Enable verbose logging for debugging purposes. Mul-
-              tiple -v options  make  the  software  increasingly
+              tiple  -v  options  make  the software increasingly
               verbose.
 
 ENVIRONMENT
@@ -53,22 +53,22 @@ POSTLOG(1)                                                          POSTLOG(1)
               Directory with the main.cf file.
 
 CONFIGURATION PARAMETERS
-       The  following  main.cf parameters are especially relevant
+       The following main.cf parameters are  especially  relevant
        to this program.
 
-       The text below provides  only  a  parameter  summary.  See
+       The  text  below  provides  only  a parameter summary. See
        postconf(5) for more details including examples.
 
        config_directory (see 'postconf -d' output)
-              The  default  location  of  the Postfix main.cf and
+              The default location of  the  Postfix  main.cf  and
               master.cf configuration files.
 
        syslog_facility (mail)
               The syslog facility of Postfix logging.
 
        syslog_name (postfix)
-              The mail system  name  that  is  prepended  to  the
-              process  name  in  syslog  records, so that "smtpd"
+              The  mail  system  name  that  is  prepended to the
+              process name in syslog  records,  so  that  "smtpd"
               becomes, for example, "postfix/smtpd".
 
 SEE ALSO
@@ -76,7 +76,7 @@ POSTLOG(1)                                                          POSTLOG(1)
        syslogd(8), syslog daemon
 
 LICENSE
-       The Secure Mailer license must be  distributed  with  this
+       The  Secure  Mailer  license must be distributed with this
        software.
 
 AUTHOR(S)
diff --git a/postfix/html/proxymap.8.html b/postfix/html/proxymap.8.html
index f3a5270b6..57eca5eb4 100644
--- a/postfix/html/proxymap.8.html
+++ b/postfix/html/proxymap.8.html
@@ -117,24 +117,23 @@ PROXYMAP(8)                                                        PROXYMAP(8)
 
        max_idle (100s)
               The  maximum  amount  of  time that an idle Postfix
-              daemon process waits  for  an  incoming  connection
-              before terminating voluntarily.
+              daemon process waits for the next  service  request
+              before exiting.
 
        max_use (100)
-              The  maximal  number of incoming connections that a
-              Postfix daemon process will service  before  termi-
-              nating voluntarily.
+              The  maximal number of connection requests before a
+              Postfix daemon process terminates.
 
        process_id (read-only)
-              The  process  ID  of  a  Postfix  command or daemon
+              The process ID  of  a  Postfix  command  or  daemon
               process.
 
        process_name (read-only)
-              The process name of a  Postfix  command  or  daemon
+              The  process  name  of  a Postfix command or daemon
               process.
 
        proxy_read_maps (see 'postconf -d' output)
-              The  lookup  tables  that the proxymap(8) server is
+              The lookup tables that the  proxymap(8)  server  is
               allowed to access.
 
 SEE ALSO
@@ -145,7 +144,7 @@ PROXYMAP(8)                                                        PROXYMAP(8)
        DATABASE_README, Postfix lookup table overview
 
 LICENSE
-       The  Secure  Mailer  license must be distributed with this
+       The Secure Mailer license must be  distributed  with  this
        software.
 
 HISTORY
diff --git a/postfix/html/qmqpd.8.html b/postfix/html/qmqpd.8.html
index 9583cc1a0..8f244435a 100644
--- a/postfix/html/qmqpd.8.html
+++ b/postfix/html/qmqpd.8.html
@@ -114,41 +114,40 @@ QMQPD(8)                                                              QMQPD(8)
 
        max_idle (100s)
               The maximum amount of time  that  an  idle  Postfix
-              daemon  process  waits  for  an incoming connection
-              before terminating voluntarily.
+              daemon  process  waits for the next service request
+              before exiting.
 
        max_use (100)
-              The maximal number of incoming connections  that  a
-              Postfix  daemon  process will service before termi-
-              nating voluntarily.
+              The maximal number of connection requests before  a
+              Postfix daemon process terminates.
 
        process_id (read-only)
-              The process ID  of  a  Postfix  command  or  daemon
+              The  process  ID  of  a  Postfix  command or daemon
               process.
 
        process_name (read-only)
-              The  process  name  of  a Postfix command or daemon
+              The process name of a  Postfix  command  or  daemon
               process.
 
        qmqpd_authorized_clients (empty)
-              What clients are allowed to  connect  to  the  QMQP
+              What  clients  are  allowed  to connect to the QMQP
               server port.
 
        queue_directory (see 'postconf -d' output)
-              The  location of the Postfix top-level queue direc-
+              The location of the Postfix top-level queue  direc-
               tory.
 
        syslog_facility (mail)
               The syslog facility of Postfix logging.
 
        syslog_name (postfix)
-              The mail system  name  that  is  prepended  to  the
-              process  name  in  syslog  records, so that "smtpd"
+              The  mail  system  name  that  is  prepended to the
+              process name in syslog  records,  so  that  "smtpd"
               becomes, for example, "postfix/smtpd".
 
        verp_delimiter_filter (-=+)
-              The characters Postfix accepts  as  VERP  delimiter
-              characters  on the Postfix sendmail(1) command line
+              The  characters  Postfix  accepts as VERP delimiter
+              characters on the Postfix sendmail(1) command  line
               and in SMTP commands.
 
 SEE ALSO
@@ -161,7 +160,7 @@ QMQPD(8)                                                              QMQPD(8)
        QMQP_README, Postfix ezmlm-idx howto.
 
 LICENSE
-       The  Secure  Mailer  license must be distributed with this
+       The Secure Mailer license must be  distributed  with  this
        software.
 
 HISTORY
diff --git a/postfix/html/qshape.1.html b/postfix/html/qshape.1.html
index 4feacadab..490cb713b 100644
--- a/postfix/html/qshape.1.html
+++ b/postfix/html/qshape.1.html
@@ -13,7 +13,6 @@ QSHAPE(1)                                                            QSHAPE(1)
        qshape [-s] [-p] [-m min_subdomains]
                [-b bucket_count] [-t bucket_time]
                [-l] [-w terminal_width]
-               [-N batch_msg_count] [-n batch_top_domains]
                [-c config_directory] [queue_name ...]
 
 DESCRIPTION
@@ -78,39 +77,26 @@ QSHAPE(1)                                                            QSHAPE(1)
               narrow  to  show  the domain name and all the coun-
               ters, the terminal_width limit is violated.
 
-       -N batch_msg_count
-              When the output device is a terminal,  intermediate
-              results  are shown each "batch_msg_count" messages.
-              This produces usable results in a  reasonable  time
-              even  when the deferred queue is large. The default
-              is to show intermediate  results  every  1000  mes-
-              sages.
-
-       -n batch_top_domains
-              When  reporting  intermediate or final results to a
-              termainal, report only the top  "batch_top_domains"
-              domains. The default limit is 20 domains.
-
        -c config_directory
-              The  main.cf  configuration  file  is  in the named
+              The main.cf configuration  file  is  in  the  named
               directory  instead  of  the  default  configuration
               directory.
 
        Arguments:
 
        queue_name
-              By  default  qshape displays the combined distribu-
-              tion of the incoming and active queues. To  display
-              a  different  set of queues, just list their direc-
+              By default qshape displays the  combined  distribu-
+              tion  of the incoming and active queues. To display
+              a different set of queues, just list  their  direc-
               tory names on the command line.  Absolute paths are
-              used  as  is, other paths are taken relative to the
-              main.cf queue_directory parameter  setting.   While
-              main.cf  supports the use of $variable expansion in
-              the definition of  the  queue_directory  parameter,
-              the  qshape program does not. If you must use vari-
+              used as is, other paths are taken relative  to  the
+              main.cf  queue_directory  parameter setting.  While
+              main.cf supports the use of $variable expansion  in
+              the  definition  of  the queue_directory parameter,
+              the qshape program does not. If you must use  vari-
               able expansions in the queue_directory setting, you
-              must  specify  an  explicit  absolute path for each
-              queue subdirectory even if  you  want  the  default
+              must specify an explicit  absolute  path  for  each
+              queue  subdirectory  even  if  you want the default
               incoming and active queue distribution.
 
 SEE ALSO
@@ -126,7 +112,7 @@ QSHAPE(1)                                                            QSHAPE(1)
        $queue_directory/deferred/, messages postponed for later delivery.
 
 LICENSE
-       The  Secure  Mailer  license must be distributed with this
+       The Secure Mailer license must be  distributed  with  this
        software.
 
 AUTHOR(S)
diff --git a/postfix/html/regexp_table.5.html b/postfix/html/regexp_table.5.html
index 53eb26746..d42fa4483 100644
--- a/postfix/html/regexp_table.5.html
+++ b/postfix/html/regexp_table.5.html
@@ -10,9 +10,9 @@ REGEXP_TABLE(5)                                                REGEXP_TABLE(5)
        regexp_table - format of Postfix regular expression tables
 
 SYNOPSIS
-       postmap -q "string" regexp:/etc/postfix/filename
+       postmap -fq "string" regexp:/etc/postfix/filename
 
-       postmap -q - regexp:/etc/postfix/filename <inputfile
+       postmap -fq - regexp:/etc/postfix/filename <inputfile
 
 DESCRIPTION
        The Postfix mail system uses optional tables  for  address
@@ -21,21 +21,15 @@ REGEXP_TABLE(5)                                                REGEXP_TABLE(5)
 
        Alternatively, lookup tables can  be  specified  in  POSIX
        regular  expression form. In this case, each input is com-
-       pared against a list of patterns. When a match  is  found,
-       the  corresponding  result  is  returned and the search is
-       terminated.
+       pared against a list of patterns,  and  when  a  match  is
+       found the corresponding result is returned.
 
-       To find out what types of lookup tables your Postfix  sys-
+       To  find out what types of lookup tables your Postfix sys-
        tem supports use the "postconf -m" command.
 
-       To  test  lookup  tables,  use the "postmap -q" command as
+       To test lookup tables, use the "postmap  -fq"  command  as
        described in the SYNOPSIS above.
 
-COMPATIBILITY
-       With Postfix version 2.2 and earlier specify "postmap -fq"
-       to  query  a  table that contains case sensitive patterns.
-       Patterns are case insensitive by default.
-
 TABLE FORMAT
        The general form of a Postfix regular expression table is:
 
@@ -44,7 +38,7 @@ REGEXP_TABLE(5)                                                REGEXP_TABLE(5)
               responding result value.
 
        !/pattern/flags result
-              When pattern does not match the input  string,  use
+              When  pattern  does not match the input string, use
               the corresponding result value.
 
        if /pattern/flags
@@ -53,7 +47,7 @@ REGEXP_TABLE(5)                                                REGEXP_TABLE(5)
               if and endif, if and only if that same input string
               also matches pattern. The if..endif can nest.
 
-              Note:  do not prepend whitespace to patterns inside
+              Note: do not prepend whitespace to patterns  inside
               if..endif.
 
               This feature is available in Postfix 2.1 and later.
@@ -62,77 +56,77 @@ REGEXP_TABLE(5)                                                REGEXP_TABLE(5)
 
        endif  Match the input string against the patterns between
               if and endif, if and only if that same input string
-              does  not  match  pattern.  The if..endif can nest.
+              does not match pattern.  The  if..endif  can  nest.
               matches pattern. The if..endif can nest.
 
-              Note: do not prepend whitespace to patterns  inside
+              Note:  do not prepend whitespace to patterns inside
               if..endif.
 
               This feature is available in Postfix 2.1 and later.
 
        blank lines and comments
-              Empty lines and whitespace-only lines are  ignored,
-              as  are  lines whose first non-whitespace character
+              Empty  lines and whitespace-only lines are ignored,
+              as are lines whose first  non-whitespace  character
               is a `#'.
 
        multi-line text
-              A logical line starts with non-whitespace  text.  A
-              line  that starts with whitespace continues a logi-
+              A  logical  line starts with non-whitespace text. A
+              line that starts with whitespace continues a  logi-
               cal line.
 
-       Each pattern is a POSIX regular expression enclosed  by  a
+       Each  pattern  is a POSIX regular expression enclosed by a
        pair of delimiters. The regular expression syntax is docu-
-       mented in  re_format(7)  with  4.4BSD,  in  regex(5)  with
+       mented  in  re_format(7)  with  4.4BSD,  in  regex(5) with
        Solaris, and in regex(7) with Linux. Other systems may use
        other document names.
 
-       The expression delimiter  can  be  any  character,  except
+       The  expression  delimiter  can  be  any character, except
        whitespace or characters that have special meaning (tradi-
-       tionally the forward slash is used). The  regular  expres-
+       tionally  the  forward slash is used). The regular expres-
        sion can contain whitespace.
 
        By default, matching is case-insensitive, and newlines are
-       not treated as special characters. The  behavior  is  con-
-       trolled  by  flags,  which are toggled by appending one or
+       not  treated  as  special characters. The behavior is con-
+       trolled by flags, which are toggled by  appending  one  or
        more of the following characters after the pattern:
 
        i (default: on)
-              Toggles the  case  sensitivity  flag.  By  default,
+              Toggles  the  case  sensitivity  flag.  By default,
               matching is case insensitive.
 
        x (default: on)
-              Toggles  the  extended  expression  syntax flag. By
-              default, support for extended expression syntax  is
+              Toggles the extended  expression  syntax  flag.  By
+              default,  support for extended expression syntax is
               enabled.
 
        m (default: off)
-              Toggle  the multi-line mode flag. When this flag is
-              on, the ^ and $  metacharacters  match  immediately
-              after  and  immediately before a newline character,
-              respectively, in addition to matching at the  start
+              Toggle the multi-line mode flag. When this flag  is
+              on,  the  ^  and $ metacharacters match immediately
+              after and immediately before a  newline  character,
+              respectively,  in addition to matching at the start
               and end of the input string.
 
 TABLE SEARCH ORDER
-       Patterns  are applied in the order as specified in the ta-
-       ble, until a pattern  is  found  that  matches  the  input
+       Patterns are applied in the order as specified in the  ta-
+       ble,  until  a  pattern  is  found  that matches the input
        string.
 
-       Each  pattern  is  applied  to  the  entire  input string.
-       Depending on the application, that  string  is  an  entire
+       Each pattern  is  applied  to  the  entire  input  string.
+       Depending  on  the  application,  that string is an entire
        client hostname, an entire client IP address, or an entire
-       mail address.  Thus, no parent domain  or  parent  network
-       search  is  done,  and  user@domain mail addresses are not
-       broken up into their user and  domain  constituent  parts,
+       mail  address.   Thus,  no parent domain or parent network
+       search is done, and user@domain  mail  addresses  are  not
+       broken  up  into  their user and domain constituent parts,
        nor is user+foo broken up into user and foo.
 
 TEXT SUBSTITUTION
-       Substitution  of  substrings  from  the matched expression
-       into the result string is possible  using  $1,  $2,  etc.;
+       Substitution of substrings  from  the  matched  expression
+       into  the  result  string  is possible using $1, $2, etc.;
        specify $$ to produce a $ character as output.  The macros
-       in the result string may need to be  written  as  ${n}  or
+       in  the  result  string  may need to be written as ${n} or
        $(n) if they aren't followed by whitespace.
 
-       Note:  since negated patterns (those preceded by !) return
+       Note: since negated patterns (those preceded by !)  return
        a result when the expression does not match, substitutions
        are not available for negated patterns.
 
diff --git a/postfix/html/relocated.5.html b/postfix/html/relocated.5.html
index d31e1628c..f3d27d524 100644
--- a/postfix/html/relocated.5.html
+++ b/postfix/html/relocated.5.html
@@ -21,8 +21,8 @@ RELOCATED(5)                                                      RELOCATED(5)
        file that serves as input to the postmap(1) command.   The
        result,  an  indexed file in dbm or db format, is used for
        fast searching by the mail  system.  Execute  the  command
-       "postmap  /etc/postfix/relocated"  to  rebuild  an indexed
-       file after changing the corresponding relocated table.
+       "postmap  /etc/postfix/relocated"  in order to rebuild the
+       indexed file after changing the relocated table.
 
        When the table is provided via other means  such  as  NIS,
        LDAP  or  SQL,  the  same lookups are done as for ordinary
@@ -31,9 +31,9 @@ RELOCATED(5)                                                      RELOCATED(5)
        Alternatively, the table can be  provided  as  a  regular-
        expression map where patterns are given as regular expres-
        sions, or lookups can be directed to TCP-based server.  In
-       those  case,  the lookups are done in a slightly different
+       that  case,  the  lookups are done in a slightly different
        way as described below under "REGULAR  EXPRESSION  TABLES"
-       or "TCP-BASED TABLES".
+       and "TCP-BASED TABLES".
 
        Table lookups are case insensitive.
 
@@ -91,7 +91,7 @@ RELOCATED(5)                                                      RELOCATED(5)
        regexp_table(5) or pcre_table(5). For a description of the
        TCP client/server table lookup protocol, see tcp_table(5).
        This feature is not available up to and including  Postfix
-       version 2.4.
+       version 2.3.
 
        Each  pattern  is  a regular expression that is applied to
        the entire address being looked up. Thus, user@domain mail
@@ -112,7 +112,7 @@ RELOCATED(5)                                                      RELOCATED(5)
        lookups are directed to a TCP-based server. For a descrip-
        tion of the TCP client/server lookup protocol, see tcp_ta-
        ble(5).  This feature is not available up to and including
-       Postfix version 2.4.
+       Postfix version 2.3.
 
        Each lookup operation uses the entire address once.  Thus,
        user@domain mail addresses are not broken  up  into  their
diff --git a/postfix/html/scache.8.html b/postfix/html/scache.8.html
index 9b3aacc2d..868e14f53 100644
--- a/postfix/html/scache.8.html
+++ b/postfix/html/scache.8.html
@@ -120,8 +120,8 @@ SCACHE(8)                                                            SCACHE(8)
 
        max_idle (100s)
               The  maximum  amount  of  time that an idle Postfix
-              daemon process waits  for  an  incoming  connection
-              before terminating voluntarily.
+              daemon process waits for the next  service  request
+              before exiting.
 
        process_id (read-only)
               The  process  ID  of  a  Postfix  command or daemon
diff --git a/postfix/html/sendmail.1.html b/postfix/html/sendmail.1.html
index 52a9a8645..0390a1dc9 100644
--- a/postfix/html/sendmail.1.html
+++ b/postfix/html/sendmail.1.html
@@ -282,9 +282,9 @@ SENDMAIL(1)                                                        SENDMAIL(1)
 
 SECURITY
        By  design,  this  program  is not set-user (or group) id.
-       However, it must  handle  data  from  untrusted,  possibly
-       remote,  users.   Thus,  the  usual precautions need to be
-       taken against malicious inputs.
+       However, it must  handle  data  from  untrusted  users  or
+       untrusted  machines.   Thus, the usual precautions need to
+       be taken against malicious inputs.
 
 DIAGNOSTICS
        Problems are logged to  syslogd(8)  and  to  the  standard
diff --git a/postfix/html/showq.8.html b/postfix/html/showq.8.html
index 2cf7d33d2..5cb1f446f 100644
--- a/postfix/html/showq.8.html
+++ b/postfix/html/showq.8.html
@@ -34,6 +34,11 @@ SHOWQ(8)                                                              SHOWQ(8)
 DIAGNOSTICS
        Problems and transactions are logged to syslogd(8).
 
+BUGS
+       The showq(8) daemon runs at a fixed low privilege;  conse-
+       quently, it cannot extract information from queue files in
+       the maildrop directory.
+
 CONFIGURATION PARAMETERS
        Changes to main.cf are picked up automatically as showq(8)
        processes  run  for only a limited amount of time. Use the
@@ -67,32 +72,31 @@ SHOWQ(8)                                                              SHOWQ(8)
 
        max_idle (100s)
               The  maximum  amount  of  time that an idle Postfix
-              daemon process waits  for  an  incoming  connection
-              before terminating voluntarily.
+              daemon process waits for the next  service  request
+              before exiting.
 
        max_use (100)
-              The  maximal  number of incoming connections that a
-              Postfix daemon process will service  before  termi-
-              nating voluntarily.
+              The  maximal number of connection requests before a
+              Postfix daemon process terminates.
 
        process_id (read-only)
-              The  process  ID  of  a  Postfix  command or daemon
+              The process ID  of  a  Postfix  command  or  daemon
               process.
 
        process_name (read-only)
-              The process name of a  Postfix  command  or  daemon
+              The  process  name  of  a Postfix command or daemon
               process.
 
        queue_directory (see 'postconf -d' output)
-              The  location of the Postfix top-level queue direc-
+              The location of the Postfix top-level queue  direc-
               tory.
 
        syslog_facility (mail)
               The syslog facility of Postfix logging.
 
        syslog_name (postfix)
-              The mail system  name  that  is  prepended  to  the
-              process  name  in  syslog  records, so that "smtpd"
+              The  mail  system  name  that  is  prepended to the
+              process name in syslog  records,  so  that  "smtpd"
               becomes, for example, "postfix/smtpd".
 
 FILES
@@ -107,7 +111,7 @@ SHOWQ(8)                                                              SHOWQ(8)
        syslogd(8), system logging
 
 LICENSE
-       The Secure Mailer license must be  distributed  with  this
+       The  Secure  Mailer  license must be distributed with this
        software.
 
 AUTHOR(S)
diff --git a/postfix/html/smtp.8.html b/postfix/html/smtp.8.html
index d991668be..7d4246aab 100644
--- a/postfix/html/smtp.8.html
+++ b/postfix/html/smtp.8.html
@@ -42,8 +42,8 @@ SMTP(8)                                                                SMTP(8)
 
        By  default, connection caching is enabled temporarily for
        destinations that have a high volume of mail in the active
-       queue.  Connection  caching can be enabled permanently for
-       specific destinations.
+       queue. Session caching can be enabled permanently for spe-
+       cific destinations.
 
 SMTP DESTINATION SYNTAX
        SMTP destinations have the following form:
@@ -142,9 +142,9 @@ SMTP(8)                                                                SMTP(8)
        the client is used for multiple domains.
 
        Most  smtp_xxx  configuration  parameters have an lmtp_xxx
-       "mirror" parameter for the equivalent LMTP  feature.  This
+       "ghost" parameter for the equivalent  LMTP  feature.  This
        document describes only those LMTP-related parameters that
-       aren't simply "mirror" parameters.
+       aren't simply "ghost" parameters.
 
        Changes to main.cf are picked up automatically, as smtp(8)
        processes  run  for only a limited amount of time. Use the
@@ -247,7 +247,7 @@ SMTP(8)                                                                SMTP(8)
               LMTP client will ignore in the LHLO response from a
               remote LMTP server.
 
-       lmtp_discard_lhlo_keywords (empty)
+       lmtp_discard_lhlo_keywords ($myhostname)
               A  case insensitive list of LHLO keywords (pipelin-
               ing, starttls, auth, etc.)  that  the  LMTP  client
               will ignore in the LHLO response from a remote LMTP
@@ -655,70 +655,69 @@ SMTP(8)                                                                SMTP(8)
 
        max_idle (100s)
               The maximum amount of time  that  an  idle  Postfix
-              daemon  process  waits  for  an incoming connection
-              before terminating voluntarily.
+              daemon  process  waits for the next service request
+              before exiting.
 
        max_use (100)
-              The maximal number of incoming connections  that  a
-              Postfix  daemon  process will service before termi-
-              nating voluntarily.
+              The maximal number of connection requests before  a
+              Postfix daemon process terminates.
 
        process_id (read-only)
-              The process ID  of  a  Postfix  command  or  daemon
+              The  process  ID  of  a  Postfix  command or daemon
               process.
 
        process_name (read-only)
-              The  process  name  of  a Postfix command or daemon
+              The process name of a  Postfix  command  or  daemon
               process.
 
        proxy_interfaces (empty)
               The network interface addresses that this mail sys-
-              tem  receives  mail on by way of a proxy or network
+              tem receives mail on by way of a proxy  or  network
               address translation unit.
 
        smtp_bind_address (empty)
-              An optional  numerical  network  address  that  the
-              Postfix  SMTP  client should bind to when making an
+              An  optional  numerical  network  address  that the
+              Postfix SMTP client should bind to when  making  an
               IPv4 connection.
 
        smtp_bind_address6 (empty)
-              An optional  numerical  network  address  that  the
-              Postfix  SMTP  client should bind to when making an
+              An  optional  numerical  network  address  that the
+              Postfix SMTP client should bind to when  making  an
               IPv6 connection.
 
        smtp_helo_name ($myhostname)
-              The hostname to send in the SMTP EHLO or HELO  com-
+              The  hostname to send in the SMTP EHLO or HELO com-
               mand.
 
        lmtp_lhlo_name ($myhostname)
               The hostname to send in the LMTP LHLO command.
 
        smtp_host_lookup (dns)
-              What  mechanisms  when the Postfix SMTP client uses
+              What mechanisms when the Postfix SMTP  client  uses
               to look up a host's IP address.
 
        smtp_randomize_addresses (yes)
-              Randomize the order  of  equal-preference  MX  host
+              Randomize  the  order  of  equal-preference MX host
               addresses.
 
        syslog_facility (mail)
               The syslog facility of Postfix logging.
 
        syslog_name (postfix)
-              The  mail  system  name  that  is  prepended to the
-              process name in syslog  records,  so  that  "smtpd"
+              The mail system  name  that  is  prepended  to  the
+              process  name  in  syslog  records, so that "smtpd"
               becomes, for example, "postfix/smtpd".
 
        Available with Postfix 2.2 and earlier:
 
        fallback_relay (empty)
-              Optional  list of relay hosts for SMTP destinations
+              Optional list of relay hosts for SMTP  destinations
               that can't be found or that are unreachable.
 
        Available with Postfix 2.3 and later:
 
        smtp_fallback_relay ($fallback_relay)
-              Optional list of relay hosts for SMTP  destinations
+              Optional  list of relay hosts for SMTP destinations
               that can't be found or that are unreachable.
 
 SEE ALSO
@@ -736,7 +735,7 @@ SMTP(8)                                                                SMTP(8)
        TLS_README, Postfix STARTTLS howto
 
 LICENSE
-       The Secure Mailer license must be  distributed  with  this
+       The  Secure  Mailer  license must be distributed with this
        software.
 
 AUTHOR(S)
diff --git a/postfix/html/smtpd.8.html b/postfix/html/smtpd.8.html
index 364f879b0..38b474b63 100644
--- a/postfix/html/smtpd.8.html
+++ b/postfix/html/smtpd.8.html
@@ -1048,36 +1048,35 @@ SMTPD(8)                                                              SMTPD(8)
 
        max_idle (100s)
               The maximum amount of time  that  an  idle  Postfix
-              daemon  process  waits  for  an incoming connection
-              before terminating voluntarily.
+              daemon  process  waits for the next service request
+              before exiting.
 
        max_use (100)
-              The maximal number of incoming connections  that  a
-              Postfix  daemon  process will service before termi-
-              nating voluntarily.
+              The maximal number of connection requests before  a
+              Postfix daemon process terminates.
 
        myhostname (see 'postconf -d' output)
               The internet hostname of this mail system.
 
        mynetworks (see 'postconf -d' output)
-              The list of "trusted" SMTP clients that  have  more
+              The  list  of "trusted" SMTP clients that have more
               privileges than "strangers".
 
        myorigin ($myhostname)
               The domain name that locally-posted mail appears to
-              come from, and that locally posted mail  is  deliv-
+              come  from,  and that locally posted mail is deliv-
               ered to.
 
        process_id (read-only)
-              The  process  ID  of  a  Postfix  command or daemon
+              The process ID  of  a  Postfix  command  or  daemon
               process.
 
        process_name (read-only)
-              The process name of a  Postfix  command  or  daemon
+              The  process  name  of  a Postfix command or daemon
               process.
 
        queue_directory (see 'postconf -d' output)
-              The  location of the Postfix top-level queue direc-
+              The location of the Postfix top-level queue  direc-
               tory.
 
        recipient_delimiter (empty)
@@ -1085,22 +1084,22 @@ SMTPD(8)                                                              SMTPD(8)
               sions (user+foo).
 
        smtpd_banner ($myhostname ESMTP $mail_name)
-              The  text  that  follows the 220 status code in the
+              The text that follows the 220 status  code  in  the
               SMTP greeting banner.
 
        syslog_facility (mail)
               The syslog facility of Postfix logging.
 
        syslog_name (postfix)
-              The mail system  name  that  is  prepended  to  the
-              process  name  in  syslog  records, so that "smtpd"
+              The  mail  system  name  that  is  prepended to the
+              process name in syslog  records,  so  that  "smtpd"
               becomes, for example, "postfix/smtpd".
 
        Available in Postfix version 2.2 and later:
 
        smtpd_forbidden_commands (CONNECT, GET, POST)
-              List of  commands  that  causes  the  Postfix  SMTP
-              server  to immediately terminate the session with a
+              List  of  commands  that  causes  the  Postfix SMTP
+              server to immediately terminate the session with  a
               221 code.
 
 SEE ALSO
@@ -1130,7 +1129,7 @@ SMTPD(8)                                                              SMTPD(8)
        XFORWARD_README, Postfix XFORWARD extension
 
 LICENSE
-       The  Secure  Mailer  license must be distributed with this
+       The Secure Mailer license must be  distributed  with  this
        software.
 
 AUTHOR(S)
diff --git a/postfix/html/spawn.8.html b/postfix/html/spawn.8.html
index afd13628b..b5e402946 100644
--- a/postfix/html/spawn.8.html
+++ b/postfix/html/spawn.8.html
@@ -110,32 +110,31 @@ SPAWN(8)                                                              SPAWN(8)
 
        max_idle (100s)
               The  maximum  amount  of  time that an idle Postfix
-              daemon process waits  for  an  incoming  connection
-              before terminating voluntarily.
+              daemon process waits for the next  service  request
+              before exiting.
 
        max_use (100)
-              The  maximal  number of incoming connections that a
-              Postfix daemon process will service  before  termi-
-              nating voluntarily.
+              The  maximal number of connection requests before a
+              Postfix daemon process terminates.
 
        process_id (read-only)
-              The  process  ID  of  a  Postfix  command or daemon
+              The process ID  of  a  Postfix  command  or  daemon
               process.
 
        process_name (read-only)
-              The process name of a  Postfix  command  or  daemon
+              The  process  name  of  a Postfix command or daemon
               process.
 
        queue_directory (see 'postconf -d' output)
-              The  location of the Postfix top-level queue direc-
+              The location of the Postfix top-level queue  direc-
               tory.
 
        syslog_facility (mail)
               The syslog facility of Postfix logging.
 
        syslog_name (postfix)
-              The mail system  name  that  is  prepended  to  the
-              process  name  in  syslog  records, so that "smtpd"
+              The  mail  system  name  that  is  prepended to the
+              process name in syslog  records,  so  that  "smtpd"
               becomes, for example, "postfix/smtpd".
 
 SEE ALSO
@@ -144,7 +143,7 @@ SPAWN(8)                                                              SPAWN(8)
        syslogd(8), system logging
 
 LICENSE
-       The Secure Mailer license must be  distributed  with  this
+       The  Secure  Mailer  license must be distributed with this
        software.
 
 AUTHOR(S)
diff --git a/postfix/html/trace.8.html b/postfix/html/trace.8.html
deleted file mode 100644
index 5d8aef4d7..000000000
--- a/postfix/html/trace.8.html
+++ /dev/null
@@ -1,180 +0,0 @@
-
- 
-
- Postfix manual - bounce(8) 
-  
    -BOUNCE(8)                                                            BOUNCE(8)
-
-NAME
-       bounce - Postfix delivery status reports
-
-SYNOPSIS
-       bounce [generic Postfix daemon options]
-
-DESCRIPTION
-       The  bounce(8) daemon maintains per-message log files with
-       delivery status information. Each log file is named  after
-       the  queue  file  that it corresponds to, and is kept in a
-       queue subdirectory named after the  service  name  in  the
-       master.cf file (either bounce, defer or trace).  This pro-
-       gram expects to be run from the master(8) process manager.
-
-       The  bounce(8)  daemon  processes  two  types  of  service
-       requests:
-
-       o      Append a recipient (non-)delivery status record  to
-              a per-message log file.
-
-       o      Enqueue  a  delivery  status  notification message,
-              with a copy of a per-message log file  and  of  the
-              corresponding  message.   When  the delivery status
-              notification message is enqueued successfully,  the
-              per-message log file is deleted.
-
-       The software does a best notification effort. A non-deliv-
-       ery notification is sent even when the  log  file  or  the
-       original message cannot be read.
-
-       Optionally,  a  bounce  (defer,  trace) client can request
-       that  the  per-message  log  file  be  deleted  when   the
-       requested  operation  fails.  This is used by clients that
-       cannot retry transactions by themselves, and  that  depend
-       on retry logic in their own client.
-
-STANDARDS
-       RFC 822 (ARPA Internet Text Messages)
-       RFC 2045 (Format of Internet Message Bodies)
-       RFC 2822 (ARPA Internet Text Messages)
-       RFC 3462 (Delivery Status Notifications)
-       RFC 3464 (Delivery Status Notifications)
-       RFC 3834 (Auto-Submitted: message header)
-
-DIAGNOSTICS
-       Problems and transactions are logged to syslogd(8).
-
-CONFIGURATION PARAMETERS
-       Changes   to  main.cf  are  picked  up  automatically,  as
-       bounce(8) processes run for only a limited amount of time.
-       Use the command "postfix reload" to speed up a change.
-
-       The  text  below  provides  only  a parameter summary. See
-       postconf(5) for more details including examples.
-
-       2bounce_notice_recipient (postmaster)
-              The recipient of undeliverable mail that cannot  be
-              returned to the sender.
-
-       backwards_bounce_logfile_compatibility (yes)
-              Produce  additional  bounce(8) logfile records that
-              can be read by Postfix versions before 2.0.
-
-       bounce_notice_recipient (postmaster)
-              The recipient of postmaster notifications with  the
-              message  headers  of  mail  that  Postfix  did  not
-              deliver and of  SMTP  conversation  transcripts  of
-              mail that Postfix did not receive.
-
-       bounce_size_limit (50000)
-              The maximal amount of original message text that is
-              sent in a non-delivery notification.
-
-       bounce_template_file (empty)
-              Pathname of a configuration file with  bounce  mes-
-              sage templates.
-
-       config_directory (see 'postconf -d' output)
-              The  default  location  of  the Postfix main.cf and
-              master.cf configuration files.
-
-       daemon_timeout (18000s)
-              How much time a Postfix daemon process may take  to
-              handle  a  request  before  it  is  terminated by a
-              built-in watchdog timer.
-
-       delay_notice_recipient (postmaster)
-              The recipient of postmaster notifications with  the
-              message  headers  of  mail that cannot be delivered
-              within $delay_warning_time time units.
-
-       deliver_lock_attempts (20)
-              The maximal number of attempts to acquire an exclu-
-              sive lock on a mailbox file or bounce(8) logfile.
-
-       deliver_lock_delay (1s)
-              The  time  between attempts to acquire an exclusive
-              lock on a mailbox file or bounce(8) logfile.
-
-       ipc_timeout (3600s)
-              The time limit for sending or receiving information
-              over an internal communication channel.
-
-       internal_mail_filter_classes (empty)
-              What  categories of Postfix-generated mail are sub-
-              ject  to   before-queue   content   inspection   by
-              non_smtpd_milters, header_checks and body_checks.
-
-       mail_name (Postfix)
-              The mail system name that is displayed in Received:
-              headers,  in  the  SMTP  greeting  banner,  and  in
-              bounced mail.
-
-       max_idle (100s)
-              The  maximum  amount  of  time that an idle Postfix
-              daemon process waits  for  an  incoming  connection
-              before terminating voluntarily.
-
-       max_use (100)
-              The  maximal  number of incoming connections that a
-              Postfix daemon process will service  before  termi-
-              nating voluntarily.
-
-       notify_classes (resource, software)
-              The  list of error classes that are reported to the
-              postmaster.
-
-       process_id (read-only)
-              The process ID  of  a  Postfix  command  or  daemon
-              process.
-
-       process_name (read-only)
-              The  process  name  of  a Postfix command or daemon
-              process.
-
-       queue_directory (see 'postconf -d' output)
-              The location of the Postfix top-level queue  direc-
-              tory.
-
-       syslog_facility (mail)
-              The syslog facility of Postfix logging.
-
-       syslog_name (postfix)
-              The  mail  system  name  that  is  prepended to the
-              process name in syslog  records,  so  that  "smtpd"
-              becomes, for example, "postfix/smtpd".
-
-FILES
-       /var/spool/postfix/bounce/* non-delivery records
-       /var/spool/postfix/defer/* non-delivery records
-       /var/spool/postfix/trace/* delivery status records
-
-SEE ALSO
-       bounce(5), bounce message template format
-       qmgr(8), queue manager
-       postconf(5), configuration parameters
-       master(5), generic daemon options
-       master(8), process manager
-       syslogd(8), system logging
-
-LICENSE
-       The  Secure  Mailer  license must be distributed with this
-       software.
-
-AUTHOR(S)
-       Wietse Venema
-       IBM T.J. Watson Research
-       P.O. Box 704
-       Yorktown Heights, NY 10598, USA
-
-                                                                     BOUNCE(8)
-
      
diff --git a/postfix/html/trace.8.html b/postfix/html/trace.8.html
new file mode 120000
index 000000000..4de6cc212
--- /dev/null
+++ b/postfix/html/trace.8.html
@@ -0,0 +1 @@
+bounce.8.html
\ No newline at end of file
diff --git a/postfix/html/transport.5.html b/postfix/html/transport.5.html
index a2a225f3b..609131a52 100644
--- a/postfix/html/transport.5.html
+++ b/postfix/html/transport.5.html
@@ -55,8 +55,8 @@ TRANSPORT(5)                                                      TRANSPORT(5)
        file that serves as input to the postmap(1) command.   The
        result,  an  indexed file in dbm or db format, is used for
        fast searching by the mail  system.  Execute  the  command
-       "postmap  /etc/postfix/transport"  to  rebuild  an indexed
-       file after changing the corresponding transport table.
+       "postmap  /etc/postfix/transport"  in order to rebuild the
+       indexed file after changing the transport table.
 
        When the table is provided via other means  such  as  NIS,
        LDAP  or  SQL,  the  same lookups are done as for ordinary
@@ -65,9 +65,9 @@ TRANSPORT(5)                                                      TRANSPORT(5)
        Alternatively, the table can be  provided  as  a  regular-
        expression map where patterns are given as regular expres-
        sions, or lookups can be directed to TCP-based server.  In
-       those  case,  the lookups are done in a slightly different
+       that  case,  the  lookups are done in a slightly different
        way as described below under "REGULAR  EXPRESSION  TABLES"
-       or "TCP-BASED TABLES".
+       and "TCP-BASED TABLES".
 
 CASE FOLDING
        The  search  string is folded to lowercase before database
@@ -243,7 +243,7 @@ TRANSPORT(5)                                                      TRANSPORT(5)
        lookups are directed to a TCP-based server. For a descrip-
        tion of the TCP client/server lookup protocol, see tcp_ta-
        ble(5).  This feature is not available up to and including
-       Postfix version 2.4.
+       Postfix version 2.3.
 
        Each  lookup  operation  uses the entire recipient address
        once.  Thus, some.domain.hierarchy is not  looked  up  via
diff --git a/postfix/html/trivial-rewrite.8.html b/postfix/html/trivial-rewrite.8.html
index 18b5b7a34..2e045a1e6 100644
--- a/postfix/html/trivial-rewrite.8.html
+++ b/postfix/html/trivial-rewrite.8.html
@@ -252,46 +252,45 @@ TRIVIAL-REWRITE(8)                                          TRIVIAL-REWRITE(8)
 
        max_idle (100s)
               The  maximum  amount  of  time that an idle Postfix
-              daemon process waits  for  an  incoming  connection
-              before terminating voluntarily.
+              daemon process waits for the next  service  request
+              before exiting.
 
        max_use (100)
-              The  maximal  number of incoming connections that a
-              Postfix daemon process will service  before  termi-
-              nating voluntarily.
+              The  maximal number of connection requests before a
+              Postfix daemon process terminates.
 
        relocated_maps (empty)
               Optional lookup tables with new contact information
               for users or domains that no longer exist.
 
        process_id (read-only)
-              The process ID  of  a  Postfix  command  or  daemon
+              The  process  ID  of  a  Postfix  command or daemon
               process.
 
        process_name (read-only)
-              The  process  name  of  a Postfix command or daemon
+              The process name of a  Postfix  command  or  daemon
               process.
 
        queue_directory (see 'postconf -d' output)
-              The location of the Postfix top-level queue  direc-
+              The  location of the Postfix top-level queue direc-
               tory.
 
        show_user_unknown_table_name (yes)
-              Display  the  name  of  the  recipient table in the
+              Display the name of  the  recipient  table  in  the
               "User unknown" responses.
 
        syslog_facility (mail)
               The syslog facility of Postfix logging.
 
        syslog_name (postfix)
-              The mail system  name  that  is  prepended  to  the
-              process  name  in  syslog  records, so that "smtpd"
+              The  mail  system  name  that  is  prepended to the
+              process name in syslog  records,  so  that  "smtpd"
               becomes, for example, "postfix/smtpd".
 
        Available in Postfix version 2.0 and later:
 
        helpful_warnings (yes)
-              Log warnings about problematic  configuration  set-
+              Log  warnings  about problematic configuration set-
               tings, and provide helpful suggestions.
 
 SEE ALSO
@@ -306,7 +305,7 @@ TRIVIAL-REWRITE(8)                                          TRIVIAL-REWRITE(8)
        ADDRESS_VERIFICATION_README, Postfix address verification
 
 LICENSE
-       The Secure Mailer license must be  distributed  with  this
+       The  Secure  Mailer  license must be distributed with this
        software.
 
 AUTHOR(S)
diff --git a/postfix/html/virtual.5.html b/postfix/html/virtual.5.html
index 06450986b..c1dd3872e 100644
--- a/postfix/html/virtual.5.html
+++ b/postfix/html/virtual.5.html
@@ -48,8 +48,8 @@ VIRTUAL(5)                                                          VIRTUAL(5)
        text  file that serves as input to the postmap(1) command.
        The result, an indexed file in dbm or db format,  is  used
        for fast searching by the mail system. Execute the command
-       "postmap /etc/postfix/virtual" to rebuild an indexed  file
-       after changing the corresponding text file.
+       "postmap /etc/postfix/virtual" in  order  to  rebuild  the
+       indexed file after changing the text file.
 
        When  the  table  is provided via other means such as NIS,
        LDAP or SQL, the same lookups are  done  as  for  ordinary
@@ -58,9 +58,9 @@ VIRTUAL(5)                                                          VIRTUAL(5)
        Alternatively,  the  table  can  be provided as a regular-
        expression map where patterns are given as regular expres-
        sions,  or lookups can be directed to TCP-based server. In
-       those case, the lookups are done in a  slightly  different
+       that case, the lookups are done in  a  slightly  different
        way  as  described below under "REGULAR EXPRESSION TABLES"
-       or "TCP-BASED TABLES".
+       and "TCP-BASED TABLES".
 
 CASE FOLDING
        The search string is folded to lowercase  before  database
@@ -109,22 +109,15 @@ VIRTUAL(5)                                                          VIRTUAL(5)
               Redirect mail for other users in domain to address.
               This form has the lowest precedence.
 
-              Note:  @domain  is a wild-card. With this form, the
-              Postfix SMTP server accepts mail for any  recipient
-              in  domain,  regardless  of  whether that recipient
-              exists.  This may turn  your  mail  system  into  a
-              backscatter  source that returns undeliverable spam
-              to innocent people.
-
 RESULT ADDRESS REWRITING
        The lookup result is subject to address rewriting:
 
-       o      When the result  has  the  form  @otherdomain,  the
-              result  becomes the same user in otherdomain.  This
+       o      When  the  result  has  the  form @otherdomain, the
+              result becomes the same user in otherdomain.   This
               works only for the first address in a multi-address
               lookup result.
 
-       o      When  "append_at_myorigin=yes", append "@$myorigin"
+       o      When "append_at_myorigin=yes", append  "@$myorigin"
               to addresses without "@domain".
 
        o      When "append_dot_mydomain=yes", append ".$mydomain"
@@ -132,29 +125,29 @@ VIRTUAL(5)                                                          VIRTUAL(5)
 
 ADDRESS EXTENSION
        When a mail address localpart contains the optional recip-
-       ient delimiter (e.g., user+foo@domain), the  lookup  order
+       ient  delimiter  (e.g., user+foo@domain), the lookup order
        becomes: user+foo@domain, user@domain, user+foo, user, and
        @domain.
 
-       The  propagate_unmatched_extensions   parameter   controls
-       whether  an  unmatched  address extension (+foo) is propa-
+       The   propagate_unmatched_extensions   parameter  controls
+       whether an unmatched address extension  (+foo)  is  propa-
        gated to the result of table lookup.
 
 VIRTUAL ALIAS DOMAINS
-       Besides virtual aliases, the virtual alias table can  also
+       Besides  virtual aliases, the virtual alias table can also
        be used to implement virtual alias domains. With a virtual
-       alias domain,  all  recipient  addresses  are  aliased  to
+       alias  domain,  all  recipient  addresses  are  aliased to
        addresses in other domains.
 
        Virtual alias domains are not to be confused with the vir-
        tual mailbox domains that are implemented with the Postfix
        virtual(8)  mail  delivery  agent.  With  virtual  mailbox
-       domains, each recipient address can have its own  mailbox.
+       domains,  each recipient address can have its own mailbox.
 
-       With  a  virtual  alias domain, the virtual domain has its
-       own user name space. Local  (i.e.  non-virtual)  usernames
-       are  not visible in a virtual alias domain. In particular,
-       local aliases(5) and local mailing lists are  not  visible
+       With a virtual alias domain, the virtual  domain  has  its
+       own  user  name  space. Local (i.e. non-virtual) usernames
+       are not visible in a virtual alias domain. In  particular,
+       local  aliases(5)  and local mailing lists are not visible
        as localname@virtual-alias.domain.
 
        Support for a virtual alias domain looks like:
@@ -162,8 +155,8 @@ VIRTUAL(5)                                                          VIRTUAL(5)
        /etc/postfix/main.cf:
            virtual_alias_maps = hash:/etc/postfix/virtual
 
-           Note:  some systems use dbm databases instead of hash.
-           See the output from "postconf -m" for available  data-
+           Note: some systems use dbm databases instead of  hash.
+           See  the output from "postconf -m" for available data-
            base types.
 
        /etc/postfix/virtual:
@@ -172,95 +165,95 @@ VIRTUAL(5)                                                          VIRTUAL(5)
            user1@virtual-alias.domain   address1
            user2@virtual-alias.domain   address2, address3
 
-       The  virtual-alias.domain anything entry is required for a
+       The virtual-alias.domain anything entry is required for  a
        virtual alias domain. Without this entry, mail is rejected
-       with  "relay  access  denied", or bounces with "mail loops
+       with "relay access denied", or bounces  with  "mail  loops
        back to myself".
 
-       Do not specify virtual alias domain names in  the  main.cf
+       Do  not  specify virtual alias domain names in the main.cf
        mydestination or relay_domains configuration parameters.
 
-       With  a  virtual  alias  domain,  the  Postfix SMTP server
-       accepts  mail  for  known-user@virtual-alias.domain,   and
-       rejects   mail  for  unknown-user@virtual-alias.domain  as
+       With a virtual  alias  domain,  the  Postfix  SMTP  server
+       accepts   mail  for  known-user@virtual-alias.domain,  and
+       rejects  mail  for  unknown-user@virtual-alias.domain   as
        undeliverable.
 
-       Instead of specifying the virtual alias  domain  name  via
-       the  virtual_alias_maps table, you may also specify it via
+       Instead  of  specifying  the virtual alias domain name via
+       the virtual_alias_maps table, you may also specify it  via
        the main.cf virtual_alias_domains configuration parameter.
-       This  latter parameter uses the same syntax as the main.cf
+       This latter parameter uses the same syntax as the  main.cf
        mydestination configuration parameter.
 
 REGULAR EXPRESSION TABLES
-       This section describes how the table lookups  change  when
+       This  section  describes how the table lookups change when
        the table is given in the form of regular expressions. For
-       a description of regular expression lookup  table  syntax,
+       a  description  of regular expression lookup table syntax,
        see regexp_table(5) or pcre_table(5).
 
-       Each  pattern  is  a regular expression that is applied to
+       Each pattern is a regular expression that  is  applied  to
        the entire address being looked up. Thus, user@domain mail
-       addresses  are  not  broken up into their user and @domain
+       addresses are not broken up into their  user  and  @domain
        constituent parts, nor is user+foo broken up into user and
        foo.
 
-       Patterns  are applied in the order as specified in the ta-
-       ble, until a pattern is  found  that  matches  the  search
+       Patterns are applied in the order as specified in the  ta-
+       ble,  until  a  pattern  is  found that matches the search
        string.
 
-       Results  are  the  same as with indexed file lookups, with
-       the additional feature that parenthesized substrings  from
+       Results are the same as with indexed  file  lookups,  with
+       the  additional feature that parenthesized substrings from
        the pattern can be interpolated as $1, $2 and so on.
 
 TCP-BASED TABLES
-       This  section  describes how the table lookups change when
+       This section describes how the table lookups  change  when
        lookups are directed to a TCP-based server. For a descrip-
        tion of the TCP client/server lookup protocol, see tcp_ta-
        ble(5).  This feature is not available up to and including
-       Postfix version 2.4.
+       Postfix version 2.3.
 
        Each lookup operation uses the entire address once.  Thus,
-       user@domain mail addresses are not broken  up  into  their
+       user@domain  mail  addresses  are not broken up into their
        user and @domain constituent parts, nor is user+foo broken
        up into user and foo.
 
        Results are the same as with indexed file lookups.
 
 BUGS
-       The table format does not understand quoting  conventions.
+       The  table format does not understand quoting conventions.
 
 CONFIGURATION PARAMETERS
-       The  following  main.cf parameters are especially relevant
-       to this topic. See the Postfix  main.cf  file  for  syntax
-       details  and  for default values. Use the "postfix reload"
+       The following main.cf parameters are  especially  relevant
+       to  this  topic.  See  the Postfix main.cf file for syntax
+       details and for default values. Use the  "postfix  reload"
        command after a configuration change.
 
        virtual_alias_maps
               List of virtual aliasing tables.
 
        virtual_alias_domains
-              List of virtual alias domains. This uses  the  same
+              List  of  virtual alias domains. This uses the same
               syntax as the mydestination parameter.
 
        propagate_unmatched_extensions
-              A  list  of  address rewriting or forwarding mecha-
-              nisms that propagate an address extension from  the
-              original  address  to  the result.  Specify zero or
-              more  of  canonical,   virtual,   alias,   forward,
+              A list of address rewriting  or  forwarding  mecha-
+              nisms  that propagate an address extension from the
+              original address to the result.   Specify  zero  or
+              more   of   canonical,   virtual,  alias,  forward,
               include, or generic.
 
        Other parameters of interest:
 
        inet_interfaces
-              The  network  interface  addresses that this system
+              The network interface addresses  that  this  system
               receives mail on.  You need to stop and start Post-
               fix when this parameter changes.
 
        mydestination
-              List  of  domains  that  this mail system considers
+              List of domains that  this  mail  system  considers
               local.
 
        myorigin
-              The domain that is appended  to  any  address  that
+              The  domain  that  is  appended to any address that
               does not have a domain.
 
        owner_request_special
@@ -284,7 +277,7 @@ VIRTUAL(5)                                                          VIRTUAL(5)
        VIRTUAL_README, domain hosting guide
 
 LICENSE
-       The  Secure  Mailer  license must be distributed with this
+       The Secure Mailer license must be  distributed  with  this
        software.
 
 AUTHOR(S)
diff --git a/postfix/html/virtual.8.html b/postfix/html/virtual.8.html
index 3d7e5268a..eda09fc99 100644
--- a/postfix/html/virtual.8.html
+++ b/postfix/html/virtual.8.html
@@ -253,32 +253,31 @@ VIRTUAL(8)                                                          VIRTUAL(8)
 
        max_idle (100s)
               The  maximum  amount  of  time that an idle Postfix
-              daemon process waits  for  an  incoming  connection
-              before terminating voluntarily.
+              daemon process waits for the next  service  request
+              before exiting.
 
        max_use (100)
-              The  maximal  number of incoming connections that a
-              Postfix daemon process will service  before  termi-
-              nating voluntarily.
+              The  maximal number of connection requests before a
+              Postfix daemon process terminates.
 
        process_id (read-only)
-              The  process  ID  of  a  Postfix  command or daemon
+              The process ID  of  a  Postfix  command  or  daemon
               process.
 
        process_name (read-only)
-              The process name of a  Postfix  command  or  daemon
+              The  process  name  of  a Postfix command or daemon
               process.
 
        queue_directory (see 'postconf -d' output)
-              The  location of the Postfix top-level queue direc-
+              The location of the Postfix top-level queue  direc-
               tory.
 
        syslog_facility (mail)
               The syslog facility of Postfix logging.
 
        syslog_name (postfix)
-              The mail system  name  that  is  prepended  to  the
-              process  name  in  syslog  records, so that "smtpd"
+              The  mail  system  name  that  is  prepended to the
+              process name in syslog  records,  so  that  "smtpd"
               becomes, for example, "postfix/smtpd".
 
 SEE ALSO
@@ -291,20 +290,20 @@ VIRTUAL(8)                                                          VIRTUAL(8)
        VIRTUAL_README, domain hosting howto
 
 LICENSE
-       The Secure Mailer license must be  distributed  with  this
+       The  Secure  Mailer  license must be distributed with this
        software.
 
 HISTORY
-       This  delivery  agent  was originally based on the Postfix
-       local delivery agent. Modifications  mainly  consisted  of
-       removing  code  that either was not applicable or that was
-       not safe in this context: aliases,  ~user/.forward  files,
+       This delivery agent was originally based  on  the  Postfix
+       local  delivery  agent.  Modifications mainly consisted of
+       removing code that either was not applicable or  that  was
+       not  safe  in this context: aliases, ~user/.forward files,
        delivery to "|command" or to /file/name.
 
        The Delivered-To: message header appears in the qmail sys-
        tem by Daniel Bernstein.
 
-       The maildir structure  appears  in  the  qmail  system  by
+       The  maildir  structure  appears  in  the  qmail system by
        Daniel Bernstein.
 
 AUTHOR(S)
diff --git a/postfix/man/man1/postfix.1 b/postfix/man/man1/postfix.1
index 6dd40a489..75948b337 100644
--- a/postfix/man/man1/postfix.1
+++ b/postfix/man/man1/postfix.1
@@ -281,9 +281,3 @@ Amos Gouaux
 University of Texas at Dallas
 P.O. Box 830688, MC34
 Richardson, TX 75083, USA
-
-IPv6 support originally by:
-Mark Huizer, Eindhoven University, The Netherlands
-Jun-ichiro 'itojun' Hagino, KAME project, Japan
-The Linux PLD project
-Dean Strik, Eindhoven University, The Netherlands
diff --git a/postfix/man/man1/postlog.1 b/postfix/man/man1/postlog.1
index ab067d386..d83267d53 100644
--- a/postfix/man/man1/postlog.1
+++ b/postfix/man/man1/postlog.1
@@ -9,9 +9,8 @@ Postfix-compatible logging utility
 .na
 .nf
 .fi
-.ad
 \fBpostlog\fR [\fB-iv\fR] [\fB-c \fIconfig_dir\fR]
-[\fB-p \fIpriority\fB] [\fB-t \fItag\fR] [\fItext...\fR]
+        [\fB-p \fIpriority\fB] [\fB-t \fItag\fR] [\fItext...\fR]
 .SH DESCRIPTION
 .ad
 .fi
diff --git a/postfix/man/man1/qshape.1 b/postfix/man/man1/qshape.1
index cd8b6350d..4badd4c02 100644
--- a/postfix/man/man1/qshape.1
+++ b/postfix/man/man1/qshape.1
@@ -12,7 +12,6 @@ Print Postfix queue domain and age distribution
 \fBqshape\fR [\fB-s\fR] [\fB-p\fR] [\fB-m \fImin_subdomains\fR]
         [\fB-b \fIbucket_count\fR] [\fB-t \fIbucket_time\fR]
         [\fB-l\fR] [\fB-w \fIterminal_width\fR]
-        [\fB-N \fIbatch_msg_count\fR] [\fB-n \fIbatch_top_domains\fR]
         [\fB-c \fIconfig_directory\fR] [\fIqueue_name\fR ...]
 .SH DESCRIPTION
 .ad
@@ -65,15 +64,6 @@ are shown with the prefix replaced by a '+' character. Truncated
 parent domain rows are shown as '.+' followed by the last 16 bytes
 of the domain name. If this is still too narrow to show the domain
 name and all the counters, the terminal_width limit is violated.
-.IP "\fB-N \fIbatch_msg_count\fR"
-When the output device is a terminal, intermediate results are
-shown each "batch_msg_count" messages. This produces usable results
-in a reasonable time even when the deferred queue is large. The
-default is to show intermediate results every 1000 messages.
-.IP "\fB-n \fIbatch_top_domains\fR"
-When reporting intermediate or final results to a termainal, report
-only the top "batch_top_domains" domains. The default limit is 20
-domains.
 .IP "\fB-c \fIconfig_directory\fR"
 The \fBmain.cf\fR configuration file is in the named directory
 instead of the default configuration directory.
diff --git a/postfix/man/man1/sendmail.1 b/postfix/man/man1/sendmail.1
index 04ba044f9..0b88eca36 100644
--- a/postfix/man/man1/sendmail.1
+++ b/postfix/man/man1/sendmail.1
@@ -230,7 +230,7 @@ Log mailer traffic. Use the \fBdebug_peer_list\fR and
 .ad
 .fi
 By design, this program is not set-user (or group) id. However,
-it must handle data from untrusted, possibly remote, users.
+it must handle data from untrusted users or untrusted machines.
 Thus, the usual precautions need to be taken against malicious
 inputs.
 .SH DIAGNOSTICS
diff --git a/postfix/man/man5/access.5 b/postfix/man/man5/access.5
index 6db6bf701..ad4f084a4 100644
--- a/postfix/man/man5/access.5
+++ b/postfix/man/man5/access.5
@@ -4,7 +4,7 @@
 .SH NAME
 access
 \-
-Postfix SMTP server access table
+Postfix access table format
 .SH "SYNOPSIS"
 .na
 .nf
@@ -16,28 +16,29 @@ Postfix SMTP server access table
 .SH DESCRIPTION
 .ad
 .fi
-This document describes access control on remote SMTP client
-information: host names, network addresses, and envelope
-sender or recipient addresses; it is implemented by the
-Postfix SMTP server.  See \fBheader_checks\fR(5) or
-\fBbody_checks\fR(5) for access control on the content of
-email messages.
+The optional \fBaccess\fR(5) table directs the Postfix SMTP server
+to selectively reject or accept mail. Access can be allowed or
+denied for specific host names, domain names, networks, host
+addresses or mail addresses.
+
+For an example, see the EXAMPLE section at the end of this
+manual page.
 
 Normally, the \fBaccess\fR(5) table is specified as a text file
 that serves as input to the \fBpostmap\fR(1) command.
 The result, an indexed file in \fBdbm\fR or \fBdb\fR format,
-is used for fast searching by the mail system. Execute the
-command "\fBpostmap /etc/postfix/access\fR" to rebuild an
-indexed file after changing the corresponding text file.
+is used for fast searching by the mail system. Execute the command
+"\fBpostmap /etc/postfix/access\fR" in order to rebuild the indexed
+file after changing the access table.
 
 When the table is provided via other means such as NIS, LDAP
 or SQL, the same lookups are done as for ordinary indexed files.
 
 Alternatively, the table can be provided as a regular-expression
 map where patterns are given as regular expressions, or lookups
-can be directed to TCP-based server. In those cases, the lookups
-are done in a slightly different way as described below under
-"REGULAR EXPRESSION TABLES" or "TCP-BASED TABLES".
+can be directed to TCP-based server. In that case, the lookups are
+done in a slightly different way as described below under
+"REGULAR EXPRESSION TABLES" and "TCP-BASED TABLES".
 .SH "CASE FOLDING"
 .na
 .nf
@@ -127,9 +128,9 @@ Subnetworks are matched by repeatedly truncating the last
 match is found in the access table, or until further
 truncation is not possible.
 
-NOTE 1: The access map lookup key must be in canonical form:
-do not specify unnecessary null characters, and do not
-enclose network address information with "[]" characters.
+NOTE 1: The information in the access map should be in
+canonical form, with unnecessary null characters eliminated.
+Address information must not be enclosed with "[]" characters.
 
 NOTE 2: use the \fBcidr\fR lookup table type to specify
 network/netmask patterns. See \fBcidr_table\fR(5) for details.
@@ -150,9 +151,9 @@ NOTE 1: the truncation and comparison are done with the
 string representation of the IPv6 host address. Thus, not
 all the ":" subnetworks will be tried.
 
-NOTE 2: The access map lookup key must be in canonical form:
-do not specify unnecessary null characters, and do not
-enclose network address information with "[]" characters.
+NOTE 2: The information in the access map should be in
+canonical form, with unnecessary null characters eliminated.
+Address information must not be enclosed with "[]" characters.
 
 NOTE 3: use the \fBcidr\fR lookup table type to specify
 network/netmask patterns. See \fBcidr_table\fR(5) for details.
@@ -194,8 +195,7 @@ Reject the address etc. that matches the pattern. Reply with
 specified, otherwise reply with a generic error response message.
 .IP "\fBDEFER_IF_REJECT \fIoptional text...\fR
 Defer the request if some later restriction would result in a
-REJECT action. Reply with "\fB450 4.7.1 \fI optional
-text...\fR when the
+REJECT action. Reply with "\fB450\fI optional text...\fR when the
 optional text is specified, otherwise reply with a generic error
 response message.
 .sp
@@ -203,7 +203,7 @@ This feature is available in Postfix 2.1 and later.
 .IP "\fBDEFER_IF_PERMIT \fIoptional text...\fR
 Defer the request if some later restriction would result in a
 an explicit or implicit PERMIT action.
-Reply with "\fB450 4.7.1 \fI optional text...\fR when the
+Reply with "\fB450\fI optional text...\fR when the
 optional text is specified, otherwise reply with a generic error
 response message.
 .sp
@@ -239,7 +239,7 @@ syntax is described in the \fBtransport\fR(5) manual page.
 More information
 about external content filters is in the Postfix FILTER_README file.
 .sp
-Note: this action overrides the \fBcontent_filter\fR setting,
+Note: this action overrides the \fBmain.cf content_filter\fR setting,
 and currently affects all recipients of the message.
 .sp
 This feature is available in Postfix 2.0 and later.
@@ -255,21 +255,20 @@ the \fBpostsuper\fR(1) command.
 .sp
 Note: use "\fBpostsuper -r\fR" to release mail that was kept on
 hold for a significant fraction of \fB$maximal_queue_lifetime\fR
-or \fB$bounce_queue_lifetime\fR, or longer. Use "\fBpostsuper -H\fR"
-only for mail that will not expire within a few delivery attempts.
+or \fB$bounce_queue_lifetime\fR, or longer.
 .sp
 Note: this action currently affects all recipients of the message.
 .sp
 This feature is available in Postfix 2.0 and later.
 .IP "\fBPREPEND \fIheadername: headervalue\fR"
 Prepend the specified message header to the message.
-When more than one PREPEND action executes, the first
-prepended header appears before the second etc. prepended
-header.
+When this action is used multiple times, the first prepended
+header appears before the second etc. prepended header.
+.sp
+Note: this action does not support multi-line message headers.
 .sp
-Note: this action must execute before the message content
-is received; it cannot execute in the context of
-\fBsmtpd_end_of_data_restrictions\fR.
+Note: this action must be used before the message content
+is received; it cannot be used in \fBsmtpd_end_of_data_restrictions\fR.
 .sp
 This feature is available in Postfix 2.1 and later.
 .IP "\fBREDIRECT \fIuser@domain\fR"
@@ -341,7 +340,7 @@ pattern can be interpolated as \fB$1\fR, \fB$2\fR and so on.
 This section describes how the table lookups change when lookups
 are directed to a TCP-based server. For a description of the TCP
 client/server lookup protocol, see \fBtcp_table\fR(5).
-This feature is not available up to and including Postfix version 2.4.
+This feature is not available up to and including Postfix version 2.3.
 
 Each lookup operation uses the entire query string once.
 Depending on the application, that string is an entire client
diff --git a/postfix/man/man5/aliases.5 b/postfix/man/man5/aliases.5
index 05ca24b90..7f067da6c 100644
--- a/postfix/man/man5/aliases.5
+++ b/postfix/man/man5/aliases.5
@@ -75,8 +75,8 @@ quotes. See \fBlocal\fR(8) for details of delivery to command.
 When the command fails, a limited amount of command output is
 mailed back to the sender.  The file \fB/usr/include/sysexits.h\fR
 defines the expected exit status codes. For example, use
-\fB"|exit 67"\fR to simulate a "user unknown" error, and
-\fB"|exit 0"\fR to implement an expensive black hole.
+\fB|"exit 67"\fR to simulate a "user unknown" error, and
+\fB|"exit 0"\fR to implement an expensive black hole.
 .IP \fB:include:\fI/file/name\fR
 Mail is sent to the destinations listed in the named file.
 Lines in \fB:include:\fR files have the same syntax
diff --git a/postfix/man/man5/bounce.5 b/postfix/man/man5/bounce.5
index 25bbfda41..4c6215ab3 100644
--- a/postfix/man/man5/bounce.5
+++ b/postfix/man/man5/bounce.5
@@ -32,8 +32,7 @@ bounce template formats.
 .nf
 .ad
 .fi
-To create a customized bounce template file, create a
-temporary
+To create customized bounce template file, create a temporary
 copy of the file \fB/etc/postfix/bounce.cf.default\fR and
 edit the temporary file.
 
diff --git a/postfix/man/man5/canonical.5 b/postfix/man/man5/canonical.5
index 6f1083051..1faefbca7 100644
--- a/postfix/man/man5/canonical.5
+++ b/postfix/man/man5/canonical.5
@@ -25,17 +25,17 @@ Normally, the \fBcanonical\fR(5) table is specified as a text file
 that serves as input to the \fBpostmap\fR(1) command.
 The result, an indexed file in \fBdbm\fR or \fBdb\fR format,
 is used for fast searching by the mail system. Execute the command
-"\fBpostmap /etc/postfix/canonical\fR" to rebuild an indexed
-file after changing the corresponding text file.
+"\fBpostmap /etc/postfix/canonical\fR" in order to rebuild the indexed
+file after changing the text file.
 
 When the table is provided via other means such as NIS, LDAP
 or SQL, the same lookups are done as for ordinary indexed files.
 
 Alternatively, the table can be provided as a regular-expression
 map where patterns are given as regular expressions, or lookups
-can be directed to TCP-based server. In those cases, the lookups
-are done in a slightly different way as described below under
-"REGULAR EXPRESSION TABLES" or "TCP-BASED TABLES".
+can be directed to TCP-based server. In that case, the lookups are
+done in a slightly different way as described below under
+"REGULAR EXPRESSION TABLES" and "TCP-BASED TABLES".
 
 By default the \fBcanonical\fR(5) mapping affects both message
 header addresses (i.e. addresses that appear inside messages)
@@ -55,9 +55,10 @@ names by \fIFirstname.Lastname\fR, or to clean up addresses produced
 by legacy mail systems.
 
 The \fBcanonical\fR(5) mapping is not to be confused with \fIvirtual
-alias\fR support or with local aliasing. To change the destination
-but not the headers, use the \fBvirtual\fR(5) or \fBaliases\fR(5)
-map instead.
+domain\fR support. Use the \fBvirtual\fR(5) map for that purpose.
+
+The \fBcanonical\fR(5) mapping is not to be confused with local aliasing.
+Use the \fBaliases\fR(5) map for that purpose.
 .SH "CASE FOLDING"
 .na
 .nf
@@ -108,13 +109,6 @@ This form is useful for replacing login names by
 .IP "@\fIdomain address\fR"
 Replace other addresses in \fIdomain\fR by \fIaddress\fR.
 This form has the lowest precedence.
-.sp
-Note: @\fIdomain\fR is a wild-card. When this form is applied
-to recipient addresses, the Postfix SMTP server accepts
-mail for any recipient in \fIdomain\fR, regardless of whether
-that recipient exists.  This may turn your mail system into
-a backscatter source that returns undeliverable spam to
-innocent people.
 .SH "RESULT ADDRESS REWRITING"
 .na
 .nf
@@ -172,7 +166,7 @@ pattern can be interpolated as \fB$1\fR, \fB$2\fR and so on.
 This section describes how the table lookups change when lookups
 are directed to a TCP-based server. For a description of the TCP
 client/server lookup protocol, see \fBtcp_table\fR(5).
-This feature is not available up to and including Postfix version 2.4.
+This feature is not available up to and including Postfix version 2.3.
 
 Each lookup operation uses the entire address once.  Thus,
 \fIuser@domain\fR mail addresses are not broken up into their
diff --git a/postfix/man/man5/cidr_table.5 b/postfix/man/man5/cidr_table.5
index 576619465..30504a406 100644
--- a/postfix/man/man5/cidr_table.5
+++ b/postfix/man/man5/cidr_table.5
@@ -17,10 +17,7 @@ format of Postfix CIDR tables
 The Postfix mail system uses optional lookup tables.
 These tables are usually in \fBdbm\fR or \fBdb\fR format.
 Alternatively, lookup tables can be specified in CIDR
-(Classless Inter-Domain Routing) form. In this case, each
-input is compared against a list of patterns. When a match
-is found, the corresponding result is returned and the search
-is terminated.
+(Classless Inter-Domain Routing) form.
 
 To find out what types of lookup tables your Postfix system
 supports use the "\fBpostconf -m\fR" command.
@@ -48,7 +45,7 @@ are converted from string to binary. Therefore table entries
 will be matched regardless of redundant zero characters.
 
 Note: address information may be enclosed inside "[]" but
-this form is not required.
+this form is not recommended.
 
 IPv6 support is available in Postfix 2.2 and later.
 .IP "\fInetwork_address     result\fR"
@@ -102,6 +99,7 @@ DATABASE_README, Postfix lookup table overview
 .nf
 The CIDR table lookup code was originally written by:
 Jozsef Kadlecsik
+kadlec@blackhole.kfki.hu
 KFKI Research Institute for Particle and Nuclear Physics
 POB. 49
 1525 Budapest, Hungary
diff --git a/postfix/man/man5/generic.5 b/postfix/man/man5/generic.5
index 32e310197..e0ec31a84 100644
--- a/postfix/man/man5/generic.5
+++ b/postfix/man/man5/generic.5
@@ -39,7 +39,7 @@ text file that serves as input to the \fBpostmap\fR(1)
 command.  The result, an indexed file in \fBdbm\fR or
 \fBdb\fR format, is used for fast searching by the mail
 system. Execute the command "\fBpostmap /etc/postfix/generic\fR"
-to rebuild an indexed file after changing the corresponding
+in order to rebuild the indexed file after changing the
 text file.
 
 When the table is provided via other means such as NIS, LDAP
@@ -47,9 +47,9 @@ or SQL, the same lookups are done as for ordinary indexed files.
 
 Alternatively, the table can be provided as a regular-expression
 map where patterns are given as regular expressions, or lookups
-can be directed to TCP-based server. In those case, the lookups
-are done in a slightly different way as described below under
-"REGULAR EXPRESSION TABLES" or "TCP-BASED TABLES".
+can be directed to TCP-based server. In that case, the lookups are
+done in a slightly different way as described below under
+"REGULAR EXPRESSION TABLES" and "TCP-BASED TABLES".
 .SH "CASE FOLDING"
 .na
 .nf
@@ -150,7 +150,7 @@ pattern can be interpolated as \fB$1\fR, \fB$2\fR and so on.
 This section describes how the table lookups change when lookups
 are directed to a TCP-based server. For a description of the TCP
 client/server lookup protocol, see \fBtcp_table\fR(5).
-This feature is not available up to and including Postfix version 2.4.
+This feature is not available up to and including Postfix version 2.3.
 
 Each lookup operation uses the entire address once.  Thus,
 \fIuser@domain\fR mail addresses are not broken up into their
diff --git a/postfix/man/man5/header_checks.5 b/postfix/man/man5/header_checks.5
index 0446aaa24..ada401686 100644
--- a/postfix/man/man5/header_checks.5
+++ b/postfix/man/man5/header_checks.5
@@ -4,7 +4,7 @@
 .SH NAME
 header_checks
 \-
-Postfix built-in content inspection
+Postfix built-in header/body inspection
 .SH "SYNOPSIS"
 .na
 .nf
@@ -16,23 +16,17 @@ Postfix built-in content inspection
 .br
 \fBbody_checks = pcre:/etc/postfix/body_checks\fR
 .sp
-\fBpostmap -q "\fIstring\fB" pcre:/etc/postfix/\fIfilename\fR
+\fBpostmap -fq "\fIstring\fB" pcre:/etc/postfix/\fIfilename\fR
 .br
-\fBpostmap -q - pcre:/etc/postfix/\fIfilename\fR <\fIinputfile\fR
+\fBpostmap -fq - pcre:/etc/postfix/\fIfilename\fR <\fIinputfile\fR
 .SH DESCRIPTION
 .ad
 .fi
-This document describes access control on the content of
-message headers and message body lines; it is implemented
-by the Postfix cleanup(8) server before mail is queued.
-See \fBaccess\fR(5) for access control on remote SMTP client
-information.
-
-Each message header or message body line is compared against
-a list of patterns.
-When a match is found the corresponding action is executed, and
-the matching process is repeated for the next message header or
-message body line.
+Postfix provides a simple built-in content inspection mechanism that
+examines incoming mail one message header or one message body line
+at a time. Each input is compared against a list of patterns, and
+when a match is found the corresponding action is executed.
+This feature is implemented by the Postfix \fBcleanup\fR(8) server.
 
 For examples, see the EXAMPLES section at the end of this
 manual page.
@@ -93,17 +87,16 @@ execute the corresponding \fIaction\fR.
 .IP "\fBif /\fIpattern\fB/\fIflags\fR"
 .IP "\fBendif\fR"
 Match the input string against the patterns between \fBif\fR
-and \fBendif\fR, if and only if the same input string also
-matches \fIpattern\fR. The \fBif\fR..\fBendif\fR can nest.
+and \fBendif\fR, if and only if the input string also matches
+\fIpattern\fR. The \fBif\fR..\fBendif\fR can nest.
 .sp
 Note: do not prepend whitespace to patterns inside
 \fBif\fR..\fBendif\fR.
 .IP "\fBif !/\fIpattern\fB/\fIflags\fR"
 .IP "\fBendif\fR"
 Match the input string against the patterns between \fBif\fR
-and \fBendif\fR, if and only if the same input string does
-\fBnot\fR match \fIpattern\fR. The \fBif\fR..\fBendif\fR
-can nest.
+and \fBendif\fR, if and only if the input string does \fBnot\fR
+match \fIpattern\fR. The \fBif\fR..\fBendif\fR can nest.
 .IP "blank lines and comments"
 Empty lines and whitespace-only lines are ignored, as
 are lines whose first non-whitespace character is a `#'.
@@ -161,13 +154,13 @@ For backwards compatibility reasons, Postfix also accepts
 .sp
 This feature is available in Postfix 2.1 and later.
 .IP "\fBFILTER \fItransport:destination\fR"
-Write a content filter request to the queue file, and
+Write a content filter request to the queue file and
 inspect the next input line.
 After the complete message is received it will be sent through
 the specified external content filter.  More information about
 external content filters is in the Postfix FILTER_README file.
 .sp
-Note: this action overrides the \fBcontent_filter\fR setting,
+Note: this action overrides the \fBmain.cf content_filter\fR setting,
 and affects all recipients of the message. In the case that multiple
 \fBFILTER\fR actions fire, only the last one is executed.
 .sp
@@ -185,17 +178,16 @@ the \fBpostsuper\fR(1) command.
 .sp
 Note: use "\fBpostsuper -r\fR" to release mail that was kept on
 hold for a significant fraction of \fB$maximal_queue_lifetime\fR
-or \fB$bounce_queue_lifetime\fR, or longer. Use "\fBpostsuper -H\fR"
-only for mail that will not expire within a few delivery attempts.
+or \fB$bounce_queue_lifetime\fR, or longer.
 .sp
 Note: this action affects all recipients of the message.
 .sp
 This feature is available in Postfix 2.0 and later.
 .IP \fBIGNORE\fR
-Delete the current line from the input, and inspect
+Delete the current line from the input and inspect
 the next input line.
 .IP "\fBPREPEND \fItext...\fR"
-Prepend one line with the specified text, and inspect the next
+Prepend one line with the specified text and inspect the next
 input line.
 .sp
 Notes:
@@ -217,7 +209,7 @@ This action cannot be used to prepend multi-line text.
 .IP
 This feature is available in Postfix 2.1 and later.
 .IP "\fBREDIRECT \fIuser@domain\fR"
-Write a message redirection request to the queue file, and
+Write a message redirection request to the queue file and
 inspect the next input line. After the message is queued,
 it will be sent to the specified address instead of the
 intended recipient(s).
@@ -228,7 +220,7 @@ fire, only the last one is executed.
 .sp
 This feature is available in Postfix 2.1 and later.
 .IP "\fBREPLACE \fItext...\fR"
-Replace the current line with the specified text, and inspect the next
+Replace the current line with the specified text and inspect the next
 input line.
 .sp
 This feature is available in Postfix 2.2 and later. The
@@ -259,27 +251,21 @@ text...\fR, Postfix inserts a default enhanced status code of
 "5.7.1".
 .IP "\fBWARN \fIoptional text...\fR
 Log a warning with the \fIoptional text...\fR (or log a
-generic message), and inspect the next input line. This
+generic message) and inspect the next input line. This
 action is useful for debugging and for testing a pattern
 before applying more drastic actions.
 .SH BUGS
 .ad
 .fi
 Many people overlook the main limitations of header and body_checks
-rules.
-.IP \(bu
-These rules operate on one logical message header or one body
-line at a time. A decision made for one line is not carried over
-to the next line.
-.IP \(bu
-If text in the message body is encoded
+rules.  These rules operate on one logical message header or one body
+line at a time, and a decision made for one line is not carried over
+to the next line.  If text in the message body is encoded
 (RFC 2045) then the rules have to specified for the encoded
-form.
-.IP \(bu
-Likewise, when message headers are encoded (RFC
+form.  Likewise, when message headers are encoded (RFC
 2047) then the rules need to be specified for the encoded
 form.
-.PP
+
 Message headers added by the \fBcleanup\fR(8) daemon itself
 are excluded from inspection. Examples of such message headers
 are \fBFrom:\fR, \fBTo:\fR, \fBMessage-ID:\fR, \fBDate:\fR.
diff --git a/postfix/man/man5/ldap_table.5 b/postfix/man/man5/ldap_table.5
index d183e9586..4e22f4987 100644
--- a/postfix/man/man5/ldap_table.5
+++ b/postfix/man/man5/ldap_table.5
@@ -22,7 +22,6 @@ Alternatively, lookup tables can be specified as LDAP databases.
 
 In order to use LDAP lookups, define an LDAP source as a lookup
 table in main.cf, for example:
-
 .ti +4
 alias_maps = ldap:/etc/postfix/ldap-aliases.cf
 
@@ -88,7 +87,6 @@ an arbitrary value. With LDAP databases it is not uncommon to
 return the key itself.
 
 For example, NEVER do this in a map defining $mydestination:
-
 .in +4
 query_filter = domain=*
 .br
@@ -96,7 +94,6 @@ result_attribute = domain
 .in -4
 
 Do this instead:
-
 .in +4
 query_filter = domain=%s
 .br
@@ -113,7 +110,6 @@ Postfix configuration routines understand how to deal with quoted
 strings.
 .IP "\fBserver_host (default: localhost)\fR"
 The name of the host running the LDAP server, e.g.
-
 .ti +4
 server_host = ldap.example.com
 
@@ -122,13 +118,11 @@ be possible to specify multiple servers here, with the library
 trying them in order should the first one fail. It should also
 be possible to give each server in the list a different port
 (overriding \fBserver_port\fR below), by naming them like
-
 .ti +4
 server_host = ldap.example.com:1444
 
 With OpenLDAP, a (list of) LDAP URLs can be used to specify both
 the hostname(s) and the port(s):
-
 .ti +4
 server_host = ldap://ldap.example.com:1444
 .ti +8
@@ -138,24 +132,20 @@ All LDAP URLs accepted by the OpenLDAP library are supported,
 including connections over UNIX domain sockets, and LDAP SSL
 (the last one provided that OpenLDAP was compiled with support
 for SSL):
-
 .ti +4
 server_host = ldapi://%2Fsome%2Fpath
 .ti +8
         ldaps://ldap.example.com:636
 .IP "\fBserver_port (default: 389)\fR"
 The port the LDAP server listens on, e.g.
-
 .ti +4
 server_port = 778
 .IP "\fBtimeout (default: 10 seconds)\fR"
 The number of seconds a search can take before timing out, e.g.
-
 .ti +4
 timeout = 5
 .IP "\fBsearch_base (No default; you must configure this)\fR"
 The RFC2253 base DN at which to conduct the search, e.g.
-
 .ti +4
 search_base = dc=your, dc=com
 .IP
@@ -198,7 +188,6 @@ no results.
 The RFC2254 filter used to search the directory, where \fB%s\fR
 is a substitute for the address Postfix is trying to resolve,
 e.g.
-
 .ti +4
 query_filter = (&(mail=%s)(paid_up=true))
 
@@ -236,7 +225,7 @@ most significant component of the input key's domain. If the
 input key is \fIuser@mail.example.com\fR, then %1 is \fBcom\fR,
 %2 is \fBexample\fR and %3 is \fBmail\fR. If the input key is
 unqualified or does not have enough domain components to satisfy
-all the specified patterns, the search is suppressed and returns
+all the specified patterns, the saerch is suppressed and returns
 no results.
 .IP
 The above %1, ..., %9 expansions are available with Postfix 2.2
@@ -308,7 +297,6 @@ keys with a *non-empty* localpart and a matching domain
 are eligible for lookup: 'user' lookups, bare domain lookups
 and "@domain" lookups are not performed. This can significantly
 reduce the query load on the LDAP server.
-
 .ti +4
 domain = postfix.org, hash:/etc/postfix/searchdomains
 
@@ -322,16 +310,14 @@ This feature is available in Postfix 1.0 and later.
 The attribute(s) Postfix will read from any directory
 entries returned by the lookup, to be resolved to an email
 address.
-
 .ti +4
 result_attribute = mailbox, maildrop
-.IP "\fBspecial_result_attribute (default: empty)\fR"
+.IP "\fBspecial_result_attribute (No default)\fR"
 The attribute(s) of directory entries that can contain DNs
 or URLs. If found, a recursive subsequent search is done
 using their values.
-
 .ti +4
-special_result_attribute = memberdn
+special_result_attribute = member
 
 DN recursion retrieves the same result_attributes as the
 main query, including the special attributes for further
@@ -340,47 +326,6 @@ that are included in the URI definition and are *also*
 listed in "result_attribute". If the URI lists any of the
 map's special result attributes, these are also retrieved
 and used recursively.
-.IP "\fBterminal_result_attribute (default: empty)\fR"
-When one or more terminal result attributes are found in an LDAP
-entry, all other result attributes are ignored and only the terminal
-result attributes are returned. This is useful for delegating expansion
-of group members to a particular host, by using an optional "maildrop"
-attribute on selected groups to route the group to a specific host,
-where the group is expanded, possibly via mailing-list manager or
-other special processing.
-
-.ti +4
-terminal_result_attribute = maildrop
-
-This feature is available with Postfix 2.4 or later.
-.IP "\fBleaf_result_attribute (default: empty)\fR"
-When one or more special result attributes are found in a non-terminal
-(see above) LDAP entry, leaf result attributes are excluded from the
-expansion of that entry. This is useful when expanding groups and the
-desired mail address attribute(s) of the member objects obtained via
-DN or URI recursion are also present in the group object. To only
-return the attribute values from the leaf objects and not the
-containing group, add the attribute to the leaf_result_attribute list,
-and not the result_attribute list, which is always expanded. Note,
-the default value of "result_attribute" is not empty, you may want to
-set it explicitly empty when using "leaf_result_attribute" to expand
-the group to a list of member DN addresses. If groups have both
-member DN references AND attributes that hold multiple string valued
-rfc822 addresses, then the string attributes go in "result_attribute".
-The attributes that represent the email addresses of objects
-referenced via a DN (or LDAP URI) go in "leaf_result_attribute".
-
-.in +4
-result_attribute = memberaddr
-.br
-special_result_attribute = memberdn
-.br
-terminal_result_attribute = maildrop
-.br
-leaf_result_attribute = mail
-.in -4
-
-This feature is available with Postfix 2.4 or later.
 .IP "\fBscope (default: sub)\fR"
 The LDAP search scope: \fBsub\fR, \fBbase\fR, or \fBone\fR.
 These translate into LDAP_SCOPE_SUBTREE, LDAP_SCOPE_BASE,
@@ -389,7 +334,6 @@ and LDAP_SCOPE_ONELEVEL.
 Whether or not to bind to the LDAP server. Newer LDAP
 implementations don't require clients to bind, which saves
 time. Example:
-
 .ti +4
 bind = no
 
@@ -402,7 +346,6 @@ should prevent the password from traversing the network in
 the clear.
 .IP "\fBbind_dn (default: empty)\fR"
 If you do have to bind, do it with this distinguished name. Example:
-
 .ti +4
 bind_dn = uid=postfix, dc=your, dc=com
 .IP "\fBbind_pw (default: empty)\fR"
@@ -414,7 +357,6 @@ main.cf, it is not possible to securely store the bind
 password. This is because main.cf needs to be world readable
 to allow local accounts to submit mail via the sendmail
 command. Example:
-
 .ti +4
 bind_pw = postfixpw
 .IP "\fBcache (IGNORED with a warning)\fR"
@@ -484,18 +426,15 @@ issue the STARTTLS command.
 
 LDAP SSL service can be requested by using a LDAP SSL URL
 in the server_host parameter:
-
 .ti +4
 server_host = ldaps://ldap.example.com:636
 
 STARTTLS can be turned on with the start_tls parameter:
-
 .ti +4
 start_tls = yes
 
 Both forms require LDAP protocol version 3, which has to be set
 explicitly with:
-
 .ti +4
 version = 3
 
@@ -549,23 +488,21 @@ Cipher suite to use in SSL/TLS negotiations.
 Here's a basic example for using LDAP to look up local(8)
 aliases.
 Assume that in main.cf, you have:
-
 .ti +4
 alias_maps = hash:/etc/aliases,
 .ti +8
 ldap:/etc/postfix/ldap-aliases.cf
 
 and in ldap:/etc/postfix/ldap-aliases.cf you have:
-
 .in +4
-server_host = ldap.example.com
+server_host = ldap.my.com
 .br
-search_base = dc=example, dc=com
+search_base = dc=my, dc=com
 .in -4
 
 Upon receiving mail for a local address "ldapuser" that
 isn't found in the /etc/aliases database, Postfix will
-search the LDAP server listening at port 389 on ldap.example.com.
+search the LDAP server listening at port 389 on ldap.my.com.
 It will bind anonymously, search for any directory entries
 whose mailacceptinggeneralid attribute is "ldapuser", read
 the "maildrop" attributes of those found, and build a list
diff --git a/postfix/man/man5/nisplus_table.5 b/postfix/man/man5/nisplus_table.5
index bddb669f2..e8a6716b3 100644
--- a/postfix/man/man5/nisplus_table.5
+++ b/postfix/man/man5/nisplus_table.5
@@ -93,6 +93,8 @@ Hinxton
 Cambridge
 CB10 1SB, UK
 
+Based on the NIS client code:
+
 Adopted and adapted by:
 Wietse Venema
 IBM T.J. Watson Research
diff --git a/postfix/man/man5/pcre_table.5 b/postfix/man/man5/pcre_table.5
index 9cb05a0a1..dc2cb3dfa 100644
--- a/postfix/man/man5/pcre_table.5
+++ b/postfix/man/man5/pcre_table.5
@@ -8,9 +8,9 @@ format of Postfix PCRE tables
 .SH "SYNOPSIS"
 .na
 .nf
-\fBpostmap -q "\fIstring\fB" pcre:/etc/postfix/\fIfilename\fR
+\fBpostmap -fq "\fIstring\fB" pcre:/etc/postfix/\fIfilename\fR
 
-\fBpostmap -q - pcre:/etc/postfix/\fIfilename\fR <\fIinputfile\fR
+\fBpostmap -fq - pcre:/etc/postfix/\fIfilename\fR <\fIinputfile\fR
 .SH DESCRIPTION
 .ad
 .fi
@@ -20,22 +20,14 @@ rewriting or mail routing. These tables are usually in
 
 Alternatively, lookup tables can be specified in Perl Compatible
 Regular Expression form. In this case, each input is compared
-against a list of patterns. When a match is found, the
-corresponding result is returned and the search is terminated.
+against a list of patterns, and when a match is found the
+corresponding result is returned.
 
 To find out what types of lookup tables your Postfix system
 supports use the "\fBpostconf -m\fR" command.
 
-To test lookup tables, use the "\fBpostmap -q\fR" command as
+To test lookup tables, use the "\fBpostmap -fq\fR" command as
 described in the SYNOPSIS above.
-.SH "COMPATIBILITY"
-.na
-.nf
-.ad
-.fi
-With Postfix version 2.2 and earlier specify "\fBpostmap
--fq\fR" to query a table that contains case sensitive
-patterns. Patterns are case insensitive by default.
 .SH "TABLE FORMAT"
 .na
 .nf
diff --git a/postfix/man/man5/postconf.5 b/postfix/man/man5/postconf.5
index 7d56391ad..0894e6a06 100644
--- a/postfix/man/man5/postconf.5
+++ b/postfix/man/man5/postconf.5
@@ -368,8 +368,8 @@ generates itself.
 The time unit over which client connection rates and other rates
 are calculated.
 .PP
-This feature is implemented by the \fBanvil\fR(8) service which is available
-in Postfix version 2.2 and later.
+This feature is implemented by the \fBanvil\fR(8) service which is not
+part of the stable Postfix version 2.1 release.
 .PP
 The default interval is relatively short. Because of the high
 frequency of updates, the \fBanvil\fR(8) server uses volatile memory
@@ -1104,9 +1104,9 @@ precision.
 .PP
 The format of the "delays=a/b/c/d" logging is as follows:
 .IP \(bu
-a = time from message arrival to last active queue entry
+a = time before the queue manager, including message transmission
 .IP \(bu
-b = time from last active queue entry to connection setup
+b = time in queue manager
 .IP \(bu
 c = time in connection setup, including DNS, EHLO and TLS
 .IP \(bu
@@ -1530,7 +1530,7 @@ parameter also controls delivery of mail to user@[ip.address].
 Note 1: you need to stop and start Postfix when this parameter changes.
 .PP
 Note 2: address information may be enclosed inside [],
-but this form is not required here.
+but this form is not recommended here.
 .PP
 When inet_interfaces specifies just one IPv4 and/or IPv6 address
 that is not a loopback address, the Postfix SMTP client will use
@@ -1805,7 +1805,7 @@ details. The table is not indexed by hostname for consistency with
 smtpd_discard_ehlo_keyword_address_maps.
 .PP
 This feature is available in Postfix 2.3 and later.
-.SH lmtp_discard_lhlo_keywords (default: empty)
+.SH lmtp_discard_lhlo_keywords (default: $myhostname)
 A case insensitive list of LHLO keywords (pipelining, starttls,
 auth, etc.) that the LMTP client will ignore in the LHLO response
 from a remote LMTP server.
@@ -2649,18 +2649,16 @@ masquerade_exceptions = root
 .ad
 .ft R
 .SH max_idle (default: 100s)
-The maximum amount of time that an idle Postfix daemon process waits
-for an incoming connection before terminating voluntarily.  This
-parameter
+The maximum amount of time that an idle Postfix daemon process
+waits for the next service request before exiting.  This parameter
 is ignored by the Postfix queue manager and by other long-lived
 Postfix daemon processes.
 .PP
 Time units: s (seconds), m (minutes), h (hours), d (days), w (weeks).
 The default time unit is s (seconds).
 .SH max_use (default: 100)
-The maximal number of incoming connections that a Postfix daemon
-process will service before terminating voluntarily.  This parameter
-is ignored by the Postfix queue
+The maximal number of connection requests before a Postfix daemon
+process terminates. This parameter is ignored by the Postfix queue
 manager and by other long-lived Postfix daemon processes.
 .SH maximal_backoff_time (default: 4000s)
 The maximal time between attempts to deliver a deferred message.
@@ -2850,13 +2848,14 @@ The maximal recursion level that the MIME processor will handle.
 Postfix refuses mail that is nested deeper than the specified limit.
 .PP
 This feature is available in Postfix 2.0 and later.
-.SH minimal_backoff_time (default: 300s)
-The minimal time between attempts to deliver a deferred message;
-prior to Postfix 2.4 the default value was 1000s.
-.PP
+.SH minimal_backoff_time (default: version dependent)
+The minimal time between attempts to deliver a deferred message.
 This parameter also limits the time an unreachable destination is
 kept in the short-term, in-memory, destination status cache.
 .PP
+With Postfix 2.4 the default value was reduced from 1000s to
+300s.
+.PP
 This parameter should be set greater than or equal to
 $queue_run_delay. See also $maximal_backoff_time.
 .PP
@@ -3305,9 +3304,10 @@ value that is at least 1.5*$message_size_limit.
 .PP
 With Postfix versions 2.0 and earlier, a queue_minfree value of
 zero means there is no minimum required amount of free space.
-.SH queue_run_delay (default: 300s)
-The time between deferred queue scans by the queue manager;
-prior to Postfix 2.4 the default value was 1000s.
+.SH queue_run_delay (default: version dependent)
+The time between deferred queue scans by the queue manager.
+.PP
+With Postfix 2.4 the default value was reduced from 1000s to 300s.
 .PP
 This parameter should be set less than or equal to
 $minimal_backoff_time. See also $maximal_backoff_time.
@@ -3543,10 +3543,7 @@ Do not change this unless you have a complete understanding of RFC 821.
 .SH relay_recipient_maps (default: empty)
 Optional lookup tables with all valid addresses in the domains
 that match $relay_domains. Specify @domain as a wild-card for
-domains that have no valid recipient list, and become a source of
-backscatter mail: Postfix accepts spam for non-existent recipients
-and then floods innocent people with undeliverable mail.  Technically,
-tables
+domains that do not have a valid recipient list. Technically, tables
 listed with $relay_recipient_maps are used as lists: Postfix needs
 to know only if a lookup string is found or not, but it does not
 use the result from table lookup.
@@ -3850,7 +3847,7 @@ IP hosting, but can be a problem on multi-homed firewalls. See the
 inet_interfaces documentation for more detail.
 .PP
 Note 2: address information may be enclosed inside [],
-but this form is not required here.
+but this form is not recommended here.
 .SH smtp_bind_address6 (default: empty)
 An optional numerical network address that the Postfix SMTP client
 should bind to when making an IPv6 connection.
diff --git a/postfix/man/man5/regexp_table.5 b/postfix/man/man5/regexp_table.5
index a08091071..43af5f38b 100644
--- a/postfix/man/man5/regexp_table.5
+++ b/postfix/man/man5/regexp_table.5
@@ -8,9 +8,9 @@ format of Postfix regular expression tables
 .SH "SYNOPSIS"
 .na
 .nf
-\fBpostmap -q "\fIstring\fB" regexp:/etc/postfix/\fIfilename\fR
+\fBpostmap -fq "\fIstring\fB" regexp:/etc/postfix/\fIfilename\fR
 
-\fBpostmap -q - regexp:/etc/postfix/\fIfilename\fR <\fIinputfile\fR
+\fBpostmap -fq - regexp:/etc/postfix/\fIfilename\fR <\fIinputfile\fR
 .SH DESCRIPTION
 .ad
 .fi
@@ -20,22 +20,14 @@ rewriting or mail routing. These tables are usually in
 
 Alternatively, lookup tables can be specified in POSIX regular
 expression form. In this case, each input is compared against a
-list of patterns. When a match is found, the corresponding
-result is returned and the search is terminated.
+list of patterns, and when a match is found the corresponding
+result is returned.
 
 To find out what types of lookup tables your Postfix system
 supports use the "\fBpostconf -m\fR" command.
 
-To test lookup tables, use the "\fBpostmap -q\fR" command
-as described in the SYNOPSIS above.
-.SH "COMPATIBILITY"
-.na
-.nf
-.ad
-.fi
-With Postfix version 2.2 and earlier specify "\fBpostmap
--fq\fR" to query a table that contains case sensitive
-patterns. Patterns are case insensitive by default.
+To test lookup tables, use the "\fBpostmap -fq\fR" command as
+described in the SYNOPSIS above.
 .SH "TABLE FORMAT"
 .na
 .nf
diff --git a/postfix/man/man5/relocated.5 b/postfix/man/man5/relocated.5
index ebfe3ee4a..e1d65a2d6 100644
--- a/postfix/man/man5/relocated.5
+++ b/postfix/man/man5/relocated.5
@@ -19,17 +19,17 @@ Normally, the \fBrelocated\fR(5) table is specified as a text file
 that serves as input to the \fBpostmap\fR(1) command.
 The result, an indexed file in \fBdbm\fR or \fBdb\fR format,
 is used for fast searching by the mail system. Execute the command
-"\fBpostmap /etc/postfix/relocated\fR" to rebuild an indexed
-file after changing the corresponding relocated table.
+"\fBpostmap /etc/postfix/relocated\fR" in order to rebuild the indexed
+file after changing the relocated table.
 
 When the table is provided via other means such as NIS, LDAP
 or SQL, the same lookups are done as for ordinary indexed files.
 
 Alternatively, the table can be provided as a regular-expression
 map where patterns are given as regular expressions, or lookups
-can be directed to TCP-based server. In those case, the lookups
-are done in a slightly different way as described below under
-"REGULAR EXPRESSION TABLES" or "TCP-BASED TABLES".
+can be directed to TCP-based server. In that case, the lookups are
+done in a slightly different way as described below under
+"REGULAR EXPRESSION TABLES" and "TCP-BASED TABLES".
 
 Table lookups are case insensitive.
 .SH "CASE FOLDING"
@@ -98,7 +98,7 @@ directed to a TCP-based server. For a description of regular
 expression lookup table syntax, see \fBregexp_table\fR(5) or
 \fBpcre_table\fR(5). For a description of the TCP client/server
 table lookup protocol, see \fBtcp_table\fR(5).
-This feature is not available up to and including Postfix version 2.4.
+This feature is not available up to and including Postfix version 2.3.
 
 Each pattern is a regular expression that is applied to the entire
 address being looked up. Thus, \fIuser@domain\fR mail addresses are not
@@ -119,7 +119,7 @@ pattern can be interpolated as \fB$1\fR, \fB$2\fR and so on.
 This section describes how the table lookups change when lookups
 are directed to a TCP-based server. For a description of the TCP
 client/server lookup protocol, see \fBtcp_table\fR(5).
-This feature is not available up to and including Postfix version 2.4.
+This feature is not available up to and including Postfix version 2.3.
 
 Each lookup operation uses the entire address once.  Thus,
 \fIuser@domain\fR mail addresses are not broken up into their
diff --git a/postfix/man/man5/transport.5 b/postfix/man/man5/transport.5
index 92a30338b..7283c334f 100644
--- a/postfix/man/man5/transport.5
+++ b/postfix/man/man5/transport.5
@@ -49,17 +49,17 @@ Normally, the \fBtransport\fR(5) table is specified as a text file
 that serves as input to the \fBpostmap\fR(1) command.
 The result, an indexed file in \fBdbm\fR or \fBdb\fR format, is used
 for fast searching by the mail system. Execute the command
-"\fBpostmap /etc/postfix/transport\fR" to rebuild an indexed
-file after changing the corresponding transport table.
+"\fBpostmap /etc/postfix/transport\fR" in order to rebuild the indexed
+file after changing the transport table.
 
 When the table is provided via other means such as NIS, LDAP
 or SQL, the same lookups are done as for ordinary indexed files.
 
 Alternatively, the table can be provided as a regular-expression
 map where patterns are given as regular expressions, or lookups
-can be directed to TCP-based server. In those case, the lookups
-are done in a slightly different way as described below under
-"REGULAR EXPRESSION TABLES" or "TCP-BASED TABLES".
+can be directed to TCP-based server. In that case, the lookups are
+done in a slightly different way as described below under
+"REGULAR EXPRESSION TABLES" and "TCP-BASED TABLES".
 .SH "CASE FOLDING"
 .na
 .nf
@@ -249,7 +249,7 @@ pattern can be interpolated as \fB$1\fR, \fB$2\fR and so on.
 This section describes how the table lookups change when lookups
 are directed to a TCP-based server. For a description of the TCP
 client/server lookup protocol, see \fBtcp_table\fR(5).
-This feature is not available up to and including Postfix version 2.4.
+This feature is not available up to and including Postfix version 2.3.
 
 Each lookup operation uses the entire recipient address once.  Thus,
 \fIsome.domain.hierarchy\fR is not looked up via its parent domains,
diff --git a/postfix/man/man5/virtual.5 b/postfix/man/man5/virtual.5
index 5c3cb1da2..7f7ee5f2f 100644
--- a/postfix/man/man5/virtual.5
+++ b/postfix/man/man5/virtual.5
@@ -45,17 +45,17 @@ Normally, the \fBvirtual\fR(5) alias table is specified as a text file
 that serves as input to the \fBpostmap\fR(1) command.
 The result, an indexed file in \fBdbm\fR or \fBdb\fR format,
 is used for fast searching by the mail system. Execute the command
-"\fBpostmap /etc/postfix/virtual\fR" to rebuild an indexed
-file after changing the corresponding text file.
+"\fBpostmap /etc/postfix/virtual\fR" in order to rebuild the indexed
+file after changing the text file.
 
 When the table is provided via other means such as NIS, LDAP
 or SQL, the same lookups are done as for ordinary indexed files.
 
 Alternatively, the table can be provided as a regular-expression
 map where patterns are given as regular expressions, or lookups
-can be directed to TCP-based server. In those case, the lookups
-are done in a slightly different way as described below under
-"REGULAR EXPRESSION TABLES" or "TCP-BASED TABLES".
+can be directed to TCP-based server. In that case, the lookups are
+done in a slightly different way as described below under
+"REGULAR EXPRESSION TABLES" and "TCP-BASED TABLES".
 .SH "CASE FOLDING"
 .na
 .nf
@@ -103,13 +103,6 @@ mapping can be applied to non-local addresses.
 .IP "@\fIdomain address, address, ...\fR"
 Redirect mail for other users in \fIdomain\fR to \fIaddress\fR.
 This form has the lowest precedence.
-.sp
-Note: @\fIdomain\fR is a wild-card. With this form, the
-Postfix SMTP server accepts
-mail for any recipient in \fIdomain\fR, regardless of whether
-that recipient exists.  This may turn your mail system into
-a backscatter source that returns undeliverable spam to
-innocent people.
 .SH "RESULT ADDRESS REWRITING"
 .na
 .nf
@@ -228,7 +221,7 @@ pattern can be interpolated as \fB$1\fR, \fB$2\fR and so on.
 This section describes how the table lookups change when lookups
 are directed to a TCP-based server. For a description of the TCP
 client/server lookup protocol, see \fBtcp_table\fR(5).
-This feature is not available up to and including Postfix version 2.4.
+This feature is not available up to and including Postfix version 2.3.
 
 Each lookup operation uses the entire address once.  Thus,
 \fIuser@domain\fR mail addresses are not broken up into their
diff --git a/postfix/man/man8/anvil.8 b/postfix/man/man8/anvil.8
index ba10373e6..f4aca61f2 100644
--- a/postfix/man/man8/anvil.8
+++ b/postfix/man/man8/anvil.8
@@ -193,8 +193,8 @@ count and/or rate limits falsely.
 
 In this preliminary implementation, a count (or rate) limited server
 can have only one remote client at a time. If a server reports
-multiple simultaneous clients, state is kept only for the last
-reported client.
+multiple simultaneous clients, all but the last reported client
+are ignored.
 
 The \fBanvil\fR(8) server automatically discards client
 request information after it expires.  To prevent the
@@ -230,11 +230,11 @@ request before it is terminated by a built-in watchdog timer.
 The time limit for sending or receiving information over an internal
 communication channel.
 .IP "\fBmax_idle (100s)\fR"
-The maximum amount of time that an idle Postfix daemon process waits
-for an incoming connection before terminating voluntarily.
+The maximum amount of time that an idle Postfix daemon process
+waits for the next service request before exiting.
 .IP "\fBmax_use (100)\fR"
-The maximal number of incoming connections that a Postfix daemon
-process will service before terminating voluntarily.
+The maximal number of connection requests before a Postfix daemon
+process terminates.
 .IP "\fBprocess_id (read-only)\fR"
 The process ID of a Postfix command or daemon process.
 .IP "\fBprocess_name (read-only)\fR"
diff --git a/postfix/man/man8/bounce.8 b/postfix/man/man8/bounce.8
index dfaa53a46..0e100933b 100644
--- a/postfix/man/man8/bounce.8
+++ b/postfix/man/man8/bounce.8
@@ -25,9 +25,8 @@ The \fBbounce\fR(8) daemon processes two types of service requests:
 Append a recipient (non-)delivery status record to a per-message
 log file.
 .IP \(bu
-Enqueue a delivery status notification message, with a copy
-of a per-message log file and of the corresponding message.
-When the delivery status notification message is
+Enqueue a bounce message, with a copy of a per-message log file
+and of the corresponding message. When the bounce message is
 enqueued successfully, the per-message log file is deleted.
 .PP
 The software does a best notification effort. A non-delivery
@@ -104,11 +103,11 @@ and body_checks.
 The mail system name that is displayed in Received: headers, in
 the SMTP greeting banner, and in bounced mail.
 .IP "\fBmax_idle (100s)\fR"
-The maximum amount of time that an idle Postfix daemon process waits
-for an incoming connection before terminating voluntarily.
+The maximum amount of time that an idle Postfix daemon process
+waits for the next service request before exiting.
 .IP "\fBmax_use (100)\fR"
-The maximal number of incoming connections that a Postfix daemon
-process will service before terminating voluntarily.
+The maximal number of connection requests before a Postfix daemon
+process terminates.
 .IP "\fBnotify_classes (resource, software)\fR"
 The list of error classes that are reported to the postmaster.
 .IP "\fBprocess_id (read-only)\fR"
diff --git a/postfix/man/man8/cleanup.8 b/postfix/man/man8/cleanup.8
index e6876820b..bf83d73c0 100644
--- a/postfix/man/man8/cleanup.8
+++ b/postfix/man/man8/cleanup.8
@@ -333,11 +333,11 @@ mail that is still queued.
 The time limit for sending or receiving information over an internal
 communication channel.
 .IP "\fBmax_idle (100s)\fR"
-The maximum amount of time that an idle Postfix daemon process waits
-for an incoming connection before terminating voluntarily.
+The maximum amount of time that an idle Postfix daemon process
+waits for the next service request before exiting.
 .IP "\fBmax_use (100)\fR"
-The maximal number of incoming connections that a Postfix daemon
-process will service before terminating voluntarily.
+The maximal number of connection requests before a Postfix daemon
+process terminates.
 .IP "\fBmyhostname (see 'postconf -d' output)\fR"
 The internet hostname of this mail system.
 .IP "\fBmyorigin ($myhostname)\fR"
diff --git a/postfix/man/man8/discard.8 b/postfix/man/man8/discard.8
index 7a9cd7dae..48256947b 100644
--- a/postfix/man/man8/discard.8
+++ b/postfix/man/man8/discard.8
@@ -74,11 +74,11 @@ by the mail system.
 The time limit for sending or receiving information over an internal
 communication channel.
 .IP "\fBmax_idle (100s)\fR"
-The maximum amount of time that an idle Postfix daemon process waits
-for an incoming connection before terminating voluntarily.
+The maximum amount of time that an idle Postfix daemon process
+waits for the next service request before exiting.
 .IP "\fBmax_use (100)\fR"
-The maximal number of incoming connections that a Postfix daemon
-process will service before terminating voluntarily.
+The maximal number of connection requests before a Postfix daemon
+process terminates.
 .IP "\fBprocess_id (read-only)\fR"
 The process ID of a Postfix command or daemon process.
 .IP "\fBprocess_name (read-only)\fR"
diff --git a/postfix/man/man8/error.8 b/postfix/man/man8/error.8
index d774d74af..854837691 100644
--- a/postfix/man/man8/error.8
+++ b/postfix/man/man8/error.8
@@ -15,8 +15,8 @@ Postfix error/retry mail delivery agent
 The Postfix \fBerror\fR(8) delivery agent processes delivery
 requests from
 the queue manager. Each request specifies a queue file, a sender
-address, the reason for non-delivery (specified as the
-next-hop destination), and recipient information.
+address, a domain or host name that is treated as the reason for
+non-delivery, and recipient information.
 The reason may be prefixed with an RFC 3463-compatible detail code.
 This program expects to be run from the \fBmaster\fR(8) process
 manager.
@@ -81,11 +81,11 @@ by the mail system.
 The time limit for sending or receiving information over an internal
 communication channel.
 .IP "\fBmax_idle (100s)\fR"
-The maximum amount of time that an idle Postfix daemon process waits
-for an incoming connection before terminating voluntarily.
+The maximum amount of time that an idle Postfix daemon process
+waits for the next service request before exiting.
 .IP "\fBmax_use (100)\fR"
-The maximal number of incoming connections that a Postfix daemon
-process will service before terminating voluntarily.
+The maximal number of connection requests before a Postfix daemon
+process terminates.
 .IP "\fBnotify_classes (resource, software)\fR"
 The list of error classes that are reported to the postmaster.
 .IP "\fBprocess_id (read-only)\fR"
diff --git a/postfix/man/man8/flush.8 b/postfix/man/man8/flush.8
index 91313b9f9..c85d6eb44 100644
--- a/postfix/man/man8/flush.8
+++ b/postfix/man/man8/flush.8
@@ -110,11 +110,11 @@ is deleted.
 The time limit for sending or receiving information over an internal
 communication channel.
 .IP "\fBmax_idle (100s)\fR"
-The maximum amount of time that an idle Postfix daemon process waits
-for an incoming connection before terminating voluntarily.
+The maximum amount of time that an idle Postfix daemon process
+waits for the next service request before exiting.
 .IP "\fBmax_use (100)\fR"
-The maximal number of incoming connections that a Postfix daemon
-process will service before terminating voluntarily.
+The maximal number of connection requests before a Postfix daemon
+process terminates.
 .IP "\fBparent_domain_matches_subdomains (see 'postconf -d' output)\fR"
 What Postfix features match subdomains of "domain.tld" automatically,
 instead of requiring an explicit ".domain.tld" pattern.
diff --git a/postfix/man/man8/local.8 b/postfix/man/man8/local.8
index 445200745..324bb2a27 100644
--- a/postfix/man/man8/local.8
+++ b/postfix/man/man8/local.8
@@ -545,11 +545,11 @@ communication channel.
 .IP "\fBlocal_command_shell (empty)\fR"
 Optional shell program for \fBlocal\fR(8) delivery to non-Postfix command.
 .IP "\fBmax_idle (100s)\fR"
-The maximum amount of time that an idle Postfix daemon process waits
-for an incoming connection before terminating voluntarily.
+The maximum amount of time that an idle Postfix daemon process
+waits for the next service request before exiting.
 .IP "\fBmax_use (100)\fR"
-The maximal number of incoming connections that a Postfix daemon
-process will service before terminating voluntarily.
+The maximal number of connection requests before a Postfix daemon
+process terminates.
 .IP "\fBprepend_delivered_header (command, file, forward)\fR"
 The message delivery contexts where the Postfix \fBlocal\fR(8) delivery
 agent prepends a Delivered-To:  message header with the address
diff --git a/postfix/man/man8/master.8 b/postfix/man/man8/master.8
index bc20cda9d..05e7b839a 100644
--- a/postfix/man/man8/master.8
+++ b/postfix/man/man8/master.8
@@ -101,11 +101,11 @@ Use the "\fBpostfix reload\fR" command after a configuration change.
 The default maximal number of Postfix child processes that provide
 a given service.
 .IP "\fBmax_idle (100s)\fR"
-The maximum amount of time that an idle Postfix daemon process waits
-for an incoming connection before terminating voluntarily.
+The maximum amount of time that an idle Postfix daemon process
+waits for the next service request before exiting.
 .IP "\fBmax_use (100)\fR"
-The maximal number of incoming connections that a Postfix daemon
-process will service before terminating voluntarily.
+The maximal number of connection requests before a Postfix daemon
+process terminates.
 .IP "\fBservice_throttle_time (60s)\fR"
 How long the Postfix \fBmaster\fR(8) waits before forking a server that
 appears to be malfunctioning.
diff --git a/postfix/man/man8/pickup.8 b/postfix/man/man8/pickup.8
index 2c7204091..ece84a09d 100644
--- a/postfix/man/man8/pickup.8
+++ b/postfix/man/man8/pickup.8
@@ -87,11 +87,11 @@ communication channel.
 Upon input, long lines are chopped up into pieces of at most
 this length; upon delivery, long lines are reconstructed.
 .IP "\fBmax_idle (100s)\fR"
-The maximum amount of time that an idle Postfix daemon process waits
-for an incoming connection before terminating voluntarily.
+The maximum amount of time that an idle Postfix daemon process
+waits for the next service request before exiting.
 .IP "\fBmax_use (100)\fR"
-The maximal number of incoming connections that a Postfix daemon
-process will service before terminating voluntarily.
+The maximal number of connection requests before a Postfix daemon
+process terminates.
 .IP "\fBprocess_id (read-only)\fR"
 The process ID of a Postfix command or daemon process.
 .IP "\fBprocess_name (read-only)\fR"
diff --git a/postfix/man/man8/pipe.8 b/postfix/man/man8/pipe.8
index e8e7747c2..d2ccd3175 100644
--- a/postfix/man/man8/pipe.8
+++ b/postfix/man/man8/pipe.8
@@ -128,8 +128,8 @@ Prepend "\fB>\fR" to lines starting with "\fBFrom \fR". This is expected
 by, for example, \fBUUCP\fR software.
 .RE
 .IP "\fBnull_sender\fR=\fIreplacement\fR (default: MAILER-DAEMON)"
-Replace the null sender address (typically used for delivery
-status notifications) with the specified text
+Replace the null sender address, which is typically used
+for delivery status notifications, with the specified text
 when expanding the \fB$sender\fR command-line macro, and
 when generating a From_ or Return-Path: message header.
 
@@ -351,11 +351,11 @@ communication channel.
 The UNIX system account that owns the Postfix queue and most Postfix
 daemon processes.
 .IP "\fBmax_idle (100s)\fR"
-The maximum amount of time that an idle Postfix daemon process waits
-for an incoming connection before terminating voluntarily.
+The maximum amount of time that an idle Postfix daemon process
+waits for the next service request before exiting.
 .IP "\fBmax_use (100)\fR"
-The maximal number of incoming connections that a Postfix daemon
-process will service before terminating voluntarily.
+The maximal number of connection requests before a Postfix daemon
+process terminates.
 .IP "\fBprocess_id (read-only)\fR"
 The process ID of a Postfix command or daemon process.
 .IP "\fBprocess_name (read-only)\fR"
diff --git a/postfix/man/man8/proxymap.8 b/postfix/man/man8/proxymap.8
index 975e230a3..4cf7464a6 100644
--- a/postfix/man/man8/proxymap.8
+++ b/postfix/man/man8/proxymap.8
@@ -118,11 +118,11 @@ request before it is terminated by a built-in watchdog timer.
 The time limit for sending or receiving information over an internal
 communication channel.
 .IP "\fBmax_idle (100s)\fR"
-The maximum amount of time that an idle Postfix daemon process waits
-for an incoming connection before terminating voluntarily.
+The maximum amount of time that an idle Postfix daemon process
+waits for the next service request before exiting.
 .IP "\fBmax_use (100)\fR"
-The maximal number of incoming connections that a Postfix daemon
-process will service before terminating voluntarily.
+The maximal number of connection requests before a Postfix daemon
+process terminates.
 .IP "\fBprocess_id (read-only)\fR"
 The process ID of a Postfix command or daemon process.
 .IP "\fBprocess_name (read-only)\fR"
diff --git a/postfix/man/man8/qmqpd.8 b/postfix/man/man8/qmqpd.8
index 6ca72e751..b19fb1c93 100644
--- a/postfix/man/man8/qmqpd.8
+++ b/postfix/man/man8/qmqpd.8
@@ -119,11 +119,11 @@ request before it is terminated by a built-in watchdog timer.
 The time limit for sending or receiving information over an internal
 communication channel.
 .IP "\fBmax_idle (100s)\fR"
-The maximum amount of time that an idle Postfix daemon process waits
-for an incoming connection before terminating voluntarily.
+The maximum amount of time that an idle Postfix daemon process
+waits for the next service request before exiting.
 .IP "\fBmax_use (100)\fR"
-The maximal number of incoming connections that a Postfix daemon
-process will service before terminating voluntarily.
+The maximal number of connection requests before a Postfix daemon
+process terminates.
 .IP "\fBprocess_id (read-only)\fR"
 The process ID of a Postfix command or daemon process.
 .IP "\fBprocess_name (read-only)\fR"
diff --git a/postfix/man/man8/scache.8 b/postfix/man/man8/scache.8
index 4b200166a..310ee8af4 100644
--- a/postfix/man/man8/scache.8
+++ b/postfix/man/man8/scache.8
@@ -120,8 +120,8 @@ request before it is terminated by a built-in watchdog timer.
 The time limit for sending or receiving information over an internal
 communication channel.
 .IP "\fBmax_idle (100s)\fR"
-The maximum amount of time that an idle Postfix daemon process waits
-for an incoming connection before terminating voluntarily.
+The maximum amount of time that an idle Postfix daemon process
+waits for the next service request before exiting.
 .IP "\fBprocess_id (read-only)\fR"
 The process ID of a Postfix command or daemon process.
 .IP "\fBprocess_name (read-only)\fR"
diff --git a/postfix/man/man8/showq.8 b/postfix/man/man8/showq.8
index 46bbfa6f8..c8b802623 100644
--- a/postfix/man/man8/showq.8
+++ b/postfix/man/man8/showq.8
@@ -38,6 +38,12 @@ outside world.
 .ad
 .fi
 Problems and transactions are logged to \fBsyslogd\fR(8).
+.SH BUGS
+.ad
+.fi
+The \fBshowq\fR(8) daemon runs at a fixed low privilege; consequently,
+it cannot extract information from queue files in the
+\fBmaildrop\fR directory.
 .SH "CONFIGURATION PARAMETERS"
 .na
 .nf
@@ -65,11 +71,11 @@ The recipient of mail addressed to the null address.
 The time limit for sending or receiving information over an internal
 communication channel.
 .IP "\fBmax_idle (100s)\fR"
-The maximum amount of time that an idle Postfix daemon process waits
-for an incoming connection before terminating voluntarily.
+The maximum amount of time that an idle Postfix daemon process
+waits for the next service request before exiting.
 .IP "\fBmax_use (100)\fR"
-The maximal number of incoming connections that a Postfix daemon
-process will service before terminating voluntarily.
+The maximal number of connection requests before a Postfix daemon
+process terminates.
 .IP "\fBprocess_id (read-only)\fR"
 The process ID of a Postfix command or daemon process.
 .IP "\fBprocess_name (read-only)\fR"
diff --git a/postfix/man/man8/smtp.8 b/postfix/man/man8/smtp.8
index f1c2bca62..198d25c7d 100644
--- a/postfix/man/man8/smtp.8
+++ b/postfix/man/man8/smtp.8
@@ -39,7 +39,7 @@ may be used by any SMTP+LMTP client for a subsequent transaction.
 
 By default, connection caching is enabled temporarily for
 destinations that have a high volume of mail in the active
-queue. Connection caching can be enabled permanently for
+queue. Session caching can be enabled permanently for
 specific destinations.
 .SH "SMTP DESTINATION SYNTAX"
 .na
@@ -140,9 +140,9 @@ connections are cached in-process, making it ineffective
 when the client is used for multiple domains.
 
 Most smtp_\fIxxx\fR configuration parameters have an
-lmtp_\fIxxx\fR "mirror" parameter for the equivalent LMTP
+lmtp_\fIxxx\fR "ghost" parameter for the equivalent LMTP
 feature. This document describes only those LMTP-related
-parameters that aren't simply "mirror" parameters.
+parameters that aren't simply "ghost" parameters.
 
 Changes to \fBmain.cf\fR are picked up automatically, as \fBsmtp\fR(8)
 processes run for only a limited amount of time. Use the command
@@ -222,7 +222,7 @@ Lookup tables, indexed by the remote LMTP server address, with
 case insensitive lists of LHLO keywords (pipelining, starttls,
 auth, etc.) that the LMTP client will ignore in the LHLO response
 from a remote LMTP server.
-.IP "\fBlmtp_discard_lhlo_keywords (empty)\fR"
+.IP "\fBlmtp_discard_lhlo_keywords ($myhostname)\fR"
 A case insensitive list of LHLO keywords (pipelining, starttls,
 auth, etc.) that the LMTP client will ignore in the LHLO response
 from a remote LMTP server.
@@ -524,11 +524,11 @@ communication channel.
 .IP "\fBlmtp_tcp_port (24)\fR"
 The default TCP port that the Postfix LMTP client connects to.
 .IP "\fBmax_idle (100s)\fR"
-The maximum amount of time that an idle Postfix daemon process waits
-for an incoming connection before terminating voluntarily.
+The maximum amount of time that an idle Postfix daemon process
+waits for the next service request before exiting.
 .IP "\fBmax_use (100)\fR"
-The maximal number of incoming connections that a Postfix daemon
-process will service before terminating voluntarily.
+The maximal number of connection requests before a Postfix daemon
+process terminates.
 .IP "\fBprocess_id (read-only)\fR"
 The process ID of a Postfix command or daemon process.
 .IP "\fBprocess_name (read-only)\fR"
diff --git a/postfix/man/man8/smtpd.8 b/postfix/man/man8/smtpd.8
index 21ab94646..f76921ba0 100644
--- a/postfix/man/man8/smtpd.8
+++ b/postfix/man/man8/smtpd.8
@@ -829,11 +829,11 @@ the SMTP greeting banner, and in bounced mail.
 The UNIX system account that owns the Postfix queue and most Postfix
 daemon processes.
 .IP "\fBmax_idle (100s)\fR"
-The maximum amount of time that an idle Postfix daemon process waits
-for an incoming connection before terminating voluntarily.
+The maximum amount of time that an idle Postfix daemon process
+waits for the next service request before exiting.
 .IP "\fBmax_use (100)\fR"
-The maximal number of incoming connections that a Postfix daemon
-process will service before terminating voluntarily.
+The maximal number of connection requests before a Postfix daemon
+process terminates.
 .IP "\fBmyhostname (see 'postconf -d' output)\fR"
 The internet hostname of this mail system.
 .IP "\fBmynetworks (see 'postconf -d' output)\fR"
diff --git a/postfix/man/man8/spawn.8 b/postfix/man/man8/spawn.8
index 21418fc13..df72c346a 100644
--- a/postfix/man/man8/spawn.8
+++ b/postfix/man/man8/spawn.8
@@ -112,11 +112,11 @@ communication channel.
 The UNIX system account that owns the Postfix queue and most Postfix
 daemon processes.
 .IP "\fBmax_idle (100s)\fR"
-The maximum amount of time that an idle Postfix daemon process waits
-for an incoming connection before terminating voluntarily.
+The maximum amount of time that an idle Postfix daemon process
+waits for the next service request before exiting.
 .IP "\fBmax_use (100)\fR"
-The maximal number of incoming connections that a Postfix daemon
-process will service before terminating voluntarily.
+The maximal number of connection requests before a Postfix daemon
+process terminates.
 .IP "\fBprocess_id (read-only)\fR"
 The process ID of a Postfix command or daemon process.
 .IP "\fBprocess_name (read-only)\fR"
diff --git a/postfix/man/man8/trivial-rewrite.8 b/postfix/man/man8/trivial-rewrite.8
index 7252e4388..396147f95 100644
--- a/postfix/man/man8/trivial-rewrite.8
+++ b/postfix/man/man8/trivial-rewrite.8
@@ -224,11 +224,11 @@ The recipient of mail addressed to the null address.
 The time limit for sending or receiving information over an internal
 communication channel.
 .IP "\fBmax_idle (100s)\fR"
-The maximum amount of time that an idle Postfix daemon process waits
-for an incoming connection before terminating voluntarily.
+The maximum amount of time that an idle Postfix daemon process
+waits for the next service request before exiting.
 .IP "\fBmax_use (100)\fR"
-The maximal number of incoming connections that a Postfix daemon
-process will service before terminating voluntarily.
+The maximal number of connection requests before a Postfix daemon
+process terminates.
 .IP "\fBrelocated_maps (empty)\fR"
 Optional lookup tables with new contact information for users or
 domains that no longer exist.
diff --git a/postfix/man/man8/virtual.8 b/postfix/man/man8/virtual.8
index 9cf898111..72fdf2acd 100644
--- a/postfix/man/man8/virtual.8
+++ b/postfix/man/man8/virtual.8
@@ -260,11 +260,11 @@ sub-second delay values.
 The time limit for sending or receiving information over an internal
 communication channel.
 .IP "\fBmax_idle (100s)\fR"
-The maximum amount of time that an idle Postfix daemon process waits
-for an incoming connection before terminating voluntarily.
+The maximum amount of time that an idle Postfix daemon process
+waits for the next service request before exiting.
 .IP "\fBmax_use (100)\fR"
-The maximal number of incoming connections that a Postfix daemon
-process will service before terminating voluntarily.
+The maximal number of connection requests before a Postfix daemon
+process terminates.
 .IP "\fBprocess_id (read-only)\fR"
 The process ID of a Postfix command or daemon process.
 .IP "\fBprocess_name (read-only)\fR"
diff --git a/postfix/mantools/postlink b/postfix/mantools/postlink
index 77768dd57..b81a59ac2 100755
--- a/postfix/mantools/postlink
+++ b/postfix/mantools/postlink
@@ -14,7 +14,7 @@ while (<>) {
 
     {
       Again:
-	if (/(-[<\/bB>]*|RFC)$/) {
+	if (/-[<\/bB>]*$/) {
 	    $_ .= "\n";
 	    $len1 = length;
 	    $_ .= <>;
@@ -778,13 +778,7 @@ while (<>) {
     s;\bmilter_unknown_command_macros\b;$&;g;
     s;\bmilter_end_of_data_macros\b;$&;g;
 
-    # Hyperlink URLs and RFC documents
-
-    s/(http:\/\/[^ ,"\(\)]*[^ ,"\(\):;!?.])/$1<\/a>/;
-    s/(ftp:\/\/[^ ,"\(\)]*[^ ,"\(\):;!?.])/$1<\/a>/;
-    s/\bRFC\s*([1-9]\d*)/$&<\/a>/;
-
-    # Split README/RFC/parameter/restriction hyperlinks that span line breaks
+    # Split *README, parameter or restriction hyperlinks across line breaks
 
     s/()([-A-Za-z0-9_]*)\b([-<\/bB>]*\n *[]*)\b([-A-Za-z0-9_]*)(<\/a>)/$1$2$5$3$1$4$5/;
 
@@ -793,6 +787,12 @@ while (<>) {
     s/()([]*[-a-zA-Z0-9._]*[]*)<\/a>\1/$1$2/g;
     s/()([]*[-a-zA-Z0-9._]*[]*)<\/a>\1/$1$2/g;
 
+    # Hyperlink URLs and RFC documents
+
+    s/(http:\/\/[^ ,"\(\)]*[^ ,"\(\):;!?.])/$1<\/a>/;
+    s/(ftp:\/\/[^ ,"\(\)]*[^ ,"\(\):;!?.])/$1<\/a>/;
+    s/\bRFC *([1-9]\d*)/$&<\/a>/;
+
     # Hyperlink phrases not in headers.
 
     if (/<\/*h\d>/) {
diff --git a/postfix/postfix-install b/postfix/postfix-install
index fac59dc2f..1a630440a 100644
--- a/postfix/postfix-install
+++ b/postfix/postfix-install
@@ -684,24 +684,20 @@ do
 	esac) || exit 1
 	continue;;
 
-     # Hard link. Skip files that are not installed.
-
-     h) eval echo $path | (IFS=/ read prefix file; test "$prefix" = "no" || (
-	    eval dest_path=$install_root$path
-	    check_parent $dest_path || exit 1
-	    eval source_path=$install_root$source
-	    compare_or_hardlink $source_path $dest_path || exit 1
-	)) || exit 1
+     # Hard link
+
+     h) eval dest_path=$install_root$path
+	check_parent $dest_path || exit 1
+	eval source_path=$install_root$source
+	compare_or_hardlink $source_path $dest_path || exit 1
 	continue;;
 
-     # Symbolic link. Skip files that are not installed.
+     # Symbolic link
 
-     l) eval echo $path | (IFS=/ read prefix file; test "$prefix" = "no" || (
-	    eval dest_path=$install_root$path
-	    check_parent $dest_path || exit 1
-	    eval source_path=$install_root$source
-	    compare_or_symlink $source_path $dest_path || exit 1
-	)) || exit 1
+     l) eval dest_path=$install_root$path
+	check_parent $dest_path || exit 1
+	eval source_path=$install_root$source
+	compare_or_symlink $source_path $dest_path || exit 1
 	continue;;
 
      *) echo $0: Error: unknown type $type for $path in conf/postfix-files 1>&2
diff --git a/postfix/proto/ADDRESS_CLASS_README.html b/postfix/proto/ADDRESS_CLASS_README.html
index ac9ac07f5..3741f5761 100644
--- a/postfix/proto/ADDRESS_CLASS_README.html
+++ b/postfix/proto/ADDRESS_CLASS_README.html
@@ -53,11 +53,9 @@ address classes are very important for the operation of Postfix. 
    
 
  •  
     The list of domains that are a member of the class: for
 example, all local domains, or all relay domains. 
    
 
-
  •  
     The default delivery transport. For example, the local,
-virtual or relay delivery transport (delivery transports are defined
-in master.cf). This helps to keep Postfix configurations simple,
-by avoiding the need for explicit routing information in transport
-maps. 
    
+
  •  
     The default delivery method. For example, the local or
+smtp delivery agent. This helps to keep Postfix configurations
+simple. 
    
 
 
  •  
     The list of valid recipient addresses for that address
 class. The Postfix SMTP server rejects invalid recipients with
diff --git a/postfix/proto/ADDRESS_VERIFICATION_README.html b/postfix/proto/ADDRESS_VERIFICATION_README.html
index 6addcb7b5..1d66b4fe9 100644
--- a/postfix/proto/ADDRESS_VERIFICATION_README.html
+++ b/postfix/proto/ADDRESS_VERIFICATION_README.html
@@ -21,8 +21,7 @@
 
 
     The sender/recipient address verification feature described in this
 document is suitable only for low-traffic sites. It performs poorly
-under high load; excessive sender address verification activity may
-even cause your site to be blacklisted by some
+under high load and may cause your site to be blacklisted by some
 providers. See the "Limitations" section
 below for details. 
    
 
@@ -229,10 +228,7 @@ MAILER-DAEMON messages. 
    
 
     Recipient address verification is relatively straightforward
 and there are no surprises. If a recipient probe fails, then Postfix
 rejects mail for the recipient address.  If a recipient probe
-succeeds, then Postfix accepts mail for the recipient address.
-However, recipient address verification probes can increase the
-load on down-stream MTAs when you're being flooded by backscatter
-bounces, or when some spammer is mounting a dictionary attack. 
    
+succeeds, then Postfix accepts mail for the recipient address. 
    
 
 
     By default, address verification results are not saved. To avoid
 probing the same address repeatedly, you can store the result in a
diff --git a/postfix/proto/CONNECTION_CACHE_README.html b/postfix/proto/CONNECTION_CACHE_README.html
index 2b4fcd3fa..17692e713 100644
--- a/postfix/proto/CONNECTION_CACHE_README.html
+++ b/postfix/proto/CONNECTION_CACHE_README.html
@@ -92,41 +92,28 @@ by the mail delivering process that creates the connection.  To get
 the same performance improvement as with a shared connection cache,
 non-shared connections need to be kept open for a longer time. 
    
 
-
     The scache(8) server, introduced with Postfix version 2.2,
-maintains the shared connection cache.  With Postfix version 2.2,
-only the smtp(8) client has support to access this cache.  
    
-
 
    
 
 
 
-
-
-
-
-
-
-
-
-
-
-
-
+
+
         /--    smtp(8)   
--->  Internet  
      qmgr(8)       |
    |
    |
    |
    v    		    
         \--    smtp(8)   
--->  Internet  
       ^
    |    		    
        scache(8)  
      Internet <--  
+
     smtp(8) 
           		   <->    
     scache(8) 
           		  <->   
+
     smtp(8) 
           		  --> Internet 
 
 
    
 
 
    
 
+
     The scache(8) server, introduced with Postfix version 2.2,
+maintains the shared connection cache.  With Postfix version 2.2,
+only the smtp(8) client has support to access this cache.  
    
+
 
     When SMTP connection caching is enabled (see next section), the
 smtp(8) client does not disconnect after a mail transaction, but
 gives the connection to the scache(8) server which keeps the
-connection open for a limited amount of time. 
    
+connection open for a limited amount of time.  
    
 
 
     After handing over the open connection to the scache(8) server,
 the smtp(8) client continues with some other mail delivery request.
diff --git a/postfix/proto/CYRUS_README.html b/postfix/proto/CYRUS_README.html
new file mode 100644
index 000000000..d304c77d3
--- /dev/null
+++ b/postfix/proto/CYRUS_README.html
@@ -0,0 +1,24 @@
+
+
+
+
+
+
+Postfix Cyrus Howto
+
+
+
+
+
+
+
+
    Postfix Cyrus Howto
    
+
+
    
+
+
     This document will be made available via http://www.postfix.org/. 
    
+
+
+
+
diff --git a/postfix/proto/DATABASE_README.html b/postfix/proto/DATABASE_README.html
index e5fde9d1e..ab2cf804f 100644
--- a/postfix/proto/DATABASE_README.html
+++ b/postfix/proto/DATABASE_README.html
@@ -80,8 +80,7 @@ below.
 
 
  •  You can use Berkeley DB files with fixed lookup strings for
 simple address rewriting operations and you can use regular expression
-tables for the more complicated work. In other words, you don't
-have to put everything into the same table.
+tables for the more complicated work.
 
 
 
@@ -190,9 +189,8 @@ because something else happens.  This is because commands such as
 postmap(1) or postalias(1) overwrite existing files. If the update
 fails in the middle then you have no usable database, and Postfix
 will stop working. This is not an issue with the CDB database type
-available with Postfix 2.2 and later: CDB
-creates a new file, and renames the file upon successful completion.
-
    
+available with Postfix 2.2 and later, because CDB
+database rebuilds are atomic. 
    
 
 
     With multi-file databases such as DBM, there is no simple
 solution. With Berkeley DB and other "one file" databases, it is
@@ -366,7 +364,7 @@ described in tcp_table(5). The lookup table name is "tcp:host:port"
 where "host" specifies a symbolic hostname or a numeric IP address,
 and "port" specifies a symbolic service name or a numeric port
 number. This protocol is not available up to and including Postfix
-version 2.4.  
+version 2.2.  
 
 
     unix (read-only) 
    
 
diff --git a/postfix/proto/DB_README.html b/postfix/proto/DB_README.html
index cc6595ca1..896817b25 100644
--- a/postfix/proto/DB_README.html
+++ b/postfix/proto/DB_README.html
@@ -49,17 +49,15 @@ versions.  
    
 
    Building Postfix on systems without Berkeley
 DB
    
 
-
     Some UNIXes ship without Berkeley DB support; for historical
-reasons these use DBM files instead. A problem with DBM files is
-that they can store only limited amounts of data. To build Postfix
-with
+
     Many commercial UNIXes ship without Berkeley DB support. Examples
+are Solaris, HP-UX, IRIX, UNIXWARE. In order to build Postfix with
 Berkeley DB support you need to download and install the source
-code from http://www.oracle.com/database/berkeley-db/. 
    
+code from http://www.sleepycat.com/ 
    
 
 
     Warning: some Linux system libraries use Berkeley DB, as do
 some third-party libraries such as SASL. If you compile Postfix
 with a different Berkeley DB implementation, then every Postfix
-program will dump core because either the system library, the SASL
+program will dump core because either the system library, SASL
 library, or Postfix itself ends up using the wrong version. 
    
 
 
    The more recent Berkeley DB versions have a compile-time switch,
@@ -69,7 +67,7 @@ Although wasteful, this may be the only way to keep things from
 falling apart. 
    
 
 
     To build Postfix after you installed the Berkeley DB from
-source code, use something like: 
    
+http://www.sleepycat.com/, use something like: 
    
 
 
    
 
    @@ -216,8 +214,7 @@ undefined reference to `pthread_mutex_trylock'
 
    
 
    
 
-
     More information is available at
-http://www.oracle.com/database/berkeley-db/. 
    
+
     More information is available at http://www.sleepycat.com/. 
    
 
 
 
diff --git a/postfix/proto/DEBUG_README.html b/postfix/proto/DEBUG_README.html
index 2cb297249..cdfc09a4b 100644
--- a/postfix/proto/DEBUG_README.html
+++ b/postfix/proto/DEBUG_README.html
@@ -100,9 +100,8 @@ is fixed. 
    
 permissions, incorrect configuration file settings that you can
 fix.  Postfix cannot proceed until this is fixed. 
    
 
-
  •  
     "error" reports an error condition. For safety
-reasons, a Postfix process will terminate when more than 13 of these
-happen. 
    
+
  •  
     "error" reports a fatal or non-fatal error condition.
+Postfix cannot proceed until this is fixed.  
    
 
 
  •  
     "warning" indicates a non-fatal error. These are
 problems that you may not be able to fix (such as a broken DNS
@@ -146,7 +145,7 @@ Mail Delivery Status Report will be mailed to <your login name>.
 
 
 
     These reports contain information that is generated by Postfix
-delivery agents. Since these run as daemon processes that cannot
+delivery agents. Since these run as daemon processes and do not
 interact with users directly, the result is sent as mail to the
 sender of the test message. The format of these reports is practically
 identical to that of ordinary non-delivery notifications. 
    
@@ -210,21 +209,18 @@ command "postfix reload". 
    
 
    Record the SMTP session with a network sniffer
    
 
 
     This example uses tcpdump. In order to record a conversation
-you need to specify a large enough buffer with the "-s"
-option or else you will miss some or all of the packet payload.
-
    
+you need to specify a large enough buffer with the "-s" option or
+else you will miss some or all of the packet payload. 
    
 
 
    
 
    -# tcpdump -w /file/name -s 0 host example.com and port 25
+# tcpdump -w /file/name -s 2000 host example.com and port 25
 
    
 
    
 
-
     Older tcpdump versions don't support "-s 0"; in that case,
-use "-s 2000" instead.  
    
-
 
     Run this for a while, stop with Ctrl-C when done. To view the
-data use a binary viewer, ethereal, or good old less.
+data use a binary viewer, or ethereal, or use my tcpdumpx
+utility that is available from ftp://ftp.porcupine.org/pub/debugging/.
 
    
 
 
    Making Postfix daemon programs more verbose
    
@@ -232,7 +228,7 @@ data use a binary viewer, ethereal, or good old less.
 
     Append one or more "-v" options to selected daemon
 definitions in /etc/postfix/master.cf and type "postfix reload".
 This will cause a lot of activity to be logged to the syslog daemon.
-For example, to make the Postfix SMTP server process more verbose: 
    
+Example: 
    
 
 
    
 
    @@ -241,9 +237,10 @@ For example, to make the Postfix SMTP server process more verbose: 
    
 
    
 
    
 
-
     To diagnose problems with address rewriting specify a "-v"
+
     This makes the Postfix SMTP server more verbose. To diagnose
+problems with address rewriting one would specify a "-v"
 option for the cleanup(8) and/or trivial-rewrite(8) daemon, and to
-diagnose problems with mail delivery specify a "-v"
+diagnose problems with mail delivery one would specify a "-v"
 option for the qmgr(8) or oqmgr(8) queue manager, or for the lmtp(8),
 local(8), pipe(8), smtp(8), or virtual(8) delivery agent.  
    
 
@@ -541,23 +538,20 @@ attachments, instead of reciting information from memory.
 
 
  •  
     Postfix logging. See the text at the top of the DEBUG_README
 document to find out where logging is stored. Please do not frustrate
-the helpers by word wrapping the logging. If the logging is more
-than a few kbytes of text, consider posting an URL on a web or ftp
-site. 
    
+the helpers by word wrapping the logging. 
    
 
 
  •  
     Consider using a test email address so that you don't have
 to reveal email addresses or passwords of innocent people. 
    
 
 
  •  
     If you can't use a test email address, please anonymize
-email addresses and host names consistently. Replace each letter
-by "A", each digit
+information consistently. Replace each letter by "A", each digit
 by "D" so that the helpers can still recognize syntactical errors.
 
    
 
 
  •  
     Output from "postconf -n". Please do not send your
-main.cf file, or 500+ lines of postconf output. 
    
+main.cf file or 400+ lines of postconf output. 
    
 
-
  •  
     Better, provide output from the postfinger tool.
+
  •  
      Better, provide output from the postfinger tool.
 This can be found at http://ftp.wl0.org/SOURCES/postfinger.  
    
 
 
  •  
     If the problem is SASL related, consider including the
@@ -568,7 +562,7 @@ http://postfix.state-of-mind.de/patrick.koetter/saslfinger/. 
    
 including output from the qshape tool, as described in the
 QSHAPE_README file. 
    
 
-
  •  
     If the problem is protocol related (connections time out,
+
  •  
     If the problem is protocol related (connections time out
 or an SMTP server complains about syntax errors etc.) consider
 recording a session with tcpdump, as described in the DEBUG_README document.  
diff --git a/postfix/proto/DSN_README.html b/postfix/proto/DSN_README.html
index 456862b4f..793317275 100644
--- a/postfix/proto/DSN_README.html
+++ b/postfix/proto/DSN_README.html
@@ -44,7 +44,7 @@ identifies the message content. 
    
 
 
 
     The implementation of DSN support involves extra parameters to
-the SMTP MAIL FROM and RCPT TO commands, as well as two Postfix
+the SMTP MAIL FROM and RCPT TO commands, as well as new Postfix
 sendmail command line options that provide a sub-set of the functions
 of the extra SMTP command parameters. 
    
 
diff --git a/postfix/proto/ETRN_README.html b/postfix/proto/ETRN_README.html
index 5f9bf7f0f..10b5484d4 100644
--- a/postfix/proto/ETRN_README.html
+++ b/postfix/proto/ETRN_README.html
@@ -27,6 +27,11 @@ searches the queue for mail to the customer, and delivers that mail
 not delivered via the connection that was used for sending ETRN.
 
    
 
+
     Postfix versions before 1.0 (also known as version 20010228)
+implemented the ETRN command in an inefficient manner: they simply
+attempted to deliver all queued mail.  This is slow on mail servers
+that queue mail for many customers.  
    
+
 
     As of version 1.0, Postfix has a fast ETRN implementation that
 does not require Postfix to examine every queue file.  Instead,
 Postfix maintains a record of what queue files contain mail for
@@ -69,11 +74,11 @@ font.  
    
 
    
 
     220 my.server.tld ESMTP Postfix
-HELO my.client.tld
+helo my.client.tld
 250 Ok
-ETRN some.customer.domain
+etrn some.customer.domain
 250 Queuing started
-QUIT
+quit
 221 Bye
 
    
 
    
@@ -85,8 +90,6 @@ the connection that was used to send the ETRN command. 
    
 
     The Postfix operator can request delivery for a specific customer
 by using the command "sendmail -qRdestination" and, with
 Postfix version 1.1 and later, "postqueue -sdestination".
-Access to this feature is controlled with the authorized_flush_users
-configuration parameter (Postfix version 2.2 and later).
 
    
 
 
    How Postfix fast ETRN works
    
@@ -146,13 +149,12 @@ want to turn on fast ETRN service for every possible destination.
 with queue file names. When a request to "deliver mail now" arrives,
 Postfix will attempt to deliver all recipients in the queue files
 that have mail for the destination in question.  This does not
-perform well with queue files that have recipients in many different
-domains, such as queue files with outbound mailing list traffic.
-
    
+perform well when queue files have recipients in many different
+domains.  
    
 
 
  •  
     The flush(8) daemon maintains per-destination logfiles
 only for destinations listed with $fast_flush_domains. With other
-destinations you cannot request delivery with "sendmail
+destinations it not possible to trigger delivery with "sendmail
 -qRdestination" or, with Postfix version 1.1 and later,
 "postqueue -sdestination". 
    
 
@@ -164,11 +166,6 @@ does not ignore the volatile in-memory list of dead domains, and
 the list of message delivery transports specified with the
 defer_transports configuration parameter.  
    
 
-
  •  
     Up to and including Postfix version 2.3, the "fast flush"
-service may not deliver some messages if the request to "deliver
-mail now" arrives while an incoming queue scan is already in progress.
-
    
-
 
 
 
    Configuring the Postfix fast ETRN service
    
@@ -305,9 +302,9 @@ boldface: 
    
 
    
 
     220 my.server.tld ESMTP Postfix
-HELO my.client.tld
+helo my.client.tld
 250 Ok
-ETRN some.customer.domain
+etrn some.customer.domain
 250 Queuing started
 
    
 
    
@@ -341,9 +338,9 @@ commands that you type: 
    
 
    
 
     220 my.server.tld ESMTP Postfix
-HELO my.client.tld
+helo my.client.tld
 250 Ok
-ETRN some.other.customer.domain
+etrn some.other.customer.domain
 250 Queuing started
 
    
 
    
@@ -359,9 +356,9 @@ server has mail queued for that destination. 
    
 
    
 
     220 my.server.tld ESMTP Postfix
-HELO my.client.tld
+helo my.client.tld
 250 Ok
-ETRN not.a.customer.domain
+etrn not.a.customer.domain
 459 <not.a.customer.domain>: service unavailable
 
    
 
    
diff --git a/postfix/proto/FILTER_README.html b/postfix/proto/FILTER_README.html
index 9f036b1cb..2cdb80384 100644
--- a/postfix/proto/FILTER_README.html
+++ b/postfix/proto/FILTER_README.html
@@ -71,8 +71,7 @@ mail.  Applications that use two separate Postfix instances will
 be covered by a later version of this document.  
    
 
 
     The after-queue content filter is not to be confused with the
-approaches described in the SMTPD_PROXY_README or MILTER_README
-documents,
+approach that is described in the SMTPD_PROXY_README document,
 where incoming SMTP mail is filtered BEFORE it is stored into the
 Postfix queue.  
    
 
@@ -126,18 +125,16 @@ all email, as well as several options to filter mail selectively: 
    
 
 
    Principles of operation 
    
 
-
     An after-queue content filter receives unfiltered mail from Postfix
-(as described further below) and can do one of the following: 
    
+
     An external content filter receives unfiltered mail from Postfix
+(as described further below) and does one of the following: 
    
 
 
      
 
 
    1.  
       Re-inject the mail back into Postfix, perhaps after changing
     content and/or destination. 
      
 
-
    2.  
       Discard or quarantine the mail. 
      
-
 
    3.  
       Reject the mail (by sending a suitable status code back to
-    Postfix). Postfix will send the mail back to the sender address. 
      
+    Postfix). Postfix will return the mail to the sender. 
      
 
 
    
 
@@ -149,8 +146,7 @@ suspect so that a human can decide what to do with it. 
    
 
 
    Simple content filter example
    
 
-
     The first example is simple to set up, but has major limitations
-that will be addressed in a second example.  Postfix receives
+
     The first example is simple to set up.  Postfix receives
 unfiltered mail from the network with the smtpd(8) server, and
 delivers unfiltered mail to a content filter with the Postfix
 pipe(8) delivery agent.  The content filter injects filtered mail
@@ -286,23 +282,21 @@ document for an introduction to the Postfix architecture. 
    
 
 
      
 
-
    •  
       Line 8: The -G option says the filter output is not a local
-mail submission: don't do silly things like appending the local
-domain name to addresses in message headers.  This option does
-nothing before Postfix version 2.3.  
      
+
    •  
       Line 8: The -G option does nothing before Postfix 2.3,
+otherwise it disables address rewriting of message headers. 
      
 
 
    •  
       Line 8: The -i option says don't stop reading input when
 a line contains "." only.  
      
 
 
    •  
       Line 8: NEVER NEVER NEVER use the "-t" command-line option
-here. It will mis-deliver mail, like sending messages from a mailing
-list back to the mailing list. 
      
+here. It will mis-deliver mail, like sending mailing list mail back
+to the mailing list. 
      
 
 
    •  
       Line 21: The idea is to first capture the message to
 file and then run the content through a third-party content filter
 program. 
      
 
-
    •  
       Line 22: If the message cannot be captured to file, mail
+
    •  
       Line 22: If the mail cannot be captured to file, mail
 delivery is deferred by terminating with exit status 75 (EX_TEMPFAIL).
 Postfix places the message in the deferred mail queue and tries
 again later.  
      
@@ -312,14 +306,13 @@ program here that receives the content on standard input. 
      
 
 
    •  
       Line 26: If the content filter program finds a problem,
 the mail is bounced by terminating with exit status 69 (EX_UNAVAILABLE).
-Postfix will send the message back to the sender as undeliverable
-mail.
+Postfix will return the message to the sender as undeliverable.
 
      
 
-
    •  
       NOTE: in this time of mail worms and spam, it is a BAD
+
    •  
       Note: in this time of mail worms and spam, it is a BAD
 IDEA to send known viruses or spam back to the sender, because that
-address is likely to be forged. It is safer to discard known viruses
-and to quarantine suspicious content so that it can
+address is likely to be forged. It is safer to discard known to be
+bad content and to quarantine suspicious content so that it can
 be inspected by a human being. 
      
 
 
    •  
       Line 28: If the content is OK, it is given as input to
@@ -338,7 +331,7 @@ as input: 
      
 
 
      
 
      -% /path/to/script -f sender -- recipient... <message-file
+% /path/to/script -f sender recipient... <message-file
 
      
 
      
 
@@ -388,7 +381,7 @@ entry that defines the Postfix SMTP server: 
      
         -o content_filter=filter:dummy
 
    • 
 
-
     The "-o content_filter" line causes Postfix to add one content
+
     The "content_filter" line causes Postfix to add one content
 filter request record to each incoming mail message, with content
 "filter:dummy". This record overrides the normal mail routing
 and causes mail to be given to the content filter instead. 
    
@@ -439,7 +432,7 @@ content_filter=filter:dummy" text from the entry that defines the
 Postfix SMTP server. 
    
 
 
  •  
     Execute "postsuper -r ALL" to remove content
-filter request records from existing queue files. 
    
+filter information from existing queue files. 
    
 
 
  •  
     Execute another "postfix reload". 
    
 
@@ -560,9 +553,7 @@ document for an introduction to the Postfix architecture. 
    
 
 
     The example given here filters all mail, including mail that
 arrives via SMTP and mail that is locally submitted via the Postfix
-sendmail command (local submissions enter Postfix via the pickup(8)
-server; to keep the figure simple we omit local submission details).
-See examples near the end of this document for
+sendmail command. See examples near the end of this document for
 how to exclude local users from filtering, or how to configure a
 destination dependent content filter. 
    
 
@@ -647,7 +638,7 @@ for more information. 
    
 
  •  
     The "-o disable_mime_output_conversion=yes" is a workaround
 that prevents the breaking of domainkeys and other digital signatures.
 This is needed because some SMTP-based content filters don't announce
-8BITMIME support, even though they can handle 8-bit mail. 
    
+8BITMIME support, even though they can handle it just fine.  
    
 
 
  •  
     The "-o smtp_generic_maps=" is a workaround that prevents
 local address rewriting with generic(5) maps. Such rewriting should
@@ -681,10 +672,6 @@ shell and home directory.  This user handles all potentially
 dangerous mail content - that is why it should be a separate account.
 
    
 
-
  •  
     By default, Postfix will terminate a command that runs
-longer than command_time_limit seconds (default: 1000s). This is a
-safety measure that prevents filters from running forever. 
    
-
 
 
 
     If you want to have your filter listening on port localhost:10025
@@ -724,14 +711,15 @@ that injects mail back into Postfix. 
    
 
 
      
 
-
    •  
       NOTE: do not use spaces around the "=" or "," characters. 
      
+
    •  
       Note: do not use spaces around the "=" or "," characters. 
      
 
-
    •  
       NOTE: the SMTP server must not have a smaller process
+
    •  
       Note: the SMTP server must not have a smaller process
 limit than the "filter" master.cf entry. 
      
 
 
    •  
       The "-o content_filter=" overrides main.cf settings, and
 requests no content filtering for mail from the content filter.
-This is required or else mail will loop. 
      
+This is required or else mail will stay in the content filtering
+loop. 
      
 
 
    •  
       The "-o receive_override_options" overrides main.cf settings
 to avoid duplicating work that was already done before the content
@@ -749,7 +737,7 @@ specified in main.cf: 
      
     
    •  
       We specify "no_milters" to disable Milter applications
     (this option is available only in Postfix 2.3 and later).  
      
 
-    
    •  
       We don't specify "no_address_mappings" here.  This
+    
    •  
       We don't specify "no_address_mapping" here.  This
     enables virtual alias expansion, canonical mappings, address
     masquerading, and other address mappings after the content
     filter. The main.cf setting of "receive_override_options"
@@ -806,7 +794,7 @@ when content filtering is turned off. 
      
 
    • 
 
 
  •  
     Execute "postsuper -r ALL" to remove content
-filter request records from existing queue files. 
    
+filter information from existing queue files. 
    
 
 
  •  
     Execute another "postfix reload". 
    
 
diff --git a/postfix/proto/INSTALL.html b/postfix/proto/INSTALL.html
index 012dc0ff2..02335fdb6 100644
--- a/postfix/proto/INSTALL.html
+++ b/postfix/proto/INSTALL.html
@@ -20,12 +20,12 @@ Installation From Source Code 
 
 
     1 - Purpose of this document 
    
 
-
     If you are using a pre-compiled version of Postfix, you should
-start with BASIC_CONFIGURATION_README and the general documentation
-referenced by it.  INSTALL is only a bootstrap document to get
-Postfix up and running from scratch with the minimal number of
-steps; it should not be considered part of the general documentation.
-
    
+
     This is a bootstrap document that helps you get Postfix up and
+running from scratch with the minimal number of steps.  If you are
+using a pre-compiled version of Postfix, you should be reading the
+general Postfix documentation which aims to describe the system in
+more detail.  This bootstrap document should not be considered part
+of the general Postfix documentation.  
    
 
 
     This document describes how to build, install and configure a
 Postfix system so that it can do one of the following: 
    
@@ -126,7 +126,7 @@ be sure to use an absolute path.  
    
 
    • 
 
 
     Of particular interest is the postconf(5) manual page that
-lists all the 500+ configuration parameters. The HTML version of
+lists all the 400+ configuration parameters. The HTML version of
 this text makes it easy to navigate around.  
    
 
 
     All Postfix source files have their own built-in manual page.
@@ -156,8 +156,8 @@ OPENSTEP 4.x 
    
 OSF1.V3 - OSF1.V5 (Digital UNIX) 
    
 Reliant UNIX 5.x 
    
 Rhapsody 5.x 
    
-SunOS 4.1.4 (March 2007) 
    
-SunOS 5.4 - 5.10 (Solaris 2.4..10) 
    
+SunOS 4.1.4 (July 2006) 
    
+SunOS 5.4 - 5.9 (Solaris 2.4..9) 
    
 Ultrix 4.x (well, that was long ago)
    • @@ -168,10 +168,7 @@ Ultrix 4.x (well, that was long ago)

    On Solaris, the "make" command and other utilities for software development are in /usr/ccs/bin, so you MUST have /usr/ccs/bin in -your command search path. If these files do not exist, install the -development packages first. See the Solaris FAQ item "Which -packages do I need to install to support a C compiler?".

    +your command search path.

    If you need to build Postfix for multiple architectures, use the "lndir" command to build a shadow tree with symbolic links to the @@ -334,33 +331,10 @@ default

    4.5 - Support for thousands of processes

    -

    The number of connections that Postfix can manage simultaneously -is limited by the number of processes that it can run. This number -in turn is limited by the number of files and sockets that a single -process can open. For example, the Postfix queue manager has a -separate connection to each delivery process, and the anvil(8) -server has one connection per smtpd(8) process.

    - -

    Postfix version 2.4 and later have no built-in limits on the -number of open files or sockets, when compiled on systems that -support one of the following:

    - -
      - -
    • BSD kqueue(2) (FreeBSD 4.1, NetBSD 2.0, OpenBSD 2.9), - -
    • Solaris 8 /dev/poll, - -
    • Linux 2.6 epoll(4). - -
    - - -

    With other Postfix versions or operating systems, the number -of file descriptors per process is limited by the value of the -FD_SETSIZE macro. If you expect to run more than 1000 mail delivery -processes, you may need to override the definition of the FD_SETSIZE -macro to make select() work correctly:

    +

    In order to build Postfix for very large applications, where you +expect to run more than 1000 mail delivery processes, you may need to +override the definition of the FD_SETSIZE macro to make select() +work correctly: 

    @@ -375,11 +349,6 @@ including <bits/types.h> directly (which is not allowed) and
 overriding the __FD_SETSIZE macro. Beware, undocumented interfaces
 can change at any time and without warning. 
    
 
-
     But wait, there is more: none of this will work unless the
-operating system is configured to handle thousands of connections.
-See the TUNING_README guide for examples of how to increase the
-number of open sockets or files. 
    
-
 
    4.6 - Compiling Postfix, at last
    
 
 
     If the command 
    
@@ -431,28 +400,19 @@ compilation
 
 
     This text describes how to install Postfix from source code.
 See the PACKAGE_README file if you are building a package for
-distribution to other systems. 
    
+distribution to other systems. See auxiliary/MacOSX/README-INSTALL.OSX
+for information about installing Postfix from source on Mac OS X.
+
    
 
 
    6.1 - Save existing Sendmail binaries
    
 
 
     IMPORTANT: if you are REPLACING an existing
 Sendmail installation with Postfix, you may need to keep the old
 sendmail program running for some time in order to flush the mail
-queue. 
    
-
-
      
-
-
    •  
       Some systems implement a mail switch mechanism where
-different MTAs (Postfix, Sendmail, etc.) can be installed at the
-same time, while only one of them is actually being used. Examples
-of such switching mechanisms are the FreeBSD mailwrapper(8) or the
-Linux mail switch.  In this case you should try to "flip" the switch
-to "Postfix" before installing Postfix. 
      
-
-
    •  
       If your system has no mail switch mechanism, execute the
-following commands (your sendmail, newaliases and mailq programs
-may be in a different place): 
      
+queue.  As superuser, execute the following commands (your sendmail,
+newaliases and mailq programs may be in a different place): 
      
 
+
      
 
       # mv /usr/sbin/sendmail /usr/sbin/sendmail.OFF
 # mv /usr/bin/newaliases /usr/bin/newaliases.OFF
@@ -460,8 +420,7 @@ may be in a different place): 
      
 # chmod 755 /usr/sbin/sendmail.OFF /usr/bin/newaliases.OFF \
     /usr/bin/mailq.OFF
 
      
-
-
    
+

    6.2 - Create account and groups

    @@ -518,17 +477,15 @@ one of the following commands as the super-user:

      -

    • The interactive version ("make install") asks for pathnames -for Postfix data and program files, and stores your preferences in -the main.cf file. If you don't want Postfix to overwrite -non-Postfix "sendmail", "mailq" and "newaliases" files, specify -pathnames that end in ".postfix".

      -

    • The non-interactive version ("make upgrade") needs the /etc/postfix/main.cf file from a previous installation. If the file does not exist, use interactive installation ("make install") instead.

      +

    • The interactive version offers suggestions for pathnames +that you can override interactively, and stores your preferences +in /etc/postfix/main.cf for convenient future upgrades.

      +

    6.4 - Configure Postfix

    @@ -628,17 +585,6 @@ receive mail while leaving your Sendmail setup intact, by running Postfix on a virtual interface address. Simply configure your mail user agent to directly invoke the Postfix sendmail program.

    -

    To create a virtual network interface address, study your -system ifconfig manual page. The command syntax could be any -of:

    - -
    -
    -# ifconfig le0:1 <address> netmask <mask> up
-# ifconfig en0 alias <address> netmask 255.255.255.255
-
    -
    -

    In the /etc/postfix/main.cf file, I would specify

    diff --git a/postfix/proto/LDAP_README.html b/postfix/proto/LDAP_README.html index 0fcdc646f..f9573a897 100644 --- a/postfix/proto/LDAP_README.html +++ b/postfix/proto/LDAP_README.html @@ -41,8 +41,6 @@ it to each.

  • Example: virtual domains/addresses -
  • Example: expanding LDAP groups -
  • Other uses of LDAP lookups
  • Notes and things to think about @@ -154,14 +152,14 @@ alias_maps = hash:/etc/aliases, ldap:/etc/postfix/ldap-aliases.cf 
    -server_host = ldap.example.com
-search_base = dc=example, dc=com
+server_host = ldap.my.com
+search_base = dc=my, dc=com

    Upon receiving mail for a local address "ldapuser" that isn't found in the /etc/aliases database, Postfix will search the LDAP -server listening at port 389 on ldap.example.com. It will bind anonymously, +server listening at port 389 on ldap.my.com. It will bind anonymously, search for any directory entries whose mailacceptinggeneralid attribute is "ldapuser", read the "maildrop" attributes of those found, and build a list of their maildrops, which will be treated @@ -178,7 +176,7 @@ of your virtual recipient's mailacceptinggeneralid attributes are fully qualified with their virtual domains. Finally, if you want to designate a directory entry as the default user for a virtual domain, just give it an additional mailacceptinggeneralid (or the -equivalent in your directory) of "@fake.dom". That's right, no +equivalent in your directory) of "@virtual.dom". That's right, no user part. If you don't want a catchall user, omit this step and mail to unknown users in the domain will simply bounce.

    @@ -214,241 +212,12 @@ go to this entry ...

    maildrop, e.g. "normaluser@fake.dom" and "normaluser@real.dom".

    -

    Example: expanding LDAP groups

    - -

    -LDAP is frequently used to store group member information. There are a -number of ways of handling LDAP groups. We will show a few examples in -order of increasing complexity, but owing to the number of independent -variables, we can only present a tiny portion of the solution space. -We show how to: -

    - -
      - -

    1. query groups as lists of addresses;

      - -

    2. query groups as lists of user objects containing addresses;

      - -

    3. forward special lists unexpanded to a separate list server, -for moderation or other processing;

      - -

    4. handle complex schemas by controlling expansion and by treating -leaf nodes specially, using features that are new in Postfix 2.4.

      - -
    - -

    -The example LDAP entries and implied schema below show two group entries -("agroup" and "bgroup") and four user entries ("auser", "buser", "cuser" -and "duser"). The group "agroup" has the users "auser" (1) and "buser" (2) -as members via DN references in the multi-valued attribute "memberdn", and -direct email addresses of two external users "auser@example.org" (3) and -"buser@example.org" (4) stored in the multi-valued attribute "memberaddr". -The same is true of "bgroup" and "cuser"/"duser" (6)/(7)/(8)/(9), but -"bgroup" also has a "maildrop" attribute of "bgroup@mlm.example.com" -(5):

    - -
    -
    -     dn: cn=agroup, dc=example, dc=com
-     objectclass: top
-     objectclass: ldapgroup
-     cn: agroup
-     mail: agroup@example.com
-1 -> memberdn: uid=auser, dc=example, dc=com
-2 -> memberdn: uid=buser, dc=example, dc=com
-3 -> memberaddr: auser@example.org
-4 -> memberaddr: buser@example.org
-
    -
    - -
    -     dn: cn=bgroup, dc=example, dc=com
-     objectclass: top
-     objectclass: ldapgroup
-     cn: bgroup
-     mail: bgroup@example.com
-5 -> maildrop: bgroup@mlm.example.com
-6 -> memberdn: uid=cuser, dc=example, dc=com
-7 -> memberdn: uid=duser, dc=example, dc=com
-8 -> memberaddr: cuser@example.org
-9 -> memberaddr: duser@example.org
-
    -
    - -
    -     dn: uid=auser, dc=example, dc=com
-     objectclass: top
-     objectclass: ldapuser
-     uid: auser
-10 -> mail: auser@example.com
-11 -> maildrop: auser@mailhub.example.com
-
    -
    - -
    -     dn: uid=buser, dc=example, dc=com
-     objectclass: top
-     objectclass: ldapuser
-     uid: buser
-12 -> mail: buser@example.com
-13 -> maildrop: buser@mailhub.example.com
-
    -
    - -
    -     dn: uid=cuser, dc=example, dc=com
-     objectclass: top
-     objectclass: ldapuser
-     uid: cuser
-14 -> mail: cuser@example.com
-
    -
    - -
    -     dn: uid=duser, dc=example, dc=com
-     objectclass: top
-     objectclass: ldapuser
-     uid: duser
-15 -> mail: duser@example.com
-
    -
    - -
    - -

    Our first use case ignores the "memberdn" attributes, and assumes -that groups hold only direct "memberaddr" strings as in (3), (4), (8) and -(9). The goal is to map the group address to the list of constituent -"memberaddr" values. This is simple, ignoring the various connection -related settings (hosts, ports, bind settings, timeouts, ...) we have: -

    - -
    -
    -    simple.cf:
-        ...
-        search_base = dc=example, dc=com
-        query_filter = mail=%s
-        result_attribute = memberaddr
-    $ postmap -q agroup@example.com ldap:simple.cf
-    auser@example.org,buser@example.org
-
    -
    - -

    We search "dc=example, dc=com". The "mail" attribute is used in the -query_filter to locate the right group, the "result_attribute" setting -described in ldap_table(5) is used to specify that "memberaddr" values -from the matching group are to be returned as a comma separated list. -Always check tables using postmap(1) with the "-q" option, before -deploying them into production use in main.cf.

    - -

    Our second use case instead expands "memberdn" attributes (1), (2), -(6) and (7), follows the DN references and returns the "maildrop" of the -referenced user entries. Here we use the "special_result_attribute" -setting from ldap_table(5) to designate the "memberdn" attribute -as holding DNs of the desired member entries. The "result_attribute" -setting selects which attributes are returned from the selected DNs. It -is important to choose a result attribute that is not also present in -the group object, because result attributes are collected from both -the group and the member DNs. In this case we choose "maildrop" and -assume for the moment that groups never have a "maildrop" (the "bgroup" -"maildrop" attribute is for a different use case). The returned data for -"auser" and "buser" is from items (11) and (13) in the example data.

    - -
    -
    -    special.cf:
-        ...
-        search_base = dc=example, dc=com
-        query_filter = mail=%s
-        result_attribute = maildrop
-        special_result_attribute = memberdn
-    $ postmap -q agroup@example.com ldap:special.cf
-    auser@mailhub.example.com,buser@mailhub.example.com
-
    -
    - -

    Note: if the desired member object result attribute is always also -present in the group, you get surprising results: the expansion also -returns the address of the group. This is a known limitation of Postfix -releases prior to 2.4, and is addressed in the new with Postfix 2.4 -"leaf_result_attribute" feature described in ldap_table(5).

    - -

    Our third use case has some groups that are expanded immediately, -and other groups that are forwarded to a dedicated mailing list manager -host for delayed expansion. This uses two LDAP tables, one for users -and forwarded groups and a second for groups that can be expanded -immediately. It is assumed that groups that require forwarding are -never nested members of groups that are directly expanded.

    - -
    -
    -    no_expand.cf:
-        ...
-        search_base = dc=example, dc=com
-        query_filter = mail=%s
-        result_attribute = maildrop
-    expand.cf
-        ...
-        search_base = dc=example, dc=com
-        query_filter = mail=%s
-        result_attribute = maildrop
-        special_result_attribute = memberdn
-    $ postmap -q auser@example.com ldap:no_expand.cf ldap:expand.cf
-    auser@mailhub.example.com
-    $ postmap -q agroup@example.com ldap:no_expand.cf ldap:expand.cf
-    auser@mailhub.example.com,buser@mailhub.example.com
-    $ postmap -q bgroup@example.com ldap:no_expand.cf ldap:expand.cf
-    bgroup@mlm.example.com
-
    -
    - -

    Non-group objects and groups with delayed expansion (those that have a -maildrop attribute) are rewritten to a single maildrop value. Groups that -don't have a maildrop are expanded as the second use case. This admits -a more elegant solution with Postfix 2.4 and later.

    - -

    Our final use case is the same as the third, but this time uses new -features in Postfix 2.4. We now are able to use just one LDAP table and -no longer need to assume that forwarded groups are never nested inside -expanded groups.

    - -
    -
    -    fancy.cf:
-        ...
-        search_base = dc=example, dc=com
-        query_filter = mail=%s
-        result_attribute = memberaddr
-        special_result_attribute = memberdn
-        terminal_result_attribute = maildrop
-        leaf_result_attribute = mail
-    $ postmap -q auser@example.com ldap:fancy.cf
-    auser@mailhub.example.com
-    $ postmap -q cuser@example.com ldap:fancy.cf
-    cuser@example.com
-    $ postmap -q agroup@example.com ldap:fancy.cf
-    auser@mailhub.example.com,buser@mailhub.example.com,auser@example.org,buser@example.org
-    $ postmap -q bgroup@example.com ldap:fancy.cf
-    bgroup@mlm.example.com
-
    -
    - -

    Above, delayed expansion is enabled via "terminal_result_attribute", -which, if present, is used as the sole result and all other expansion is -suppressed. Otherwise, the "leaf_result_attribute" is only returned for -leaf objects that don't have a "special_result_attribute" (non-groups), -while the "result_attribute" (direct member address of groups) is returned -at every level of recursive expansion, not just the leaf nodes. This fancy -example illustrates all the features of Postfix 2.4 group expansion.

    -

    Other uses of LDAP lookups

    Other common uses for LDAP lookups include rewriting senders and recipients with Postfix's canonical lookups, for example in order to make mail leaving your site appear to be coming from -"First.Last@example.com" instead of "userid@example.com". +"First.Last@site.dom" instead of "userid@site.dom".

    Notes and things to think about

    @@ -471,9 +240,9 @@ to make mail leaving your site appear to be coming from 
    -dn: cn=Accounting Staff List, dc=example, dc=com
+dn: cn=Accounting Staff List, dc=my, dc=com
 cn: Accounting Staff List
-o: example.com
+o: my.com
 objectclass: maillist
 mailacceptinggeneralid: accountingstaff
 mailacceptinggeneralid: accounting-staff
@@ -579,10 +348,6 @@ contents, please include the applicable bits of some directory entries. 
    
 Victor Duchovni developed the common query, result_format, domain and
 expansion_limit interface for LDAP, MySQL and PosgreSQL.
    • -
  • Gunnar Wrobel provided a first implementation of a feature to -limit LDAP search results to leaf nodes only. Victor generalized -this into the Postfix 2.4 "leaf_result_attribute" feature.
    • - And of course Wietse. diff --git a/postfix/proto/LINUX_README.html b/postfix/proto/LINUX_README.html index efcd35338..b2a7b5057 100644 --- a/postfix/proto/LINUX_README.html +++ b/postfix/proto/LINUX_README.html @@ -19,7 +19,7 @@

    Berkeley DB issues

    -

    If you can't compile Postfix because the file "db.h" +

    Warning: if you can't compile Postfix because the file "db.h" isn't found, then you MUST install the Berkeley DB development package (name: db???-devel-???) that matches your system library. You can find out what is installed with the rpm command. For example: @@ -33,7 +33,7 @@ db4-4.3.29-2

    This means that you need to install db4-devel-4.3.29-2 (on -some systems, specify "rpm -qf /lib/libdb.so" instead).

    +some systems, specify /lib/libdb.so in the rpm query).

    DO NOT download some Berkeley DB version from the network. Every Postfix program will dump core when it is built with a different @@ -45,13 +45,9 @@ library routines. See the DB_README file for further information.

    On RedHat Linux 7.1 and later procmail no longer has permission -to write the mail spool directory. Workaround:

    - -
    -
    -# chmod 1777 /var/spool/mail
-
    -
    +to write the mail spool directory. Workaround: chmod 1777 +/var/spool/mail. +

    Syslogd performance

    diff --git a/postfix/proto/LOCAL_RECIPIENT_README.html b/postfix/proto/LOCAL_RECIPIENT_README.html index 83e7d3bae..7aed58bda 100644 --- a/postfix/proto/LOCAL_RECIPIENT_README.html +++ b/postfix/proto/LOCAL_RECIPIENT_README.html @@ -81,11 +81,7 @@ specify:

    That is, an empty value. With this setting, the Postfix SMTP server will not reject mail with "User unknown in local recipient -table". Don't do this on systems that receive mail directly -from the Internet. With today's worms and viruses, Postfix will -become a backscatter source: it accepts mail for non-existent -recipients and then tries to return that mail as "undeliverable" -to the often forged sender address.

    +table".

    When you need to change the local_recipient_maps setting in main.cf

    diff --git a/postfix/proto/MACOSX_README b/postfix/proto/MACOSX_README new file mode 100644 index 000000000..24f37094d --- /dev/null +++ b/postfix/proto/MACOSX_README @@ -0,0 +1,2 @@ +See the files in auxiliary/MacOSX for hints and tips to set up +Postfix. diff --git a/postfix/proto/MAILDROP_README.html b/postfix/proto/MAILDROP_README.html index 97a424ec0..aaaac162c 100644 --- a/postfix/proto/MAILDROP_README.html +++ b/postfix/proto/MAILDROP_README.html @@ -41,9 +41,7 @@ file processing. You would typically do this for hosted domains with recipients that don't have UNIX home directories.

    The following example shows how to use maildrop for some.domain -and for someother.domain. The example comes in two parts.

    - -

    Part 1 describes changes to the main.cf file:

    +and for someother.domain. 

    @@ -98,8 +96,6 @@ to deliver the mail.  
    
 
 
     Note: Do not use the postfix user as the maildrop user. 
    
 
-
     Part 2 describes changes to the master.cf file: 
    
-
 
    
 
     /etc/postfix/master.cf:
diff --git a/postfix/proto/MILTER_README.html b/postfix/proto/MILTER_README.html
index 2b177cb56..853bb8ae3 100644
--- a/postfix/proto/MILTER_README.html
+++ b/postfix/proto/MILTER_README.html
@@ -28,13 +28,9 @@ this happens before mail is queued.  
    
 
     The reason for adding Milter support to Postfix is that there
 exists a large collection of applications, not only to block unwanted
 mail, but also to verify authenticity (examples: Domain keys
-identified mail, SenderID+SPF and
 Domain keys)
-or to digitally sign mail (examples: Domain keys
-identified mail, Domain keys).
 Having yet another Postfix-specific version of all that software
 is a poor use of human and system resources. 
    
@@ -206,14 +202,14 @@ does. 
    
 
 
     On some Linux and *BSD distributions, the Sendmail libmilter
 library is installed by default. With this, applications such as
-dkim-milter
+dk-milter
 and sid-milter
 build out of the box without requiring any tinkering:
    
 
 
    
 
    -$ gzcat dkim-milter-x.y.z.tar.gz | tar xf -
-$ cd dkim-milter-x.y.z
+$ gzcat dk-milter-x.y.z.tar.gz | tar xf -
+$ cd dk-milter-x.y.z
 $ make
 [...lots of output omitted...]
 
    
@@ -264,7 +260,7 @@ for options.  A typical command looks like this:
    
 
 
    
 
    -# /some/where/dkim-filter -u userid -p inet:portnumber@localhost ...other options...
+# /some/where/dk-filter -u userid -p inet:portnumber@localhost ...other options...
 
    
 
    
 
@@ -656,49 +652,42 @@ X-SenderID: Sendmail Sender-ID Filter vx.y.z host.example.com <unknown-msgid&
 
    
 
    
 
-
     This happens because those Milter applications expect that the
+
     This happens because some Milter applications expect that the
 queue ID is known before the MTA accepts the MAIL FROM
 (sender) command.  Postfix, on the other hand, does not choose a
 queue file name until after it accepts the first valid RCPT
-TO (recipient) command (Postfix queue file names must be unique
+TO (recipient) command. Postfix queue file names must be unique
 across multiple directories, so the name can't be chosen before the
-file is created; if multiple messages were to use the same queue
-ID simultaneously, mail would be lost).  
    
+file is created.  If multiple messages were to use the same queue
+ID simultaneously, mail would be lost.  
    
 
-
-
-
     If you experience the ugly header problem, see if a recent
-version of the Milter application fixes it. For example, current
-versions of dkim-filter and dk-filter already have code that looks
-up the Postfix queue ID at a later protocol stage. 
    
-
-
     To fix the ugly message header with sid-filter applications,
-we change the source code, so that it does the queue ID lookup after
-Postfix receives the end of the message. 
    
+
     To work around the ugly message header from Milter applications,
+we add a little code to the Milter source to look up the queue ID
+after Postfix receives the end of the message. 
    
 
 
      
 
-
    •  
       Edit the filter source file (named
-sid-filter/sid-filter.c). 
      
-
-
    •  
       Look up the smfilter table and replace
-mlfi_eoh by NULL.
-
      
+
    •  
       Edit the filter source file (typically named
+dk-filter/dk-filter.c or similar). 
      
 
 
    •  
       Look up the mlfi_eom() function and add code near
-the top that calls mlfi_eoh() as shown by the bold
-text below: 
      
+the top shown as bold text below: 
      
 
 
    
 
 
    
 
    -        assert(ctx != NULL);
-#endif /* !DEBUG */
+dfc = cc->cctx_msg;
+assert(dfc != NULL);
 
-        ret = mlfi_eoh(ctx);
-        if (ret != SMFIS_CONTINUE)
-                return ret;
+/* Determine the job ID for logging. */
+if (dfc->mctx_jobid == 0 || strcmp(dfc->mctx_jobid, JOBIDUNKNOWN) == 0) {
+        char *jobid = smfi_getsymval(ctx, "i");
+        if (jobid != 0)
+                dfc->mctx_jobid = jobid;
+}
+
+/* get hostname; used in the X header and in new MIME boundaries */
 
    
 
    
 
@@ -706,52 +695,48 @@ text below: 
    
 
 
      
 
-
    •  
       This was tested with sid-milter-0.2.10 and sid-milter-0.2.14. 
      
+
    •  
       Different mail filters use slightly different names for
+variables. If the above code does not compile, look for the code
+at the start of the mlfi_eoh() routine. 
      
 
 
    •  
       This fixes only the ugly message header, but not the WARNING
-message.  Fortunately, sid-milter logs that message only once. 
      
+message.  Fortunately, dk-filter logs that message only once. 
      
 
 
    
 
-
     To fix the ugly message header with other Milter applications,
-you will need to do something like this: 
    
+
     With some Milter applications we can fix both the WARNING and
+the "unknown-msgid" by postponing the call of mlfi_eoh()
+(or whatever routine logs the WARNING) until the end of the message.
+
    
 
 
      
 
 
    •  
       Edit the filter source file (typically named
-xxx-filter/xxx-filter.c or similar). 
      
+sid-filter/sid-filter.c or similar). 
      
+
+
    •  
       Look up the smfilter table and replace
+mlfi_eoh (or whatever routine logs the WARNING) by NULL.
+
      
 
 
    •  
       Look up the mlfi_eom() function and add code near
-the top shown as bold text below: 
      
+the top that calls mlfi_eoh() as shown by the bold
+text below: 
      
 
 
    
 
 
    
 
    -dfc = cc->cctx_msg;
-assert(dfc != NULL);
+        assert(ctx != NULL);
+#endif /* !DEBUG */
 
-/* Determine the job ID for logging. */
-if (dfc->mctx_jobid == 0 || strcmp(dfc->mctx_jobid, JOBIDUNKNOWN) == 0) {
-        char *jobid = smfi_getsymval(ctx, "i");
-        if (jobid != 0)
-                dfc->mctx_jobid = jobid;
-}
-
-/* get hostname; used in the X header and in new MIME boundaries */
+        ret = mlfi_eoh(ctx);
+        if (ret != SMFIS_CONTINUE)
+                return ret;
 
    
 
    
 
-
     NOTES: 
    
-
-
      
-
-
    •  
       Different mail filters use slightly different names for
-variables. If the above code does not compile, look for the code
-at the start of the mlfi_eoh() routine. 
      
-
-
    •  
       This fixes only the ugly message header, but not the WARNING
-message.  Fortunately, many Milters log that message only once. 
      
+
       This works with sid-milter-0.2.10. Other Milter applications
+will dump core when you do this. 
      
 
 
    
 
@@ -810,7 +795,8 @@ operation will log a warning like this:
    -

    The solution is to use Postfix version 2.4 or later.

    +

    The solution is to use a Postfix version that supports the +missing functionality.

  • Most Milter configuration options are global. Future Postfix versions may support per-Milter timeouts, per-Milter error handling, diff --git a/postfix/proto/Makefile.in b/postfix/proto/Makefile.in index e2e855b78..594b32bae 100644 --- a/postfix/proto/Makefile.in +++ b/postfix/proto/Makefile.in @@ -15,6 +15,7 @@ HTML = ../html/ADDRESS_CLASS_README.html \ ../html/CDB_README.html \ ../html/CONNECTION_CACHE_README.html \ ../html/CONTENT_INSPECTION_README.html \ + ../html/CYRUS_README.html \ ../html/DATABASE_README.html ../html/DB_README.html \ ../html/DEBUG_README.html \ ../html/DSN_README.html \ @@ -27,7 +28,7 @@ HTML = ../html/ADDRESS_CLASS_README.html \ ../html/MYSQL_README.html ../html/NFS_README.html \ ../html/OVERVIEW.html \ ../html/PACKAGE_README.html ../html/PCRE_README.html \ - ../html/PGSQL_README.html \ + ../html/PGSQL_README.html ../html/QMQP_README.html \ ../html/QSHAPE_README.html \ ../html/RESTRICTION_CLASS_README.html ../html/SASL_README.html \ ../html/SCHEDULER_README.html ../html/SMTPD_ACCESS_README.html \ @@ -36,7 +37,7 @@ HTML = ../html/ADDRESS_CLASS_README.html \ ../html/STANDARD_CONFIGURATION_README.html \ ../html/TLS_README.html ../html/TLS_LEGACY_README.html \ ../html/TUNING_README.html \ - ../html/UUCP_README.html \ + ../html/UUCP_README.html ../html/ULTRIX_README.html \ ../html/VERP_README.html ../html/VIRTUAL_README.html \ ../html/XCLIENT_README.html ../html/XFORWARD_README.html \ ../html/postconf.5.html @@ -50,6 +51,7 @@ README = ../README_FILES/ADDRESS_CLASS_README \ ../README_FILES/CDB_README \ ../README_FILES/CONNECTION_CACHE_README \ ../README_FILES/CONTENT_INSPECTION_README \ + ../README_FILES/CYRUS_README \ ../README_FILES/DATABASE_README ../README_FILES/DB_README \ ../README_FILES/DEBUG_README \ ../README_FILES/DSN_README \ @@ -62,7 +64,7 @@ README = ../README_FILES/ADDRESS_CLASS_README \ ../README_FILES/MYSQL_README ../README_FILES/NFS_README \ ../README_FILES/OVERVIEW \ ../README_FILES/PACKAGE_README ../README_FILES/PCRE_README \ - ../README_FILES/PGSQL_README \ + ../README_FILES/PGSQL_README ../README_FILES/QMQP_README \ ../README_FILES/QSHAPE_README \ ../README_FILES/RESTRICTION_CLASS_README \ ../README_FILES/SASL_README ../README_FILES/SCHEDULER_README \ @@ -71,7 +73,7 @@ README = ../README_FILES/ADDRESS_CLASS_README \ ../README_FILES/STANDARD_CONFIGURATION_README \ ../README_FILES/TLS_README ../README_FILES/TLS_LEGACY_README \ ../README_FILES/TUNING_README \ - ../README_FILES/UUCP_README \ + ../README_FILES/UUCP_README ../README_FILES/ULTRIX_README \ ../README_FILES/VERP_README ../README_FILES/VIRTUAL_README \ ../README_FILES/XCLIENT_README ../README_FILES/XFORWARD_README \ ../README_FILES/AAAREADME diff --git a/postfix/proto/OVERVIEW.html b/postfix/proto/OVERVIEW.html index 3a7e70833..946837d15 100644 --- a/postfix/proto/OVERVIEW.html +++ b/postfix/proto/OVERVIEW.html @@ -549,30 +549,15 @@ of times that a connection may be reused.

    When delivering mail to a destination with multiple mail servers, connection caching can help to skip over a non-responding server, -and thus dramatically speed up delivery. SMTP connection caching -is available in Postfix version 2.2 and later. More information -about this feature is in the CONNECTION_CACHE_README document.

    +and thus dramatically speed up delivery.

    - - - - - - - - - - - - +
    /-- smtp(8) ---> Internet
    qmgr(8)   |
    |
    |
    |
    v    		  
    \-- smtp(8) ---> Internet
    ^
    |    		  
    scache(8)

    smtp(8)
    +      		<->
    scache(8)
          		+<->
    +smtp(8)
     
    diff --git a/postfix/proto/PACKAGE_README.html b/postfix/proto/PACKAGE_README.html index 5790ebc4f..72bdf2663 100644 --- a/postfix/proto/PACKAGE_README.html +++ b/postfix/proto/PACKAGE_README.html @@ -27,8 +27,8 @@ Postfix distributions for general use.

    file

    The installed main.cf file must be small. PLEASE resist the -temptation to list all parameters in the main.cf file. Postfix -is supposed to be easy to configure. Listing all parameters in main.cf +temptation to list all 400+ parameters in the main.cf file. Postfix +is supposed to be easy to configure. Listing all 400+ in main.cf defeats the purpose. It is an invitation for hobbyists to make random changes without understanding what they do, and gets them into endless trouble.

    diff --git a/postfix/proto/QMQP_README.html b/postfix/proto/QMQP_README.html new file mode 100644 index 000000000..ed171ff46 --- /dev/null +++ b/postfix/proto/QMQP_README.html @@ -0,0 +1,24 @@ + + + + + + +Postfix qmail and ezmlm support + + + + + + + +

    Postfix qmail and ezmlm support

    + +
    + +

    This document will be made available via http://www.postfix.org/.

    + + + + diff --git a/postfix/proto/QSHAPE_README.html b/postfix/proto/QSHAPE_README.html index 16394a138..2418eba7b 100644 --- a/postfix/proto/QSHAPE_README.html +++ b/postfix/proto/QSHAPE_README.html @@ -19,11 +19,17 @@

    Purpose of this document

    -

    This document is an introduction to Postfix queue congestion analysis. -It explains how the qshape(1) program can help to track down the -reason for queue congestion. qshape(1) is bundled with Postfix -2.1 and later source code, under the "auxiliary" directory. This -document describes qshape(1) as bundled with Postfix 2.4.

    +

    This document describes the qshape(1) program which helps the +administrator understand the Postfix queue message distribution +sorted by time and by sender or recipient domain. qshape(1) is +bundled with the Postfix 2.1 source under the "auxiliary" directory. +

    + +

    In order to understand the output of qshape(1), it useful to +understand the various Postfix queues. To this end the role of each +Postfix queue directory is described briefly in the "Background +info: Postfix queue directories" section near the end of this +document.

    This document covers the following topics:

    @@ -43,7 +49,7 @@ queue
  • Example 4: High volume destination backlog -
  • Postfix queue directories +
  • Background info: Postfix queue directories
      @@ -65,6 +71,7 @@ queue

      Introducing the qshape tool

      +

      When mail is draining slowly or the queue is unexpectedly large, run qshape(1) as the super-user (root) to help zero in on the problem. The qshape(1) program displays a tabular view of the Postfix queue @@ -117,12 +124,6 @@ minutes old and 12 older than 1280 minutes (1440 minutes in a day).

    -

    When the output is a terminal intermediate results showing the top 20 -domains (-n option) are displayed after every 1000 messages (-N option) -and the final output also shows only the top 20 domains. This makes -qshape useful even when the deferred queue is very large and it may -otherwise take prohibitively long to read the entire deferred queue.

    -

    By default, qshape shows statistics for the union of both the incoming and active queues which are the most relevant queues to look at when analyzing performance.

    @@ -131,8 +132,8 @@ look at when analyzing performance. 

    -$ qshape deferred
-$ qshape incoming active deferred
+$ qshape deferred | less
+$ qshape incoming active deferred | less
    @@ -156,11 +157,11 @@ a burst of mail started, and when it stopped.

    The problem destinations or sender domains appear near the top left corner of the output table. Remember that the active queue can accommodate up to 20000 ($qmgr_message_active_limit) messages. -To check whether this limit has been reached, use:

    +To check wether this limit has been reached, use: 

    -$ qshape -s active       (show sender statistics)
+$ qshape -s active | head       (show sender statistics)
    @@ -168,13 +169,13 @@ $ qshape -s active (show sender statistics) not yet saturated, any high volume sender domains show near the top of the output. -

    With oqmgr(8) the active queue is also limited to at most 20000 -recipient addresses ($qmgr_message_recipient_limit). To check for -exhaustion of this limit use:

    +

    The active queue is also limited to at most 20000 recipient +addresses ($qmgr_message_recipient_limit). To check for exhaustion +of this limit use: 

    -$ qshape active          (show recipient statistics)
+$ qshape active | head          (show recipient statistics)
    @@ -380,17 +381,14 @@ queue congestion is a greater cause for alarm; one might need to take measures to ensure that the mail is deferred instead or even add an access(5) rule asking the sender to try again later.

    -

    If a high volume destination exhibits frequent bursts of consecutive -connections refused by all MX hosts or "421 Server busy errors", it -is possible for the queue manager to mark the destination as "dead" -despite the transient nature of the errors. The destination will be -retried again after the expiration of a $minimal_backoff_time timer. -If the error bursts are frequent enough it may be that only a small -quantity of email is delivered before the destination is again marked -"dead". In some cases enabling static (not on demand) connection -caching by listing the appropriate nexthop domain in a table included in -"smtp_connection_cache_destinations" may help to reduce the error rate, -because most messages will re-use existing connections.

    +

    If a high volume destination exhibits frequent bursts of +consecutive connections refused by all MX hosts or "421 Server busy +errors", it is possible for the queue manager to mark the destination +as "dead" despite the transient nature of the errors. The destination +will be retried again after the expiration of a $minimal_backoff_time +timer. If the error bursts are frequent enough it may be that only +a small quantity of email is delivered before the destination is +again marked "dead".

    The MTA that has been observed most frequently to exhibit such bursts of errors is Microsoft Exchange, which refuses connections @@ -398,14 +396,17 @@ under load. Some proxy virus scanners in front of the Exchange server propagate the refused connection to the client as a "421" error.

    -

    Note that it is now possible to configure Postfix to exhibit similarly -erratic behavior by misconfiguring the anvil(8) service. Do not use -anvil(8) for steady-state rate limiting, its purpose is (unintentional) -DoS prevention and the rate limits set should be very generous!

    +

    Note that it is now possible to configure Postfix to exhibit +similarly erratic behavior by misconfiguring the anvil(8) server +(not included in Postfix 2.1.). Do not use anvil(8) for steady-state +rate limiting, its purpose is DoS prevention and the rate limits +set should be very generous!

    -

    If one finds oneself needing to deliver a high volume of mail to a -destination that exhibits frequent brief bursts of errors and connection -caching does not solve the problem, there is a subtle workaround.

    +

    In the long run it is hoped that the Postfix dead host detection +and concurrency control mechanism will be tuned to be more "noise" +tolerant. If one finds oneself needing to deliver a high volume +of mail to a destination that exhibits frequent brief bursts of +errors, there is a subtle workaround.

      @@ -416,12 +417,12 @@ transport for the destination in question.

      transport (a number in the 10-20 range is typical).

    • IMPORTANT!!! In main.cf configure a very large initial -and destination concurrency limit for this transport (say 2000).

      +and destination concurrency limit for this transport (say 200). 

       /etc/postfix/main.cf:
-    initial_destination_concurrency = 2000
-    transportname_destination_concurrency_limit = 2000
+    initial_destination_concurrency = 200
+    transportname_destination_concurrency_limit = 200

      Where transportname is the name of the master.cf entry @@ -429,13 +430,13 @@ in question.

    -

    The effect of this surprising configuration is that up to 2000 +

    The effect of this surprising configuration is that up to 200 consecutive errors are tolerated without marking the destination dead, while the total concurrency remains reasonable (10-20 processes). This trick is only for a very specialized situation: high volume delivery into a channel with multi-error bursts that is capable of high throughput, but is repeatedly throttled by -the bursts of errors.

    +the bursts of errors.

    When a destination is unable to handle the load even after the Postfix process limit is reduced to 1, a desperate measure is to @@ -471,7 +472,7 @@ updated when SMTP connection caching is introduced.

    Hopefully a more elegant solution to these problems will be found in the future.

    -

    Postfix queue directories

    +

    Background info: Postfix queue directories

    The following sections describe Postfix queues: their purpose, what normal behavior looks like, and how to diagnose abnormal @@ -496,8 +497,8 @@ to notify the pickup(8) service of its arrival.

    All mail that enters the main Postfix queue does so via the cleanup(8) service. The cleanup service is responsible for envelope and header rewriting, header and body regular expression checks, -automatic bcc recipient processing, milter content processing, and -reliable insertion of the message into the Postfix "incoming" queue.

    +automatic bcc recipient processing and guaranteed insertion of the +message into the Postfix "incoming" queue.

    In the absence of excessive CPU consumption in cleanup(8) header or body regular expression checks or other software consuming all @@ -513,10 +514,9 @@ one message at a time at a rate that does not exceed the reciprocal disk I/O latency (+ CPU if not negligible) of the cleanup service.

    -

    Congestion in this queue is indicative of an excessive local message -submission rate or perhaps excessive CPU consumption in the cleanup(8) -service due to excessive body_checks, or (Postfix ≥ 2.3) high latency -milters.

    +

    Congestion in this queue is indicative of an excessive local +message submission rate or perhaps excessive CPU consumption in +the cleanup(8) service due to excessive body_checks.

    Note, that once the active queue is full, the cleanup service will attempt to slow down message injection by pausing $in_flow_delay @@ -524,10 +524,10 @@ for each message. In this case "maildrop" queue congestion may be a consequence of congestion downstream, rather than a problem in its own right.

    -

    Note, you should not attempt to deliver large volumes of mail via -the pickup(8) service. High volume sites should avoid using "simple" -content filters that re-inject scanned mail via Postfix sendmail(1) -and postdrop(1).

    +

    Note also, that one should not attempt to deliver large volumes +of mail via the pickup(8) service. High volume sites must avoid +using content filters that reinject scanned mail via Postfix +sendmail(1) and postdrop(1).

    A high arrival rate of locally submitted mail may be an indication of an uncaught forwarding loop, or a run-away notification program. @@ -545,19 +545,20 @@ size of the "maildrop" queue.

    The administrator can define "smtpd" access(5) policies, or cleanup(8) header/body checks that cause messages to be automatically diverted from normal processing and placed indefinitely in the -"hold" queue. Messages placed in the "hold" queue stay there until +"hold" queue. Messages placed in the "hold" queue stay there until the administrator intervenes. No periodic delivery attempts are made for messages in the "hold" queue. The postsuper(1) command can be used to manually release messages into the "deferred" queue.

    -

    Messages can potentially stay in the "hold" queue longer than -$maximal_queue_lifetime. If such "old" messages need to be released from -the "hold" queue, they should typically be moved into the "maildrop" -queue using "postsuper -r", so that the message gets a new timestamp and -is given more than one opportunity to be delivered. Messages that are -"young" can be moved directly into the "deferred" queue using -"postsuper -H".

    +

    Messages can potentially stay in the "hold" queue for a time +exceeding the normal maximal queue lifetime (after which undelivered +messages are bounced back to the sender). If such "old" messages +need to be released from the "hold" queue, they should typically +be moved into the "maildrop" queue, so that the message gets a new +timestamp and is given more than one opportunity to be delivered. +Messages that are "young" can be moved directly into the "deferred" +queue.

    The "hold" queue plays little role in Postfix performance, and monitoring of the "hold" queue is typically more closely motivated @@ -588,15 +589,11 @@ messages into the active queue as soon as they become available.

    The incoming queue grows when the message input rate spikes above the rate at which the queue manager can import messages into -the active queue. The main factors slowing down the queue manager -are disk I/O and lookup queries to the trivial-rewrite service. If the queue +the active queue. The main factor slowing down the queue manager +is transport queries to the trivial-rewrite service. If the queue manager is routinely not keeping up, consider not using "slow" lookup services (MySQL, LDAP, ...) for transport lookups or speeding -up the hosts that provide the lookup service. If the problem is I/O -starvation, consider striping the queue over more disks, faster controllers -with a battery write cache, or other hardware improvements. At the very -least, make sure that the queue directory is mounted with the "noatime" -option if applicable to the underlying filesystem.

    +up the hosts that provide the lookup service.

    The in_flow_delay parameter is used to clamp the input rate when the queue manager starts to fall behind. The cleanup(8) service @@ -648,40 +645,26 @@ combination; the group size is capped by the transport's recipient concurrency limit.

    Multiple recipient groups (from one or more messages) are queued -for delivery grouped by transport/nexthop combination. The -destination concurrency limit for the transports caps the number +for delivery via the common transport/nexthop combination. The +destination concurrency limit for the transports caps the number of simultaneous delivery attempts for each nexthop. Transports with -a recipient concurrency limit of 1 are special: these are grouped -by the actual recipient address rather than the nexthop, yielding -per-recipient concurrency limits rather than per-domain +a recipient concurrency limit of 1 are special: these are grouped +by the actual recipient address rather than the nexthop, thereby +enabling per-recipient concurrency limits rather than per-domain concurrency limits. Per-recipient limits are appropriate when performing final delivery to mailboxes rather than when relaying to a remote server.

    Congestion occurs in the active queue when one or more destinations -drain slower than the corresponding message input rate.

    - -

    Input into the active queue comes both from new mail in the "incoming" -queue, and retries of mail in the "deferred" queue. Should the "deferred" -queue get really large, retries of old mail can dominate the arrival -rate of new mail. Systems with more CPU, faster disks and more network -bandwidth can deal with larger deferred queues, but as a rule of thumb -the deferred queue scales to somewhere between 100,000 and 1,000,000 -messages with good performance unlikely above that "limit". Systems with -queues this large should typically stop accepting new mail, or put the -backlog "on hold" until the underlying issue is fixed (provided that -there is enough capacity to handle just the new mail).

    - -

    When a destination is down for some time, the queue manager will -mark it dead, and immediately defer all mail for the destination without +drain slower than the corresponding message input rate. If a +destination is down for some time, the queue manager will mark it +dead, and immediately defer all mail for the destination without trying to assign it to a delivery agent. In this case the messages -will quickly leave the active queue and end up in the deferred queue -(with Postfix < 2.4, this is done directly by the queue manager, -with Postfix ≥ 2.4 this is done via the "retry" delivery agent).

    - -

    When the destination is instead simply slow, or there is a problem -causing an excessive arrival rate the active queue will grow and will -become dominated by mail to the congested destination.

    +will quickly leave the active queue and end up in the deferred +queue. If the destination is instead simply slow, or there is a +problem causing an excessive arrival rate the active queue will +grow and will become dominated by mail to the congested destination. +

    The only way to reduce congestion is to either reduce the input rate or increase the throughput. Increasing the throughput requires @@ -708,56 +691,28 @@ a high average latency. If the number of outbound SMTP connections is draining slowly and the system and network are not loaded, raise the "smtp" and/or "relay" process limits!

    -

    When a high volume destination is served by multiple MX hosts with -typically low delivery latency, performance can suffer dramatically when -one of the MX hosts is unresponsive and SMTP connections to that host -timeout. For example, if there are 2 equal weight MX hosts, the SMTP -connection timeout is 30 seconds and one of the MX hosts is down, the -average SMTP connection will take approximately 15 seconds to complete. -With a default per-destination concurrency limit of 20 connections, -throughput falls to just over 1 message per second.

    - -

    The best way to avoid bottlenecks when one or more MX hosts is -non-responsive is to use connection caching. Connection caching was -introduced with Postfix 2.2 and is by default enabled on demand for -destinations with a backlog of mail in the active queue. When connection -caching is in effect for a particular destination, established connections -are re-used to send additional messages, this reduces the number of -connections made per message delivery and maintains good throughput even -in the face of partial unavailability of the destination's MX hosts.

    - -

    If connection caching is not available (Postfix < 2.2) or does -not provide a sufficient latency reduction, especially for the "relay" -transport used to forward mail to "your own" domains, consider setting -lower than default SMTP connection timeouts (1-5 seconds) and higher -than default destination concurrency limits. This will further reduce -latency and provide more concurrency to maintain throughput should -latency rise.

    - -

    Setting high concurrency limits to domains that are not your own may -be viewed as hostile by the receiving system, and steps may be taken -to prevent you from monopolizing the destination system's resources. -The defensive measures may substantially reduce your throughput or block -access entirely. Do not set aggressive concurrency limits to remote -domains without coordinating with the administrators of the target -domain.

    - -

    If necessary, dedicate and tune custom transports for selected high -volume destinations. The "relay" transport is provided for forwarding mail -to domains for which your server is a primary or backup MX host. These can -make up a substantial fraction of your email traffic. Use the "relay" and -not the "smtp" transport to send email to these domains. Using the "relay" -transport allocates a separate delivery agent pool to these destinations -and allows separate tuning of timeouts and concurrency limits.

    - -

    Another common cause of congestion is unwarranted flushing of the -entire deferred queue. The deferred queue holds messages that are likely -to fail to be delivered and are also likely to be slow to fail delivery -(time out). As a result the most common reaction to a large deferred queue -(flush it!) is more than likely counter-productive, and typically makes -the congestion worse. Do not flush the deferred queue unless you expect -that most of its content has recently become deliverable (e.g. relayhost -back up after an outage)!

    +

    Especially for the "relay" transport, consider lower SMTP +connection timeouts (1-5 seconds) and higher than default destination +concurrency limits. Compute the expected latency when 1 out of N +of the MX hosts for a high volume site is down and not responding, +and make sure that the configured concurrency divided by this +latency exceeds the required steady-state message rate. If the +destination is managed by you, consider load balancers in front of +groups of MX hosts. Load balancers have higher uptime and will be +able to hide individual MX host failures.

    + +

    If necessary, dedicate and tune custom transports for high +volume destinations.

    + +

    Another common cause of congestion is unwarranted flushing of +the entire deferred queue. The deferred queue holds messages that +are likely to fail to be delivered and are also likely to be slow +to fail delivery (timeouts). This means that the most common reaction +to a large deferred queue (flush it!) is more than likely counter- +productive, and is likely to make the problem worse. Do not flush +the deferred queue unless you expect that most of its content has +recently become deliverable (e.g. relayhost back up after an outage)! +

    Note that whenever the queue manager is restarted, there may already be messages in the active queue directory, but the "real" @@ -768,7 +723,7 @@ queue scan to refill the active queue. The process of moving all the messages back and forth, redoing transport table (trivial-rewrite(8) resolve service) lookups, and re-importing the messages back into memory is expensive. At all costs, avoid frequent restarts of the -queue manager (e.g. via frequent execution of "postfix reload").

    +queue manager.

    The "deferred" queue

    @@ -777,19 +732,20 @@ and for some recipients delivery failed for a transient reason (it might succeed later), the message is placed in the deferred queue.

    -

    The queue manager scans the deferred queue periodically. The scan -interval is controlled by the queue_run_delay parameter. While a deferred -queue scan is in progress, if an incoming queue scan is also in progress -(ideally these are brief since the incoming queue should be short), the -queue manager alternates between looking for messages in the "incoming" -queue and in the "deferred" queue. This "round-robin" strategy prevents -starvation of either the incoming or the deferred queues.

    +

    The queue manager scans the deferred queue periodically. The +scan interval is controlled by the queue_run_delay parameter. +While a deferred queue scan is in progress, if an incoming queue +scan is also in progress (ideally these are brief since the incoming +queue should be short), the queue manager alternates between bringing +a new "incoming" message and a new "deferred" message into the +queue. This "round-robin" strategy prevents starvation of either +the incoming or the deferred queues.

    Each deferred queue scan only brings a fraction of the deferred queue back into the active queue for a retry. This is because each message in the deferred queue is assigned a "cool-off" time when it is deferred. This is done by time-warping the modification -time of the queue file into the future. The queue file is not +times of the queue file into the future. The queue file is not eligible for a retry if its modification time is not yet reached.

    @@ -800,34 +756,28 @@ within the limits. This means that young messages are initially retried more often than old messages.

    If a high volume site routinely has large deferred queues, it -may be useful to adjust the queue_run_delay, minimal_backoff_time and -maximal_backoff_time to provide short enough delays on first failure -(Postfix ≥ 2.4 has a sensibly low minimal backoff time by default), -with perhaps longer delays after multiple failures, to reduce the -retransmission rate of old messages and thereby reduce the quantity -of previously deferred mail in the active queue. If you want a really -low minimal_backoff_time, you may also want to lower queue_run_delay, -but understand that more frequent scans will increase the demand for -disk I/O.

    +may be useful to adjust the queue_run_delay, minimal_backoff_time +and maximal_backoff_time to provide short enough delays on first +failure, with perhaps longer delays after multiple failures, to +reduce the retransmission rate of old messages and thereby reduce +the quantity of previously deferred mail in the active queue.

    One common cause of large deferred queues is failure to validate recipients at the SMTP input stage. Since spammers routinely launch dictionary attacks from unrepliable sender addresses, the bounces -for invalid recipient addresses clog the deferred queue (and at high -volumes proportionally clog the active queue). Recipient validation -is strongly recommended through use of the local_recipient_maps and -relay_recipient_maps parameters. Even when bounces drain quickly they -inundate innocent victims of forgery with unwanted email. To avoid -this, do not accept mail for invalid recipients.

    +for invalid recipient addresses clog the deferred queue (and at +high volumes proportionally clog the active queue). Recipient +validation is strongly recommended through use of the local_recipient_maps +and relay_recipient_maps parameters.

    When a host with lots of deferred mail is down for some time, it is possible for the entire deferred queue to reach its retry time simultaneously. This can lead to a very full active queue once the host comes back up. The phenomenon can repeat approximately every maximal_backoff_time seconds if the messages are again deferred -after a brief burst of congestion. Perhaps, a future Postfix release +after a brief burst of congestion. Ideally, in the future Postfix will add a random offset to the retry time (or use a combination -of strategies) to reduce the odds of repeated complete deferred +of strategies) to reduce the chances of repeated complete deferred queue flushes.

    Credits

    diff --git a/postfix/proto/SASL_README.html b/postfix/proto/SASL_README.html index fd3441892..b9c662aaf 100644 --- a/postfix/proto/SASL_README.html +++ b/postfix/proto/SASL_README.html @@ -149,7 +149,7 @@ their CCARGS and AUXLIBS into the above command line.

    Building the Cyrus SASL library

    -

    Postfix appears to work with cyrus-sasl-1.5.x or cyrus-sasl-2.1.x, +

    Postfix appears to work with cyrus-sasl-1.5.5 or cyrus-sasl-2.1.1, which are available from:

    @@ -160,11 +160,11 @@ ftp://ftp.andrew.cmu.edu/pub/cyrus-mail/

    IMPORTANT: if you install the Cyrus SASL libraries as per the default, you will have to symlink /usr/lib/sasl -> /usr/local/lib/sasl -for version 1.5.x or /usr/lib/sasl2 -> /usr/local/lib/sasl2 for -version 2.1.x.

    +for version 1.5.5 or /usr/lib/sasl2 -> /usr/local/lib/sasl2 for +version 2.1.1.

    -

    Reportedly, Microsoft Outlook (Express) requires the -non-standard LOGIN authentication method. To enable this +

    Reportedly, Microsoft Internet Explorer version 5 requires the +non-standard SASL LOGIN authentication method. To enable this authentication method, specify ``./configure --enable-login''.

    Building Postfix with Cyrus SASL support

    @@ -178,7 +178,7 @@ and that the Cyrus SASL libraries are in /usr/local/lib.

    -
    (for Cyrus SASL version 1.5.x): +
    (for Cyrus SASL version 1.5.5): 
     % make tidy # if you have left-over files from a previous build
@@ -186,7 +186,7 @@ and that the Cyrus SASL libraries are in /usr/local/lib. 
    
     -I/usr/local/include" AUXLIBS="-L/usr/local/lib -lsasl"
    -
    (for Cyrus SASL version 2.1.x): +
    (for Cyrus SASL version 2.1.1): 
     % make tidy # if you have left-over files from a previous build
@@ -201,7 +201,7 @@ otherwise ld.so will not find the SASL shared library: 
    
 
 
    
 
-
     (for Cyrus SASL version 1.5.x):
+
     (for Cyrus SASL version 1.5.5):
 
    
 
     % make tidy # if you have left-over files from a previous build
@@ -210,7 +210,7 @@ otherwise ld.so will not find the SASL shared library: 
    
     -R/usr/local/lib -lsasl"
 
    
 
-
     (for Cyrus SASL version 2.1.x):
+
     (for Cyrus SASL version 2.1.1):
 
    
 
     % make tidy # if you have left-over files from a previous build
@@ -258,9 +258,8 @@ SMTP server
 
 
     Older Microsoft SMTP client software implements a non-standard
 version of the AUTH protocol syntax, and expects that the SMTP
-server replies to EHLO with "250 AUTH=mechanism-list" instead of
-"250 AUTH mechanism-list".  To accommodate such clients (in addition
-to conformant
+server replies to EHLO with "250 AUTH=stuff" instead of "250 AUTH
+stuff".  To accommodate such clients (in addition to conformant
 clients) use the following: 
    
 
 
    
@@ -319,41 +318,22 @@ the Dovecot authentication server. 
    
 
    Cyrus SASL configuration for the Postfix
 SMTP server
    
 
-
     You need to configure how the Cyrus SASL library should
-authenticate a client's username and password. These settings must
-be stored in a separate configuration file. 
    
-
-
     The name of the configuration file (default: smtpd.conf) will
-be constructed from a value sent by Postfix to the Cyrus SASL
-library, which adds the suffix .conf. The value is configured using
-one of the following variables: 
    
-
-
    
-
    -/etc/postfix/main.cf:
-    # Postfix 2.3 and later
-    smtpd_sasl_path = smtpd
-    # Postfix < 2.3
-    smtpd_sasl_application_name = smtpd
-
    
-
    
-
-
     Cyrus SASL searches for the configuration file in /usr/local/lib/sasl/
-(Cyrus SASL version 1.5.5) or /usr/local/lib/sasl2/ (Cyrus SASL
-version 2.1.x). 
    
+
     In /usr/local/lib/sasl/smtpd.conf (Cyrus SASL version 1.5.5) or
+/usr/local/lib/sasl2/smtpd.conf (Cyrus SASL version 2.1.1) you need to
+specify how the server should validate client passwords. 
    
 
 
     Note: some Postfix distributions are modified and look for 
-the smtpd.conf file in /etc/postfix/sasl. 
    
+the smtpd.conf file in /etc/postfix. 
    
 
 
     Note: some Cyrus SASL distributions look for the smtpd.conf
 file in /etc/sasl2. 
    
 
 
      
 
-
    •  
       To authenticate against the UNIX password database, use: 
      
+
    •  
       To authenticate against the UNIX password database, try: 
      
 
 
      
-
       (Cyrus SASL version 1.5.x)
+
       (Cyrus SASL version 1.5.5)
 
      
 
       /usr/local/lib/sasl/smtpd.conf:
@@ -361,13 +341,39 @@ file in /etc/sasl2. 
      
 
 
      
 
-
       IMPORTANT: pwcheck establishes a UNIX domain socket in /var/pwcheck
-and waits for authentication requests. Postfix processes must have
-read+execute permission to this directory or authentication attempts
-will fail. 
      
+
       (Cyrus SASL version 2.1.1)
+
      
+
      +/usr/local/lib/sasl2/smtpd.conf:
+    pwcheck_method: pwcheck
+
      
+
+
      
+
+
       The name of the file in /usr/local/lib/sasl (Cyrus SASL version
+1.5.5) or /usr/local/lib/sasl2 (Cyrus SASL version 2.1.1) used by
+the SASL
+library for configuration can be set with: 
      
+
+
      
+
      +/etc/postfix/main.cf:
+    smtpd_sasl_application_name = smtpd (Postfix < 2.3)
+    smtpd_sasl_path = smtpd (Postfix 2.3 and later)
+
      
+
      
 
 
       The pwcheck daemon is contained in the cyrus-sasl source tarball. 
      
 
+
       IMPORTANT: postfix processes need to have group read+execute
+permission for the /var/pwcheck directory, otherwise authentication
+attempts will fail. 
      
+
+
    •  
       Alternately, in Cyrus SASL 1.5.26 and later (including
+2.1.1), try: 
      
+
+
      
+
 
       (Cyrus SASL version 1.5.26)
 
      
 
      @@ -375,12 +381,11 @@ will fail. 
      
     pwcheck_method: saslauthd
 
      
 
-
       (Cyrus SASL version 2.1.x)
+
       (Cyrus SASL version 2.1.1)
 
      
 
       /usr/local/lib/sasl2/smtpd.conf:
     pwcheck_method: saslauthd
-    mech_list: PLAIN LOGIN
 
      
 
 
      
@@ -390,38 +395,27 @@ tarball.  It is more flexible than the pwcheck daemon, in that it
 can authenticate against PAM and various other sources. To use PAM,
 start saslauthd with "-a pam". 
      
 
-
       IMPORTANT: saslauthd usually establishes a UNIX domain socket
-in /var/run/saslauthd and waits for authentication requests. Postfix
-processes must have read+execute permission to this directory or
-authentication attempts will fail. 
      
-
-
       Note: The directory where saslauthd puts the socket is configurable.
-See the command-line option "-m /path/to/socket" in the saslauthd
---help listing. 
      
-
 
    •  
       To authenticate against Cyrus SASL's own password database: 
      
 
 
      
-
       (Cyrus SASL version 1.5.x)
+
       (Cyrus SASL version 1.5.5)
 
      
 
       /usr/local/lib/sasl/smtpd.conf:
-    pwcheck_method: sasldb
+    pwcheck_method:  sasldb
 
      
 
-
       (Cyrus SASL version 2.1.x)
+
       (Cyrus SASL version 2.1.1)
 
      
 
       /usr/local/lib/sasl2/smtpd.conf:
-    pwcheck_method: auxprop
-    auxprop_plugin: sasldb
-    mech_list: PLAIN LOGIN CRAM-MD5 DIGEST-MD5
+    pwcheck_method:  auxprop
 
      
 
 
      
 
 
       This will use the Cyrus SASL password file (default: /etc/sasldb in
-version 1.5.x, or /etc/sasldb2 in version 2.1.x), which is maintained
+version 1.5.5, or /etc/sasldb2 in version 2.1.1), which is maintained
 with the saslpasswd or saslpasswd2 command (part of the Cyrus SASL
 software). On some poorly-supported systems the saslpasswd command needs
 to be run multiple times before it stops complaining.  The Postfix SMTP
@@ -436,13 +430,13 @@ domain (realm) to a fully qualified domain name. 
      
 
       EXAMPLE: 
      
 
 
      
-
       (Cyrus SASL version 1.5.x)
+
       (Cyrus SASL version 1.5.5)
 
      
 
       % saslpasswd -c -u `postconf -h myhostname` exampleuser
 
      
 
-
       (Cyrus SASL version 2.1.x)
+
       (Cyrus SASL version 2.1.1)
 
      
 
       % saslpasswd2 -c -u `postconf -h myhostname` exampleuser
@@ -451,8 +445,8 @@ domain (realm) to a fully qualified domain name. 
      
 
      
 
 
       You can find out SASL's idea about the realms of the users
-in sasldb with sasldblistusers (Cyrus SASL version 1.5.x) or
-sasldblistusers2 (Cyrus SASL version 2.1.x). 
      
+in sasldb with sasldblistusers (Cyrus SASL version 1.5.5) or
+sasldblistusers2 (Cyrus SASL version 2.1.1). 
      
 
 
       On the Postfix side, you can have only one realm per smtpd
 instance, and only the users belonging to that realm would be able to
@@ -468,14 +462,18 @@ realm used by smtpd: 
      
 
 
    
 
-
     IMPORTANT: The Cyrus SASL password verification services pwcheck
-and saslauthd can only support the plaintext mechanisms PLAIN or
-LOGIN.  However, the Cyrus SASL library doesn't know this, and will
-happily advertise other authentication mechanisms that the SASL
-library implements, such as DIGEST-MD5. As a result, if an SMTP
-client chooses any mechanism other than PLAIN or LOGIN while pwcheck
-or saslauthd are used, authentication will fail. Thus you may need
-to limit the list of mechanisms advertised by Postfix. 
    
+
     IMPORTANT: all users must be able to authenticate using ALL
+authentication mechanisms advertised by Postfix, otherwise the
+negotiation might end up with an unsupported mechanism, and
+authentication would fail.  For example if you configure SASL to
+use saslauthd for authentication against PAM (pluggable
+authentication modules), only the PLAIN and LOGIN mechanisms are
+supported and stand a chance to succeed, yet the SASL library would also
+advertise other mechanisms, such as DIGEST-MD5.  This happens because
+those mechanisms are made available by other plugins, and the SASL
+library have no way to know that your only valid authentication source
+is PAM.  Thus you might need to limit the list of mechanisms advertised
+by Postfix. 
    
 
 
       
 
@@ -483,9 +481,7 @@ to limit the list of mechanisms advertised by Postfix. 
      
 library files from the SASL plug-in directory (and again whenever
 the system is updated). 
      
 
-
    •  
       With Cyrus SASL version 2.1.x or later the mech_list variable
-can specify a list of authentication mechanisms that Cyrus SASL may
-offer: 
      
+
    •  
       With Cyrus SASL version 2.1.1 or later: 
      
 
 
      
 
      @@ -501,17 +497,17 @@ used for authentication. 
      
 
 
        
 
-
      •  
         With Cyrus SASL version 1.5.x your only choice is to
+
      •  
         With Cyrus SASL version 1.5.5 your only choice is to
 delete the corresponding library files from the SASL plug-in 
 directory. 
        
 
-
      •  
         With SASL version 2.1.x: 
        
+
      •  
         With SASL version 2.1.1: 
        
 
 
        
 
         /usr/local/lib/sasl2/smtpd.conf:
-    pwcheck_method: auxprop
-    auxprop_plugin: sql
+    pwcheck_method:  auxprop
+    auxprop_plugin:  sql
 
        
 
        
 
@@ -574,10 +570,8 @@ to recover from the base64-encoded form. 
        
 
        Trouble shooting the SASL internals
        
 
 
         In the Cyrus SASL sources you'll find a subdirectory named
-"sample".  Run make there, then create a symbolic link from sample.conf
-to smtpd.conf in your Cyrus SASL library directory /usr/local/lib/sasl2.
-"su" to the user postfix (or whatever your mail_owner
-directive is set to): 
        
+"sample".  Run make there, "su" to the user postfix (or
+whatever your mail_owner directive is set to):
 
 
        
 
        @@ -586,11 +580,10 @@ directive is set to): 
        
 
        
 
 
         then run the resulting sample server and client in separate
-terminals.  The sample applications send log messages to the syslog
-facility auth.  Check the log to fix the problem or run strace /
-ktrace / truss on the server to see what makes it unhappy. Repeat
-the previous step until you can successfully authenticate with the
-sample client. Only then get back to Postfix. 
        
+terminals.  Strace / ktrace / truss the server to see what makes
+it unhappy, and fix the problem.  Repeat the previous step until
+you can successfully authenticate with the sample client.  Only
+then get back to Postfix. 
        
 
 
        Enabling SASL authentication in the
 Postfix SMTP client
        
@@ -619,12 +612,6 @@ table. 
        
 
      
 
      
 
-
       The Postfix SASL client password file is opened before the SMTP
-server enters the optional chroot jail, so you can keep the file
-in /etc/postfix and set permissions read / write only for root to
-keep the username:password combinations away from other system
-users. 
      
-
 
       Postfix version 2.3 supports-per-sender SASL password
 information. To search the Postfix SASL password by sender 
 before it searches by destination, specify: 
      
@@ -658,6 +645,10 @@ for example:
    +

    The Postfix SASL client password file is opened before the SMTP server +enters the optional chroot jail, so you can keep the file in +/etc/postfix.

    +

    Note: Some SMTP servers support authentication mechanisms that, although available on the client system, may not in practice work or possess the appropriate credentials to authenticate to the server. It @@ -673,7 +664,7 @@ into consideration:

    • In the above example, Postfix will decline to use mechanisms -that require special infrastructure such as Kerberos or TLS.

    +that require special infrastructure such as Kerberos.

    The Postfix SMTP client is backwards compatible with SMTP servers that use the non-standard "AUTH=method..." syntax in response @@ -703,9 +694,6 @@ smtpd_sasl_application_name into smtpd_sasl_path.

  • The Dovecot SMTP server-only plug-in was originally implemented by Timo Sirainen of Procontrol, Finland. -
  • Patrick Ben Koetter revised this document for Postfix 2.4 and -made much needed updates. - diff --git a/postfix/proto/SMTPD_POLICY_README.html b/postfix/proto/SMTPD_POLICY_README.html index b0fc39ee3..b2056a0c3 100644 --- a/postfix/proto/SMTPD_POLICY_README.html +++ b/postfix/proto/SMTPD_POLICY_README.html @@ -35,8 +35,7 @@ at http://www.openspf.org/Software.

    Policy delegation is now the preferred method for adding policies to Postfix. It's much easier to develop a new feature in few lines -of Perl, Python, Ruby, or TCL, than trying to do the same in C code. -The difference in +of Perl, than trying to do the same in C code. The difference in performance will be unnoticeable except in the most demanding environments. On active systems a policy daemon process is used multiple times, for up to $max_use incoming SMTP connections.

    @@ -165,7 +164,7 @@ etrn_domain= These attributes are empty in case of no certificate authentication. As of Postfix 2.2.11 these attribute values are encoded as xtext: some characters are represented by +XX, where XX is the - two-digit hexadecimal representation of the character value. + two-digit hecadecimal representation of the character value.

  • The "encryption_*" attributes (Postfix 2.3 and later) diff --git a/postfix/proto/SMTPD_PROXY_README.html b/postfix/proto/SMTPD_PROXY_README.html index 0972052fb..d67c609dc 100644 --- a/postfix/proto/SMTPD_PROXY_README.html +++ b/postfix/proto/SMTPD_PROXY_README.html @@ -118,8 +118,6 @@ Postfix and does one of the following:

  • Re-inject the mail back into Postfix via SMTP, perhaps after changing its content and/or destination.

    -

  • Discard or quarantine the mail.

    -

  • Reject the mail by sending a suitable SMTP status code back to Postfix. Postfix passes the status back to the remote SMTP client. This way, Postfix does not have to send a bounce @@ -270,8 +268,9 @@ the top of the master.cf file:

    This limit is not necessary if you receive all mail from a trusted relay host.

    -

    Note: this setting is available in Postfix version 2.2 and - later. Earlier Postfix versions will ignore it.

    +

    Note: this setting is ignored by the stable Postfix 2.1 + release. The feature will be available only in the experimental + release until Postfix 2.2.

  • The "-o smtpd_proxy_filter=127.0.0.1:10025" tells the before filter SMTP server that it should give incoming mail to diff --git a/postfix/proto/TLS_LEGACY_README.html b/postfix/proto/TLS_LEGACY_README.html index a46f99c58..ba1dff037 100644 --- a/postfix/proto/TLS_LEGACY_README.html +++ b/postfix/proto/TLS_LEGACY_README.html @@ -829,7 +829,7 @@ is correctly configured to supply its intermediate CA certificate). 

     /etc/postfix/main.cf:
     smtp_tls_dcert_file = /etc/postfix/client-dsa.pem
-    smtp_tls_dkey_file = $smtp_tls_dcert_file
+    smtp_tls_dkey_file = $smtpd_tls_cert_file
    @@ -857,7 +857,7 @@ privileges) from the files in the directory when the information is needed. Thus, the $smtp_tls_CApath directory needs to be accessible inside the optional chroot jail.

    -

    The choice between $smtp_tls_CAfile and $smtp_tls_CApath is +

    The choice between $smtp_tls_CAfile and $smtpd_tls_CApath is a space/time tradeoff. If there are many trusted CAs, the cost of preloading them all into memory may not pay off in reduced access time when the certificate is needed.

    diff --git a/postfix/proto/TLS_README.html b/postfix/proto/TLS_README.html index e63a7e670..0d341714b 100644 --- a/postfix/proto/TLS_README.html +++ b/postfix/proto/TLS_README.html @@ -969,7 +969,7 @@ is correctly configured to supply its intermediate CA certificate). 

     /etc/postfix/main.cf:
     smtp_tls_dcert_file = /etc/postfix/client-dsa.pem
-    smtp_tls_dkey_file = $smtp_tls_dcert_file
+    smtp_tls_dkey_file = $smtpd_tls_cert_file
    @@ -997,7 +997,7 @@ privileges) from the files in the directory when the information is needed. Thus, the $smtp_tls_CApath directory needs to be accessible inside the optional chroot jail.

    -

    The choice between $smtp_tls_CAfile and $smtp_tls_CApath is +

    The choice between $smtp_tls_CAfile and $smtpd_tls_CApath is a space/time tradeoff. If there are many trusted CAs, the cost of preloading them all into memory may not pay off in reduced access time when the certificate is needed.

    @@ -1222,7 +1222,7 @@ TLS is used selectively, only with destinations explicitly configured for TLS.

    You can disable TLS for a subset of destinations, while leaving -it enabled for the rest. With the Postfix 2.3 and later TLS policy table, specify the "none" security level. With the obsolete per-site table, specify the "NONE" keyword.

    @@ -1267,7 +1267,7 @@ Attempts to configure opportunistic encryption of LMTP sessions will be ignored with a warning written to the mail logs.

    You can enable opportunistic TLS just for selected destinations. With -the Postfix 2.3 and later TLS policy table, +the Postfix 2.3+ TLS policy table, specify the "may" security level. With the obsolete per-site table, specify the "MAY" keyword.

    @@ -1329,11 +1329,11 @@ that delivers mail to the Internet, you should not configure mandatory TLS encryption as the default security level.

    You can enable mandatory TLS encryption just for specific destinations. -With the Postfix 2.3 and later TLS policy +With the Postfix 2.3+ TLS policy table, specify the "encrypt" security level. With the obsolete per-site table, specify the "MUST_NOPEERMATCH" keyword. While the obsolete approach still works -with Postfix 2.3, it is strongly discouraged: users of Postfix 2.3 and later +with Postfix 2.3, it is strongly discouraged: users of Postfix 2.3+ should use the new TLS policy settings.

    Examples:

    @@ -1357,7 +1357,7 @@ level sessions.

    Postfix 2.2 syntax (no support for sub-domains without resorting to -regexp tables). With Postfix 2.3 and later, do not use the obsolete per-site table.

    @@ -1408,8 +1408,7 @@ example, "example.net"). Instead, use the destination (for example, "[example.net]:587"), as the per-site table lookup key (a recipient domain or MX-enabled transport nexthop with no port suffix may look like a bare -hostname, but is still a suitable destination). With Postfix 2.3 -and later, +hostname, but is still a suitable destination). With Postfix 2.3+, do not use the obsolete per-site table; use the new policy table instead.

    @@ -1469,12 +1468,12 @@ href="#client_tls_secure">secure-channel configuration instead.

    You can enable mandatory server certificate verification just -for specific destinations. With the Postfix 2.3 and later TLS policy table, specify the "verify" security level. With the obsolete per-site table, specify the "MUST" keyword. While the obsolete approach still works with Postfix 2.3, it is strongly discouraged: users of -Postfix 2.3 and later should use the new TLS policy settings.

    +Postfix 2.3+ should use the new TLS policy settings.

    Example:

    @@ -1551,13 +1550,12 @@ sends all email to a central mailhub that offers the necessary STARTTLS support.

    You can enable secure TLS verification just for specific destinations. -With the Postfix 2.3 and later TLS policy table, +With the Postfix 2.3+ TLS policy table, specify the "secure" security level. With the obsolete per-site table, specify the "MUST" keyword and harden the certificate verification against DNS forgery. While the obsolete approach still -works with Postfix 2.3, it is strongly discouraged: users of Postfix 2.3 -and later +works with Postfix 2.3, it is strongly discouraged: users of Postfix 2.3+ should use the new TLS policy settings.

    Examples:

    @@ -1636,15 +1634,14 @@ email if the related domains change hands.

    -

    Postfix 2.2.9 and later syntax:

    +

    Postfix 2.2.9+ syntax:

    Note: Avoid policy lookups with the bare hostname (for example, "tls.example.com"). Instead, use the destination (for example, "[tls.example.com]") as the per-site table lookup key (a recipient domain or MX-enabled transport nexthop with no port suffix may look like a bare -hostname, but is still a suitable destination). With Postfix 2.3 -and later, +hostname, but is still a suitable destination). With Postfix 2.3+, do not use the obsolete per-site table; use the new policy table instead.

    @@ -1812,8 +1809,7 @@ for sessions with mandatory encryption.

    full destination nexthop (enclosed in [] with a possible ":port" suffix) as the per-site table lookup key (a recipient domain or MX-enabled transport nexthop with no port suffix may look like a bare -hostname, but is still a suitable destination). With Postfix 2.3 -and later, +hostname, but is still a suitable destination). With Postfix 2.3+, use of the obsolete approach documented here is strongly discouraged: use the new policy table instead.

    @@ -1930,8 +1926,7 @@ obsolete per-site TLS policies

    For a general discussion of TLS security for SMTP see TLS limitations above. What follows applies only to Postfix 2.2.9 and subsequent Postfix 2.2 patch levels. Do -not use this approach with Postfix 2.3 -and later; instead see the instructions under secure server certificate verification.

    As long as no secure DNS lookup mechanism is available, false diff --git a/postfix/proto/TUNING_README.html b/postfix/proto/TUNING_README.html index 1a7f756b6..9882044aa 100644 --- a/postfix/proto/TUNING_README.html +++ b/postfix/proto/TUNING_README.html @@ -224,56 +224,42 @@ seconds or $smtpd_error_sleep_time, whichever is more.

    Measures against clients that make too many connections

    -

    Note: these features use the Postfix anvil(8) service, introduced -with Postfix version 2.2.

    +

    Note: this feature is not included with Postfix version 2.1.

    The Postfix smtpd(8) server can limit the number of simultaneous -connections from the same SMTP client, as well as the connection -rate and the rate of certain SMTP commands from the same client. +connections from the same SMTP client, as well as the number of +connections that a client is allowed to make per unit time. These statistics are maintained by the anvil(8) server (translation: if anvil(8) breaks, then connection limits stop working).

    -

    IMPORTANT: These limits must not be used to regulate legitimate -traffic: mail will suffer grotesque delays if you do so. The limits -are designed to protect the smtpd(8) server against abuse by -out-of-control clients.

    +

    IMPORTANT: These limits are designed to protect the smtpd(8) server +against flagrant abuse. Do not use these limits to regulate legitimate +traffic: mail will suffer grotesque delays if you do so.

    -
    - -
    - -
    smtpd_client_connection_count_limit (default: 50)
    -The maximum number of connections than an SMTP client may make -simultaneously.
    +
      -
      smtpd_client_connection_rate_limit (default: no limit)
      -
      The maximum number of connections that an SMTP client may make -in the time interval specified with anvil_rate_time_unit (default: -60s).
      +

    • An SMTP client may make up to $smtpd_client_connection_count_limit +simultaneous connections (default: 50). This is half the default +process limit.

      -
      smtpd_client_message_rate_limit (default: no limit)
      -The maximum number of message delivery requests that an SMTP client -may make in the time interval specified with anvil_rate_time_unit -(default: 60s).
      +

    • An SMTP client may make up to $smtpd_client_message_rate_limit +message delivery requests per unit time (default: no limit).

      -
      smtpd_client_recipient_rate_limit (default: no limit)
      -
      The maximum number of recipient addresses that an SMTP client -may specify in the time interval specified with anvil_rate_time_unit -(default: 60s).
      +

    • An SMTP client may send up to $smtpd_client_recipient_rate_limit +recipient addresses per unit time (default: no limit).

      -
      smtpd_client_new_tls_session_rate_limit (default: no limit) -
      The maximum number of new TLS sessions (without using -the TLS session cache) that an SMTP client may negotiate in the -time interval specified with anvil_rate_time_unit (default: 60s). -
      +

    • An SMTP client may make up to $smtpd_client_connection_rate_limit +connections per unit time (default: no limit).

      -
      smtpd_client_event_limit_exceptions (default: $mynetworks) -
      SMTP clients that are excluded from connection and rate -limits specified above.
      +

    • These limits are not applied to SMTP clients in the networks +specified with $smtpd_client_event_limit_exceptions (default: +clients in $mynetworks may make an unlimited number of connections). -

    +

  • The anvil_rate_time_unit parameter specifies the time +unit over which client connection rates are computed (default: +60s). -

    • +

    General mail delivery performance tips

    @@ -373,7 +359,7 @@ is not useful. Another good reason to limit delivery concurrency to the same recipient: if the recipient has an expensive shell command in her .forward file, or if the recipient is a mailing list manager, you don't want to run too many instances of those processes -at the same time.

    +the same time.

  • The default smtp_destination_concurrency_limit of 20 seems enough to noticeably load a system without bringing it to its knees. @@ -478,12 +464,10 @@ some amount of time.

    -
    queue_run_delay (default: 300 seconds; before Postfix 2.4: -1000s)
    How often +
    queue_run_delay (default: 1000 seconds)
    How often the queue manager scans the queue for deferred mail.
    -
    minimal_backoff_time (default: 300 seconds; before Postfix -2.4: 1000s)
    The +
    minimal_backoff_time (default: 1000 seconds)
    The minimal amount of time a message won't be looked at, and the minimal amount of time to stay away from a "dead" destination.
    @@ -534,8 +518,7 @@ that usually requires timing out one or more SMTP connections.

    always better than increasing the frequency of delivery attempts. However, if you can control only the delivery attempt frequency, consider using a dedicated fallback_relay "graveyard" machine for -bad destinations, so that these destinations do not ruin the -performance of normal +bad destinations so that they do not ruin the performance of normal mail deliveries.

    Tuning the number of Postfix processes

    @@ -589,20 +572,6 @@ errors.

      -

    • Depending on your Postfix and operating system versions -you may need to recompile Postfix if you need more than 1024 file -descriptors per process:

      - -

      • No recompilation is needed for Postfix version 2.4 -and later, when it was compiled for systems that support BSD kqueue(2) -(FreeBSD 4.1, NetBSD 2.0, OpenBSD 2.9), Solaris 8 /dev/poll, or -Linux 2.6 epoll(4).

        - -

      • Otherwise, Postfix needs to be recompiled to override the -default FD_SETSIZE value.

        - -
      -

    • Reduce the number of processes as described under "Tuning the number of Postfix processes" above. Fewer processes need fewer open files and sockets.

      @@ -615,8 +584,7 @@ with your system tuning guide:

      • Some FreeBSD kernel parameters can be specified in -/boot/loader.conf, and some can be specified in /etc/sysctl.conf -or changed with sysctl commands. +/boot/loader.conf, and some can be changed with sysctl commands. Which is which depends on the version.

        @@ -629,7 +597,7 @@ kern.maxfilesperproc="16384"

      • Linux kernel parameters can be specified in /etc/sysctl.conf -or changed with sysctl commands:

        +and can also be changed with sysctl commands: 

         fs.file-max=16384
@@ -638,7 +606,7 @@ kernel.threads-max=2048
 
 
      •  
         Solaris kernel parameters can be specified in /etc/system,
 as described in the Solaris
+href="http://www.science.uva.nl/pub/solaris/solaris2.html#q3.46">Solaris
 FAQ entry titled "How can I increase the number of file
 descriptors per process?" 
        
 
diff --git a/postfix/proto/ULTRIX_README.html b/postfix/proto/ULTRIX_README.html
new file mode 100644
index 000000000..b2fb39c4e
--- /dev/null
+++ b/postfix/proto/ULTRIX_README.html
@@ -0,0 +1,71 @@
+
+
+
+
+
+
+Postfix and Ultrix 
+
+
+
+
+
+
+
+
        Postfix and Ultrix 
        
+
+
        
+
+
         Postfix on Ultrix 
        
+
+
         This document is probably only of historical value, because
+Ultrix version 4 dates from the early 1990s. However, as long as
+Wietse keeps Postfix alive for SunOS 4, it is likely to run on
+Ultrix 4 with very little change. Feedback is welcome if anyone
+actually still uses Postfix on any version of Ultrix. 
        
+
+
         The source of this document is an email message by Christian von Roques
+that was sent on Jun 2, 1999. 
        
+
+
         
+
+
         I've upgraded the MTA of our DECstation-3100 running Ultrix4.3a to
+postfix-19990317-pl05 and am sending you the patches I needed to get
+it running under Ultrix. 
        
+
+
         . . . 
        
+
+
         One of the bugs of Ultrix's /bin/sh is that shell-variables
+set in arguments of `:' expand to garbage if expanded in here-documents.
+Using a different shell helps.  I needed to replace all calls of
+``sh .../makedefs'' by ``$(SHELL) .../makedefs'' in all the
+Makefile.in and am now able to use ``make SHELL=/bin/sh5'' or zsh.
+
+
         . . . 
        
+
+
         Ultrix's FD_SET_SIZE is 4096, but getdtablesize()
+returns 64 by default, if not increased when building a new
+kernel.  getrlimit() doesn't know RLIMIT_NOFILE.  This makes
+event_init() always log the warning: `could allocate space for
+only 64 open files'. 
        
+
+
         I just reduced the threshold from 256 to 64, but this is not good.
+The initial problem still remains: How to disable this warning on
+Ultrix without making the source ugly?   
        
+
+
        
+
+
         To work around the first problem, all the Makefile.in files
+have been updated to use `$(SHELL)' instead of `sh'. So you only
+need to supply a non-default shell in order to eliminate Ultrix
+shell trouble.  
        
+
+
         To work around the latter, util/sys_defs.h was updated for
+Ultrix, with a default FD_SETSIZE of 100.  This should be sufficient
+for a workstation. Even in 1999, no-one would run a major mail hub
+on Ultrix 4. 
        
+
+
+
+
diff --git a/postfix/proto/VIRTUAL_README.html b/postfix/proto/VIRTUAL_README.html
index 7139d0934..eea8bafd3 100644
--- a/postfix/proto/VIRTUAL_README.html
+++ b/postfix/proto/VIRTUAL_README.html
@@ -432,13 +432,9 @@ domain!  
        
 
 
      •  
         Lines 4, 7-13: The virtual_mailbox_maps parameter specifies
 the lookup table with all valid recipient addresses. The lookup
-result value is ignored by Postfix.  In the above example,
-info@example.com
-and sales@example.com are listed as valid addresses; other mail for
-example.com is rejected with "User unknown" by the Postfix SMTP
-server. It's left up to the non-Postfix delivery agent to reject
-non-existent recipients from local submission or from local alias
-expansion.  If you intend to
+result is ignored by Postfix.  In the above example, info@example.com
+and sales@example.com are listed as valid addresses, and mail for
+anything else is rejected with "User unknown". If you intend to
 use LDAP, MySQL or PgSQL instead of local files, be sure to review
 the  "local files versus databases"
 section at the top of this document! 
        
diff --git a/postfix/proto/access b/postfix/proto/access
index 3cf8366e5..2e2af8615 100644
--- a/postfix/proto/access
+++ b/postfix/proto/access
@@ -2,7 +2,7 @@
 # NAME
 #	access 5
 # SUMMARY
-#	Postfix SMTP server access table
+#	Postfix access table format
 # SYNOPSIS
 #	\fBpostmap /etc/postfix/access\fR
 #
@@ -10,28 +10,29 @@
 #
 #	\fBpostmap -q - /etc/postfix/access <\fIinputfile\fR
 # DESCRIPTION
-#	This document describes access control on remote SMTP client
-#	information: host names, network addresses, and envelope
-#	sender or recipient addresses; it is implemented by the
-#	Postfix SMTP server.  See \fBheader_checks\fR(5) or
-#	\fBbody_checks\fR(5) for access control on the content of
-#	email messages.
+#	The optional \fBaccess\fR(5) table directs the Postfix SMTP server
+#	to selectively reject or accept mail. Access can be allowed or
+#	denied for specific host names, domain names, networks, host
+#	addresses or mail addresses.
+#
+#	For an example, see the EXAMPLE section at the end of this
+#	manual page.
 #
 #	Normally, the \fBaccess\fR(5) table is specified as a text file
 #	that serves as input to the \fBpostmap\fR(1) command.
 #	The result, an indexed file in \fBdbm\fR or \fBdb\fR format,
-#	is used for fast searching by the mail system. Execute the
-#	command "\fBpostmap /etc/postfix/access\fR" to rebuild an
-#	indexed file after changing the corresponding text file.
+#	is used for fast searching by the mail system. Execute the command
+#	"\fBpostmap /etc/postfix/access\fR" in order to rebuild the indexed
+#	file after changing the access table.
 #
 #	When the table is provided via other means such as NIS, LDAP
 #	or SQL, the same lookups are done as for ordinary indexed files.
 #
 #	Alternatively, the table can be provided as a regular-expression
 #	map where patterns are given as regular expressions, or lookups
-#	can be directed to TCP-based server. In those cases, the lookups
-#	are done in a slightly different way as described below under
-#	"REGULAR EXPRESSION TABLES" or "TCP-BASED TABLES".
+#	can be directed to TCP-based server. In that case, the lookups are
+#	done in a slightly different way as described below under
+#	"REGULAR EXPRESSION TABLES" and "TCP-BASED TABLES".
 # CASE FOLDING
 # .ad
 # .fi
@@ -111,9 +112,9 @@
 #	match is found in the access table, or until further
 #	truncation is not possible.
 #
-#	NOTE 1: The access map lookup key must be in canonical form:
-#	do not specify unnecessary null characters, and do not
-#	enclose network address information with "[]" characters.
+#	NOTE 1: The information in the access map should be in
+#	canonical form, with unnecessary null characters eliminated.
+#	Address information must not be enclosed with "[]" characters.
 #
 #	NOTE 2: use the \fBcidr\fR lookup table type to specify
 #	network/netmask patterns. See \fBcidr_table\fR(5) for details.
@@ -134,9 +135,9 @@
 #	string representation of the IPv6 host address. Thus, not
 #	all the ":" subnetworks will be tried.
 #
-#	NOTE 2: The access map lookup key must be in canonical form:
-#	do not specify unnecessary null characters, and do not
-#	enclose network address information with "[]" characters.
+#	NOTE 2: The information in the access map should be in
+#	canonical form, with unnecessary null characters eliminated.
+#	Address information must not be enclosed with "[]" characters.
 #
 #	NOTE 3: use the \fBcidr\fR lookup table type to specify
 #	network/netmask patterns. See \fBcidr_table\fR(5) for details.
@@ -174,8 +175,7 @@
 #	specified, otherwise reply with a generic error response message.
 # .IP "\fBDEFER_IF_REJECT \fIoptional text...\fR
 #	Defer the request if some later restriction would result in a
-#	REJECT action. Reply with "\fB450 4.7.1 \fI optional
-#	text...\fR when the
+#	REJECT action. Reply with "\fB450\fI optional text...\fR when the
 #	optional text is specified, otherwise reply with a generic error
 #	response message.
 # .sp
@@ -183,7 +183,7 @@
 # .IP "\fBDEFER_IF_PERMIT \fIoptional text...\fR
 #	Defer the request if some later restriction would result in a
 #	an explicit or implicit PERMIT action.
-#	Reply with "\fB450 4.7.1 \fI optional text...\fR when the
+#	Reply with "\fB450\fI optional text...\fR when the
 #	optional text is specified, otherwise reply with a generic error
 #	response message.
 # .sp
@@ -244,7 +244,7 @@
 #	More information
 #	about external content filters is in the Postfix FILTER_README file.
 # .sp
-#	Note: this action overrides the \fBcontent_filter\fR setting,
+#	Note: this action overrides the \fBmain.cf content_filter\fR setting,
 #	and currently affects all recipients of the message.
 # .sp
 #	This feature is available in Postfix 2.0 and later.
@@ -260,21 +260,20 @@
 # .sp
 #	Note: use "\fBpostsuper -r\fR" to release mail that was kept on
 #	hold for a significant fraction of \fB$maximal_queue_lifetime\fR
-#	or \fB$bounce_queue_lifetime\fR, or longer. Use "\fBpostsuper -H\fR"
-#	only for mail that will not expire within a few delivery attempts.
+#	or \fB$bounce_queue_lifetime\fR, or longer.
 # .sp
 #	Note: this action currently affects all recipients of the message.
 # .sp
 #	This feature is available in Postfix 2.0 and later.
 # .IP "\fBPREPEND \fIheadername: headervalue\fR"
 #	Prepend the specified message header to the message.
-#	When more than one PREPEND action executes, the first
-#	prepended header appears before the second etc. prepended
-#	header.
+#	When this action is used multiple times, the first prepended
+#	header appears before the second etc. prepended header.
+# .sp
+#	Note: this action does not support multi-line message headers.
 # .sp
-#	Note: this action must execute before the message content
-#	is received; it cannot execute in the context of
-#	\fBsmtpd_end_of_data_restrictions\fR.
+#	Note: this action must be used before the message content
+#	is received; it cannot be used in \fBsmtpd_end_of_data_restrictions\fR.
 # .sp
 #	This feature is available in Postfix 2.1 and later.
 # .IP "\fBREDIRECT \fIuser@domain\fR"
@@ -340,7 +339,7 @@
 #	This section describes how the table lookups change when lookups
 #	are directed to a TCP-based server. For a description of the TCP
 #	client/server lookup protocol, see \fBtcp_table\fR(5).
-#	This feature is not available up to and including Postfix version 2.4.
+#	This feature is not available up to and including Postfix version 2.3.
 #
 #	Each lookup operation uses the entire query string once.
 #	Depending on the application, that string is an entire client
diff --git a/postfix/proto/aliases b/postfix/proto/aliases
index 2ac242c9f..4aab46b31 100644
--- a/postfix/proto/aliases
+++ b/postfix/proto/aliases
@@ -69,8 +69,8 @@
 #	When the command fails, a limited amount of command output is
 #	mailed back to the sender.  The file \fB/usr/include/sysexits.h\fR
 #	defines the expected exit status codes. For example, use
-#	\fB"|exit 67"\fR to simulate a "user unknown" error, and
-#	\fB"|exit 0"\fR to implement an expensive black hole.
+#	\fB|"exit 67"\fR to simulate a "user unknown" error, and
+#	\fB|"exit 0"\fR to implement an expensive black hole.
 # .IP \fB:include:\fI/file/name\fR
 #	Mail is sent to the destinations listed in the named file.
 #	Lines in \fB:include:\fR files have the same syntax
diff --git a/postfix/proto/bounce b/postfix/proto/bounce
index 113fea84f..842cad9b8 100644
--- a/postfix/proto/bounce
+++ b/postfix/proto/bounce
@@ -24,8 +24,7 @@
 # GENERAL PROCEDURE
 # .ad
 # .fi
-#	To create a customized bounce template file, create a
-#	temporary
+#	To create customized bounce template file, create a temporary
 #	copy of the file \fB/etc/postfix/bounce.cf.default\fR and
 #	edit the temporary file.
 #
diff --git a/postfix/proto/canonical b/postfix/proto/canonical
index cc65ec407..1aeb6e752 100644
--- a/postfix/proto/canonical
+++ b/postfix/proto/canonical
@@ -19,17 +19,17 @@
 #	that serves as input to the \fBpostmap\fR(1) command.
 #	The result, an indexed file in \fBdbm\fR or \fBdb\fR format,
 #	is used for fast searching by the mail system. Execute the command
-#	"\fBpostmap /etc/postfix/canonical\fR" to rebuild an indexed
-#	file after changing the corresponding text file.
+#	"\fBpostmap /etc/postfix/canonical\fR" in order to rebuild the indexed
+#	file after changing the text file.
 #
 #	When the table is provided via other means such as NIS, LDAP
 #	or SQL, the same lookups are done as for ordinary indexed files.
 #
 #	Alternatively, the table can be provided as a regular-expression
 #	map where patterns are given as regular expressions, or lookups
-#	can be directed to TCP-based server. In those cases, the lookups
-#	are done in a slightly different way as described below under
-#	"REGULAR EXPRESSION TABLES" or "TCP-BASED TABLES".
+#	can be directed to TCP-based server. In that case, the lookups are
+#	done in a slightly different way as described below under
+#	"REGULAR EXPRESSION TABLES" and "TCP-BASED TABLES".
 #
 #	By default the \fBcanonical\fR(5) mapping affects both message
 #	header addresses (i.e. addresses that appear inside messages)
@@ -49,9 +49,10 @@
 #	by legacy mail systems.
 #
 #	The \fBcanonical\fR(5) mapping is not to be confused with \fIvirtual
-#	alias\fR support or with local aliasing. To change the destination
-#	but not the headers, use the \fBvirtual\fR(5) or \fBaliases\fR(5)
-#	map instead.
+#	domain\fR support. Use the \fBvirtual\fR(5) map for that purpose.
+#
+#	The \fBcanonical\fR(5) mapping is not to be confused with local aliasing.
+#	Use the \fBaliases\fR(5) map for that purpose.
 # CASE FOLDING
 # .ad
 # .fi
@@ -96,13 +97,6 @@
 # .IP "@\fIdomain address\fR"
 #	Replace other addresses in \fIdomain\fR by \fIaddress\fR.
 #	This form has the lowest precedence.
-# .sp
-#	Note: @\fIdomain\fR is a wild-card. When this form is applied
-#	to recipient addresses, the Postfix SMTP server accepts
-#	mail for any recipient in \fIdomain\fR, regardless of whether
-#	that recipient exists.  This may turn your mail system into
-#	a backscatter source that returns undeliverable spam to
-#	innocent people.
 # RESULT ADDRESS REWRITING
 # .ad
 # .fi
@@ -152,7 +146,7 @@
 #	This section describes how the table lookups change when lookups
 #	are directed to a TCP-based server. For a description of the TCP
 #	client/server lookup protocol, see \fBtcp_table\fR(5).
-#	This feature is not available up to and including Postfix version 2.4.
+#	This feature is not available up to and including Postfix version 2.3.
 #	
 #	Each lookup operation uses the entire address once.  Thus,
 #	\fIuser@domain\fR mail addresses are not broken up into their
diff --git a/postfix/proto/cidr_table b/postfix/proto/cidr_table
index eee19478a..478326222 100644
--- a/postfix/proto/cidr_table
+++ b/postfix/proto/cidr_table
@@ -11,10 +11,7 @@
 #	The Postfix mail system uses optional lookup tables.
 #	These tables are usually in \fBdbm\fR or \fBdb\fR format.
 #	Alternatively, lookup tables can be specified in CIDR
-#	(Classless Inter-Domain Routing) form. In this case, each
-#	input is compared against a list of patterns. When a match
-#	is found, the corresponding result is returned and the search
-#	is terminated.
+#	(Classless Inter-Domain Routing) form.
 #
 #	To find out what types of lookup tables your Postfix system
 #	supports use the "\fBpostconf -m\fR" command.
@@ -40,7 +37,7 @@
 #	will be matched regardless of redundant zero characters.
 #
 #	Note: address information may be enclosed inside "[]" but
-#	this form is not required.
+#	this form is not recommended.
 #
 #	IPv6 support is available in Postfix 2.2 and later.
 # .IP "\fInetwork_address     result\fR"
@@ -84,6 +81,7 @@
 # AUTHOR(S)
 #	The CIDR table lookup code was originally written by:
 #	Jozsef Kadlecsik
+#	kadlec@blackhole.kfki.hu
 #	KFKI Research Institute for Particle and Nuclear Physics
 #	POB. 49
 #	1525 Budapest, Hungary
diff --git a/postfix/proto/generic b/postfix/proto/generic
index 7c4374ced..d19dfde45 100644
--- a/postfix/proto/generic
+++ b/postfix/proto/generic
@@ -33,7 +33,7 @@
 #	command.  The result, an indexed file in \fBdbm\fR or
 #	\fBdb\fR format, is used for fast searching by the mail
 #	system. Execute the command "\fBpostmap /etc/postfix/generic\fR"
-#	to rebuild an indexed file after changing the corresponding
+#	in order to rebuild the indexed file after changing the
 #	text file.
 #
 #	When the table is provided via other means such as NIS, LDAP
@@ -41,9 +41,9 @@
 #
 #	Alternatively, the table can be provided as a regular-expression
 #	map where patterns are given as regular expressions, or lookups
-#	can be directed to TCP-based server. In those case, the lookups
-#	are done in a slightly different way as described below under
-#	"REGULAR EXPRESSION TABLES" or "TCP-BASED TABLES".
+#	can be directed to TCP-based server. In that case, the lookups are
+#	done in a slightly different way as described below under
+#	"REGULAR EXPRESSION TABLES" and "TCP-BASED TABLES".
 # CASE FOLDING
 # .ad
 # .fi
@@ -130,7 +130,7 @@
 #	This section describes how the table lookups change when lookups
 #	are directed to a TCP-based server. For a description of the TCP
 #	client/server lookup protocol, see \fBtcp_table\fR(5).
-#	This feature is not available up to and including Postfix version 2.4.
+#	This feature is not available up to and including Postfix version 2.3.
 #	
 #	Each lookup operation uses the entire address once.  Thus,
 #	\fIuser@domain\fR mail addresses are not broken up into their
diff --git a/postfix/proto/header_checks b/postfix/proto/header_checks
index b677ff750..97da52b72 100644
--- a/postfix/proto/header_checks
+++ b/postfix/proto/header_checks
@@ -2,7 +2,7 @@
 # NAME
 #	header_checks 5
 # SUMMARY
-#	Postfix built-in content inspection
+#	Postfix built-in header/body inspection
 # SYNOPSIS
 #	\fBheader_checks = pcre:/etc/postfix/header_checks\fR
 # .br
@@ -12,21 +12,15 @@
 # .br
 #	\fBbody_checks = pcre:/etc/postfix/body_checks\fR
 # .sp
-#	\fBpostmap -q "\fIstring\fB" pcre:/etc/postfix/\fIfilename\fR
+#	\fBpostmap -fq "\fIstring\fB" pcre:/etc/postfix/\fIfilename\fR
 # .br
-#	\fBpostmap -q - pcre:/etc/postfix/\fIfilename\fR <\fIinputfile\fR
+#	\fBpostmap -fq - pcre:/etc/postfix/\fIfilename\fR <\fIinputfile\fR
 # DESCRIPTION
-#	This document describes access control on the content of
-#	message headers and message body lines; it is implemented
-#	by the Postfix cleanup(8) server before mail is queued.
-#	See \fBaccess\fR(5) for access control on remote SMTP client
-#	information.
-#
-#	Each message header or message body line is compared against
-#	a list of patterns.
-#	When a match is found the corresponding action is executed, and
-#	the matching process is repeated for the next message header or
-#	message body line.
+#	Postfix provides a simple built-in content inspection mechanism that
+#	examines incoming mail one message header or one message body line
+#	at a time. Each input is compared against a list of patterns, and
+#	when a match is found the corresponding action is executed.
+#	This feature is implemented by the Postfix \fBcleanup\fR(8) server.
 #
 #	For examples, see the EXAMPLES section at the end of this
 #	manual page.
@@ -85,17 +79,16 @@
 # .IP "\fBif /\fIpattern\fB/\fIflags\fR"
 # .IP "\fBendif\fR"
 #	Match the input string against the patterns between \fBif\fR
-#	and \fBendif\fR, if and only if the same input string also
-#	matches \fIpattern\fR. The \fBif\fR..\fBendif\fR can nest.
+#	and \fBendif\fR, if and only if the input string also matches
+#	\fIpattern\fR. The \fBif\fR..\fBendif\fR can nest.
 # .sp
 #	Note: do not prepend whitespace to patterns inside
 #	\fBif\fR..\fBendif\fR.
 # .IP "\fBif !/\fIpattern\fB/\fIflags\fR"
 # .IP "\fBendif\fR"
 #	Match the input string against the patterns between \fBif\fR
-#	and \fBendif\fR, if and only if the same input string does
-#	\fBnot\fR match \fIpattern\fR. The \fBif\fR..\fBendif\fR
-#	can nest.
+#	and \fBendif\fR, if and only if the input string does \fBnot\fR
+#	match \fIpattern\fR. The \fBif\fR..\fBendif\fR can nest.
 # .IP "blank lines and comments"
 #	Empty lines and whitespace-only lines are ignored, as
 #	are lines whose first non-whitespace character is a `#'.
@@ -174,13 +167,13 @@
 # .sp
 #	This feature is available in Postfix 2.1 and later.
 # .IP "\fBFILTER \fItransport:destination\fR"
-#	Write a content filter request to the queue file, and
+#	Write a content filter request to the queue file and
 #	inspect the next input line.
 #	After the complete message is received it will be sent through
 #	the specified external content filter.  More information about
 #	external content filters is in the Postfix FILTER_README file.
 # .sp
-#	Note: this action overrides the \fBcontent_filter\fR setting,
+#	Note: this action overrides the \fBmain.cf content_filter\fR setting,
 #	and affects all recipients of the message. In the case that multiple
 #	\fBFILTER\fR actions fire, only the last one is executed.
 # .sp
@@ -198,17 +191,16 @@
 # .sp
 #	Note: use "\fBpostsuper -r\fR" to release mail that was kept on
 #	hold for a significant fraction of \fB$maximal_queue_lifetime\fR
-#	or \fB$bounce_queue_lifetime\fR, or longer. Use "\fBpostsuper -H\fR"
-#	only for mail that will not expire within a few delivery attempts.
+#	or \fB$bounce_queue_lifetime\fR, or longer.
 # .sp
 #	Note: this action affects all recipients of the message.
 # .sp
 #	This feature is available in Postfix 2.0 and later.
 # .IP \fBIGNORE\fR
-#	Delete the current line from the input, and inspect
+#	Delete the current line from the input and inspect
 #	the next input line.
 # .IP "\fBPREPEND \fItext...\fR"
-#	Prepend one line with the specified text, and inspect the next
+#	Prepend one line with the specified text and inspect the next
 #	input line.
 # .sp
 #	Notes: 
@@ -230,7 +222,7 @@
 # .IP
 #	This feature is available in Postfix 2.1 and later.
 # .IP "\fBREDIRECT \fIuser@domain\fR"
-#	Write a message redirection request to the queue file, and
+#	Write a message redirection request to the queue file and
 #	inspect the next input line. After the message is queued,
 #	it will be sent to the specified address instead of the
 #	intended recipient(s).
@@ -241,7 +233,7 @@
 # .sp
 #	This feature is available in Postfix 2.1 and later.
 # .IP "\fBREPLACE \fItext...\fR"
-#	Replace the current line with the specified text, and inspect the next
+#	Replace the current line with the specified text and inspect the next
 #	input line.
 # .sp
 #	This feature is available in Postfix 2.2 and later. The
@@ -272,25 +264,19 @@
 #	"5.7.1".
 # .IP "\fBWARN \fIoptional text...\fR
 #	Log a warning with the \fIoptional text...\fR (or log a
-#	generic message), and inspect the next input line. This
+#	generic message) and inspect the next input line. This
 #	action is useful for debugging and for testing a pattern
 #	before applying more drastic actions.
 # BUGS
 #	Many people overlook the main limitations of header and body_checks
-#	rules.
-# .IP \(bu
-#	These rules operate on one logical message header or one body
-#	line at a time. A decision made for one line is not carried over
-#	to the next line.
-# .IP \(bu
-#	If text in the message body is encoded
+#	rules.  These rules operate on one logical message header or one body
+#	line at a time, and a decision made for one line is not carried over
+#	to the next line.  If text in the message body is encoded
 #	(RFC 2045) then the rules have to specified for the encoded
-#	form.
-# .IP \(bu
-#	Likewise, when message headers are encoded (RFC
+#	form.  Likewise, when message headers are encoded (RFC
 #	2047) then the rules need to be specified for the encoded
 #	form.
-# .PP
+#
 #	Message headers added by the \fBcleanup\fR(8) daemon itself
 #	are excluded from inspection. Examples of such message headers
 #	are \fBFrom:\fR, \fBTo:\fR, \fBMessage-ID:\fR, \fBDate:\fR.
diff --git a/postfix/proto/ldap_table b/postfix/proto/ldap_table
index c1328389f..d8d2d2ef0 100644
--- a/postfix/proto/ldap_table
+++ b/postfix/proto/ldap_table
@@ -16,7 +16,6 @@
 #
 #	In order to use LDAP lookups, define an LDAP source as a lookup
 #	table in main.cf, for example:
-#
 # .ti +4
 #	alias_maps = ldap:/etc/postfix/ldap-aliases.cf
 #
@@ -78,7 +77,6 @@
 #	return the key itself.
 #
 #	For example, NEVER do this in a map defining $mydestination:
-#
 # .in +4
 #	query_filter = domain=* 
 # .br
@@ -86,7 +84,6 @@
 # .in -4
 #
 #	Do this instead:
-#
 # .in +4
 #	query_filter = domain=%s 
 # .br
@@ -101,7 +98,6 @@
 #	strings.
 # .IP "\fBserver_host (default: localhost)\fR"
 #	The name of the host running the LDAP server, e.g.
-#
 # .ti +4
 #	server_host = ldap.example.com
 #
@@ -110,13 +106,11 @@
 #	trying them in order should the first one fail. It should also
 #	be possible to give each server in the list a different port
 #	(overriding \fBserver_port\fR below), by naming them like
-#
 # .ti +4
 #	server_host = ldap.example.com:1444
 #
 #	With OpenLDAP, a (list of) LDAP URLs can be used to specify both
 #	the hostname(s) and the port(s):
-#
 # .ti +4
 #	server_host = ldap://ldap.example.com:1444
 # .ti +8
@@ -126,24 +120,20 @@
 #	including connections over UNIX domain sockets, and LDAP SSL
 #	(the last one provided that OpenLDAP was compiled with support
 #	for SSL):
-#
 # .ti +4
 #	server_host = ldapi://%2Fsome%2Fpath
 # .ti +8
 #		ldaps://ldap.example.com:636
 # .IP "\fBserver_port (default: 389)\fR"
 #	The port the LDAP server listens on, e.g.
-#
 # .ti +4
 #	server_port = 778
 # .IP "\fBtimeout (default: 10 seconds)\fR"
 #	The number of seconds a search can take before timing out, e.g.
-#
 # .ti +4
 #	timeout = 5
 # .IP "\fBsearch_base (No default; you must configure this)\fR"
 #	The RFC2253 base DN at which to conduct the search, e.g.
-#
 # .ti +4
 #	search_base = dc=your, dc=com
 # .IP
@@ -186,7 +176,6 @@
 #	The RFC2254 filter used to search the directory, where \fB%s\fR
 #	is a substitute for the address Postfix is trying to resolve,
 #	e.g.
-#
 # .ti +4
 #	query_filter = (&(mail=%s)(paid_up=true))
 #
@@ -224,7 +213,7 @@
 #	input key is \fIuser@mail.example.com\fR, then %1 is \fBcom\fR,
 #	%2 is \fBexample\fR and %3 is \fBmail\fR. If the input key is
 #	unqualified or does not have enough domain components to satisfy
-#	all the specified patterns, the search is suppressed and returns
+#	all the specified patterns, the saerch is suppressed and returns
 #	no results.
 # .IP
 #	The above %1, ..., %9 expansions are available with Postfix 2.2
@@ -296,7 +285,6 @@
 #	are eligible for lookup: 'user' lookups, bare domain lookups
 #	and "@domain" lookups are not performed. This can significantly
 #	reduce the query load on the LDAP server.
-#
 # .ti +4
 #	domain = postfix.org, hash:/etc/postfix/searchdomains
 #
@@ -310,16 +298,14 @@
 #	The attribute(s) Postfix will read from any directory
 #	entries returned by the lookup, to be resolved to an email
 #	address.
-#
 # .ti +4
 #	result_attribute = mailbox, maildrop
-# .IP "\fBspecial_result_attribute (default: empty)\fR"
+# .IP "\fBspecial_result_attribute (No default)\fR"
 #	The attribute(s) of directory entries that can contain DNs
 #	or URLs. If found, a recursive subsequent search is done
 #	using their values.
-#
 # .ti +4
-#	special_result_attribute = memberdn
+#	special_result_attribute = member
 #
 #	DN recursion retrieves the same result_attributes as the
 #	main query, including the special attributes for further
@@ -328,47 +314,6 @@
 #	listed in "result_attribute". If the URI lists any of the
 #	map's special result attributes, these are also retrieved
 #	and used recursively.
-# .IP "\fBterminal_result_attribute (default: empty)\fR"
-#	When one or more terminal result attributes are found in an LDAP
-#	entry, all other result attributes are ignored and only the terminal
-#	result attributes are returned. This is useful for delegating expansion
-#	of group members to a particular host, by using an optional "maildrop"
-#	attribute on selected groups to route the group to a specific host,
-#	where the group is expanded, possibly via mailing-list manager or
-#	other special processing.
-#
-# .ti +4
-#	terminal_result_attribute = maildrop
-#
-#	This feature is available with Postfix 2.4 or later.
-# .IP "\fBleaf_result_attribute (default: empty)\fR"
-#	When one or more special result attributes are found in a non-terminal
-#	(see above) LDAP entry, leaf result attributes are excluded from the
-#	expansion of that entry. This is useful when expanding groups and the
-#	desired mail address attribute(s) of the member objects obtained via
-#	DN or URI recursion are also present in the group object. To only
-#	return the attribute values from the leaf objects and not the
-#	containing group, add the attribute to the leaf_result_attribute list,
-#	and not the result_attribute list, which is always expanded. Note,
-#	the default value of "result_attribute" is not empty, you may want to
-#	set it explicitly empty when using "leaf_result_attribute" to expand
-#	the group to a list of member DN addresses. If groups have both
-#	member DN references AND attributes that hold multiple string valued
-#	rfc822 addresses, then the string attributes go in "result_attribute".
-#	The attributes that represent the email addresses of objects
-#	referenced via a DN (or LDAP URI) go in "leaf_result_attribute".
-#
-# .in +4
-#	result_attribute = memberaddr
-# .br
-#	special_result_attribute = memberdn
-# .br
-#	terminal_result_attribute = maildrop
-# .br
-#	leaf_result_attribute = mail
-# .in -4
-#
-#	This feature is available with Postfix 2.4 or later.
 # .IP "\fBscope (default: sub)\fR"
 #	The LDAP search scope: \fBsub\fR, \fBbase\fR, or \fBone\fR.
 #	These translate into LDAP_SCOPE_SUBTREE, LDAP_SCOPE_BASE,
@@ -377,7 +322,6 @@
 #	Whether or not to bind to the LDAP server. Newer LDAP
 #	implementations don't require clients to bind, which saves
 #	time. Example:
-#
 # .ti +4
 #	bind = no
 #
@@ -390,7 +334,6 @@
 #	the clear.
 # .IP "\fBbind_dn (default: empty)\fR"
 #	If you do have to bind, do it with this distinguished name. Example:
-#
 # .ti +4
 #	bind_dn = uid=postfix, dc=your, dc=com
 # .IP "\fBbind_pw (default: empty)\fR"
@@ -402,7 +345,6 @@
 #	password. This is because main.cf needs to be world readable
 #	to allow local accounts to submit mail via the sendmail
 #	command. Example:
-#
 # .ti +4
 #	bind_pw = postfixpw
 # .IP "\fBcache (IGNORED with a warning)\fR"
@@ -470,18 +412,15 @@
 #
 #	LDAP SSL service can be requested by using a LDAP SSL URL
 #	in the server_host parameter:
-#
 # .ti +4
 #	server_host = ldaps://ldap.example.com:636
 #
 #	STARTTLS can be turned on with the start_tls parameter:
-#
 # .ti +4
 #	start_tls = yes
 #
 #	Both forms require LDAP protocol version 3, which has to be set
 #	explicitly with:
-#
 # .ti +4
 #	version = 3
 #
@@ -533,23 +472,21 @@
 #	Here's a basic example for using LDAP to look up local(8)
 #	aliases.
 #	Assume that in main.cf, you have:
-#
 # .ti +4
 #	alias_maps = hash:/etc/aliases,
 # .ti +8
 #	ldap:/etc/postfix/ldap-aliases.cf
 #
 #	and in ldap:/etc/postfix/ldap-aliases.cf you have:
-#
 # .in +4
-#	server_host = ldap.example.com
+#	server_host = ldap.my.com
 # .br
-#	search_base = dc=example, dc=com
+#	search_base = dc=my, dc=com
 # .in -4
 #
 #	Upon receiving mail for a local address "ldapuser" that
 #	isn't found in the /etc/aliases database, Postfix will
-#	search the LDAP server listening at port 389 on ldap.example.com.
+#	search the LDAP server listening at port 389 on ldap.my.com.
 #	It will bind anonymously, search for any directory entries
 #	whose mailacceptinggeneralid attribute is "ldapuser", read
 #	the "maildrop" attributes of those found, and build a list
diff --git a/postfix/proto/nisplus_table b/postfix/proto/nisplus_table
index 3d16d6612..268b8bcdc 100644
--- a/postfix/proto/nisplus_table
+++ b/postfix/proto/nisplus_table
@@ -75,6 +75,8 @@
 #	Cambridge
 #	CB10 1SB, UK
 #
+#	Based on the NIS client code:
+#
 #	Adopted and adapted by:
 #	Wietse Venema
 #	IBM T.J. Watson Research
diff --git a/postfix/proto/pcre_table b/postfix/proto/pcre_table
index 5b7a1bbd1..a2620d2ca 100644
--- a/postfix/proto/pcre_table
+++ b/postfix/proto/pcre_table
@@ -4,9 +4,9 @@
 # SUMMARY
 #	format of Postfix PCRE tables
 # SYNOPSIS
-#	\fBpostmap -q "\fIstring\fB" pcre:/etc/postfix/\fIfilename\fR
+#	\fBpostmap -fq "\fIstring\fB" pcre:/etc/postfix/\fIfilename\fR
 #
-#	\fBpostmap -q - pcre:/etc/postfix/\fIfilename\fR <\fIinputfile\fR
+#	\fBpostmap -fq - pcre:/etc/postfix/\fIfilename\fR <\fIinputfile\fR
 # DESCRIPTION
 #	The Postfix mail system uses optional tables for address
 #	rewriting or mail routing. These tables are usually in
@@ -14,20 +14,14 @@
 #
 #	Alternatively, lookup tables can be specified in Perl Compatible
 #	Regular Expression form. In this case, each input is compared
-#	against a list of patterns. When a match is found, the
-#	corresponding result is returned and the search is terminated.
+#	against a list of patterns, and when a match is found the
+#	corresponding result is returned.
 #
 #	To find out what types of lookup tables your Postfix system
 #	supports use the "\fBpostconf -m\fR" command.
 #
-#	To test lookup tables, use the "\fBpostmap -q\fR" command as
+#	To test lookup tables, use the "\fBpostmap -fq\fR" command as
 #	described in the SYNOPSIS above.
-# COMPATIBILITY 
-# .ad
-# .fi
-#	With Postfix version 2.2 and earlier specify "\fBpostmap
-#	-fq\fR" to query a table that contains case sensitive
-#	patterns. Patterns are case insensitive by default.
 # TABLE FORMAT
 # .ad
 # .fi
diff --git a/postfix/proto/postconf.proto b/postfix/proto/postconf.proto
index a42ea22d6..bbf125e7a 100644
--- a/postfix/proto/postconf.proto
+++ b/postfix/proto/postconf.proto
@@ -1706,7 +1706,7 @@ Note 1: you need to stop and start Postfix when this parameter changes.
 
        
 
 
         Note 2: address information may be enclosed inside [],
-but this form is not required here. 
        
+but this form is not recommended here. 
        
 
 
         When inet_interfaces specifies just one IPv4 and/or IPv6 address
 that is not a loopback address, the Postfix SMTP client will use
@@ -2565,9 +2565,8 @@ masquerade_exceptions = root
 %PARAM max_idle 100s
 
 
        
-The maximum amount of time that an idle Postfix daemon process waits
-for an incoming connection before terminating voluntarily.  This
-parameter
+The maximum amount of time that an idle Postfix daemon process
+waits for the next service request before exiting.  This parameter
 is ignored by the Postfix queue manager and by other long-lived
 Postfix daemon processes.
 
        
@@ -2580,9 +2579,8 @@ The default time unit is s (seconds).
 %PARAM max_use 100
 
 
        
-The maximal number of incoming connections that a Postfix daemon
-process will service before terminating voluntarily.  This parameter
-is ignored by the Postfix queue
+The maximal number of connection requests before a Postfix daemon
+process terminates. This parameter is ignored by the Postfix queue
 manager and by other long-lived Postfix daemon processes.
 
        
 
@@ -2622,18 +2620,17 @@ Specify 0 when mail delivery should be tried only once.
 The maximal size in bytes of a message, including envelope information.
 
        
 
-%PARAM minimal_backoff_time 300s
-
-
        
-The minimal time between attempts to deliver a deferred message;
-prior to Postfix 2.4 the default value was 1000s.
-
        
+%PARAM minimal_backoff_time version dependent
 
 
        
+The minimal time between attempts to deliver a deferred message.
 This parameter also limits the time an unreachable destination is
 kept in the short-term, in-memory, destination status cache.
 
        
 
+
         With Postfix 2.4 the default value was reduced from 1000s to
+300s.  
        
+
 
         This parameter should be set greater than or equal to
 $queue_run_delay. See also $maximal_backoff_time.  
        
 
@@ -3077,11 +3074,14 @@ With Postfix versions 2.0 and earlier, a queue_minfree value of
 zero means there is no minimum required amount of free space.
 
        
 
-%PARAM queue_run_delay 300s
+%PARAM queue_run_delay version dependent
 
 
        
-The time between deferred queue scans by the queue manager;
-prior to Postfix 2.4 the default value was 1000s.
+The time between deferred queue scans by the queue manager.
+
        
+
+
        
+With Postfix 2.4 the default value was reduced from 1000s to 300s.
 
        
 
 
         This parameter should be set less than or equal to
@@ -3317,10 +3317,7 @@ Do not change this unless you have a complete understanding of RFC 821.
 
 
         Optional lookup tables with all valid addresses in the domains
 that match $relay_domains. Specify @domain as a wild-card for
-domains that have no valid recipient list, and become a source of
-backscatter mail: Postfix accepts spam for non-existent recipients
-and then floods innocent people with undeliverable mail.  Technically,
-tables
+domains that do not have a valid recipient list. Technically, tables
 listed with $relay_recipient_maps are used as lists: Postfix needs
 to know only if a lookup string is found or not, but it does not
 use the result from table lookup.  
        
@@ -3566,7 +3563,7 @@ IP hosting, but can be a problem on multi-homed firewalls. See the
 inet_interfaces documentation for more detail. 
        
 
 
         Note 2: address information may be enclosed inside [],
-but this form is not required here. 
        
+but this form is not recommended here. 
        
 
 %PARAM smtp_bind_address6 
 
@@ -6489,8 +6486,8 @@ are calculated.
 
        
 
 
        
-This feature is implemented by the anvil(8) service which is available
-in Postfix version 2.2 and later.
+This feature is implemented by the anvil(8) service which is not
+part of the stable Postfix version 2.1 release.
 
        
 
 
        
@@ -9034,9 +9031,9 @@ precision.  
        
 
 
          
 
-
        •  a = time from message arrival to last active queue entry
+
        •  a = time before the queue manager, including message transmission
 
-
        •  b = time from last active queue entry to connection setup
+
        •  b = time in queue manager
 
 
        •  c = time in connection setup, including DNS, EHLO and TLS
 
@@ -9135,7 +9132,7 @@ smtpd_discard_ehlo_keyword_address_maps. 
          
 
 
           This feature is available in Postfix 2.3 and later. 
          
 
-%PARAM lmtp_discard_lhlo_keywords 
+%PARAM lmtp_discard_lhlo_keywords $myhostname
 
 
           A case insensitive list of LHLO keywords (pipelining, starttls,
 auth, etc.) that the LMTP client will ignore in the LHLO response
@@ -9629,7 +9626,7 @@ and higher the optional "ciphers" attribute overrides the main.cf
 smtp_tls_mandatory_ciphers parameter and the optional "protocols"
 keyword overrides the main.cf smtp_tls_mandatory_protocols parameter.
 In the policy table, multiple protocols must be separated by colons,
-as attribute values may not contain whitespace or commas. 
+as attribute values may not contain whitespace or commas. 
          
 
 
          verify
           
          Mandatory TLS verification.  At this security
 level, DNS MX lookups are trusted to be secure enough, and the name
diff --git a/postfix/proto/regexp_table b/postfix/proto/regexp_table
index 5560bad9b..5662d4603 100644
--- a/postfix/proto/regexp_table
+++ b/postfix/proto/regexp_table
@@ -4,9 +4,9 @@
 # SUMMARY
 #	format of Postfix regular expression tables
 # SYNOPSIS
-#	\fBpostmap -q "\fIstring\fB" regexp:/etc/postfix/\fIfilename\fR
+#	\fBpostmap -fq "\fIstring\fB" regexp:/etc/postfix/\fIfilename\fR
 #
-#	\fBpostmap -q - regexp:/etc/postfix/\fIfilename\fR <\fIinputfile\fR
+#	\fBpostmap -fq - regexp:/etc/postfix/\fIfilename\fR <\fIinputfile\fR
 # DESCRIPTION
 #	The Postfix mail system uses optional tables for address
 #	rewriting or mail routing. These tables are usually in
@@ -14,20 +14,14 @@
 #
 #	Alternatively, lookup tables can be specified in POSIX regular
 #	expression form. In this case, each input is compared against a
-#	list of patterns. When a match is found, the corresponding
-#	result is returned and the search is terminated.
+#	list of patterns, and when a match is found the corresponding
+#	result is returned.
 #
 #	To find out what types of lookup tables your Postfix system
 #	supports use the "\fBpostconf -m\fR" command.
 #
-#	To test lookup tables, use the "\fBpostmap -q\fR" command
-#	as described in the SYNOPSIS above.
-# COMPATIBILITY
-# .ad
-# .fi
-#	With Postfix version 2.2 and earlier specify "\fBpostmap
-#	-fq\fR" to query a table that contains case sensitive
-#	patterns. Patterns are case insensitive by default.
+#	To test lookup tables, use the "\fBpostmap -fq\fR" command as
+#	described in the SYNOPSIS above.
 # TABLE FORMAT
 # .ad
 # .fi
diff --git a/postfix/proto/relocated b/postfix/proto/relocated
index 34b6beee4..f1e1fe55b 100644
--- a/postfix/proto/relocated
+++ b/postfix/proto/relocated
@@ -13,17 +13,17 @@
 #	that serves as input to the \fBpostmap\fR(1) command.
 #	The result, an indexed file in \fBdbm\fR or \fBdb\fR format,
 #	is used for fast searching by the mail system. Execute the command
-#	"\fBpostmap /etc/postfix/relocated\fR" to rebuild an indexed
-#	file after changing the corresponding relocated table.
+#	"\fBpostmap /etc/postfix/relocated\fR" in order to rebuild the indexed
+#	file after changing the relocated table.
 #
 #	When the table is provided via other means such as NIS, LDAP
 #	or SQL, the same lookups are done as for ordinary indexed files.
 #
 #	Alternatively, the table can be provided as a regular-expression
 #	map where patterns are given as regular expressions, or lookups
-#	can be directed to TCP-based server. In those case, the lookups
-#	are done in a slightly different way as described below under
-#	"REGULAR EXPRESSION TABLES" or "TCP-BASED TABLES".
+#	can be directed to TCP-based server. In that case, the lookups are
+#	done in a slightly different way as described below under
+#	"REGULAR EXPRESSION TABLES" and "TCP-BASED TABLES".
 #
 #	Table lookups are case insensitive.
 # CASE FOLDING
@@ -82,7 +82,7 @@
 #	expression lookup table syntax, see \fBregexp_table\fR(5) or
 #	\fBpcre_table\fR(5). For a description of the TCP client/server
 #	table lookup protocol, see \fBtcp_table\fR(5).
-#	This feature is not available up to and including Postfix version 2.4.
+#	This feature is not available up to and including Postfix version 2.3.
 #
 #	Each pattern is a regular expression that is applied to the entire
 #	address being looked up. Thus, \fIuser@domain\fR mail addresses are not
@@ -101,7 +101,7 @@
 #	This section describes how the table lookups change when lookups
 #	are directed to a TCP-based server. For a description of the TCP
 #	client/server lookup protocol, see \fBtcp_table\fR(5).
-#	This feature is not available up to and including Postfix version 2.4.
+#	This feature is not available up to and including Postfix version 2.3.
 #
 #	Each lookup operation uses the entire address once.  Thus,
 #	\fIuser@domain\fR mail addresses are not broken up into their
diff --git a/postfix/proto/stop b/postfix/proto/stop
index 71b0af5a1..653260ccc 100644
--- a/postfix/proto/stop
+++ b/postfix/proto/stop
@@ -982,109 +982,3 @@ xf
 xxxxx
 yy
 zz
-AAAREADME
-API
-DAEMONs
-DHE
-DSL
-DataBase
-EMSTP
-EST
-HTTPS
-JOBIDUNKNOWN
-Jänicke
-Koetter
-Leandro
-MSA
-MUAs
-Netinfo
-ODRhu
-Outlook's
-PQexec
-Procontrol
-REJECTs
-Requeuing
-SDBM
-SSLv
-Santi
-Sirainen
-TCL
-TEMPFAILs
-TLSv
-Tallon
-Tinycdb
-Tokarev
-Wrobel
-aNULL
-agroup
-alloc
-antiantivirus
-apps
-arandom
-arounds
-auser
-beb
-bgroup
-buser
-callouts
-cctx
-cli
-cname
-corpit
-cuser
-ddd
-dfc
-dkim
-dmS
-domainkeys
-duser
-epoll
-esmtp
-exim
-gssapi
-heraccount
-herisp
-hisaccount
-hisisp
-ietf
-imc
-interoperate
-keysize
-koetter
-kqueue
-ldapgroup
-libcdb
-libdb
-lpr
-mailwrapper
-mctx
-memberaddr
-memberdn
-mjt
-mlm
-msa
-myisp
-myname
-netinfo
-nisplus
-noatime
-nopeer
-obs
-openspf
-orig
-passdb
-patrick
-preloading
-rpm
-saslfinger
-securetls
-spamware
-systemtype
-tinycdb
-unencoded
-uniquename
-william
-xxxxxxx
-yulszqocfzsficvzzju
-yyyyyy
-zzzzzz
diff --git a/postfix/proto/transport b/postfix/proto/transport
index 6f1985496..f6d6fd502 100644
--- a/postfix/proto/transport
+++ b/postfix/proto/transport
@@ -43,17 +43,17 @@
 #	that serves as input to the \fBpostmap\fR(1) command.
 #	The result, an indexed file in \fBdbm\fR or \fBdb\fR format, is used
 #	for fast searching by the mail system. Execute the command
-#	"\fBpostmap /etc/postfix/transport\fR" to rebuild an indexed
-#	file after changing the corresponding transport table.
+#	"\fBpostmap /etc/postfix/transport\fR" in order to rebuild the indexed
+#	file after changing the transport table.
 #
 #	When the table is provided via other means such as NIS, LDAP
 #	or SQL, the same lookups are done as for ordinary indexed files.
 #
 #	Alternatively, the table can be provided as a regular-expression
 #	map where patterns are given as regular expressions, or lookups
-#	can be directed to TCP-based server. In those case, the lookups
-#	are done in a slightly different way as described below under
-#	"REGULAR EXPRESSION TABLES" or "TCP-BASED TABLES".
+#	can be directed to TCP-based server. In that case, the lookups are
+#	done in a slightly different way as described below under
+#	"REGULAR EXPRESSION TABLES" and "TCP-BASED TABLES".
 # CASE FOLDING
 # .ad
 # .fi
@@ -229,7 +229,7 @@
 #	This section describes how the table lookups change when lookups
 #	are directed to a TCP-based server. For a description of the TCP
 #	client/server lookup protocol, see \fBtcp_table\fR(5).
-#	This feature is not available up to and including Postfix version 2.4.
+#	This feature is not available up to and including Postfix version 2.3.
 #
 #	Each lookup operation uses the entire recipient address once.  Thus,
 #	\fIsome.domain.hierarchy\fR is not looked up via its parent domains,
diff --git a/postfix/proto/virtual b/postfix/proto/virtual
index 256b97716..2ec87104b 100644
--- a/postfix/proto/virtual
+++ b/postfix/proto/virtual
@@ -39,17 +39,17 @@
 #	that serves as input to the \fBpostmap\fR(1) command.
 #	The result, an indexed file in \fBdbm\fR or \fBdb\fR format,
 #	is used for fast searching by the mail system. Execute the command
-#	"\fBpostmap /etc/postfix/virtual\fR" to rebuild an indexed
-#	file after changing the corresponding text file.
+#	"\fBpostmap /etc/postfix/virtual\fR" in order to rebuild the indexed
+#	file after changing the text file.
 #
 #	When the table is provided via other means such as NIS, LDAP
 #	or SQL, the same lookups are done as for ordinary indexed files.
 #
 #	Alternatively, the table can be provided as a regular-expression
 #	map where patterns are given as regular expressions, or lookups
-#	can be directed to TCP-based server. In those case, the lookups
-#	are done in a slightly different way as described below under
-#	"REGULAR EXPRESSION TABLES" or "TCP-BASED TABLES".
+#	can be directed to TCP-based server. In that case, the lookups are
+#	done in a slightly different way as described below under
+#	"REGULAR EXPRESSION TABLES" and "TCP-BASED TABLES".
 # CASE FOLDING
 # .ad
 # .fi
@@ -91,13 +91,6 @@
 # .IP "@\fIdomain address, address, ...\fR"
 #	Redirect mail for other users in \fIdomain\fR to \fIaddress\fR.
 #	This form has the lowest precedence.
-# .sp
-#	Note: @\fIdomain\fR is a wild-card. With this form, the
-#	Postfix SMTP server accepts
-#	mail for any recipient in \fIdomain\fR, regardless of whether
-#	that recipient exists.  This may turn your mail system into
-#	a backscatter source that returns undeliverable spam to
-#	innocent people.
 # RESULT ADDRESS REWRITING
 # .ad
 # .fi
@@ -206,7 +199,7 @@
 #	This section describes how the table lookups change when lookups
 #	are directed to a TCP-based server. For a description of the TCP
 #	client/server lookup protocol, see \fBtcp_table\fR(5).
-#	This feature is not available up to and including Postfix version 2.4.
+#	This feature is not available up to and including Postfix version 2.3.
 #
 #	Each lookup operation uses the entire address once.  Thus,
 #	\fIuser@domain\fR mail addresses are not broken up into their
diff --git a/postfix/src/anvil/Makefile.in b/postfix/src/anvil/Makefile.in
index 14772fa32..62946461e 100644
--- a/postfix/src/anvil/Makefile.in
+++ b/postfix/src/anvil/Makefile.in
@@ -67,7 +67,6 @@ anvil.o: ../../include/mail_conf.h
 anvil.o: ../../include/mail_params.h
 anvil.o: ../../include/mail_proto.h
 anvil.o: ../../include/mail_server.h
-anvil.o: ../../include/mail_version.h
 anvil.o: ../../include/msg.h
 anvil.o: ../../include/mymalloc.h
 anvil.o: ../../include/stringops.h
diff --git a/postfix/src/anvil/anvil.c b/postfix/src/anvil/anvil.c
index ed5c58a3a..e3e1d222a 100644
--- a/postfix/src/anvil/anvil.c
+++ b/postfix/src/anvil/anvil.c
@@ -173,8 +173,8 @@
 /*
 /*	In this preliminary implementation, a count (or rate) limited server
 /*	can have only one remote client at a time. If a server reports
-/*	multiple simultaneous clients, state is kept only for the last
-/*	reported client.
+/*	multiple simultaneous clients, all but the last reported client
+/*	are ignored.
 /*
 /*	The \fBanvil\fR(8) server automatically discards client
 /*	request information after it expires.  To prevent the
@@ -208,11 +208,11 @@
 /*	The time limit for sending or receiving information over an internal
 /*	communication channel.
 /* .IP "\fBmax_idle (100s)\fR"
-/*	The maximum amount of time that an idle Postfix daemon process waits
-/*	for an incoming connection before terminating voluntarily.
+/*	The maximum amount of time that an idle Postfix daemon process
+/*	waits for the next service request before exiting.
 /* .IP "\fBmax_use (100)\fR"
-/*	The maximal number of incoming connections that a Postfix daemon
-/*	process will service before terminating voluntarily.
+/*	The maximal number of connection requests before a Postfix daemon
+/*	process terminates.
 /* .IP "\fBprocess_id (read-only)\fR"
 /*	The process ID of a Postfix command or daemon process.
 /* .IP "\fBprocess_name (read-only)\fR"
@@ -267,7 +267,6 @@
 
 #include 
 #include 
-#include 
 #include 
 #include 
 
@@ -946,8 +945,6 @@ static void post_jail_init(char *unused_name, char **unused_argv)
 	var_idle_limit = var_anvil_time_unit;
 }
 
-MAIL_VERSION_STAMP_DECLARE;
-
 /* main - pass control to the multi-threaded skeleton */
 
 int     main(int argc, char **argv)
@@ -958,11 +955,6 @@ int     main(int argc, char **argv)
 	0,
     };
 
-    /*
-     * Fingerprint executables and core dumps.
-     */
-    MAIL_VERSION_STAMP_ALLOCATE;
-
     multi_server_main(argc, argv, anvil_service,
 		      MAIL_SERVER_TIME_TABLE, time_table,
 		      MAIL_SERVER_POST_INIT, post_jail_init,
diff --git a/postfix/src/bounce/Makefile.in b/postfix/src/bounce/Makefile.in
index 09de6e9d0..ddfaaa2eb 100644
--- a/postfix/src/bounce/Makefile.in
+++ b/postfix/src/bounce/Makefile.in
@@ -107,7 +107,6 @@ bounce.o: ../../include/mail_params.h
 bounce.o: ../../include/mail_proto.h
 bounce.o: ../../include/mail_queue.h
 bounce.o: ../../include/mail_server.h
-bounce.o: ../../include/mail_version.h
 bounce.o: ../../include/msg.h
 bounce.o: ../../include/msg_stats.h
 bounce.o: ../../include/rcpt_buf.h
@@ -167,7 +166,6 @@ bounce_notify_service.o: ../../include/deliver_request.h
 bounce_notify_service.o: ../../include/dsn.h
 bounce_notify_service.o: ../../include/dsn_buf.h
 bounce_notify_service.o: ../../include/dsn_mask.h
-bounce_notify_service.o: ../../include/int_filt.h
 bounce_notify_service.o: ../../include/mail_addr.h
 bounce_notify_service.o: ../../include/mail_error.h
 bounce_notify_service.o: ../../include/mail_params.h
@@ -193,7 +191,6 @@ bounce_notify_util.o: ../../include/dsn.h
 bounce_notify_util.o: ../../include/dsn_buf.h
 bounce_notify_util.o: ../../include/dsn_mask.h
 bounce_notify_util.o: ../../include/events.h
-bounce_notify_util.o: ../../include/int_filt.h
 bounce_notify_util.o: ../../include/iostuff.h
 bounce_notify_util.o: ../../include/is_header.h
 bounce_notify_util.o: ../../include/lex_822.h
@@ -231,7 +228,6 @@ bounce_notify_verp.o: ../../include/deliver_request.h
 bounce_notify_verp.o: ../../include/dsn.h
 bounce_notify_verp.o: ../../include/dsn_buf.h
 bounce_notify_verp.o: ../../include/dsn_mask.h
-bounce_notify_verp.o: ../../include/int_filt.h
 bounce_notify_verp.o: ../../include/mail_addr.h
 bounce_notify_verp.o: ../../include/mail_error.h
 bounce_notify_verp.o: ../../include/mail_params.h
@@ -258,7 +254,6 @@ bounce_one_service.o: ../../include/deliver_request.h
 bounce_one_service.o: ../../include/dsn.h
 bounce_one_service.o: ../../include/dsn_buf.h
 bounce_one_service.o: ../../include/dsn_mask.h
-bounce_one_service.o: ../../include/int_filt.h
 bounce_one_service.o: ../../include/mail_addr.h
 bounce_one_service.o: ../../include/mail_error.h
 bounce_one_service.o: ../../include/mail_params.h
@@ -314,7 +309,6 @@ bounce_trace_service.o: ../../include/deliver_request.h
 bounce_trace_service.o: ../../include/dsn.h
 bounce_trace_service.o: ../../include/dsn_buf.h
 bounce_trace_service.o: ../../include/dsn_mask.h
-bounce_trace_service.o: ../../include/int_filt.h
 bounce_trace_service.o: ../../include/mail_addr.h
 bounce_trace_service.o: ../../include/mail_error.h
 bounce_trace_service.o: ../../include/mail_params.h
@@ -338,7 +332,6 @@ bounce_warn_service.o: ../../include/cleanup_user.h
 bounce_warn_service.o: ../../include/dsn.h
 bounce_warn_service.o: ../../include/dsn_buf.h
 bounce_warn_service.o: ../../include/dsn_mask.h
-bounce_warn_service.o: ../../include/int_filt.h
 bounce_warn_service.o: ../../include/mail_addr.h
 bounce_warn_service.o: ../../include/mail_error.h
 bounce_warn_service.o: ../../include/mail_params.h
diff --git a/postfix/src/bounce/bounce.c b/postfix/src/bounce/bounce.c
index 805144e95..c09d36eed 100644
--- a/postfix/src/bounce/bounce.c
+++ b/postfix/src/bounce/bounce.c
@@ -19,9 +19,8 @@
 /*	Append a recipient (non-)delivery status record to a per-message
 /*	log file.
 /* .IP \(bu
-/*	Enqueue a delivery status notification message, with a copy
-/*	of a per-message log file and of the corresponding message.
-/*	When the delivery status notification message is
+/*	Enqueue a bounce message, with a copy of a per-message log file
+/*	and of the corresponding message. When the bounce message is
 /*	enqueued successfully, the per-message log file is deleted.
 /* .PP
 /*	The software does a best notification effort. A non-delivery
@@ -92,11 +91,11 @@
 /*	The mail system name that is displayed in Received: headers, in
 /*	the SMTP greeting banner, and in bounced mail.
 /* .IP "\fBmax_idle (100s)\fR"
-/*	The maximum amount of time that an idle Postfix daemon process waits
-/*	for an incoming connection before terminating voluntarily.
+/*	The maximum amount of time that an idle Postfix daemon process
+/*	waits for the next service request before exiting.
 /* .IP "\fBmax_use (100)\fR"
-/*	The maximal number of incoming connections that a Postfix daemon
-/*	process will service before terminating voluntarily.
+/*	The maximal number of connection requests before a Postfix daemon
+/*	process terminates.
 /* .IP "\fBnotify_classes (resource, software)\fR"
 /*	The list of error classes that are reported to the postmaster.
 /* .IP "\fBprocess_id (read-only)\fR"
@@ -155,7 +154,6 @@
 #include 
 #include 
 #include 
-#include 
 #include 
 #include 
 #include 
@@ -578,8 +576,8 @@ static void post_jail_init(char *service_name, char **unused_argv)
     /*
      * Special case: dump bounce templates. This is not part of the master(5)
      * public interface. This internal interface is used by the postconf
-     * command. It was implemented before bounce templates were isolated into
-     * modules that could have been called directly.
+     * command. It was implemented before bounce templates were isolated
+     * into modules that could have been called directly.
      */
     if (strcmp(service_name, "dump_templates") == 0) {
 	bounce_templates_dump(VSTREAM_OUT, bounce_templates);
@@ -606,8 +604,6 @@ static void post_jail_init(char *service_name, char **unused_argv)
     dsn_buf = dsb_create();
 }
 
-MAIL_VERSION_STAMP_DECLARE;
-
 /* main - the main program */
 
 int     main(int argc, char **argv)
@@ -630,11 +626,6 @@ int     main(int argc, char **argv)
 	0,
     };
 
-    /*
-     * Fingerprint executables and core dumps.
-     */
-    MAIL_VERSION_STAMP_ALLOCATE;
-
     /*
      * Pass control to the single-threaded service skeleton.
      */
diff --git a/postfix/src/cleanup/Makefile.in b/postfix/src/cleanup/Makefile.in
index fa98471ae..ecd317a6c 100644
--- a/postfix/src/cleanup/Makefile.in
+++ b/postfix/src/cleanup/Makefile.in
@@ -319,7 +319,6 @@ cleanup.o: ../../include/mail_params.h
 cleanup.o: ../../include/mail_proto.h
 cleanup.o: ../../include/mail_server.h
 cleanup.o: ../../include/mail_stream.h
-cleanup.o: ../../include/mail_version.h
 cleanup.o: ../../include/maps.h
 cleanup.o: ../../include/match_list.h
 cleanup.o: ../../include/match_ops.h
diff --git a/postfix/src/cleanup/cleanup.c b/postfix/src/cleanup/cleanup.c
index 5747f8c94..6e555ca10 100644
--- a/postfix/src/cleanup/cleanup.c
+++ b/postfix/src/cleanup/cleanup.c
@@ -303,11 +303,11 @@
 /*	The time limit for sending or receiving information over an internal
 /*	communication channel.
 /* .IP "\fBmax_idle (100s)\fR"
-/*	The maximum amount of time that an idle Postfix daemon process waits
-/*	for an incoming connection before terminating voluntarily.
+/*	The maximum amount of time that an idle Postfix daemon process
+/*	waits for the next service request before exiting.
 /* .IP "\fBmax_use (100)\fR"
-/*	The maximal number of incoming connections that a Postfix daemon
-/*	process will service before terminating voluntarily.
+/*	The maximal number of connection requests before a Postfix daemon
+/*	process terminates.
 /* .IP "\fBmyhostname (see 'postconf -d' output)\fR"
 /*	The internet hostname of this mail system.
 /* .IP "\fBmyorigin ($myhostname)\fR"
@@ -386,7 +386,6 @@
 #include 
 #include 
 #include 
-#include 
 
 /* Single-threaded server skeleton. */
 
@@ -503,18 +502,11 @@ static void pre_accept(char *unused_name, char **unused_argv)
     }
 }
 
-MAIL_VERSION_STAMP_DECLARE;
-
 /* main - the main program */
 
 int     main(int argc, char **argv)
 {
 
-    /*
-     * Fingerprint executables and core dumps.
-     */
-    MAIL_VERSION_STAMP_ALLOCATE;
-
     /*
      * Clean up an incomplete queue file in case of a fatal run-time error,
      * or after receiving SIGTERM from the master at shutdown time.
diff --git a/postfix/src/cleanup/cleanup_init.c b/postfix/src/cleanup/cleanup_init.c
index 13e792e52..2791f32e6 100644
--- a/postfix/src/cleanup/cleanup_init.c
+++ b/postfix/src/cleanup/cleanup_init.c
@@ -202,7 +202,7 @@ CONFIG_STR_TABLE cleanup_str_table[] = {
     VAR_BODY_CHECKS, DEF_BODY_CHECKS, &var_body_checks, 0, 0,
     VAR_PROP_EXTENSION, DEF_PROP_EXTENSION, &var_prop_extension, 0, 0,
     VAR_ALWAYS_BCC, DEF_ALWAYS_BCC, &var_always_bcc, 0, 0,
-    VAR_RCPT_WITHELD, DEF_RCPT_WITHELD, &var_rcpt_witheld, 0, 0,
+    VAR_RCPT_WITHELD, DEF_RCPT_WITHELD, &var_rcpt_witheld, 1, 0,
     VAR_MASQ_CLASSES, DEF_MASQ_CLASSES, &var_masq_classes, 0, 0,
     VAR_SEND_BCC_MAPS, DEF_SEND_BCC_MAPS, &var_send_bcc_maps, 0, 0,
     VAR_RCPT_BCC_MAPS, DEF_RCPT_BCC_MAPS, &var_rcpt_bcc_maps, 0, 0,
diff --git a/postfix/src/cleanup/cleanup_message.c b/postfix/src/cleanup/cleanup_message.c
index 2087c0908..be6b2ed1c 100644
--- a/postfix/src/cleanup/cleanup_message.c
+++ b/postfix/src/cleanup/cleanup_message.c
@@ -691,7 +691,7 @@ static void cleanup_header_done_callback(void *context)
 #define VISIBLE_RCPT	((1 << HDR_TO) | (1 << HDR_RESENT_TO) \
 			| (1 << HDR_CC) | (1 << HDR_RESENT_CC))
 
-    if ((state->headers_seen & VISIBLE_RCPT) == 0 && *var_rcpt_witheld)
+    if ((state->headers_seen & VISIBLE_RCPT) == 0)
 	cleanup_out_format(state, REC_TYPE_NORM, "%s", var_rcpt_witheld);
 
     /*
diff --git a/postfix/src/cleanup/cleanup_out.c b/postfix/src/cleanup/cleanup_out.c
index 904208071..a5c5bf68d 100644
--- a/postfix/src/cleanup/cleanup_out.c
+++ b/postfix/src/cleanup/cleanup_out.c
@@ -198,8 +198,7 @@ void    cleanup_out_header(CLEANUP_STATE *state, VSTRING *header_buf)
 	}
 	if (line == start) {
 	    cleanup_out_string(state, REC_TYPE_NORM, line);
-	    if ((state->milters || cleanup_milters)
-		&& line_len < REC_TYPE_PTR_PAYL_SIZE)
+	    if (line_len < REC_TYPE_PTR_PAYL_SIZE)
 		rec_pad(state->dst, REC_TYPE_DTXT,
 			REC_TYPE_PTR_PAYL_SIZE - line_len);
 	} else if (IS_SPACE_TAB(*line)) {
diff --git a/postfix/src/discard/Makefile.in b/postfix/src/discard/Makefile.in
index 00a5d5c34..e39100098 100644
--- a/postfix/src/discard/Makefile.in
+++ b/postfix/src/discard/Makefile.in
@@ -67,7 +67,6 @@ discard.o: ../../include/dsn_util.h
 discard.o: ../../include/flush_clnt.h
 discard.o: ../../include/mail_queue.h
 discard.o: ../../include/mail_server.h
-discard.o: ../../include/mail_version.h
 discard.o: ../../include/msg.h
 discard.o: ../../include/msg_stats.h
 discard.o: ../../include/recipient_list.h
diff --git a/postfix/src/discard/discard.c b/postfix/src/discard/discard.c
index 17bdeceee..04855889b 100644
--- a/postfix/src/discard/discard.c
+++ b/postfix/src/discard/discard.c
@@ -60,11 +60,11 @@
 /*	The time limit for sending or receiving information over an internal
 /*	communication channel.
 /* .IP "\fBmax_idle (100s)\fR"
-/*	The maximum amount of time that an idle Postfix daemon process waits
-/*	for an incoming connection before terminating voluntarily.
+/*	The maximum amount of time that an idle Postfix daemon process
+/*	waits for the next service request before exiting.
 /* .IP "\fBmax_use (100)\fR"
-/*	The maximal number of incoming connections that a Postfix daemon
-/*	process will service before terminating voluntarily.
+/*	The maximal number of connection requests before a Postfix daemon
+/*	process terminates.
 /* .IP "\fBprocess_id (read-only)\fR"
 /*	The process ID of a Postfix command or daemon process.
 /* .IP "\fBprocess_name (read-only)\fR"
@@ -121,7 +121,6 @@
 #include 
 #include 
 #include 
-#include 
 
 /* Single server skeleton. */
 
@@ -226,18 +225,10 @@ static void pre_init(char *unused_name, char **unused_argv)
     flush_init();
 }
 
-MAIL_VERSION_STAMP_DECLARE;
-
 /* main - pass control to the single-threaded skeleton */
 
 int     main(int argc, char **argv)
 {
-
-    /*
-     * Fingerprint executables and core dumps.
-     */
-    MAIL_VERSION_STAMP_ALLOCATE;
-
     single_server_main(argc, argv, discard_service,
 		       MAIL_SERVER_PRE_INIT, pre_init,
 		       0);
diff --git a/postfix/src/error/Makefile.in b/postfix/src/error/Makefile.in
index a9453126f..8e1d097c5 100644
--- a/postfix/src/error/Makefile.in
+++ b/postfix/src/error/Makefile.in
@@ -70,7 +70,6 @@ error.o: ../../include/iostuff.h
 error.o: ../../include/mail_proto.h
 error.o: ../../include/mail_queue.h
 error.o: ../../include/mail_server.h
-error.o: ../../include/mail_version.h
 error.o: ../../include/msg.h
 error.o: ../../include/msg_stats.h
 error.o: ../../include/recipient_list.h
diff --git a/postfix/src/error/error.c b/postfix/src/error/error.c
index 019900b2b..77ae72ca8 100644
--- a/postfix/src/error/error.c
+++ b/postfix/src/error/error.c
@@ -9,8 +9,8 @@
 /*	The Postfix \fBerror\fR(8) delivery agent processes delivery
 /*	requests from
 /*	the queue manager. Each request specifies a queue file, a sender
-/*	address, the reason for non-delivery (specified as the
-/*	next-hop destination), and recipient information.
+/*	address, a domain or host name that is treated as the reason for
+/*	non-delivery, and recipient information.
 /*	The reason may be prefixed with an RFC 3463-compatible detail code.
 /*	This program expects to be run from the \fBmaster\fR(8) process
 /*	manager.
@@ -67,11 +67,11 @@
 /*	The time limit for sending or receiving information over an internal
 /*	communication channel.
 /* .IP "\fBmax_idle (100s)\fR"
-/*	The maximum amount of time that an idle Postfix daemon process waits
-/*	for an incoming connection before terminating voluntarily.
+/*	The maximum amount of time that an idle Postfix daemon process
+/*	waits for the next service request before exiting.
 /* .IP "\fBmax_use (100)\fR"
-/*	The maximal number of incoming connections that a Postfix daemon
-/*	process will service before terminating voluntarily.
+/*	The maximal number of connection requests before a Postfix daemon
+/*	process terminates.
 /* .IP "\fBnotify_classes (resource, software)\fR"
 /*	The list of error classes that are reported to the postmaster.
 /* .IP "\fBprocess_id (read-only)\fR"
@@ -126,7 +126,6 @@
 #include 
 #include 
 #include 
-#include 
 
 /* Single server skeleton. */
 
@@ -238,18 +237,10 @@ static void pre_init(char *unused_name, char **unused_argv)
     flush_init();
 }
 
-MAIL_VERSION_STAMP_DECLARE;
-
 /* main - pass control to the single-threaded skeleton */
 
 int     main(int argc, char **argv)
 {
-
-    /*
-     * Fingerprint executables and core dumps.
-     */
-    MAIL_VERSION_STAMP_ALLOCATE;
-
     single_server_main(argc, argv, error_service,
 		       MAIL_SERVER_PRE_INIT, pre_init,
 		       0);
diff --git a/postfix/src/flush/Makefile.in b/postfix/src/flush/Makefile.in
index 7578940f5..8144eabbf 100644
--- a/postfix/src/flush/Makefile.in
+++ b/postfix/src/flush/Makefile.in
@@ -72,7 +72,6 @@ flush.o: ../../include/mail_proto.h
 flush.o: ../../include/mail_queue.h
 flush.o: ../../include/mail_scan_dir.h
 flush.o: ../../include/mail_server.h
-flush.o: ../../include/mail_version.h
 flush.o: ../../include/maps.h
 flush.o: ../../include/match_list.h
 flush.o: ../../include/match_ops.h
diff --git a/postfix/src/flush/flush.c b/postfix/src/flush/flush.c
index 41ffafa87..06f19f15b 100644
--- a/postfix/src/flush/flush.c
+++ b/postfix/src/flush/flush.c
@@ -96,11 +96,11 @@
 /*	The time limit for sending or receiving information over an internal
 /*	communication channel.
 /* .IP "\fBmax_idle (100s)\fR"
-/*	The maximum amount of time that an idle Postfix daemon process waits
-/*	for an incoming connection before terminating voluntarily.
+/*	The maximum amount of time that an idle Postfix daemon process
+/*	waits for the next service request before exiting.
 /* .IP "\fBmax_use (100)\fR"
-/*	The maximal number of incoming connections that a Postfix daemon
-/*	process will service before terminating voluntarily.
+/*	The maximal number of connection requests before a Postfix daemon
+/*	process terminates.
 /* .IP "\fBparent_domain_matches_subdomains (see 'postconf -d' output)\fR"
 /*	What Postfix features match subdomains of "domain.tld" automatically,
 /*	instead of requiring an explicit ".domain.tld" pattern.
@@ -173,7 +173,6 @@
 /* Global library. */
 
 #include 
-#include 
 #include 
 #include 
 #include 
@@ -388,7 +387,7 @@ static int flush_send_service(const char *site, int how)
 /* flush_one_file - move one queue file to incoming queue */
 
 static int flush_one_file(const char *queue_id, VSTRING *queue_file,
-			          struct utimbuf * tbuf, int how)
+			            struct utimbuf * tbuf, int how)
 {
     const char *myname = "flush_one_file";
     const char *queue_name;
@@ -808,8 +807,6 @@ static void pre_jail_init(char *unused_name, char **unused_argv)
 				     var_fflush_domains);
 }
 
-MAIL_VERSION_STAMP_DECLARE;
-
 /* main - pass control to the single-threaded skeleton */
 
 int     main(int argc, char **argv)
@@ -820,11 +817,6 @@ int     main(int argc, char **argv)
 	0,
     };
 
-    /*
-     * Fingerprint executables and core dumps.
-     */
-    MAIL_VERSION_STAMP_ALLOCATE;
-
     single_server_main(argc, argv, flush_service,
 		       MAIL_SERVER_TIME_TABLE, time_table,
 		       MAIL_SERVER_PRE_INIT, pre_jail_init,
diff --git a/postfix/src/fsstone/fsstone.c b/postfix/src/fsstone/fsstone.c
index 026741231..26ff50c1e 100644
--- a/postfix/src/fsstone/fsstone.c
+++ b/postfix/src/fsstone/fsstone.c
@@ -150,8 +150,6 @@ static void usage(char *myname)
     msg_fatal("usage: %s [-cr] [-s size] messages directory_entries", myname);
 }
 
-MAIL_VERSION_STAMP_DECLARE;
-
 int     main(int argc, char **argv)
 {
     int     op_count;
@@ -163,11 +161,6 @@ int     main(int argc, char **argv)
     int     ch;
     int     size = 2;
 
-    /*
-     * Fingerprint executables and core dumps.
-     */
-    MAIL_VERSION_STAMP_ALLOCATE;
-
     msg_vstream_init(argv[0], VSTREAM_ERR);
     while ((ch = GETOPT(argc, argv, "crs:")) != EOF) {
 	switch (ch) {
diff --git a/postfix/src/global/Makefile.in b/postfix/src/global/Makefile.in
index b6c602f0b..49e288d89 100644
--- a/postfix/src/global/Makefile.in
+++ b/postfix/src/global/Makefile.in
@@ -890,12 +890,10 @@ input_transp.o: cleanup_user.h
 input_transp.o: input_transp.c
 input_transp.o: input_transp.h
 input_transp.o: mail_params.h
-int_filt.o: ../../include/msg.h
 int_filt.o: ../../include/name_mask.h
 int_filt.o: ../../include/sys_defs.h
 int_filt.o: ../../include/vbuf.h
 int_filt.o: ../../include/vstring.h
-int_filt.o: cleanup_user.h
 int_filt.o: int_filt.c
 int_filt.o: int_filt.h
 int_filt.o: mail_params.h
@@ -1464,7 +1462,6 @@ post_mail.o: ../../include/vbuf.h
 post_mail.o: ../../include/vstream.h
 post_mail.o: ../../include/vstring.h
 post_mail.o: cleanup_user.h
-post_mail.o: int_filt.h
 post_mail.o: mail_date.h
 post_mail.o: mail_params.h
 post_mail.o: mail_proto.h
diff --git a/postfix/src/global/dict_ldap.c b/postfix/src/global/dict_ldap.c
index fd35579d2..efd8c3927 100644
--- a/postfix/src/global/dict_ldap.c
+++ b/postfix/src/global/dict_ldap.c
@@ -60,14 +60,6 @@
 /* .IP special_result_attribute
 /*	The attribute(s) of directory entries that can contain DNs or URLs.
 /*	If found, a recursive subsequent search is done using their values.
-/* .IP leaf_result_attribute
-/*	These are only returned for "leaf" LDAP entries, i.e. those that are
-/*	not "terminal" and have no values for any of the "special" result
-/*	attributes.
-/* .IP terminal_result_attribute
-/*	If found, the LDAP entry is considered a terminal LDAP object, not
-/*	subject to further direct or recursive expansion. Only the terminal
-/*	result attributes are returned.
 /* .IP scope
 /*	LDAP search scope: sub, base, or one.
 /* .IP bind
@@ -236,9 +228,7 @@ typedef struct {
     int     scope;
     char   *search_base;
     ARGV   *result_attributes;
-    int     num_terminal;		/* Number of terminal attributes. */
-    int     num_leaf;			/* Number of leaf attributes */
-    int     num_attributes;		/* Combined # of non-special attrs */
+    int     num_attributes;		/* rest of list is DN's. */
     int     bind;
     char   *bind_dn;
     char   *bind_pw;
@@ -266,16 +256,7 @@ typedef struct {
 
 #define DICT_LDAP_CONN(d) ((LDAP_CONN *)((d)->ht->value))
 
- /*
-  * Bitrot: LDAP_API 3000 and up (OpenLDAP 2.2.x) deprecated ldap_unbind()
-  */
-#if LDAP_API_VERSION >= 3000
-#define dict_ldap_unbind(ld)		ldap_unbind_ext((ld), 0, 0)
-#define dict_ldap_abandon(ld, msg)	ldap_abandon_ext((ld), (msg), 0, 0)
-#else
-#define dict_ldap_unbind(ld)		ldap_unbind(ld)
-#define dict_ldap_abandon(ld, msg)	ldap_abandon((ld), (msg))
-#endif
+
 
 /*
  * Quoting rules.
@@ -344,7 +325,8 @@ static void dict_ldap_timeout(int unused_sig)
 static void dict_ldap_logprint(LDAP_CONST char *data)
 {
     const char *myname = "dict_ldap_debug";
-    char   *buf, *p;
+    char   *buf,
+           *p;
 
     buf = mystrdup(data);
     if (*buf) {
@@ -356,7 +338,7 @@ static void dict_ldap_logprint(LDAP_CONST char *data)
     myfree(buf);
 }
 
-static int dict_ldap_get_errno(LDAP *ld)
+static int dict_ldap_get_errno(LDAP * ld)
 {
     int     rc;
 
@@ -365,7 +347,7 @@ static int dict_ldap_get_errno(LDAP *ld)
     return rc;
 }
 
-static int dict_ldap_set_errno(LDAP *ld, int rc)
+static int dict_ldap_set_errno(LDAP * ld, int rc)
 {
     (void) ldap_set_option(ld, LDAP_OPT_ERROR_NUMBER, &rc);
     return rc;
@@ -385,9 +367,10 @@ static int dict_ldap_result(LDAP *ld, int msgid, int timeout, LDAPMessage **res)
 	return (dict_ldap_get_errno(ld));
 
     if (dict_ldap_get_errno(ld) == LDAP_TIMEOUT) {
-	(void) dict_ldap_abandon(ld, msgid);
+	(void) ldap_abandon_ext(ld, msgid, 0, 0);
 	return (dict_ldap_set_errno(ld, LDAP_TIMEOUT));
     }
+
     return LDAP_SUCCESS;
 }
 
@@ -417,7 +400,7 @@ static int dict_ldap_bind_st(DICT_LDAP *dict_ldap)
 /* search_st - Synchronous search with timeout */
 
 static int search_st(LDAP *ld, char *base, int scope, char *query,
-		             char **attrs, int timeout, LDAPMessage **res)
+			    char **attrs, int timeout, LDAPMessage **res)
 {
     struct timeval mytimeval;
     int     msgid;
@@ -428,7 +411,7 @@ static int search_st(LDAP *ld, char *base, int scope, char *query,
     mytimeval.tv_usec = 0;
 
 #define WANTVALS 0
-#define USE_SIZE_LIM_OPT -1			/* Any negative value will do */
+#define USE_SIZE_LIM_OPT -1		/* Any negative value will do */
 
     if ((rc = ldap_search_ext(ld, base, scope, query, attrs, WANTVALS, 0, 0,
 			      &mytimeval, USE_SIZE_LIM_OPT,
@@ -523,7 +506,7 @@ static int dict_ldap_connect(DICT_LDAP *dict_ldap)
 #if defined(LDAP_OPT_DEBUG_LEVEL) && defined(LBER_OPT_LOG_PRINT_FN)
     if (dict_ldap->debuglevel > 0 &&
 	ber_set_option(NULL, LBER_OPT_LOG_PRINT_FN,
-		(LDAP_CONST void *) dict_ldap_logprint) != LBER_OPT_SUCCESS)
+		     (LDAP_CONST void *) dict_ldap_logprint) != LBER_OPT_SUCCESS)
 	msg_warn("%s: Unable to set ber logprint function.", myname);
 #if defined(LBER_OPT_DEBUG_LEVEL)
     if (ber_set_option(NULL, LBER_OPT_DEBUG_LEVEL,
@@ -769,8 +752,8 @@ static void dict_ldap_conn_find(DICT_LDAP *dict_ldap)
  * This and the rest of the handling of multiple attributes, DNs and URLs
  * are thanks to LaMont Jones.
  */
-static void dict_ldap_get_values(DICT_LDAP *dict_ldap, LDAPMessage *res,
-				         VSTRING *result, const char *name)
+static void dict_ldap_get_values(DICT_LDAP *dict_ldap, LDAPMessage * res,
+				         VSTRING *result, const char* name)
 {
     static int recursion = 0;
     static int expansion;
@@ -785,8 +768,6 @@ static void dict_ldap_get_values(DICT_LDAP *dict_ldap, LDAPMessage *res,
     int     valcount;
     LDAPURLDesc *url;
     const char *myname = "dict_ldap_get_values";
-    int     is_leaf = 1;		/* No recursion via this entry */
-    int     is_terminal = 0;		/* No expansion via this entry */
 
     if (++recursion == 1)
 	expansion = 0;
@@ -811,45 +792,10 @@ static void dict_ldap_get_values(DICT_LDAP *dict_ldap, LDAPMessage *res,
 		     dict_ldap->size_limit);
 	    dict_errno = DICT_ERR_RETRY;
 	}
-
-	/*
-	 * Check for terminal attributes, these preclude expansion of all
-	 * other attributes, and DN/URI recursion. Any terminal attributes
-	 * are listed first in the attribute array.
-	 */
-	if (dict_ldap->num_terminal > 0) {
-	    for (i = 0; i < dict_ldap->num_terminal; ++i) {
-		attr = dict_ldap->result_attributes->argv[i];
-		if (!(vals = ldap_get_values_len(dict_ldap->ld, entry, attr)))
-		    continue;
-		is_terminal = (ldap_count_values_len(vals) > 0);
-		ldap_value_free_len(vals);
-		if (is_terminal)
-		    break;
-	    }
-	}
-
-	/*
-	 * Check for special attributes, these preclude expansion of
-	 * "leaf-only" attributes, and are at the end of the attribute array
-	 * after the terminal, leaf and regular attributes.
-	 */
-	if (is_terminal == 0 && dict_ldap->num_leaf > 0) {
-	    for (i = dict_ldap->num_attributes;
-		 dict_ldap->result_attributes->argv[i]; ++i) {
-		attr = dict_ldap->result_attributes->argv[i];
-		if (!(vals = ldap_get_values_len(dict_ldap->ld, entry, attr)))
-		    continue;
-		is_leaf = (ldap_count_values_len(vals) == 0);
-		ldap_value_free_len(vals);
-		if (!is_leaf)
-		    break;
-	    }
-	}
 	for (attr = ldap_first_attribute(dict_ldap->ld, entry, &ber);
-	     attr != NULL; ldap_memfree(attr),
-	     attr = ldap_next_attribute(dict_ldap->ld, entry, ber)) {
-
+	     attr != NULL;
+	     ldap_memfree(attr), attr = ldap_next_attribute(dict_ldap->ld,
+							    entry, ber)) {
 	    vals = ldap_get_values_len(dict_ldap->ld, entry, attr);
 	    if (vals == NULL) {
 		if (msg_verbose)
@@ -857,6 +803,7 @@ static void dict_ldap_get_values(DICT_LDAP *dict_ldap, LDAPMessage *res,
 			     myname, recursion, attr);
 		continue;
 	    }
+
 	    valcount = ldap_count_values_len(vals);
 
 	    /*
@@ -883,47 +830,36 @@ static void dict_ldap_get_values(DICT_LDAP *dict_ldap, LDAPMessage *res,
 	     * We compute the attribute type (ordinary or special) from its
 	     * index on the "result_attributes" list.
 	     */
-	    for (i = 0; dict_ldap->result_attributes->argv[i]; i++)
-		if (strcasecmp(dict_ldap->result_attributes->argv[i],
-			       attr) == 0)
+	    for (i = 0; dict_ldap->result_attributes->argv[i]; i++) {
+		if (strcasecmp(dict_ldap->result_attributes->argv[i], attr) == 0)
 		    break;
+	    }
 
 	    /*
 	     * Append each returned address to the result list, possibly
-	     * recursing (for dn or url attributes of non-terminal entries)
+	     * recursing (for dn or url attributes).
 	     */
-	    if (i < dict_ldap->num_attributes || is_terminal) {
-		if (is_terminal && i >= dict_ldap->num_terminal
-		    || !is_leaf &&
-		    i < dict_ldap->num_terminal + dict_ldap->num_leaf) {
-		    if (msg_verbose)
-			msg_info("%s[%d]: skipping %ld value(s) of %s "
-				 "attribute %s", myname, recursion, i,
-				 is_terminal ? "non-terminal" : "leaf-only",
-				 attr);
-		} else {
-		    /* Ordinary result attribute */
-		    for (i = 0; i < valcount; i++) {
-			if (db_common_expand(dict_ldap->ctx,
-					     dict_ldap->result_format,
-					     vals[i]->bv_val,
-					     name, result, 0)
-			    && dict_ldap->expansion_limit > 0
-			    && ++expansion > dict_ldap->expansion_limit) {
-			    msg_warn("%s[%d]: %s: Expansion limit exceeded "
-				     "for key: '%s'", myname, recursion,
-				     dict_ldap->parser->name, name);
-			    dict_errno = DICT_ERR_RETRY;
-			    break;
-			}
+	    if (i < dict_ldap->num_attributes) {
+		/* Ordinary result attribute */
+		for (i = 0; i < valcount; i++) {
+		    if (db_common_expand(dict_ldap->ctx,
+					 dict_ldap->result_format,
+					 vals[i]->bv_val,
+					 name, result, 0)
+			&& dict_ldap->expansion_limit > 0
+			&& ++expansion > dict_ldap->expansion_limit) {
+			msg_warn("%s[%d]: %s: Expansion limit exceeded for key: '%s'",
+				 myname, recursion, dict_ldap->parser->name, name);
+			dict_errno = DICT_ERR_RETRY;
+			break;
 		    }
-		    if (dict_errno != 0)
-			continue;
-		    if (msg_verbose)
-			msg_info("%s[%d]: search returned %ld value(s) for"
-				 " requested result attribute %s",
-				 myname, recursion, i, attr);
 		}
+		if (dict_errno != 0)
+		    continue;
+		if (msg_verbose)
+		    msg_info("%s[%d]: search returned %ld value(s) for"
+			     " requested result attribute %s",
+			     myname, recursion, i, attr);
 	    } else if (recursion < dict_ldap->recursion_limit
 		       && dict_ldap->result_attributes->argv[i]) {
 		/* Special result attribute */
@@ -936,7 +872,7 @@ static void dict_ldap_get_values(DICT_LDAP *dict_ldap, LDAPMessage *res,
 			if (rc == 0) {
 			    rc = search_st(dict_ldap->ld, url->lud_dn,
 					   url->lud_scope, url->lud_filter,
-					 url->lud_attrs, dict_ldap->timeout,
+					   url->lud_attrs, dict_ldap->timeout,
 					   &resloop);
 			    ldap_free_urldesc(url);
 			}
@@ -1037,6 +973,7 @@ static const char *dict_ldap_lookup(DICT *dict, const char *name)
 	    msg_info("%s: Skipping lookup of '%s'", myname, name);
 	return (0);
     }
+
 #define INIT_VSTR(buf, len) do { \
 	if (buf == 0) \
 	    buf = vstring_alloc(len); \
@@ -1089,27 +1026,28 @@ static const char *dict_ldap_lookup(DICT *dict, const char *name)
 		 myname, dict_ldap->parser->name, dict_ldap->size_limit);
 
     /*
-     * Expand the search base and query. Skip lookup when the input key lacks
-     * sufficient domain components to satisfy all the requested
-     * %-substitutions.
-     * 
-     * When the search base is not static, LDAP_NO_SUCH_OBJECT is expected and
-     * is therefore treated as a non-error: the lookup returns no results
-     * rather than a soft error.
+     * Expand the search base and query. Skip lookup when the
+     * input key lacks sufficient domain components to satisfy
+     * all the requested %-substitutions.
+     *
+     * When the search base is not static, LDAP_NO_SUCH_OBJECT is
+     * expected and is therefore treated as a non-error: the lookup
+     * returns no results rather than a soft error.
      */
     if (!db_common_expand(dict_ldap->ctx, dict_ldap->search_base,
-			  name, 0, base, rfc2253_quote)) {
-	if (msg_verbose > 1)
+    			  name, 0, base, rfc2253_quote)) {
+        if (msg_verbose > 1)
 	    msg_info("%s: %s: Empty expansion for %s", myname,
 		     dict_ldap->parser->name, dict_ldap->search_base);
-	return (0);
+        return (0);
     }
+
     if (!db_common_expand(dict_ldap->ctx, dict_ldap->query,
 			  name, 0, query, rfc2254_quote)) {
-	if (msg_verbose > 1)
+        if (msg_verbose > 1)
 	    msg_info("%s: %s: Empty expansion for %s", myname,
 		     dict_ldap->parser->name, dict_ldap->query);
-	return (0);
+        return (0);
     }
 
     /*
@@ -1128,7 +1066,7 @@ static const char *dict_ldap_lookup(DICT *dict, const char *name)
 	    msg_info("%s: Lost connection for LDAP source %s, reopening",
 		     myname, dict_ldap->parser->name);
 
-	dict_ldap_unbind(dict_ldap->ld);
+	ldap_unbind_ext(dict_ldap->ld, 0, 0);
 	dict_ldap->ld = DICT_LDAP_CONN(dict_ldap)->conn_ld = 0;
 	dict_ldap_connect(dict_ldap);
 
@@ -1139,14 +1077,14 @@ static const char *dict_ldap_lookup(DICT *dict, const char *name)
 	    return (0);
 
 	rc = search_st(dict_ldap->ld, vstring_str(base), dict_ldap->scope,
-		     vstring_str(query), dict_ldap->result_attributes->argv,
+		       vstring_str(query), dict_ldap->result_attributes->argv,
 		       dict_ldap->timeout, &res);
 
     }
+
     switch (rc) {
 
     case LDAP_SUCCESS:
-
 	/*
 	 * Search worked; extract the requested result_attribute.
 	 */
@@ -1171,13 +1109,12 @@ static const char *dict_ldap_lookup(DICT *dict, const char *name)
 	break;
 
     case LDAP_NO_SUCH_OBJECT:
-
-	/*
-	 * If the search base is input key dependent, then not finding it, is
-	 * equivalent to not finding the input key. Sadly, we cannot detect
-	 * misconfiguration in this case.
+        /*
+	 * If the search base is input key dependent, then not finding it,
+	 * is equivalent to not finding the input key. Sadly, we cannot
+	 * detect misconfiguration in this case.
 	 */
-	if (dict_ldap->dynamic_base)
+    	if (dict_ldap->dynamic_base)
 	    break;
 
 	msg_warn("%s: %s: Search base '%s' not found: %d: %s",
@@ -1187,7 +1124,6 @@ static const char *dict_ldap_lookup(DICT *dict, const char *name)
 	break;
 
     default:
-
 	/*
 	 * Rats. The search didn't work.
 	 */
@@ -1198,7 +1134,7 @@ static const char *dict_ldap_lookup(DICT *dict, const char *name)
 	 * Tear down the connection so it gets set up from scratch on the
 	 * next lookup.
 	 */
-	dict_ldap_unbind(dict_ldap->ld);
+	ldap_unbind_ext(dict_ldap->ld, 0, 0);
 	dict_ldap->ld = DICT_LDAP_CONN(dict_ldap)->conn_ld = 0;
 
 	/*
@@ -1235,7 +1171,7 @@ static void dict_ldap_close(DICT *dict)
 	    if (msg_verbose)
 		msg_info("%s: Closed connection handle for LDAP source %s",
 			 myname, dict_ldap->parser->name);
-	    dict_ldap_unbind(conn->conn_ld);
+	    ldap_unbind_ext(conn->conn_ld, 0, 0);
 	}
 	binhash_delete(conn_hash, ht->key, ht->key_len, myfree);
     }
@@ -1244,7 +1180,7 @@ static void dict_ldap_close(DICT *dict)
     myfree(dict_ldap->search_base);
     myfree(dict_ldap->query);
     if (dict_ldap->result_format)
-	myfree(dict_ldap->result_format);
+        myfree(dict_ldap->result_format);
     argv_free(dict_ldap->result_attributes);
     myfree(dict_ldap->bind_dn);
     myfree(dict_ldap->bind_pw);
@@ -1346,11 +1282,11 @@ DICT   *dict_ldap_open(const char *ldapsource, int dummy, int dict_flags)
 		dict_ldap->ldap_ssl = 1;
 	    ldap_free_urldesc(url_desc);
 	    if (VSTRING_LEN(url_list) > 0)
-		VSTRING_ADDCH(url_list, ' ');
+	    	VSTRING_ADDCH(url_list, ' ');
 	    vstring_strcat(url_list, h);
 	} else {
 	    if (VSTRING_LEN(url_list) > 0)
-		VSTRING_ADDCH(url_list, ' ');
+	    	VSTRING_ADDCH(url_list, ' ');
 	    if (strrchr(h, ':'))
 		vstring_sprintf_append(url_list, "ldap://%s", h);
 	    else
@@ -1408,26 +1344,24 @@ DICT   *dict_ldap_open(const char *ldapsource, int dummy, int dict_flags)
      */
     dict_ldap->timeout = cfg_get_int(dict_ldap->parser, "timeout", 10, 0, 0);
 
-#if 0						/* No benefit from changing
-						 * this to match the
-						 * MySQL/PGSQL syntax */
+#if 0	/* No benefit from changing this to match the MySQL/PGSQL syntax */
     if ((dict_ldap->query =
-	 cfg_get_str(dict_ldap->parser, "query", 0, 0, 0)) == 0)
+    	     cfg_get_str(dict_ldap->parser, "query", 0, 0, 0)) == 0)
 #endif
-	dict_ldap->query =
+        dict_ldap->query =
 	    cfg_get_str(dict_ldap->parser, "query_filter",
 			"(mailacceptinggeneralid=%s)", 0, 0);
 
     if ((dict_ldap->result_format =
-	 cfg_get_str(dict_ldap->parser, "result_format", 0, 0, 0)) == 0)
-	dict_ldap->result_format =
-	    cfg_get_str(dict_ldap->parser, "result_filter", "%s", 1, 0);
+        cfg_get_str(dict_ldap->parser, "result_format", 0, 0, 0)) == 0)
+        dict_ldap->result_format =
+                cfg_get_str(dict_ldap->parser, "result_filter", "%s", 1, 0);
 
     /*
-     * Must parse all templates before we can use db_common_expand() If data
-     * dependent substitutions are found in the search base, treat
-     * NO_SUCH_OBJECT search errors as a non-matching key, rather than a
-     * fatal run-time error.
+     * Must parse all templates before we can use db_common_expand()
+     * If data dependent substitutions are found in the search base,
+     * treat NO_SUCH_OBJECT search errors as a non-matching key, rather
+     * than a fatal run-time error.
      */
     dict_ldap->ctx = 0;
     dict_ldap->dynamic_base =
@@ -1441,8 +1375,8 @@ DICT   *dict_ldap_open(const char *ldapsource, int dummy, int dict_flags)
     db_common_parse_domain(dict_ldap->parser, dict_ldap->ctx);
 
     /*
-     * Maps that use substring keys should only be used with the full input
-     * key.
+     * Maps that use substring keys should only be used with the full
+     * input key.
      */
     if (db_common_dict_partial(dict_ldap->ctx))
 	dict_ldap->dict.flags |= DICT_FLAG_PATTERN;
@@ -1451,29 +1385,14 @@ DICT   *dict_ldap_open(const char *ldapsource, int dummy, int dict_flags)
     if (dict_flags & DICT_FLAG_FOLD_FIX)
 	dict_ldap->dict.fold_buf = vstring_alloc(10);
 
-    /* Order matters, first the terminal attributes: */
-    attr = cfg_get_str(dict_ldap->parser, "terminal_result_attribute", "", 0, 0);
+    attr = cfg_get_str(dict_ldap->parser, "result_attribute",
+		       "maildrop", 0, 0);
     dict_ldap->result_attributes = argv_split(attr, " ,\t\r\n");
-    dict_ldap->num_terminal = dict_ldap->result_attributes->argc;
-    myfree(attr);
-
-    /* Order matters, next the leaf-only attributes: */
-    attr = cfg_get_str(dict_ldap->parser, "leaf_result_attribute", "", 0, 0);
-    if (*attr)
-	argv_split_append(dict_ldap->result_attributes, attr, " ,\t\r\n");
-    dict_ldap->num_leaf =
-	dict_ldap->result_attributes->argc - dict_ldap->num_terminal;
-    myfree(attr);
-
-    /* Order matters, next the regular attributes: */
-    attr = cfg_get_str(dict_ldap->parser, "result_attribute", "maildrop", 0, 0);
-    if (*attr)
-	argv_split_append(dict_ldap->result_attributes, attr, " ,\t\r\n");
     dict_ldap->num_attributes = dict_ldap->result_attributes->argc;
     myfree(attr);
 
-    /* Order matters, finally the special attributes: */
-    attr = cfg_get_str(dict_ldap->parser, "special_result_attribute", "", 0, 0);
+    attr = cfg_get_str(dict_ldap->parser, "special_result_attribute",
+		       "", 0, 0);
     if (*attr)
 	argv_split_append(dict_ldap->result_attributes, attr, " ,\t\r\n");
     myfree(attr);
diff --git a/postfix/src/global/dict_proxy.c b/postfix/src/global/dict_proxy.c
index 264b5ed39..c36675c4c 100644
--- a/postfix/src/global/dict_proxy.c
+++ b/postfix/src/global/dict_proxy.c
@@ -91,7 +91,6 @@ static const char *dict_proxy_lookup(DICT *dict, const char *key)
     VSTREAM *stream;
     int     status;
     int     count = 0;
-    int     request_flags;
 
     /*
      * The client and server live in separate processes that may start and
@@ -102,8 +101,6 @@ static const char *dict_proxy_lookup(DICT *dict, const char *key)
      */
     VSTRING_RESET(dict_proxy->result);
     VSTRING_TERMINATE(dict_proxy->result);
-    request_flags = (dict_proxy->in_flags & DICT_FLAG_RQST_MASK)
-	| (dict->flags & DICT_FLAG_RQST_MASK);
     for (;;) {
 	stream = clnt_stream_access(proxy_stream);
 	errno = 0;
@@ -111,7 +108,7 @@ static const char *dict_proxy_lookup(DICT *dict, const char *key)
 	if (attr_print(stream, ATTR_FLAG_NONE,
 		       ATTR_TYPE_STR, MAIL_ATTR_REQ, PROXY_REQ_LOOKUP,
 		       ATTR_TYPE_STR, MAIL_ATTR_TABLE, dict->name,
-		       ATTR_TYPE_INT, MAIL_ATTR_FLAGS, request_flags,
+		       ATTR_TYPE_INT, MAIL_ATTR_FLAGS, dict_proxy->in_flags,
 		       ATTR_TYPE_STR, MAIL_ATTR_KEY, key,
 		       ATTR_TYPE_END) != 0
 	    || vstream_fflush(stream)
@@ -125,7 +122,7 @@ static const char *dict_proxy_lookup(DICT *dict, const char *key)
 	    if (msg_verbose)
 		msg_info("%s: table=%s flags=%s key=%s -> status=%d result=%s",
 			 myname, dict->name,
-			 dict_flags_str(request_flags), key,
+			 dict_flags_str(dict_proxy->in_flags), key,
 			 status, STR(dict_proxy->result));
 	    switch (status) {
 	    case PROXY_STAT_BAD:
diff --git a/postfix/src/global/mail_version.h b/postfix/src/global/mail_version.h
index b624ee382..9021b5dca 100644
--- a/postfix/src/global/mail_version.h
+++ b/postfix/src/global/mail_version.h
@@ -20,8 +20,8 @@
   * Patches change both the patchlevel and the release date. Snapshots have no
   * patchlevel; they change the release date only.
   */
-#define MAIL_RELEASE_DATE	"20070325"
-#define MAIL_VERSION_NUMBER	"2.4"
+#define MAIL_RELEASE_DATE	"20070228"
+#define MAIL_VERSION_NUMBER	"2.4.0-RC1"
 
 #ifdef SNAPSHOT
 # define MAIL_VERSION_DATE	"-" MAIL_RELEASE_DATE
@@ -47,24 +47,6 @@ extern char *var_mail_version;
 #define DEF_MAIL_RELEASE	MAIL_RELEASE_DATE
 extern char *var_mail_release;
 
- /*
-  * The following macros stamp executable files as well as core dumps. This
-  * information helps to answer the following questions:
-  * 
-  * - What Postfix versions(s) are installed on this machine?
-  * 
-  * - Is this installation mixing multiple Postfix versions?
-  * 
-  * - What Postfix version generated this core dump?
-  */
-#include 
-
-#define MAIL_VERSION_STAMP_DECLARE \
-    char *mail_version_stamp
-
-#define MAIL_VERSION_STAMP_ALLOCATE \
-    mail_version_stamp = strdup(VAR_MAIL_VERSION "=" DEF_MAIL_VERSION)
-
 /* LICENSE
 /* .ad
 /* .fi
diff --git a/postfix/src/global/mbox_open.c b/postfix/src/global/mbox_open.c
index ea96d8a4b..42fae4ca1 100644
--- a/postfix/src/global/mbox_open.c
+++ b/postfix/src/global/mbox_open.c
@@ -161,9 +161,9 @@ MBOX   *mbox_open(const char *path, int flags, mode_t mode, struct stat * st,
      */
     if ((fp = safe_open(path, flags | O_NONBLOCK, mode, st,
 			chown_uid, chown_gid, why->reason)) == 0) {
-	dsb_status(why, mbox_dsn(errno, def_dsn));
 	if (locked & MBOX_DOT_LOCK)
 	    dot_unlockfile(path);
+	dsb_status(why, mbox_dsn(errno, def_dsn));
 	return (0);
     }
     close_on_exec(vstream_fileno(fp), CLOSE_ON_EXEC);
diff --git a/postfix/src/global/rec_type.h b/postfix/src/global/rec_type.h
index 3edb5fcbd..80313b310 100644
--- a/postfix/src/global/rec_type.h
+++ b/postfix/src/global/rec_type.h
@@ -57,7 +57,7 @@
 
 #define REC_TYPE_CONT	'L'		/* long data record */
 #define REC_TYPE_NORM	'N'		/* normal data record */
-#define REC_TYPE_DTXT	'w'		/* padding (was: deleted data) */
+#define REC_TYPE_DTXT	'w'		/* deleted data record */
 
 #define REC_TYPE_XTRA	'X'		/* start extracted records */
 
@@ -82,12 +82,9 @@
   * contains pure recipient sequences only, then the queue manager will not
   * have to read all the queue file records before starting delivery. This is
   * often the case with list mail, where such optimization is desirable.
-  * 
-  * XXX These definitions include the respective segment terminators to avoid
-  * special cases in the cleanup(8) envelope and extracted record processors.
   */
-#define REC_TYPE_ENV_RECIPIENT	"MDRO/Kon"
-#define REC_TYPE_EXT_RECIPIENT	"EDRO/Kon"
+#define REC_TYPE_ENV_RECIPIENT	"DRO/Kon"
+#define REC_TYPE_EXT_RECIPIENT	"DRO/Kon"
 
  /*
   * The types of records that I expect to see while processing different
diff --git a/postfix/src/local/Makefile.in b/postfix/src/local/Makefile.in
index f22a5646e..bd9814b5f 100644
--- a/postfix/src/local/Makefile.in
+++ b/postfix/src/local/Makefile.in
@@ -353,7 +353,6 @@ local.o: ../../include/mail_addr.h
 local.o: ../../include/mail_conf.h
 local.o: ../../include/mail_params.h
 local.o: ../../include/mail_server.h
-local.o: ../../include/mail_version.h
 local.o: ../../include/maps.h
 local.o: ../../include/mbox_conf.h
 local.o: ../../include/msg.h
diff --git a/postfix/src/local/local.c b/postfix/src/local/local.c
index 557be6f4d..623bd4782 100644
--- a/postfix/src/local/local.c
+++ b/postfix/src/local/local.c
@@ -501,11 +501,11 @@
 /* .IP "\fBlocal_command_shell (empty)\fR"
 /*	Optional shell program for \fBlocal\fR(8) delivery to non-Postfix command.
 /* .IP "\fBmax_idle (100s)\fR"
-/*	The maximum amount of time that an idle Postfix daemon process waits
-/*	for an incoming connection before terminating voluntarily.
+/*	The maximum amount of time that an idle Postfix daemon process
+/*	waits for the next service request before exiting.
 /* .IP "\fBmax_use (100)\fR"
-/*	The maximal number of incoming connections that a Postfix daemon
-/*	process will service before terminating voluntarily.
+/*	The maximal number of connection requests before a Postfix daemon
+/*	process terminates.
 /* .IP "\fBprepend_delivered_header (command, file, forward)\fR"
 /*	The message delivery contexts where the Postfix \fBlocal\fR(8) delivery
 /*	agent prepends a Delivered-To:  message header with the address
@@ -595,7 +595,6 @@
 #include 
 #include 
 #include 
-#include 
 #include 
 #include 
 #include 
@@ -846,8 +845,6 @@ static void pre_init(char *unused_name, char **unused_argv)
     flush_init();
 }
 
-MAIL_VERSION_STAMP_DECLARE;
-
 /* main - pass control to the single-threaded skeleton */
 
 int     main(int argc, char **argv)
@@ -899,11 +896,6 @@ int     main(int argc, char **argv)
 	0,
     };
 
-    /*
-     * Fingerprint executables and core dumps.
-     */
-    MAIL_VERSION_STAMP_ALLOCATE;
-
     single_server_main(argc, argv, local_service,
 		       MAIL_SERVER_INT_TABLE, int_table,
 		       MAIL_SERVER_STR_TABLE, str_table,
diff --git a/postfix/src/master/Makefile.in b/postfix/src/master/Makefile.in
index d8230c1b7..2138f0a48 100644
--- a/postfix/src/master/Makefile.in
+++ b/postfix/src/master/Makefile.in
@@ -180,7 +180,6 @@ master_service.o: master.h
 master_service.o: master_service.c
 master_sig.o: ../../include/events.h
 master_sig.o: ../../include/iostuff.h
-master_sig.o: ../../include/killme_after.h
 master_sig.o: ../../include/msg.h
 master_sig.o: ../../include/posix_signals.h
 master_sig.o: ../../include/sys_defs.h
diff --git a/postfix/src/master/master.c b/postfix/src/master/master.c
index ed9f94277..3304b1cdb 100644
--- a/postfix/src/master/master.c
+++ b/postfix/src/master/master.c
@@ -87,11 +87,11 @@
 /*	The default maximal number of Postfix child processes that provide
 /*	a given service.
 /* .IP "\fBmax_idle (100s)\fR"
-/*	The maximum amount of time that an idle Postfix daemon process waits
-/*	for an incoming connection before terminating voluntarily.
+/*	The maximum amount of time that an idle Postfix daemon process
+/*	waits for the next service request before exiting.
 /* .IP "\fBmax_use (100)\fR"
-/*	The maximal number of incoming connections that a Postfix daemon
-/*	process will service before terminating voluntarily.
+/*	The maximal number of connection requests before a Postfix daemon
+/*	process terminates.
 /* .IP "\fBservice_throttle_time (60s)\fR"
 /*	How long the Postfix \fBmaster\fR(8) waits before forking a server that
 /*	appears to be malfunctioning.
@@ -209,8 +209,6 @@ static NORETURN usage(const char *me)
     msg_fatal("usage: %s [-c config_dir] [-D (debug)] [-d (don't detach from terminal)] [-e exit_time] [-t (test)] [-v]", me);
 }
 
-MAIL_VERSION_STAMP_DECLARE;
-
 /* main - main program */
 
 int     main(int argc, char **argv)
@@ -227,11 +225,6 @@ int     main(int argc, char **argv)
     WATCHDOG *watchdog;
     ARGV   *import_env;
 
-    /*
-     * Fingerprint executables and core dumps.
-     */
-    MAIL_VERSION_STAMP_ALLOCATE;
-
     /*
      * Initialize.
      */
diff --git a/postfix/src/master/multi_server.c b/postfix/src/master/multi_server.c
index ede015d8b..c4dbb5c7d 100644
--- a/postfix/src/master/multi_server.c
+++ b/postfix/src/master/multi_server.c
@@ -393,7 +393,7 @@ static void multi_server_accept_local(int unused_event, char *context)
 	msg_fatal("select unlock: %m");
     if (fd < 0) {
 	if (errno != EAGAIN)
-	    msg_error("accept connection: %m");
+	    msg_fatal("accept connection: %m");
 	if (time_left >= 0)
 	    event_request_timer(multi_server_timeout, (char *) 0, time_left);
 	return;
@@ -430,7 +430,7 @@ static void multi_server_accept_pass(int unused_event, char *context)
 	msg_fatal("select unlock: %m");
     if (fd < 0) {
 	if (errno != EAGAIN)
-	    msg_error("accept connection: %m");
+	    msg_fatal("accept connection: %m");
 	if (time_left >= 0)
 	    event_request_timer(multi_server_timeout, (char *) 0, time_left);
 	return;
@@ -467,7 +467,7 @@ static void multi_server_accept_inet(int unused_event, char *context)
 	msg_fatal("select unlock: %m");
     if (fd < 0) {
 	if (errno != EAGAIN)
-	    msg_error("accept connection: %m");
+	    msg_fatal("accept connection: %m");
 	if (time_left >= 0)
 	    event_request_timer(multi_server_timeout, (char *) 0, time_left);
 	return;
@@ -626,14 +626,6 @@ NORETURN multi_server_main(int argc, char **argv, MULTI_SERVER_FN service,...)
     if (redo_syslog_init)
 	msg_syslog_init(mail_task(var_procname), LOG_PID, LOG_FACILITY);
 
-    /*
-     * If not connected to stdin, stdin must not be a terminal.
-     */
-    if (daemon_mode && stream == 0 && isatty(STDIN_FILENO)) {
-	msg_vstream_init(var_procname, VSTREAM_ERR);
-	msg_fatal("do not run this command by hand");
-    }
-
     /*
      * Application-specific initialization.
      */
@@ -702,6 +694,14 @@ NORETURN multi_server_main(int argc, char **argv, MULTI_SERVER_FN service,...)
     if (user_name)
 	user_name = var_mail_owner;
 
+    /*
+     * If not connected to stdin, stdin must not be a terminal.
+     */
+    if (daemon_mode && stream == 0 && isatty(STDIN_FILENO)) {
+	msg_vstream_init(var_procname, VSTREAM_ERR);
+	msg_fatal("do not run this command by hand");
+    }
+
     /*
      * Can options be required?
      */
diff --git a/postfix/src/master/single_server.c b/postfix/src/master/single_server.c
index 244b6798f..7e67eaa57 100644
--- a/postfix/src/master/single_server.c
+++ b/postfix/src/master/single_server.c
@@ -291,7 +291,7 @@ static void single_server_accept_local(int unused_event, char *context)
 	msg_fatal("select unlock: %m");
     if (fd < 0) {
 	if (errno != EAGAIN)
-	    msg_error("accept connection: %m");
+	    msg_fatal("accept connection: %m");
 	if (time_left >= 0)
 	    event_request_timer(single_server_timeout, (char *) 0, time_left);
 	return;
@@ -327,7 +327,7 @@ static void single_server_accept_pass(int unused_event, char *context)
 	msg_fatal("select unlock: %m");
     if (fd < 0) {
 	if (errno != EAGAIN)
-	    msg_error("accept connection: %m");
+	    msg_fatal("accept connection: %m");
 	if (time_left >= 0)
 	    event_request_timer(single_server_timeout, (char *) 0, time_left);
 	return;
@@ -363,7 +363,7 @@ static void single_server_accept_inet(int unused_event, char *context)
 	msg_fatal("select unlock: %m");
     if (fd < 0) {
 	if (errno != EAGAIN)
-	    msg_error("accept connection: %m");
+	    msg_fatal("accept connection: %m");
 	if (time_left >= 0)
 	    event_request_timer(single_server_timeout, (char *) 0, time_left);
 	return;
@@ -519,14 +519,6 @@ NORETURN single_server_main(int argc, char **argv, SINGLE_SERVER_FN service,...)
     if (redo_syslog_init)
 	msg_syslog_init(mail_task(var_procname), LOG_PID, LOG_FACILITY);
 
-    /*
-     * If not connected to stdin, stdin must not be a terminal.
-     */
-    if (daemon_mode && stream == 0 && isatty(STDIN_FILENO)) {
-	msg_vstream_init(var_procname, VSTREAM_ERR);
-	msg_fatal("do not run this command by hand");
-    }
-
     /*
      * Application-specific initialization.
      */
@@ -592,6 +584,14 @@ NORETURN single_server_main(int argc, char **argv, SINGLE_SERVER_FN service,...)
     if (user_name)
 	user_name = var_mail_owner;
 
+    /*
+     * If not connected to stdin, stdin must not be a terminal.
+     */
+    if (daemon_mode && stream == 0 && isatty(STDIN_FILENO)) {
+	msg_vstream_init(var_procname, VSTREAM_ERR);
+	msg_fatal("do not run this command by hand");
+    }
+
     /*
      * Can options be required?
      */
diff --git a/postfix/src/master/trigger_server.c b/postfix/src/master/trigger_server.c
index e420d895e..1e0846207 100644
--- a/postfix/src/master/trigger_server.c
+++ b/postfix/src/master/trigger_server.c
@@ -315,7 +315,7 @@ static void trigger_server_accept_local(int unused_event, char *context)
 	msg_fatal("select unlock: %m");
     if (fd < 0) {
 	if (errno != EAGAIN)
-	    msg_error("accept connection: %m");
+	    msg_fatal("accept connection: %m");
 	if (time_left >= 0)
 	    event_request_timer(trigger_server_timeout, (char *) 0, time_left);
 	return;
@@ -361,7 +361,7 @@ static void trigger_server_accept_pass(int unused_event, char *context)
 	msg_fatal("select unlock: %m");
     if (fd < 0) {
 	if (errno != EAGAIN)
-	    msg_error("accept connection: %m");
+	    msg_fatal("accept connection: %m");
 	if (time_left >= 0)
 	    event_request_timer(trigger_server_timeout, (char *) 0, time_left);
 	return;
@@ -526,14 +526,6 @@ NORETURN trigger_server_main(int argc, char **argv, TRIGGER_SERVER_FN service,..
     if (redo_syslog_init)
 	msg_syslog_init(mail_task(var_procname), LOG_PID, LOG_FACILITY);
 
-    /*
-     * If not connected to stdin, stdin must not be a terminal.
-     */
-    if (daemon_mode && stream == 0 && isatty(STDIN_FILENO)) {
-	msg_vstream_init(var_procname, VSTREAM_ERR);
-	msg_fatal("do not run this command by hand");
-    }
-
     /*
      * Application-specific initialization.
      */
@@ -599,6 +591,14 @@ NORETURN trigger_server_main(int argc, char **argv, TRIGGER_SERVER_FN service,..
     if (user_name)
 	user_name = var_mail_owner;
 
+    /*
+     * If not connected to stdin, stdin must not be a terminal.
+     */
+    if (daemon_mode && stream == 0 && isatty(STDIN_FILENO)) {
+	msg_vstream_init(var_procname, VSTREAM_ERR);
+	msg_fatal("do not run this command by hand");
+    }
+
     /*
      * Can options be required?
      * 
diff --git a/postfix/src/milter/Makefile.in b/postfix/src/milter/Makefile.in
index ce66bd170..4b10cda9b 100644
--- a/postfix/src/milter/Makefile.in
+++ b/postfix/src/milter/Makefile.in
@@ -100,7 +100,6 @@ milter8.o: ../../include/connect.h
 milter8.o: ../../include/header_opts.h
 milter8.o: ../../include/iostuff.h
 milter8.o: ../../include/is_header.h
-milter8.o: ../../include/mail_params.h
 milter8.o: ../../include/mail_proto.h
 milter8.o: ../../include/mime_state.h
 milter8.o: ../../include/msg.h
diff --git a/postfix/src/oqmgr/Makefile.in b/postfix/src/oqmgr/Makefile.in
index 7c6b21cce..136bd72e6 100644
--- a/postfix/src/oqmgr/Makefile.in
+++ b/postfix/src/oqmgr/Makefile.in
@@ -75,7 +75,6 @@ qmgr.o: ../../include/mail_params.h
 qmgr.o: ../../include/mail_proto.h
 qmgr.o: ../../include/mail_queue.h
 qmgr.o: ../../include/mail_server.h
-qmgr.o: ../../include/mail_version.h
 qmgr.o: ../../include/master_proto.h
 qmgr.o: ../../include/msg.h
 qmgr.o: ../../include/recipient_list.h
diff --git a/postfix/src/oqmgr/qmgr.c b/postfix/src/oqmgr/qmgr.c
index 6b7b037a3..84baa7cac 100644
--- a/postfix/src/oqmgr/qmgr.c
+++ b/postfix/src/oqmgr/qmgr.c
@@ -294,7 +294,6 @@
 #include 
 #include 
 #include 
-#include 
 #include 			/* QMGR_SCAN constants */
 #include 
 #include 
@@ -549,8 +548,6 @@ static void qmgr_post_init(char *unused_name, char **unused_argv)
     qmgr_deferred_run_event(0, (char *) 0);
 }
 
-MAIL_VERSION_STAMP_DECLARE;
-
 /* main - the main program */
 
 int     main(int argc, char **argv)
@@ -587,11 +584,6 @@ int     main(int argc, char **argv)
 	0,
     };
 
-    /*
-     * Fingerprint executables and core dumps.
-     */
-    MAIL_VERSION_STAMP_ALLOCATE;
-
     /*
      * Use the trigger service skeleton, because no-one else should be
      * monitoring our service port while this process runs, and because we do
diff --git a/postfix/src/pickup/Makefile.in b/postfix/src/pickup/Makefile.in
index 07e39f2e1..f416e3cb1 100644
--- a/postfix/src/pickup/Makefile.in
+++ b/postfix/src/pickup/Makefile.in
@@ -69,7 +69,6 @@ pickup.o: ../../include/mail_params.h
 pickup.o: ../../include/mail_proto.h
 pickup.o: ../../include/mail_queue.h
 pickup.o: ../../include/mail_server.h
-pickup.o: ../../include/mail_version.h
 pickup.o: ../../include/msg.h
 pickup.o: ../../include/mymalloc.h
 pickup.o: ../../include/rec_attr_map.h
diff --git a/postfix/src/pickup/pickup.c b/postfix/src/pickup/pickup.c
index 153f36326..04514a448 100644
--- a/postfix/src/pickup/pickup.c
+++ b/postfix/src/pickup/pickup.c
@@ -67,11 +67,11 @@
 /*	Upon input, long lines are chopped up into pieces of at most
 /*	this length; upon delivery, long lines are reconstructed.
 /* .IP "\fBmax_idle (100s)\fR"
-/*	The maximum amount of time that an idle Postfix daemon process waits
-/*	for an incoming connection before terminating voluntarily.
+/*	The maximum amount of time that an idle Postfix daemon process
+/*	waits for the next service request before exiting.
 /* .IP "\fBmax_use (100)\fR"
-/*	The maximal number of incoming connections that a Postfix daemon
-/*	process will service before terminating voluntarily.
+/*	The maximal number of connection requests before a Postfix daemon
+/*	process terminates.
 /* .IP "\fBprocess_id (read-only)\fR"
 /*	The process ID of a Postfix command or daemon process.
 /* .IP "\fBprocess_name (read-only)\fR"
@@ -141,7 +141,6 @@
 #include 
 #include 
 #include 
-#include 
 
 /* Single-threaded server skeleton. */
 
@@ -571,8 +570,6 @@ static void post_jail_init(char *unused_name, char **unused_argv)
 	input_transp_mask(VAR_INPUT_TRANSP, var_input_transp);
 }
 
-MAIL_VERSION_STAMP_DECLARE;
-
 /* main - pass control to the multi-threaded server skeleton */
 
 int     main(int argc, char **argv)
@@ -583,11 +580,6 @@ int     main(int argc, char **argv)
 	0,
     };
 
-    /*
-     * Fingerprint executables and core dumps.
-     */
-    MAIL_VERSION_STAMP_ALLOCATE;
-
     /*
      * Use the multi-threaded skeleton, because no-one else should be
      * monitoring our service socket while this process runs.
diff --git a/postfix/src/pipe/Makefile.in b/postfix/src/pipe/Makefile.in
index c661d7420..f4e286670 100644
--- a/postfix/src/pipe/Makefile.in
+++ b/postfix/src/pipe/Makefile.in
@@ -77,7 +77,6 @@ pipe.o: ../../include/mail_conf.h
 pipe.o: ../../include/mail_copy.h
 pipe.o: ../../include/mail_params.h
 pipe.o: ../../include/mail_server.h
-pipe.o: ../../include/mail_version.h
 pipe.o: ../../include/msg.h
 pipe.o: ../../include/msg_stats.h
 pipe.o: ../../include/mymalloc.h
diff --git a/postfix/src/pipe/pipe.c b/postfix/src/pipe/pipe.c
index 164896ca6..839b93108 100644
--- a/postfix/src/pipe/pipe.c
+++ b/postfix/src/pipe/pipe.c
@@ -118,8 +118,8 @@
 /*	by, for example, \fBUUCP\fR software.
 /* .RE
 /* .IP "\fBnull_sender\fR=\fIreplacement\fR (default: MAILER-DAEMON)"
-/*	Replace the null sender address (typically used for delivery
-/*	status notifications) with the specified text
+/*	Replace the null sender address, which is typically used
+/*	for delivery status notifications, with the specified text
 /*	when expanding the \fB$sender\fR command-line macro, and
 /*	when generating a From_ or Return-Path: message header.
 /*
@@ -329,11 +329,11 @@
 /*	The UNIX system account that owns the Postfix queue and most Postfix
 /*	daemon processes.
 /* .IP "\fBmax_idle (100s)\fR"
-/*	The maximum amount of time that an idle Postfix daemon process waits
-/*	for an incoming connection before terminating voluntarily.
+/*	The maximum amount of time that an idle Postfix daemon process
+/*	waits for the next service request before exiting.
 /* .IP "\fBmax_use (100)\fR"
-/*	The maximal number of incoming connections that a Postfix daemon
-/*	process will service before terminating voluntarily.
+/*	The maximal number of connection requests before a Postfix daemon
+/*	process terminates.
 /* .IP "\fBprocess_id (read-only)\fR"
 /*	The process ID of a Postfix command or daemon process.
 /* .IP "\fBprocess_name (read-only)\fR"
@@ -400,7 +400,6 @@
 #include 
 #include 
 #include 
-#include 
 #include 
 #include 
 #include 
@@ -1197,8 +1196,6 @@ static void pre_init(char *unused_name, char **unused_argv)
     flush_init();
 }
 
-MAIL_VERSION_STAMP_DECLARE;
-
 /* main - pass control to the single-threaded skeleton */
 
 int     main(int argc, char **argv)
@@ -1208,11 +1205,6 @@ int     main(int argc, char **argv)
 	0,
     };
 
-    /*
-     * Fingerprint executables and core dumps.
-     */
-    MAIL_VERSION_STAMP_ALLOCATE;
-
     single_server_main(argc, argv, pipe_service,
 		       MAIL_SERVER_TIME_TABLE, time_table,
 		       MAIL_SERVER_PRE_INIT, pre_init,
diff --git a/postfix/src/postalias/Makefile.in b/postfix/src/postalias/Makefile.in
index 2e748382e..109dd6f71 100644
--- a/postfix/src/postalias/Makefile.in
+++ b/postfix/src/postalias/Makefile.in
@@ -87,7 +87,6 @@ postalias.o: ../../include/mail_conf.h
 postalias.o: ../../include/mail_dict.h
 postalias.o: ../../include/mail_params.h
 postalias.o: ../../include/mail_task.h
-postalias.o: ../../include/mail_version.h
 postalias.o: ../../include/mkmap.h
 postalias.o: ../../include/msg.h
 postalias.o: ../../include/msg_syslog.h
diff --git a/postfix/src/postalias/postalias.c b/postfix/src/postalias/postalias.c
index 955116b99..3a6e5683a 100644
--- a/postfix/src/postalias/postalias.c
+++ b/postfix/src/postalias/postalias.c
@@ -236,7 +236,6 @@
 #include 
 #include 
 #include 
-#include 
 #include 
 #include 
 
@@ -599,8 +598,6 @@ static NORETURN usage(char *myname)
 	      myname);
 }
 
-MAIL_VERSION_STAMP_DECLARE;
-
 int     main(int argc, char **argv)
 {
     char   *path_name;
@@ -616,11 +613,6 @@ int     main(int argc, char **argv)
     int     sequence = 0;
     int     found;
 
-    /*
-     * Fingerprint executables and core dumps.
-     */
-    MAIL_VERSION_STAMP_ALLOCATE;
-
     /*
      * Be consistent with file permissions.
      */
diff --git a/postfix/src/postcat/Makefile.in b/postfix/src/postcat/Makefile.in
index 237bf6092..e92b6b71f 100644
--- a/postfix/src/postcat/Makefile.in
+++ b/postfix/src/postcat/Makefile.in
@@ -63,7 +63,6 @@ postcat.o: ../../include/mail_conf.h
 postcat.o: ../../include/mail_params.h
 postcat.o: ../../include/mail_proto.h
 postcat.o: ../../include/mail_queue.h
-postcat.o: ../../include/mail_version.h
 postcat.o: ../../include/msg.h
 postcat.o: ../../include/msg_vstream.h
 postcat.o: ../../include/rec_type.h
diff --git a/postfix/src/postcat/postcat.c b/postfix/src/postcat/postcat.c
index 1db3d506b..7f043f4c3 100644
--- a/postfix/src/postcat/postcat.c
+++ b/postfix/src/postcat/postcat.c
@@ -88,7 +88,6 @@
 #include 
 #include 
 #include 
-#include 
 #include 
 
 /* Application-specific. */
@@ -240,8 +239,6 @@ static NORETURN usage(char *myname)
 	      myname);
 }
 
-MAIL_VERSION_STAMP_DECLARE;
-
 int     main(int argc, char **argv)
 {
     VSTRING *buffer;
@@ -261,11 +258,6 @@ int     main(int argc, char **argv)
     char  **cpp;
     int     tries;
 
-    /*
-     * Fingerprint executables and core dumps.
-     */
-    MAIL_VERSION_STAMP_ALLOCATE;
-
     /*
      * To minimize confusion, make sure that the standard file descriptors
      * are open before opening anything else. XXX Work around for 44BSD where
diff --git a/postfix/src/postconf/extract.awk b/postfix/src/postconf/extract.awk
index 77cd7440f..25069f439 100644
--- a/postfix/src/postconf/extract.awk
+++ b/postfix/src/postconf/extract.awk
@@ -22,7 +22,7 @@
     }
 }
 /^(static| )*CONFIG_STR_TABLE .*\{/,/\};/ { 
-    if ($1 ~ /^VAR/) {
+    if ($1 ~ /VAR/) {
 	print "char *" substr($3,2,length($3)-2) ";" > "str_vars.h"
 	if (++stab[$1 $2 $4 $5 $6 $7 $8 $9] == 1) {
 	    print |"sed 's/[ 	][ 	]*/ /g' > str_table.h"
@@ -30,7 +30,7 @@
     }
 }
 /^(static| )*CONFIG_RAW_TABLE .*\{/,/\};/ { 
-    if ($1 ~ /^VAR/) {
+    if ($1 ~ /VAR/) {
 	print "char *" substr($3,2,length($3)-2) ";" > "raw_vars.h"
 	if (++rtab[$1 $2 $4 $5 $6 $7 $8 $9] == 1) {
 	    print |"sed 's/[ 	][ 	]*/ /g' > raw_table.h"
@@ -38,7 +38,7 @@
     }
 }
 /^(static| )*CONFIG_BOOL_TABLE .*\{/,/\};/ { 
-    if ($1 ~ /^VAR/) {
+    if ($1 ~ /VAR/) {
 	print "int " substr($3,2,length($3)-2) ";" > "bool_vars.h"
 	if (++btab[$1 $2 $4 $5 $6 $7 $8 $9] == 1) {
 	    print |"sed 's/[ 	][ 	]*/ /g' > bool_table.h"
@@ -46,7 +46,7 @@
     }
 }
 /^(static| )*CONFIG_TIME_TABLE .*\{/,/\};/ { 
-    if ($1 ~ /^VAR/) {
+    if ($1 ~ /VAR/) {
 	print "int " substr($3,2,length($3)-2) ";" > "time_vars.h"
 	if (++ttab[$1 $2 $4 $5 $6 $7 $8 $9] == 1) {
 	    print |"sed 's/[ 	][ 	]*/ /g' > time_table.h" 
diff --git a/postfix/src/postconf/postconf.c b/postfix/src/postconf/postconf.c
index dfa03612d..376644fe9 100644
--- a/postfix/src/postconf/postconf.c
+++ b/postfix/src/postconf/postconf.c
@@ -960,8 +960,6 @@ static void show_parameters(int mode, char **names)
     }
 }
 
-MAIL_VERSION_STAMP_DECLARE;
-
 /* main */
 
 int     main(int argc, char **argv)
@@ -972,11 +970,6 @@ int     main(int argc, char **argv)
     int     junk;
     ARGV   *ext_argv = 0;
 
-    /*
-     * Fingerprint executables and core dumps.
-     */
-    MAIL_VERSION_STAMP_ALLOCATE;
-
     /*
      * Be consistent with file permissions.
      */
diff --git a/postfix/src/postdrop/Makefile.in b/postfix/src/postdrop/Makefile.in
index 06afb8492..178b14ba9 100644
--- a/postfix/src/postdrop/Makefile.in
+++ b/postfix/src/postdrop/Makefile.in
@@ -68,7 +68,6 @@ postdrop.o: ../../include/mail_proto.h
 postdrop.o: ../../include/mail_queue.h
 postdrop.o: ../../include/mail_stream.h
 postdrop.o: ../../include/mail_task.h
-postdrop.o: ../../include/mail_version.h
 postdrop.o: ../../include/msg.h
 postdrop.o: ../../include/msg_syslog.h
 postdrop.o: ../../include/msg_vstream.h
diff --git a/postfix/src/postdrop/postdrop.c b/postfix/src/postdrop/postdrop.c
index 7668df8da..3bd19c8a4 100644
--- a/postfix/src/postdrop/postdrop.c
+++ b/postfix/src/postdrop/postdrop.c
@@ -126,7 +126,6 @@
 #include 
 #include 
 #include 
-#include 
 #include 
 #include 
 #include 
@@ -207,8 +206,6 @@ static void postdrop_cleanup(void)
     postdrop_sig(0);
 }
 
-MAIL_VERSION_STAMP_DECLARE;
-
 /* main - the main program */
 
 int     main(int argc, char **argv)
@@ -232,12 +229,6 @@ int     main(int argc, char **argv)
     const char *errstr;
     char   *junk;
     struct timeval start;
-    int     saved_errno;
-
-    /*
-     * Fingerprint executables and core dumps.
-     */
-    MAIL_VERSION_STAMP_ALLOCATE;
 
     /*
      * Be consistent with file permissions.
@@ -436,12 +427,9 @@ int     main(int argc, char **argv)
 	    continue;
 	}
 	if (REC_PUT_BUF(dst->stream, rec_type, buf) < 0) {
-	    /* rec_get() errors must not clobber errno. */
-	    saved_errno = errno;
-	    while (rec_get_raw(VSTREAM_IN, buf, var_line_limit,
-			       REC_FLAG_NONE) > 0)
+	    while ((rec_type = rec_get(VSTREAM_IN, buf, var_line_limit)) > 0
+		   && rec_type != REC_TYPE_END)
 		 /* void */ ;
-	    errno = saved_errno;
 	    break;
 	}
 	if (rec_type == REC_TYPE_END)
@@ -453,8 +441,8 @@ int     main(int argc, char **argv)
      * Finish the file.
      */
     if ((status = mail_stream_finish(dst, (VSTRING *) 0)) != 0) {
-	msg_warn("uid=%ld: %m", (long) uid);
 	postdrop_cleanup();
+	msg_warn("uid=%ld: %m", (long) uid);
     }
 
     /*
diff --git a/postfix/src/postfix/Makefile.in b/postfix/src/postfix/Makefile.in
index ef7c63cac..f61f6703d 100644
--- a/postfix/src/postfix/Makefile.in
+++ b/postfix/src/postfix/Makefile.in
@@ -65,7 +65,6 @@ postfix.o: ../../include/argv.h
 postfix.o: ../../include/clean_env.h
 postfix.o: ../../include/mail_conf.h
 postfix.o: ../../include/mail_params.h
-postfix.o: ../../include/mail_version.h
 postfix.o: ../../include/msg.h
 postfix.o: ../../include/msg_syslog.h
 postfix.o: ../../include/msg_vstream.h
diff --git a/postfix/src/postfix/postfix.c b/postfix/src/postfix/postfix.c
index 6c902148d..784526c47 100644
--- a/postfix/src/postfix/postfix.c
+++ b/postfix/src/postfix/postfix.c
@@ -261,12 +261,6 @@
 /*	University of Texas at Dallas
 /*	P.O. Box 830688, MC34
 /*	Richardson, TX 75083, USA
-/*
-/*	IPv6 support originally by:
-/*	Mark Huizer, Eindhoven University, The Netherlands
-/*	Jun-ichiro 'itojun' Hagino, KAME project, Japan
-/*	The Linux PLD project
-/*	Dean Strik, Eindhoven University, The Netherlands
 /*--*/
 
 /* System library. */
@@ -297,7 +291,6 @@
 
 #include 
 #include 
-#include 
 
 /* Additional installation parameters. */
 
@@ -318,8 +311,6 @@ static void check_setenv(char *name, char *value)
 	msg_fatal("setenv: %m");
 }
 
-MAIL_VERSION_STAMP_DECLARE;
-
 /* main - run administrative script from controlled environment */
 
 int     main(int argc, char **argv)
@@ -341,11 +332,6 @@ int     main(int argc, char **argv)
 	0,
     };
 
-    /*
-     * Fingerprint executables and core dumps.
-     */
-    MAIL_VERSION_STAMP_ALLOCATE;
-
     /*
      * Be consistent with file permissions.
      */
diff --git a/postfix/src/postkick/Makefile.in b/postfix/src/postkick/Makefile.in
index 7271ed1d0..527598be8 100644
--- a/postfix/src/postkick/Makefile.in
+++ b/postfix/src/postkick/Makefile.in
@@ -63,7 +63,6 @@ postkick.o: ../../include/iostuff.h
 postkick.o: ../../include/mail_conf.h
 postkick.o: ../../include/mail_params.h
 postkick.o: ../../include/mail_proto.h
-postkick.o: ../../include/mail_version.h
 postkick.o: ../../include/msg.h
 postkick.o: ../../include/msg_vstream.h
 postkick.o: ../../include/mymalloc.h
diff --git a/postfix/src/postkick/postkick.c b/postfix/src/postkick/postkick.c
index 93df8d0e3..8446f4069 100644
--- a/postfix/src/postkick/postkick.c
+++ b/postfix/src/postkick/postkick.c
@@ -96,7 +96,6 @@
 
 #include 
 #include 
-#include 
 #include 
 
 static NORETURN usage(char *myname)
@@ -104,8 +103,6 @@ static NORETURN usage(char *myname)
     msg_fatal("usage: %s [-c config_dir] [-v] class service request", myname);
 }
 
-MAIL_VERSION_STAMP_DECLARE;
-
 int     main(int argc, char **argv)
 {
     char   *class;
@@ -116,11 +113,6 @@ int     main(int argc, char **argv)
     char   *slash;
     int     c;
 
-    /*
-     * Fingerprint executables and core dumps.
-     */
-    MAIL_VERSION_STAMP_ALLOCATE;
-
     /*
      * To minimize confusion, make sure that the standard file descriptors
      * are open before opening anything else. XXX Work around for 44BSD where
diff --git a/postfix/src/postlock/Makefile.in b/postfix/src/postlock/Makefile.in
index 7024d7139..b97c2b9d4 100644
--- a/postfix/src/postlock/Makefile.in
+++ b/postfix/src/postlock/Makefile.in
@@ -66,7 +66,6 @@ postlock.o: ../../include/dsn_util.h
 postlock.o: ../../include/iostuff.h
 postlock.o: ../../include/mail_conf.h
 postlock.o: ../../include/mail_params.h
-postlock.o: ../../include/mail_version.h
 postlock.o: ../../include/mbox_conf.h
 postlock.o: ../../include/mbox_open.h
 postlock.o: ../../include/msg.h
diff --git a/postfix/src/postlock/postlock.c b/postfix/src/postlock/postlock.c
index e2814bce3..ab3a4ecf3 100644
--- a/postfix/src/postlock/postlock.c
+++ b/postfix/src/postlock/postlock.c
@@ -112,7 +112,6 @@
 /* Global library. */
 
 #include 
-#include 
 #include 
 #include 
 #include 
@@ -137,8 +136,6 @@ static void fatal_exit(void)
     exit(EX_TEMPFAIL);
 }
 
-MAIL_VERSION_STAMP_DECLARE;
-
 /* main - go for it */
 
 int     main(int argc, char **argv)
@@ -156,11 +153,6 @@ int     main(int argc, char **argv)
     char   *lock_style = 0;
     MBOX   *mp;
 
-    /*
-     * Fingerprint executables and core dumps.
-     */
-    MAIL_VERSION_STAMP_ALLOCATE;
-
     /*
      * Be consistent with file permissions.
      */
diff --git a/postfix/src/postlog/Makefile.in b/postfix/src/postlog/Makefile.in
index 5882fd33f..d0e135930 100644
--- a/postfix/src/postlog/Makefile.in
+++ b/postfix/src/postlog/Makefile.in
@@ -64,7 +64,6 @@ depend: $(MAKES)
 postlog.o: ../../include/mail_conf.h
 postlog.o: ../../include/mail_params.h
 postlog.o: ../../include/mail_task.h
-postlog.o: ../../include/mail_version.h
 postlog.o: ../../include/msg.h
 postlog.o: ../../include/msg_output.h
 postlog.o: ../../include/msg_syslog.h
diff --git a/postfix/src/postlog/postlog.c b/postfix/src/postlog/postlog.c
index 784843ce7..ef6d37ea1 100644
--- a/postfix/src/postlog/postlog.c
+++ b/postfix/src/postlog/postlog.c
@@ -5,9 +5,8 @@
 /*	Postfix-compatible logging utility
 /* SYNOPSIS
 /* .fi
-/* .ad
 /*	\fBpostlog\fR [\fB-iv\fR] [\fB-c \fIconfig_dir\fR]
-/*	[\fB-p \fIpriority\fB] [\fB-t \fItag\fR] [\fItext...\fR]
+/*		[\fB-p \fIpriority\fB] [\fB-t \fItag\fR] [\fItext...\fR]
 /* DESCRIPTION
 /*	The \fBpostlog\fR(1) command implements a Postfix-compatible logging
 /*	interface for use in, for example, shell scripts.
@@ -98,7 +97,6 @@
 /* Global library. */
 
 #include 		/* XXX right place for LOG_FACILITY? */
-#include 
 #include 
 #include 
 
@@ -162,8 +160,6 @@ static void log_stream(int level, VSTREAM *fp)
     vstring_free(buf);
 }
 
-MAIL_VERSION_STAMP_DECLARE;
-
 /* main - logger */
 
 int     main(int argc, char **argv)
@@ -176,11 +172,6 @@ int     main(int argc, char **argv)
     int     log_flags = 0;
     int     level = MSG_INFO;
 
-    /*
-     * Fingerprint executables and core dumps.
-     */
-    MAIL_VERSION_STAMP_ALLOCATE;
-
     /*
      * Be consistent with file permissions.
      */
diff --git a/postfix/src/postmap/Makefile.in b/postfix/src/postmap/Makefile.in
index 508fae4ec..a71a34f84 100644
--- a/postfix/src/postmap/Makefile.in
+++ b/postfix/src/postmap/Makefile.in
@@ -87,7 +87,6 @@ postmap.o: ../../include/mail_conf.h
 postmap.o: ../../include/mail_dict.h
 postmap.o: ../../include/mail_params.h
 postmap.o: ../../include/mail_task.h
-postmap.o: ../../include/mail_version.h
 postmap.o: ../../include/mkmap.h
 postmap.o: ../../include/msg.h
 postmap.o: ../../include/msg_syslog.h
diff --git a/postfix/src/postmap/postmap.c b/postfix/src/postmap/postmap.c
index 5befc3e69..d2f15684a 100644
--- a/postfix/src/postmap/postmap.c
+++ b/postfix/src/postmap/postmap.c
@@ -42,7 +42,7 @@
 /*	The \fIkey\fR and \fIvalue\fR are processed as is, except that
 /*	surrounding white space is stripped off. Unlike with Postfix alias
 /*	databases, quotes cannot be used to protect lookup keys that contain
-/*	special characters such as `#' or whitespace.
+/*	special characters such as `#' or whitespace. 
 /*
 /*	By default the lookup key is mapped to lowercase to make
 /*	the lookups case insensitive; as of Postfix 2.3 this case
@@ -245,7 +245,6 @@
 #include 
 #include 
 #include 
-#include 
 #include 
 #include 
 
@@ -428,7 +427,7 @@ static int postmap_queries(VSTREAM *in, char **maps, const int map_count,
 /* postmap_query - query a map and print the result to stdout */
 
 static int postmap_query(const char *map_type, const char *map_name,
-			         const char *key, int dict_flags)
+			           const char *key, int dict_flags)
 {
     DICT   *dict;
     const char *value;
@@ -451,7 +450,7 @@ static int postmap_query(const char *map_type, const char *map_name,
 /* postmap_deletes - apply multiple requests from stdin */
 
 static int postmap_deletes(VSTREAM *in, char **maps, const int map_count,
-			           int dict_flags)
+			             int dict_flags)
 {
     int     found = 0;
     VSTRING *keybuf = vstring_alloc(100);
@@ -496,7 +495,7 @@ static int postmap_deletes(VSTREAM *in, char **maps, const int map_count,
 /* postmap_delete - delete a (key, value) pair from a map */
 
 static int postmap_delete(const char *map_type, const char *map_name,
-			          const char *key, int dict_flags)
+			            const char *key, int dict_flags)
 {
     DICT   *dict;
     int     status;
@@ -510,7 +509,7 @@ static int postmap_delete(const char *map_type, const char *map_name,
 /* postmap_seq - print all map entries to stdout */
 
 static void postmap_seq(const char *map_type, const char *map_name,
-			        int dict_flags)
+			          int dict_flags)
 {
     DICT   *dict;
     const char *key;
@@ -544,8 +543,6 @@ static NORETURN usage(char *myname)
 	      myname);
 }
 
-MAIL_VERSION_STAMP_DECLARE;
-
 int     main(int argc, char **argv)
 {
     char   *path_name;
@@ -561,11 +558,6 @@ int     main(int argc, char **argv)
     int     sequence = 0;
     int     found;
 
-    /*
-     * Fingerprint executables and core dumps.
-     */
-    MAIL_VERSION_STAMP_ALLOCATE;
-
     /*
      * Be consistent with file permissions.
      */
@@ -671,15 +663,15 @@ int     main(int argc, char **argv)
 	    usage(argv[0]);
 	if (strcmp(delkey, "-") == 0)
 	    exit(postmap_deletes(VSTREAM_IN, argv + optind, argc - optind,
-				 dict_flags | DICT_FLAG_LOCK) == 0);
+				   dict_flags | DICT_FLAG_LOCK) == 0);
 	found = 0;
 	while (optind < argc) {
 	    if ((path_name = split_at(argv[optind], ':')) != 0) {
 		found |= postmap_delete(argv[optind], path_name, delkey,
-					dict_flags | DICT_FLAG_LOCK);
+					  dict_flags | DICT_FLAG_LOCK);
 	    } else {
 		found |= postmap_delete(var_db_type, argv[optind], delkey,
-					dict_flags | DICT_FLAG_LOCK);
+					  dict_flags | DICT_FLAG_LOCK);
 	    }
 	    optind++;
 	}
@@ -689,14 +681,14 @@ int     main(int argc, char **argv)
 	    usage(argv[0]);
 	if (strcmp(query, "-") == 0)
 	    exit(postmap_queries(VSTREAM_IN, argv + optind, argc - optind,
-				 dict_flags | DICT_FLAG_LOCK) == 0);
+				   dict_flags | DICT_FLAG_LOCK) == 0);
 	while (optind < argc) {
 	    if ((path_name = split_at(argv[optind], ':')) != 0) {
 		found = postmap_query(argv[optind], path_name, query,
-				      dict_flags | DICT_FLAG_LOCK);
+					dict_flags | DICT_FLAG_LOCK);
 	    } else {
 		found = postmap_query(var_db_type, argv[optind], query,
-				      dict_flags | DICT_FLAG_LOCK);
+					dict_flags | DICT_FLAG_LOCK);
 	    }
 	    if (found)
 		exit(0);
@@ -707,10 +699,10 @@ int     main(int argc, char **argv)
 	while (optind < argc) {
 	    if ((path_name = split_at(argv[optind], ':')) != 0) {
 		postmap_seq(argv[optind], path_name,
-			    dict_flags | DICT_FLAG_LOCK);
+			      dict_flags | DICT_FLAG_LOCK);
 	    } else {
 		postmap_seq(var_db_type, argv[optind],
-			    dict_flags | DICT_FLAG_LOCK);
+			      dict_flags | DICT_FLAG_LOCK);
 	    }
 	    exit(0);
 	}
diff --git a/postfix/src/postqueue/Makefile.in b/postfix/src/postqueue/Makefile.in
index 4e80a3c81..7a0a39ca9 100644
--- a/postfix/src/postqueue/Makefile.in
+++ b/postfix/src/postqueue/Makefile.in
@@ -71,7 +71,6 @@ postqueue.o: ../../include/mail_proto.h
 postqueue.o: ../../include/mail_queue.h
 postqueue.o: ../../include/mail_run.h
 postqueue.o: ../../include/mail_task.h
-postqueue.o: ../../include/mail_version.h
 postqueue.o: ../../include/msg.h
 postqueue.o: ../../include/msg_syslog.h
 postqueue.o: ../../include/msg_vstream.h
diff --git a/postfix/src/postqueue/postqueue.c b/postfix/src/postqueue/postqueue.c
index dad7b592b..8013277be 100644
--- a/postfix/src/postqueue/postqueue.c
+++ b/postfix/src/postqueue/postqueue.c
@@ -192,7 +192,6 @@
 
 #include 
 #include 
-#include 
 #include 
 #include 
 #include 
@@ -231,8 +230,8 @@
   * establish frequent proof of client liveliness with challenge/response, or
   * the client needs to restrict expensive requests to privileged users only.
   * 
-  * We don't have this problem with queue listings. The showq server detects an
-  * EPIPE error after reporting a few queue entries.
+  * We don't have this problem with queue listings. The showq server detects
+  * an EPIPE error after reporting a few queue entries.
   */
 #define PQ_MODE_DEFAULT		0	/* noop */
 #define PQ_MODE_MAILQ_LIST	1	/* list mail queue */
@@ -430,8 +429,6 @@ static NORETURN usage(void)
     msg_fatal_status(EX_USAGE, "usage: postqueue -f | postqueue -i queueid | postqueue -p | postqueue -s site");
 }
 
-MAIL_VERSION_STAMP_DECLARE;
-
 /* main - the main program */
 
 int     main(int argc, char **argv)
@@ -446,11 +443,6 @@ int     main(int argc, char **argv)
     ARGV   *import_env;
     int     bad_site;
 
-    /*
-     * Fingerprint executables and core dumps.
-     */
-    MAIL_VERSION_STAMP_ALLOCATE;
-
     /*
      * Be consistent with file permissions.
      */
diff --git a/postfix/src/postsuper/Makefile.in b/postfix/src/postsuper/Makefile.in
index 0df70b1ad..b131fe88b 100644
--- a/postfix/src/postsuper/Makefile.in
+++ b/postfix/src/postsuper/Makefile.in
@@ -63,7 +63,6 @@ postsuper.o: ../../include/mail_open_ok.h
 postsuper.o: ../../include/mail_params.h
 postsuper.o: ../../include/mail_queue.h
 postsuper.o: ../../include/mail_task.h
-postsuper.o: ../../include/mail_version.h
 postsuper.o: ../../include/msg.h
 postsuper.o: ../../include/msg_syslog.h
 postsuper.o: ../../include/msg_vstream.h
diff --git a/postfix/src/postsuper/postsuper.c b/postfix/src/postsuper/postsuper.c
index 47f67485c..a8bcedde8 100644
--- a/postfix/src/postsuper/postsuper.c
+++ b/postfix/src/postsuper/postsuper.c
@@ -253,7 +253,6 @@
 #include 
 #include 
 #include 
-#include 
 #include 
 #include 
 
@@ -989,8 +988,6 @@ static void fatal_warning(void)
     interrupted(0);
 }
 
-MAIL_VERSION_STAMP_DECLARE;
-
 int     main(int argc, char **argv)
 {
     int     fd;
@@ -1034,11 +1031,6 @@ int     main(int argc, char **argv)
 	0,
     };
 
-    /*
-     * Fingerprint executables and core dumps.
-     */
-    MAIL_VERSION_STAMP_ALLOCATE;
-
     /*
      * Be consistent with file permissions.
      */
diff --git a/postfix/src/proxymap/Makefile.in b/postfix/src/proxymap/Makefile.in
index c4ccf673d..565afbf6d 100644
--- a/postfix/src/proxymap/Makefile.in
+++ b/postfix/src/proxymap/Makefile.in
@@ -67,7 +67,6 @@ proxymap.o: ../../include/mail_conf.h
 proxymap.o: ../../include/mail_params.h
 proxymap.o: ../../include/mail_proto.h
 proxymap.o: ../../include/mail_server.h
-proxymap.o: ../../include/mail_version.h
 proxymap.o: ../../include/msg.h
 proxymap.o: ../../include/mymalloc.h
 proxymap.o: ../../include/stringops.h
diff --git a/postfix/src/proxymap/proxymap.c b/postfix/src/proxymap/proxymap.c
index a9eb0c06b..076d8089f 100644
--- a/postfix/src/proxymap/proxymap.c
+++ b/postfix/src/proxymap/proxymap.c
@@ -102,11 +102,11 @@
 /*	The time limit for sending or receiving information over an internal
 /*	communication channel.
 /* .IP "\fBmax_idle (100s)\fR"
-/*	The maximum amount of time that an idle Postfix daemon process waits
-/*	for an incoming connection before terminating voluntarily.
+/*	The maximum amount of time that an idle Postfix daemon process
+/*	waits for the next service request before exiting.
 /* .IP "\fBmax_use (100)\fR"
-/*	The maximal number of incoming connections that a Postfix daemon
-/*	process will service before terminating voluntarily.
+/*	The maximal number of connection requests before a Postfix daemon
+/*	process terminates.
 /* .IP "\fBprocess_id (read-only)\fR"
 /*	The process ID of a Postfix command or daemon process.
 /* .IP "\fBprocess_name (read-only)\fR"
@@ -159,7 +159,6 @@
 
 #include 
 #include 
-#include 
 #include 
 #include 
 
@@ -430,8 +429,6 @@ static void pre_accept(char *unused_name, char **unused_argv)
     }
 }
 
-MAIL_VERSION_STAMP_DECLARE;
-
 /* main - pass control to the multi-threaded skeleton */
 
 int     main(int argc, char **argv)
@@ -453,11 +450,6 @@ int     main(int argc, char **argv)
 	0,
     };
 
-    /*
-     * Fingerprint executables and core dumps.
-     */
-    MAIL_VERSION_STAMP_ALLOCATE;
-
     multi_server_main(argc, argv, proxymap_service,
 		      MAIL_SERVER_STR_TABLE, str_table,
 		      MAIL_SERVER_POST_INIT, post_jail_init,
diff --git a/postfix/src/qmgr/Makefile.in b/postfix/src/qmgr/Makefile.in
index d7db1a073..75b86bf91 100644
--- a/postfix/src/qmgr/Makefile.in
+++ b/postfix/src/qmgr/Makefile.in
@@ -77,7 +77,6 @@ qmgr.o: ../../include/mail_params.h
 qmgr.o: ../../include/mail_proto.h
 qmgr.o: ../../include/mail_queue.h
 qmgr.o: ../../include/mail_server.h
-qmgr.o: ../../include/mail_version.h
 qmgr.o: ../../include/master_proto.h
 qmgr.o: ../../include/msg.h
 qmgr.o: ../../include/recipient_list.h
diff --git a/postfix/src/qmgr/qmgr.c b/postfix/src/qmgr/qmgr.c
index 4cc999671..4ab22b02d 100644
--- a/postfix/src/qmgr/qmgr.c
+++ b/postfix/src/qmgr/qmgr.c
@@ -346,7 +346,6 @@
 #include 
 #include 
 #include 
-#include 
 #include 			/* QMGR_SCAN constants */
 #include 
 #include 
@@ -616,8 +615,6 @@ static void qmgr_post_init(char *name, char **unused_argv)
     qmgr_deferred_run_event(0, (char *) 0);
 }
 
-MAIL_VERSION_STAMP_DECLARE;
-
 /* main - the main program */
 
 int     main(int argc, char **argv)
@@ -662,11 +659,6 @@ int     main(int argc, char **argv)
 	0,
     };
 
-    /*
-     * Fingerprint executables and core dumps.
-     */
-    MAIL_VERSION_STAMP_ALLOCATE;
-
     /*
      * Use the trigger service skeleton, because no-one else should be
      * monitoring our service port while this process runs, and because we do
diff --git a/postfix/src/qmqpd/Makefile.in b/postfix/src/qmqpd/Makefile.in
index ef50fda86..84c5523b8 100644
--- a/postfix/src/qmqpd/Makefile.in
+++ b/postfix/src/qmqpd/Makefile.in
@@ -72,7 +72,6 @@ qmqpd.o: ../../include/mail_params.h
 qmqpd.o: ../../include/mail_proto.h
 qmqpd.o: ../../include/mail_server.h
 qmqpd.o: ../../include/mail_stream.h
-qmqpd.o: ../../include/mail_version.h
 qmqpd.o: ../../include/match_list.h
 qmqpd.o: ../../include/match_ops.h
 qmqpd.o: ../../include/match_parent_style.h
diff --git a/postfix/src/qmqpd/qmqpd.c b/postfix/src/qmqpd/qmqpd.c
index 171ecae63..0254a3875 100644
--- a/postfix/src/qmqpd/qmqpd.c
+++ b/postfix/src/qmqpd/qmqpd.c
@@ -95,11 +95,11 @@
 /*	The time limit for sending or receiving information over an internal
 /*	communication channel.
 /* .IP "\fBmax_idle (100s)\fR"
-/*	The maximum amount of time that an idle Postfix daemon process waits
-/*	for an incoming connection before terminating voluntarily.
+/*	The maximum amount of time that an idle Postfix daemon process
+/*	waits for the next service request before exiting.
 /* .IP "\fBmax_use (100)\fR"
-/*	The maximal number of incoming connections that a Postfix daemon
-/*	process will service before terminating voluntarily.
+/*	The maximal number of connection requests before a Postfix daemon
+/*	process terminates.
 /* .IP "\fBprocess_id (read-only)\fR"
 /*	The process ID of a Postfix command or daemon process.
 /* .IP "\fBprocess_name (read-only)\fR"
@@ -165,7 +165,6 @@
 /* Global library. */
 
 #include 
-#include 
 #include 
 #include 
 #include 
@@ -760,8 +759,6 @@ static void post_jail_init(char *unused_name, char **unused_argv)
     input_transp_mask(VAR_INPUT_TRANSP, var_input_transp);
 }
 
-MAIL_VERSION_STAMP_DECLARE;
-
 /* main - the main program */
 
 int     main(int argc, char **argv)
@@ -778,11 +775,6 @@ int     main(int argc, char **argv)
 	0,
     };
 
-    /*
-     * Fingerprint executables and core dumps.
-     */
-    MAIL_VERSION_STAMP_ALLOCATE;
-
     /*
      * Pass control to the single-threaded service skeleton.
      */
diff --git a/postfix/src/scache/Makefile.in b/postfix/src/scache/Makefile.in
index c6ab06562..e5282e84f 100644
--- a/postfix/src/scache/Makefile.in
+++ b/postfix/src/scache/Makefile.in
@@ -65,7 +65,6 @@ scache.o: ../../include/mail_conf.h
 scache.o: ../../include/mail_params.h
 scache.o: ../../include/mail_proto.h
 scache.o: ../../include/mail_server.h
-scache.o: ../../include/mail_version.h
 scache.o: ../../include/msg.h
 scache.o: ../../include/ring.h
 scache.o: ../../include/scache.h
diff --git a/postfix/src/scache/scache.c b/postfix/src/scache/scache.c
index f75ec306a..9d2b0dbb7 100644
--- a/postfix/src/scache/scache.c
+++ b/postfix/src/scache/scache.c
@@ -102,8 +102,8 @@
 /*	The time limit for sending or receiving information over an internal
 /*	communication channel.
 /* .IP "\fBmax_idle (100s)\fR"
-/*	The maximum amount of time that an idle Postfix daemon process waits
-/*	for an incoming connection before terminating voluntarily.
+/*	The maximum amount of time that an idle Postfix daemon process
+/*	waits for the next service request before exiting.
 /* .IP "\fBprocess_id (read-only)\fR"
 /*	The process ID of a Postfix command or daemon process.
 /* .IP "\fBprocess_name (read-only)\fR"
@@ -155,7 +155,6 @@
 /* Global library. */
 
 #include 
-#include 
 #include 
 #include 
 
@@ -533,8 +532,6 @@ static void post_jail_init(char *unused_name, char **unused_argv)
     scache_start_time = event_time();
 }
 
-MAIL_VERSION_STAMP_DECLARE;
-
 /* main - pass control to the multi-threaded skeleton */
 
 int     main(int argc, char **argv)
@@ -545,11 +542,6 @@ int     main(int argc, char **argv)
 	0,
     };
 
-    /*
-     * Fingerprint executables and core dumps.
-     */
-    MAIL_VERSION_STAMP_ALLOCATE;
-
     multi_server_main(argc, argv, scache_service,
 		      MAIL_SERVER_TIME_TABLE, time_table,
 		      MAIL_SERVER_POST_INIT, post_jail_init,
diff --git a/postfix/src/sendmail/Makefile.in b/postfix/src/sendmail/Makefile.in
index 262b9b8f8..cf9dbeeaa 100644
--- a/postfix/src/sendmail/Makefile.in
+++ b/postfix/src/sendmail/Makefile.in
@@ -76,7 +76,6 @@ sendmail.o: ../../include/mail_queue.h
 sendmail.o: ../../include/mail_run.h
 sendmail.o: ../../include/mail_stream.h
 sendmail.o: ../../include/mail_task.h
-sendmail.o: ../../include/mail_version.h
 sendmail.o: ../../include/mime_state.h
 sendmail.o: ../../include/msg.h
 sendmail.o: ../../include/msg_stats.h
diff --git a/postfix/src/sendmail/sendmail.c b/postfix/src/sendmail/sendmail.c
index 30fef831e..242896e24 100644
--- a/postfix/src/sendmail/sendmail.c
+++ b/postfix/src/sendmail/sendmail.c
@@ -222,7 +222,7 @@
 /* .ad
 /* .fi
 /*	By design, this program is not set-user (or group) id. However,
-/*	it must handle data from untrusted, possibly remote, users.
+/*	it must handle data from untrusted users or untrusted machines.
 /*	Thus, the usual precautions need to be taken against malicious
 /*	inputs.
 /* DIAGNOSTICS
@@ -419,7 +419,6 @@
 #include 
 #include 
 #include 
-#include 
 #include 
 #include 
 #include 
@@ -898,8 +897,6 @@ static void tempfail(void)
     exit(EX_TEMPFAIL);
 }
 
-MAIL_VERSION_STAMP_DECLARE;
-
 /* main - the main program */
 
 int     main(int argc, char **argv)
@@ -927,11 +924,6 @@ int     main(int argc, char **argv)
     const char *dsn_envid = 0;
     int     saved_optind;
 
-    /*
-     * Fingerprint executables and core dumps.
-     */
-    MAIL_VERSION_STAMP_ALLOCATE;
-
     /*
      * Be consistent with file permissions.
      */
@@ -1017,7 +1009,7 @@ int     main(int argc, char **argv)
     optind = saved_optind;
     mail_conf_read();
     if (strcmp(var_syslog_name, DEF_SYSLOG_NAME) != 0)
-	msg_syslog_init(mail_task("sendmail"), LOG_PID, LOG_FACILITY);
+        msg_syslog_init(mail_task("sendmail"), LOG_PID, LOG_FACILITY);
     get_mail_conf_str_table(str_table);
 
     if (chdir(var_queue_dir))
diff --git a/postfix/src/showq/Makefile.in b/postfix/src/showq/Makefile.in
index d4cd349cb..2783e9700 100644
--- a/postfix/src/showq/Makefile.in
+++ b/postfix/src/showq/Makefile.in
@@ -72,7 +72,6 @@ showq.o: ../../include/mail_proto.h
 showq.o: ../../include/mail_queue.h
 showq.o: ../../include/mail_scan_dir.h
 showq.o: ../../include/mail_server.h
-showq.o: ../../include/mail_version.h
 showq.o: ../../include/msg.h
 showq.o: ../../include/mymalloc.h
 showq.o: ../../include/quote_822_local.h
diff --git a/postfix/src/showq/showq.c b/postfix/src/showq/showq.c
index 613f333e7..8cbb27897 100644
--- a/postfix/src/showq/showq.c
+++ b/postfix/src/showq/showq.c
@@ -26,6 +26,10 @@
 /*	outside world.
 /* DIAGNOSTICS
 /*	Problems and transactions are logged to \fBsyslogd\fR(8).
+/* BUGS
+/*	The \fBshowq\fR(8) daemon runs at a fixed low privilege; consequently,
+/*	it cannot extract information from queue files in the
+/*	\fBmaildrop\fR directory.
 /* CONFIGURATION PARAMETERS
 /* .ad
 /* .fi
@@ -51,11 +55,11 @@
 /*	The time limit for sending or receiving information over an internal
 /*	communication channel.
 /* .IP "\fBmax_idle (100s)\fR"
-/*	The maximum amount of time that an idle Postfix daemon process waits
-/*	for an incoming connection before terminating voluntarily.
+/*	The maximum amount of time that an idle Postfix daemon process
+/*	waits for the next service request before exiting.
 /* .IP "\fBmax_use (100)\fR"
-/*	The maximal number of incoming connections that a Postfix daemon
-/*	process will service before terminating voluntarily.
+/*	The maximal number of connection requests before a Postfix daemon
+/*	process terminates.
 /* .IP "\fBprocess_id (read-only)\fR"
 /*	The process ID of a Postfix command or daemon process.
 /* .IP "\fBprocess_name (read-only)\fR"
@@ -118,7 +122,6 @@
 #include 
 #include 
 #include 
-#include 
 #include 
 #include 
 #include 
@@ -140,8 +143,8 @@ char   *var_empty_addr;
 #define SENDER_FORMAT	"%-11s %7ld %20.20s %s\n"
 #define DROP_FORMAT	"%-10s%c %7ld %20.20s (maildrop queue, sender UID %u)\n"
 
-static void showq_reasons(VSTREAM *, BOUNCE_LOG *, RCPT_BUF *, DSN_BUF *,
-			          HTABLE *);
+static void showq_reasons(VSTREAM *, BOUNCE_LOG *, RCPT_BUF *, DSN_BUF *, 
+HTABLE *);
 
 #define STR(x)	vstring_str(x)
 
@@ -257,8 +260,8 @@ static void showq_report(VSTREAM *client, char *queue, char *id,
 
 /* showq_reasons - show deferral reasons */
 
-static void showq_reasons(VSTREAM *client, BOUNCE_LOG *bp, RCPT_BUF *rcpt_buf,
-			          DSN_BUF *dsn_buf, HTABLE *dup_filter)
+static void showq_reasons(VSTREAM *client, BOUNCE_LOG *bp, RCPT_BUF *rcpt_buf, 
+DSN_BUF *dsn_buf, HTABLE *dup_filter)
 {
     char   *saved_reason = 0;
     int     padding;
@@ -392,8 +395,6 @@ static void showq_service(VSTREAM *client, char *unused_service, char **argv)
     }
 }
 
-MAIL_VERSION_STAMP_DECLARE;
-
 /* main - pass control to the single-threaded server skeleton */
 
 int     main(int argc, char **argv)
@@ -407,11 +408,6 @@ int     main(int argc, char **argv)
 	0,
     };
 
-    /*
-     * Fingerprint executables and core dumps.
-     */
-    MAIL_VERSION_STAMP_ALLOCATE;
-
     single_server_main(argc, argv, showq_service,
 		       MAIL_SERVER_INT_TABLE, int_table,
 		       MAIL_SERVER_STR_TABLE, str_table,
diff --git a/postfix/src/smtp/Makefile.in b/postfix/src/smtp/Makefile.in
index 8e578347d..9b10ef251 100644
--- a/postfix/src/smtp/Makefile.in
+++ b/postfix/src/smtp/Makefile.in
@@ -9,7 +9,7 @@ HDRS	= smtp.h smtp_sasl.h smtp_addr.h smtp_reuse.h
 TESTSRC	= 
 DEFS	= -I. -I$(INC_DIR) -D$(SYSTYPE)
 CFLAGS	= $(DEBUG) $(OPT) $(DEFS)
-TESTPROG= smtp_unalias smtp_map11
+TESTPROG= smtp_unalias smtp_map11 legacy levels
 PROG	= smtp
 INC_DIR	= ../../include
 LIBS	= ../../lib/libmaster.a ../../lib/libtls.a ../../lib/libdns.a \
@@ -65,6 +65,12 @@ smtp_unalias: smtp_unalias.c $(LIBS)
 smtp_map11: smtp_map11.c $(LIBS)
 	$(CC) $(CFLAGS) -DTEST -o $@ $@.c $(LIBS) $(SYSLIBS)
 
+legacy:	legacy.c $(LIBS)
+	$(CC) $(CFLAGS) -DTEST -o $@ $@.c $(LIBS)
+
+levels: levels.c $(LIBS)
+	$(CC) $(CFLAGS) -DTEST -o $@ $@.c $(LIBS)
+
 # This needs trivial-rewrite service and myorigin==mydomain
 smtp_map11_test: smtp_map11 map11_map smtp_map11.ref
 	../postmap/postmap map11_map
@@ -85,6 +91,42 @@ depend: $(MAKES)
 	@$(EXPORT) make -f Makefile.in Makefile 1>&2
 
 # do not edit below this line - it is generated by 'make depend'
+legacy.o: ../../include/msg.h
+legacy.o: ../../include/stringops.h
+legacy.o: ../../include/sys_defs.h
+legacy.o: ../../include/vbuf.h
+legacy.o: ../../include/vstream.h
+legacy.o: ../../include/vstring.h
+legacy.o: ../../include/vstring_vstream.h
+legacy.o: legacy.c
+levels.o: ../../include/argv.h
+levels.o: ../../include/attr.h
+levels.o: ../../include/deliver_request.h
+levels.o: ../../include/dict.h
+levels.o: ../../include/dsn.h
+levels.o: ../../include/dsn_buf.h
+levels.o: ../../include/htable.h
+levels.o: ../../include/maps.h
+levels.o: ../../include/match_list.h
+levels.o: ../../include/match_ops.h
+levels.o: ../../include/msg.h
+levels.o: ../../include/msg_stats.h
+levels.o: ../../include/name_code.h
+levels.o: ../../include/name_mask.h
+levels.o: ../../include/recipient_list.h
+levels.o: ../../include/resolve_clnt.h
+levels.o: ../../include/scache.h
+levels.o: ../../include/string_list.h
+levels.o: ../../include/stringops.h
+levels.o: ../../include/sys_defs.h
+levels.o: ../../include/tls.h
+levels.o: ../../include/tok822.h
+levels.o: ../../include/vbuf.h
+levels.o: ../../include/vstream.h
+levels.o: ../../include/vstring.h
+levels.o: ../../include/vstring_vstream.h
+levels.o: levels.c
+levels.o: smtp.h
 lmtp_params.o: lmtp_params.c
 smtp.o: ../../include/argv.h
 smtp.o: ../../include/attr.h
@@ -99,7 +141,6 @@ smtp.o: ../../include/htable.h
 smtp.o: ../../include/mail_conf.h
 smtp.o: ../../include/mail_params.h
 smtp.o: ../../include/mail_server.h
-smtp.o: ../../include/mail_version.h
 smtp.o: ../../include/maps.h
 smtp.o: ../../include/match_list.h
 smtp.o: ../../include/match_ops.h
@@ -169,7 +210,6 @@ smtp_chat.o: ../../include/dsn.h
 smtp_chat.o: ../../include/dsn_buf.h
 smtp_chat.o: ../../include/dsn_util.h
 smtp_chat.o: ../../include/htable.h
-smtp_chat.o: ../../include/int_filt.h
 smtp_chat.o: ../../include/line_wrap.h
 smtp_chat.o: ../../include/mail_addr.h
 smtp_chat.o: ../../include/mail_error.h
diff --git a/postfix/src/smtp/legacy.c b/postfix/src/smtp/legacy.c
new file mode 100644
index 000000000..867d02ce9
--- /dev/null
+++ b/postfix/src/smtp/legacy.c
@@ -0,0 +1,205 @@
+ /*
+  * The old legacy TLS per-site policy engine, implemented with multiple
+  * boolean variables, stripped down for exhaustive comparison with the new
+  * legacy policy engine.
+  */
+/* System library. */
+
+#include 
+#include 
+#include 
+
+#ifdef STRCASECMP_IN_STRINGS_H
+#include 
+#endif
+
+/* Utility library. */
+
+#include 
+#include 
+#include 
+#include 
+
+ /*
+  * Global policy variables.
+  */
+int     var_smtp_enforce_tls;
+int     var_smtp_tls_enforce_peername;
+int     var_smtp_use_tls;
+
+ /*
+  * Simplified session structure.
+  */
+typedef struct {
+    int     tls_use_tls;
+    int     tls_enforce_tls;
+    int     tls_enforce_peername;
+} SMTP_SESSION;
+
+ /*
+  * Per-site policies can override main.cf settings.
+  */
+typedef struct {
+    int     dont_use;			/* don't use TLS */
+    int     use;			/* useless, see above */
+    int     enforce;			/* must always use TLS */
+    int     enforce_peername;		/* must verify certificate name */
+} SMTP_TLS_SITE_POLICY;
+
+/* smtp_tls_site_policy - look up per-site TLS policy */
+
+static void smtp_tls_site_policy(SMTP_TLS_SITE_POLICY *policy,
+				         const char *lookup)
+{
+
+    /*
+     * Initialize the default policy.
+     */
+    policy->dont_use = 0;
+    policy->use = 0;
+    policy->enforce = 0;
+    policy->enforce_peername = 0;
+
+    /*
+     * Look up a non-default policy.
+     */
+    if (strcasecmp(lookup, "-")) {
+	if (!strcasecmp(lookup, "NONE"))
+	    policy->dont_use = 1;
+	else if (!strcasecmp(lookup, "MAY"))
+	    policy->use = 1;
+	else if (!strcasecmp(lookup, "MUST"))
+	    policy->enforce = policy->enforce_peername = 1;
+	else if (!strcasecmp(lookup, "MUST_NOPEERMATCH"))
+	    policy->enforce = 1;
+	else
+	    msg_fatal("unknown TLS policy '%s'", lookup);
+    }
+}
+
+static void policy(SMTP_SESSION *session, const char *host, const char *dest)
+{
+    SMTP_TLS_SITE_POLICY host_policy;
+    SMTP_TLS_SITE_POLICY rcpt_policy;
+
+    session->tls_use_tls = session->tls_enforce_tls = 0;
+    session->tls_enforce_peername = 0;
+
+    /*
+     * Override the main.cf TLS policy with an optional per-site policy.
+     */
+    smtp_tls_site_policy(&host_policy, host);
+    smtp_tls_site_policy(&rcpt_policy, dest);
+
+    /*
+     * Fix 200601: a combined per-site (NONE + MAY) policy changed global
+     * MUST into NONE, and all weaker global policies into MAY. This was
+     * discovered with exhaustive simulation. Fix verified by comparing
+     * exhaustive simulation results with Postfix 2.3 which re-implements
+     * per-site policies from the ground up.
+     */
+#ifdef FIX200601
+    if ((host_policy.dont_use || rcpt_policy.dont_use)
+	&& (host_policy.use || rcpt_policy.use)) {
+	host_policy.use = rcpt_policy.use = 0;
+	host_policy.dont_use = rcpt_policy.dont_use = 1;
+    }
+#endif
+
+    /*
+     * Set up TLS enforcement for this session.
+     */
+    if ((var_smtp_enforce_tls && !host_policy.dont_use && !rcpt_policy.dont_use)
+	|| host_policy.enforce || rcpt_policy.enforce)
+	session->tls_enforce_tls = session->tls_use_tls = 1;
+
+    /*
+     * Set up peername checking for this session.
+     * 
+     * We want to make sure that a MUST* entry in the tls_per_site table always
+     * has precedence. MUST always must lead to a peername check,
+     * MUST_NOPEERMATCH must always disable it. Only when no explicit setting
+     * has been found, the default will be used.
+     * 
+     * Fix 200601: a per-site MUST_NOPEERMATCH policy could not override a
+     * global MUST policy. Fix verified by comparing exhaustive simulation
+     * results with Postfix 2.3 which re-implements per-site policy from the
+     * ground up.
+     */
+    if (host_policy.enforce && host_policy.enforce_peername)
+	session->tls_enforce_peername = 1;
+    else if (rcpt_policy.enforce && rcpt_policy.enforce_peername)
+	session->tls_enforce_peername = 1;
+    else if (
+#ifdef FIX200601
+	     !host_policy.enforce && !rcpt_policy.enforce &&	/* Fix 200601 */
+#endif
+	     var_smtp_enforce_tls && var_smtp_tls_enforce_peername)
+	session->tls_enforce_peername = 1;
+    else if ((var_smtp_use_tls && !host_policy.dont_use && !rcpt_policy.dont_use) || host_policy.use || rcpt_policy.use)
+	session->tls_use_tls = 1;
+}
+
+static void set_global_policy(const char *global)
+{
+    var_smtp_tls_enforce_peername = var_smtp_enforce_tls = var_smtp_use_tls = 0;
+
+    if (strcasecmp(global, "must") == 0) {
+	var_smtp_enforce_tls = 1;		/* XXX */
+	var_smtp_tls_enforce_peername = 1;
+    } else if (strcasecmp(global, "must_nopeermatch") == 0) {
+	var_smtp_enforce_tls = 1;
+    } else if (strcasecmp(global, "may") == 0) {
+	var_smtp_use_tls = 1;
+    } else if (strcasecmp(global, "-") !=0) {
+	msg_fatal("unknown global policy: %s", global);
+    }
+}
+
+static const char *print_policy(SMTP_SESSION *session)
+{
+    if (session->tls_enforce_peername && session->tls_enforce_tls)
+	return ("must");
+    if (session->tls_enforce_tls)
+	return ("must_nopeermatch");
+    if (session->tls_use_tls)
+	return ("may");
+    return ("none");
+}
+
+int     main(int argc, char **argv)
+{
+    SMTP_SESSION session;
+    VSTRING *buf = vstring_alloc(200);
+    char   *cp;
+    const char *global;
+    const char *host;
+    const char *dest;
+    const char *result;
+    const char *sep = " \t\r\n";
+
+    vstream_printf("%-20s %-20s %-20s %s\n",
+		   "host", "dest", "global", "result");
+    while (vstring_get_nonl(buf, VSTREAM_IN) >= 0) {
+	cp = vstring_str(buf);
+	if (*cp == 0 || *cp == '#') {
+	    vstream_printf("%s\n", cp);
+	} else {
+	    if ((host = mystrtok(&cp, sep)) == 0)
+		msg_fatal("missing host policy");
+	    if ((dest = mystrtok(&cp, sep)) == 0)
+		msg_fatal("missing nexthop policy");
+	    if ((global = mystrtok(&cp, sep)) == 0)
+		msg_fatal("missing global policy");
+	    if (mystrtok(&cp, sep) != 0)
+		msg_fatal("garbage after global policy");
+	    set_global_policy(global);
+	    policy(&session, host, dest);
+	    result = print_policy(&session);
+	    vstream_printf("%-20s %-20s %-20s %s\n",
+			   host, dest, global, result);
+	}
+	vstream_fflush(VSTREAM_OUT);
+    }
+    exit(0);
+}
diff --git a/postfix/src/smtp/levels.c b/postfix/src/smtp/levels.c
new file mode 100644
index 000000000..7ca90e605
--- /dev/null
+++ b/postfix/src/smtp/levels.c
@@ -0,0 +1,194 @@
+ /*
+  * The new legacy TLS per-site policy engine, re-implemented in terms of
+  * enforcement levels, stripped down for exhaustive comparisons with the old
+  * legacy policy engine.
+  * 
+  * This is the code that will be used in Postfix 2.3 so that sites can upgrade
+  * Postfix without being forced to change to the new TLS policy model.
+  */
+
+/* System library. */
+
+#include 
+#include 
+#include 
+
+#ifdef STRCASECMP_IN_STRINGS_H
+#include 
+#endif
+
+/* Utility library. */
+
+#include 
+#include 
+#include 
+#include 
+
+ /*
+  * TLS levels
+  */
+#include 
+
+ /*
+  * Application-specific.
+  */
+#include 
+
+ /*
+  * Global policy variables.
+  */
+int     var_smtp_enforce_tls;
+int     var_smtp_tls_enforce_peername;
+int     var_smtp_use_tls;
+
+/* smtp_tls_policy_lookup - look up per-site TLS policy */
+
+static void smtp_tls_policy_lookup(int *site_level, const char *lookup)
+{
+
+    /*
+     * Look up a non-default policy. In case of multiple lookup results, the
+     * precedence order is a permutation of the TLS enforcement level order:
+     * VERIFY, ENCRYPT, NONE, MAY, NOTFOUND. I.e. we override MAY with a more
+     * specific policy including NONE, otherwise we choose the stronger
+     * enforcement level.
+     */
+    if (strcasecmp(lookup, "-")) {
+	if (!strcasecmp(lookup, "NONE")) {
+	    /* NONE overrides MAY or NOTFOUND. */
+	    if (*site_level <= TLS_LEV_MAY)
+		*site_level = TLS_LEV_NONE;
+	} else if (!strcasecmp(lookup, "MAY")) {
+	    /* MAY overrides NOTFOUND but not NONE. */
+	    if (*site_level < TLS_LEV_NONE)
+		*site_level = TLS_LEV_MAY;
+	} else if (!strcasecmp(lookup, "MUST_NOPEERMATCH")) {
+	    if (*site_level < TLS_LEV_ENCRYPT)
+		*site_level = TLS_LEV_ENCRYPT;
+	} else if (!strcasecmp(lookup, "MUST")) {
+	    if (*site_level < TLS_LEV_VERIFY)
+		*site_level = TLS_LEV_VERIFY;
+	} else {
+	    msg_fatal("unknown TLS policy '%s'", lookup);
+	}
+    }
+}
+
+static int policy(const char *host, const char *dest)
+{
+    int     global_level;
+    int     site_level;
+    int     tls_level;
+
+    /*
+     * Compute the global TLS policy. This is the default policy level when
+     * no per-site policy exists. It also is used to override a wild-card
+     * per-site policy.
+     */
+    if (var_smtp_enforce_tls)
+	global_level = var_smtp_tls_enforce_peername ?
+	    TLS_LEV_VERIFY : TLS_LEV_ENCRYPT;
+    else
+	global_level = var_smtp_use_tls ?
+	    TLS_LEV_MAY : TLS_LEV_NONE;
+
+    /*
+     * Compute the per-site TLS enforcement level. For compatibility with the
+     * original TLS patch, this algorithm is gives equal precedence to host
+     * and next-hop policies.
+     */
+    site_level = TLS_LEV_NOTFOUND;
+
+    smtp_tls_policy_lookup(&site_level, dest);
+    smtp_tls_policy_lookup(&site_level, host);
+
+    /*
+     * Override a wild-card per-site policy with a more specific global
+     * policy.
+     * 
+     * With the original TLS patch, 1) a per-site ENCRYPT could not override a
+     * global VERIFY, and 2) a combined per-site (NONE+MAY) policy produced
+     * inconsistent results: it changed a global VERIFY into NONE, while
+     * producing MAY with all weaker global policy settings.
+     * 
+     * With the current implementation, a combined per-site (NONE+MAY)
+     * consistently overrides global policy with NONE, and global policy can
+     * override only a per-site MAY wildcard. That is, specific policies
+     * consistently override wildcard policies, and (non-wildcard) per-site
+     * policies consistently override global policies.
+     */
+    if (site_level == TLS_LEV_NOTFOUND
+	|| (site_level == TLS_LEV_MAY
+	    && global_level > TLS_LEV_MAY))
+	tls_level = global_level;
+    else
+	tls_level = site_level;
+
+    return (tls_level);
+}
+
+static void set_global_policy(const char *global)
+{
+    var_smtp_tls_enforce_peername = var_smtp_enforce_tls = var_smtp_use_tls = 0;
+
+    if (strcasecmp(global, "must") == 0) {
+	var_smtp_enforce_tls = 1;		/* XXX */
+	var_smtp_tls_enforce_peername = 1;
+    } else if (strcasecmp(global, "must_nopeermatch") == 0) {
+	var_smtp_enforce_tls = 1;
+    } else if (strcasecmp(global, "may") == 0) {
+	var_smtp_use_tls = 1;
+    } else if (strcasecmp(global, "-") !=0) {
+	msg_fatal("unknown global policy: %s", global);
+    }
+}
+
+static const char *print_policy(int level)
+{
+    if (level == TLS_LEV_VERIFY)
+	return ("must");
+    if (level == TLS_LEV_ENCRYPT)
+	return ("must_nopeermatch");
+    if (level == TLS_LEV_MAY)
+	return ("may");
+    if (level == TLS_LEV_NONE)
+	return ("none");
+    msg_panic("unknown policy level %d", level);
+}
+
+int     main(int argc, char **argv)
+{
+    VSTRING *buf = vstring_alloc(200);
+    char   *cp;
+    const char *global;
+    const char *host;
+    const char *dest;
+    const char *result;
+    const char *sep = " \t\r\n";
+    int     level;
+
+    vstream_printf("%-20s %-20s %-20s %s\n",
+		   "host", "dest", "global", "result");
+    while (vstring_get_nonl(buf, VSTREAM_IN) > 0) {
+	cp = vstring_str(buf);
+	if (*cp == 0 || *cp == '#') {
+	    vstream_printf("%s\n", cp);
+	} else {
+	    if ((host = mystrtok(&cp, sep)) == 0)
+		msg_fatal("missing host policy");
+	    if ((dest = mystrtok(&cp, sep)) == 0)
+		msg_fatal("missing nexthop policy");
+	    if ((global = mystrtok(&cp, sep)) == 0)
+		msg_fatal("missing global policy");
+	    if (mystrtok(&cp, sep) != 0)
+		msg_fatal("garbage after global policy");
+	    set_global_policy(global);
+	    level = policy(host, dest);
+	    result = print_policy(level);
+	    vstream_printf("%-20s %-20s %-20s %s\n",
+			   host, dest, global, result);
+	}
+	vstream_fflush(VSTREAM_OUT);
+    }
+    exit(0);
+}
diff --git a/postfix/src/smtp/smtp.c b/postfix/src/smtp/smtp.c
index 9a69f2adc..91ee7e814 100644
--- a/postfix/src/smtp/smtp.c
+++ b/postfix/src/smtp/smtp.c
@@ -33,7 +33,7 @@
 /*
 /*	By default, connection caching is enabled temporarily for
 /*	destinations that have a high volume of mail in the active
-/*	queue. Connection caching can be enabled permanently for
+/*	queue. Session caching can be enabled permanently for
 /*	specific destinations.
 /* SMTP DESTINATION SYNTAX
 /* .ad
@@ -120,9 +120,9 @@
 /*	when the client is used for multiple domains.
 /*
 /*	Most smtp_\fIxxx\fR configuration parameters have an
-/*	lmtp_\fIxxx\fR "mirror" parameter for the equivalent LMTP
+/*	lmtp_\fIxxx\fR "ghost" parameter for the equivalent LMTP
 /*	feature. This document describes only those LMTP-related
-/*	parameters that aren't simply "mirror" parameters.
+/*	parameters that aren't simply "ghost" parameters.
 /*
 /*	Changes to \fBmain.cf\fR are picked up automatically, as \fBsmtp\fR(8)
 /*	processes run for only a limited amount of time. Use the command
@@ -200,7 +200,7 @@
 /*	case insensitive lists of LHLO keywords (pipelining, starttls,
 /*	auth, etc.) that the LMTP client will ignore in the LHLO response
 /*	from a remote LMTP server.
-/* .IP "\fBlmtp_discard_lhlo_keywords (empty)\fR"
+/* .IP "\fBlmtp_discard_lhlo_keywords ($myhostname)\fR"
 /*	A case insensitive list of LHLO keywords (pipelining, starttls,
 /*	auth, etc.) that the LMTP client will ignore in the LHLO response
 /*	from a remote LMTP server.
@@ -486,11 +486,11 @@
 /* .IP "\fBlmtp_tcp_port (24)\fR"
 /*	The default TCP port that the Postfix LMTP client connects to.
 /* .IP "\fBmax_idle (100s)\fR"
-/*	The maximum amount of time that an idle Postfix daemon process waits
-/*	for an incoming connection before terminating voluntarily.
+/*	The maximum amount of time that an idle Postfix daemon process
+/*	waits for the next service request before exiting.
 /* .IP "\fBmax_use (100)\fR"
-/*	The maximal number of incoming connections that a Postfix daemon
-/*	process will service before terminating voluntarily.
+/*	The maximal number of connection requests before a Postfix daemon
+/*	process terminates.
 /* .IP "\fBprocess_id (read-only)\fR"
 /*	The process ID of a Postfix command or daemon process.
 /* .IP "\fBprocess_name (read-only)\fR"
@@ -602,7 +602,6 @@
 
 #include 
 #include 
-#include 
 #include 
 #include 
 #include 
@@ -948,8 +947,6 @@ static void pre_accept(char *unused_name, char **unused_argv)
     }
 }
 
-MAIL_VERSION_STAMP_DECLARE;
-
 /* main - pass control to the single-threaded skeleton */
 
 int     main(int argc, char **argv)
@@ -958,11 +955,6 @@ int     main(int argc, char **argv)
 #include "lmtp_params.c"
     int     smtp_mode;
 
-    /*
-     * Fingerprint executables and core dumps.
-     */
-    MAIL_VERSION_STAMP_ALLOCATE;
-
     /*
      * XXX At this point, var_procname etc. are not initialized.
      */
diff --git a/postfix/src/smtp/smtp_proto.c b/postfix/src/smtp/smtp_proto.c
index 2d1a12c5f..ed8d3f75e 100644
--- a/postfix/src/smtp/smtp_proto.c
+++ b/postfix/src/smtp/smtp_proto.c
@@ -581,11 +581,12 @@ int     smtp_helo(SMTP_STATE *state)
 	     * Send STARTTLS. Recurse when the server accepts STARTTLS, after
 	     * resetting the SASL and EHLO features lists.
 	     * 
-	     * Reset the SASL mechanism list to avoid spurious warnings.
+	     * XXX Reset the SASL mechanism list to avoid spurious warnings. We
+	     * need a routine to reset the list instead of groping data here.
 	     * 
-	     * Use the smtp_sasl_tls_security_options feature to allow SASL
-	     * mechanisms that may not be allowed with plain-text
-	     * connections.
+	     * XXX Should not there be an smtp_sasl_tls_security_options feature
+	     * to allow different mechanisms across TLS tunnels than across
+	     * plain-text connections?
 	     */
 	    smtp_chat_cmd(session, "STARTTLS");
 	    if ((resp = smtp_chat_resp(session))->code / 100 == 2) {
diff --git a/postfix/src/smtpd/smtpd.c b/postfix/src/smtpd/smtpd.c
index 601a1f538..f38a0fe3c 100644
--- a/postfix/src/smtpd/smtpd.c
+++ b/postfix/src/smtpd/smtpd.c
@@ -775,11 +775,11 @@
 /*	The UNIX system account that owns the Postfix queue and most Postfix
 /*	daemon processes.
 /* .IP "\fBmax_idle (100s)\fR"
-/*	The maximum amount of time that an idle Postfix daemon process waits
-/*	for an incoming connection before terminating voluntarily.
+/*	The maximum amount of time that an idle Postfix daemon process
+/*	waits for the next service request before exiting.
 /* .IP "\fBmax_use (100)\fR"
-/*	The maximal number of incoming connections that a Postfix daemon
-/*	process will service before terminating voluntarily.
+/*	The maximal number of connection requests before a Postfix daemon
+/*	process terminates.
 /* .IP "\fBmyhostname (see 'postconf -d' output)\fR"
 /*	The internet hostname of this mail system.
 /* .IP "\fBmynetworks (see 'postconf -d' output)\fR"
@@ -4401,8 +4401,6 @@ static void post_jail_init(char *unused_name, char **unused_argv)
 	anvil_clnt = anvil_clnt_create();
 }
 
-MAIL_VERSION_STAMP_DECLARE;
-
 /* main - the main program */
 
 int     main(int argc, char **argv)
@@ -4574,11 +4572,6 @@ int     main(int argc, char **argv)
 	0,
     };
 
-    /*
-     * Fingerprint executables and core dumps.
-     */
-    MAIL_VERSION_STAMP_ALLOCATE;
-
     /*
      * Pass control to the single-threaded service skeleton.
      */
diff --git a/postfix/src/smtpstone/Makefile.in b/postfix/src/smtpstone/Makefile.in
index 3c0316e73..6de57d175 100644
--- a/postfix/src/smtpstone/Makefile.in
+++ b/postfix/src/smtpstone/Makefile.in
@@ -82,7 +82,6 @@ qmqp-sink.o: ../../include/events.h
 qmqp-sink.o: ../../include/inet_proto.h
 qmqp-sink.o: ../../include/iostuff.h
 qmqp-sink.o: ../../include/listen.h
-qmqp-sink.o: ../../include/mail_version.h
 qmqp-sink.o: ../../include/msg.h
 qmqp-sink.o: ../../include/msg_vstream.h
 qmqp-sink.o: ../../include/mymalloc.h
@@ -100,7 +99,6 @@ qmqp-source.o: ../../include/host_port.h
 qmqp-source.o: ../../include/inet_proto.h
 qmqp-source.o: ../../include/iostuff.h
 qmqp-source.o: ../../include/mail_date.h
-qmqp-source.o: ../../include/mail_version.h
 qmqp-source.o: ../../include/msg.h
 qmqp-source.o: ../../include/msg_vstream.h
 qmqp-source.o: ../../include/myaddrinfo.h
@@ -116,20 +114,14 @@ qmqp-source.o: ../../include/vbuf.h
 qmqp-source.o: ../../include/vstream.h
 qmqp-source.o: ../../include/vstring.h
 qmqp-source.o: qmqp-source.c
-smtp-sink.o: ../../include/chroot_uid.h
 smtp-sink.o: ../../include/events.h
 smtp-sink.o: ../../include/get_hostname.h
 smtp-sink.o: ../../include/inet_proto.h
 smtp-sink.o: ../../include/iostuff.h
 smtp-sink.o: ../../include/listen.h
-smtp-sink.o: ../../include/mail_date.h
-smtp-sink.o: ../../include/mail_version.h
-smtp-sink.o: ../../include/make_dirs.h
 smtp-sink.o: ../../include/msg.h
 smtp-sink.o: ../../include/msg_vstream.h
-smtp-sink.o: ../../include/myaddrinfo.h
 smtp-sink.o: ../../include/mymalloc.h
-smtp-sink.o: ../../include/myrand.h
 smtp-sink.o: ../../include/sane_accept.h
 smtp-sink.o: ../../include/smtp_stream.h
 smtp-sink.o: ../../include/stringops.h
@@ -146,7 +138,6 @@ smtp-source.o: ../../include/host_port.h
 smtp-source.o: ../../include/inet_proto.h
 smtp-source.o: ../../include/iostuff.h
 smtp-source.o: ../../include/mail_date.h
-smtp-source.o: ../../include/mail_version.h
 smtp-source.o: ../../include/msg.h
 smtp-source.o: ../../include/msg_vstream.h
 smtp-source.o: ../../include/myaddrinfo.h
diff --git a/postfix/src/smtpstone/qmqp-sink.c b/postfix/src/smtpstone/qmqp-sink.c
index f89cd194f..30390e627 100644
--- a/postfix/src/smtpstone/qmqp-sink.c
+++ b/postfix/src/smtpstone/qmqp-sink.c
@@ -79,7 +79,6 @@
 /* Global library. */
 
 #include 
-#include 
 
 /* Application-specific. */
 
@@ -240,8 +239,6 @@ static void usage(char *myname)
     msg_fatal("usage: %s [-cv] [-x time] [host]:port backlog", myname);
 }
 
-MAIL_VERSION_STAMP_DECLARE;
-
 int     main(int argc, char **argv)
 {
     int     sock;
@@ -251,11 +248,6 @@ int     main(int argc, char **argv)
     const char *protocols = INET_PROTO_NAME_ALL;
     INET_PROTO_INFO *proto_info;
 
-    /*
-     * Fingerprint executables and core dumps.
-     */
-    MAIL_VERSION_STAMP_ALLOCATE;
-
     /*
      * Fix 20051207.
      */
diff --git a/postfix/src/smtpstone/qmqp-source.c b/postfix/src/smtpstone/qmqp-source.c
index 33282ac40..2606e6e11 100644
--- a/postfix/src/smtpstone/qmqp-source.c
+++ b/postfix/src/smtpstone/qmqp-source.c
@@ -110,7 +110,6 @@
 
 #include 
 #include 
-#include 
 
 /* Application-specific. */
 
@@ -443,8 +442,6 @@ static void usage(char *myname)
     msg_fatal("usage: %s -cv -s sess -l msglen -m msgs -C count -M myhostname -f from -t to -R delay -w delay host[:port]", myname);
 }
 
-MAIL_VERSION_STAMP_DECLARE;
-
 /* main - parse JCL and start the machine */
 
 int     main(int argc, char **argv)
@@ -466,11 +463,6 @@ int     main(int argc, char **argv)
     const char *protocols = INET_PROTO_NAME_ALL;
     INET_PROTO_INFO *proto_info;
 
-    /*
-     * Fingerprint executables and core dumps.
-     */
-    MAIL_VERSION_STAMP_ALLOCATE;
-
     signal(SIGPIPE, SIG_IGN);
     msg_vstream_init(argv[0], VSTREAM_ERR);
 
diff --git a/postfix/src/smtpstone/smtp-sink.c b/postfix/src/smtpstone/smtp-sink.c
index d5b0bcd7e..b18278fa9 100644
--- a/postfix/src/smtpstone/smtp-sink.c
+++ b/postfix/src/smtpstone/smtp-sink.c
@@ -266,7 +266,6 @@
 
 #include 
 #include 
-#include 
 
 /* Application-specific. */
 
@@ -1250,8 +1249,6 @@ static void usage(char *myname)
     msg_fatal("usage: %s [-468acCeEFLpPv] [-A abort_delay] [-f commands] [-h hostname] [-m max_concurrency] [-n quit_count] [-q commands] [-r commands] [-s commands] [-w delay] [-d dump-template] [-D dump-template] [-R root-dir] [-S start-string] [-u user_privs] [host]:port backlog", myname);
 }
 
-MAIL_VERSION_STAMP_DECLARE;
-
 int     main(int argc, char **argv)
 {
     int     backlog;
@@ -1261,11 +1258,6 @@ int     main(int argc, char **argv)
     const char *root_dir = 0;
     const char *user_privs = 0;
 
-    /*
-     * Fingerprint executables and core dumps.
-     */
-    MAIL_VERSION_STAMP_ALLOCATE;
-
     /*
      * Fix 20051207.
      */
diff --git a/postfix/src/smtpstone/smtp-source.c b/postfix/src/smtpstone/smtp-source.c
index 52306cf8c..9a736e14a 100644
--- a/postfix/src/smtpstone/smtp-source.c
+++ b/postfix/src/smtpstone/smtp-source.c
@@ -137,7 +137,6 @@
 
 #include 
 #include 
-#include 
 
 /* Application-specific. */
 
@@ -795,8 +794,6 @@ static void usage(char *myname)
     msg_fatal("usage: %s -cdLNov -s sess -l msglen -m msgs -C count -M myhostname -f from -t to -r rcptcount -R delay -w delay host[:port]", myname);
 }
 
-MAIL_VERSION_STAMP_DECLARE;
-
 /* main - parse JCL and start the machine */
 
 int     main(int argc, char **argv)
@@ -816,11 +813,6 @@ int     main(int argc, char **argv)
     const char *protocols = INET_PROTO_NAME_ALL;
     INET_PROTO_INFO *proto_info;
 
-    /*
-     * Fingerprint executables and core dumps.
-     */
-    MAIL_VERSION_STAMP_ALLOCATE;
-
     signal(SIGPIPE, SIG_IGN);
     msg_vstream_init(argv[0], VSTREAM_ERR);
 
diff --git a/postfix/src/spawn/Makefile.in b/postfix/src/spawn/Makefile.in
index 1a89937db..24d2cc2fe 100644
--- a/postfix/src/spawn/Makefile.in
+++ b/postfix/src/spawn/Makefile.in
@@ -62,7 +62,6 @@ spawn.o: ../../include/dict.h
 spawn.o: ../../include/mail_conf.h
 spawn.o: ../../include/mail_params.h
 spawn.o: ../../include/mail_server.h
-spawn.o: ../../include/mail_version.h
 spawn.o: ../../include/msg.h
 spawn.o: ../../include/mymalloc.h
 spawn.o: ../../include/set_eugid.h
diff --git a/postfix/src/spawn/spawn.c b/postfix/src/spawn/spawn.c
index 90fe7987b..71345724a 100644
--- a/postfix/src/spawn/spawn.c
+++ b/postfix/src/spawn/spawn.c
@@ -70,7 +70,7 @@
 /*	The amount of time the command is allowed to run before it is
 /*	terminated.
 /*
-/*	Postfix 2.4 and later support a suffix that specifies the
+/*	Postfix 2.4 and later support a suffix that specifies the 
 /*	time unit: s (seconds), m (minutes), h (hours), d (days),
 /*	w (weeks). The default time unit is seconds.
 /* MISCELLANEOUS
@@ -92,11 +92,11 @@
 /*	The UNIX system account that owns the Postfix queue and most Postfix
 /*	daemon processes.
 /* .IP "\fBmax_idle (100s)\fR"
-/*	The maximum amount of time that an idle Postfix daemon process waits
-/*	for an incoming connection before terminating voluntarily.
+/*	The maximum amount of time that an idle Postfix daemon process
+/*	waits for the next service request before exiting.
 /* .IP "\fBmax_use (100)\fR"
-/*	The maximal number of incoming connections that a Postfix daemon
-/*	process will service before terminating voluntarily.
+/*	The maximal number of connection requests before a Postfix daemon
+/*	process terminates.
 /* .IP "\fBprocess_id (read-only)\fR"
 /*	The process ID of a Postfix command or daemon process.
 /* .IP "\fBprocess_name (read-only)\fR"
@@ -148,10 +148,6 @@
 #include 
 #include 
 
-/* Global library. */
-
-#include 
-
 /* Single server skeleton. */
 
 #include 
@@ -326,7 +322,7 @@ static void spawn_service(VSTREAM *client_stream, char *service, char **argv)
 static void pre_accept(char *unused_name, char **unused_argv)
 {
     const char *table;
-
+ 
     if ((table = dict_changed_name()) != 0) {
 	msg_info("table %s has changed -- restarting", table);
 	exit(0);
@@ -340,8 +336,6 @@ static void drop_privileges(char *unused_name, char **unused_argv)
     set_eugid(var_owner_uid, var_owner_gid);
 }
 
-MAIL_VERSION_STAMP_DECLARE;
-
 /* main - pass control to the single-threaded skeleton */
 
 int     main(int argc, char **argv)
@@ -351,11 +345,6 @@ int     main(int argc, char **argv)
 	0,
     };
 
-    /*
-     * Fingerprint executables and core dumps.
-     */
-    MAIL_VERSION_STAMP_ALLOCATE;
-
     single_server_main(argc, argv, spawn_service,
 		       MAIL_SERVER_TIME_TABLE, time_table,
 		       MAIL_SERVER_POST_INIT, drop_privileges,
diff --git a/postfix/src/tlsmgr/Makefile.in b/postfix/src/tlsmgr/Makefile.in
index a25208427..05301e47b 100644
--- a/postfix/src/tlsmgr/Makefile.in
+++ b/postfix/src/tlsmgr/Makefile.in
@@ -68,7 +68,6 @@ tlsmgr.o: ../../include/mail_conf.h
 tlsmgr.o: ../../include/mail_params.h
 tlsmgr.o: ../../include/mail_proto.h
 tlsmgr.o: ../../include/mail_server.h
-tlsmgr.o: ../../include/mail_version.h
 tlsmgr.o: ../../include/master_proto.h
 tlsmgr.o: ../../include/msg.h
 tlsmgr.o: ../../include/mymalloc.h
diff --git a/postfix/src/tlsmgr/tlsmgr.c b/postfix/src/tlsmgr/tlsmgr.c
index e4630193d..ed1018ec1 100644
--- a/postfix/src/tlsmgr/tlsmgr.c
+++ b/postfix/src/tlsmgr/tlsmgr.c
@@ -192,7 +192,6 @@
 
 #include 
 #include 
-#include 
 #include 
 #include 
 
@@ -877,8 +876,6 @@ static void tlsmgr_before_exit(char *unused_service_name, char **unused_argv)
 	tls_prng_exch_update(rand_exch);
 }
 
-MAIL_VERSION_STAMP_DECLARE;
-
 /* main - the main program */
 
 int     main(int argc, char **argv)
@@ -907,11 +904,6 @@ int     main(int argc, char **argv)
 	0,
     };
 
-    /*
-     * Fingerprint executables and core dumps.
-     */
-    MAIL_VERSION_STAMP_ALLOCATE;
-
     /*
      * Use the multi service skeleton, and require that no-one else is
      * monitoring our service port while this process runs.
diff --git a/postfix/src/trivial-rewrite/Makefile.in b/postfix/src/trivial-rewrite/Makefile.in
index 6b3ae51a3..eadb385c0 100644
--- a/postfix/src/trivial-rewrite/Makefile.in
+++ b/postfix/src/trivial-rewrite/Makefile.in
@@ -146,7 +146,6 @@ trivial-rewrite.o: ../../include/mail_conf.h
 trivial-rewrite.o: ../../include/mail_params.h
 trivial-rewrite.o: ../../include/mail_proto.h
 trivial-rewrite.o: ../../include/mail_server.h
-trivial-rewrite.o: ../../include/mail_version.h
 trivial-rewrite.o: ../../include/maps.h
 trivial-rewrite.o: ../../include/msg.h
 trivial-rewrite.o: ../../include/resolve_clnt.h
diff --git a/postfix/src/trivial-rewrite/resolve.c b/postfix/src/trivial-rewrite/resolve.c
index c67d186f2..c3dd39193 100644
--- a/postfix/src/trivial-rewrite/resolve.c
+++ b/postfix/src/trivial-rewrite/resolve.c
@@ -620,8 +620,7 @@ static void resolve_addr(RES_CONTEXT *rp, char *sender, char *addr,
 	if ((newloc = mail_addr_find(relocated_maps, STR(nextrcpt),
 				     IGNORE_ADDR_EXTENSION)) != 0) {
 	    vstring_strcpy(channel, MAIL_SERVICE_ERROR);
-	    /* 5.1.6 is the closest match, but not perfect. */
-	    vstring_sprintf(nexthop, "5.1.6 User has moved to %s", newloc);
+	    vstring_sprintf(nexthop, "User has moved to %s", newloc);
 	} else if (dict_errno != 0) {
 	    msg_warn("%s lookup failure", VAR_RELOCATED_MAPS);
 	    *flags |= RESOLVE_FLAG_FAIL;
diff --git a/postfix/src/trivial-rewrite/trivial-rewrite.c b/postfix/src/trivial-rewrite/trivial-rewrite.c
index d539a5d2a..406c6c6f6 100644
--- a/postfix/src/trivial-rewrite/trivial-rewrite.c
+++ b/postfix/src/trivial-rewrite/trivial-rewrite.c
@@ -198,11 +198,11 @@
 /*	The time limit for sending or receiving information over an internal
 /*	communication channel.
 /* .IP "\fBmax_idle (100s)\fR"
-/*	The maximum amount of time that an idle Postfix daemon process waits
-/*	for an incoming connection before terminating voluntarily.
+/*	The maximum amount of time that an idle Postfix daemon process
+/*	waits for the next service request before exiting.
 /* .IP "\fBmax_use (100)\fR"
-/*	The maximal number of incoming connections that a Postfix daemon
-/*	process will service before terminating voluntarily.
+/*	The maximal number of connection requests before a Postfix daemon
+/*	process terminates.
 /* .IP "\fBrelocated_maps (empty)\fR"
 /*	Optional lookup tables with new contact information for users or
 /*	domains that no longer exist.
@@ -272,7 +272,6 @@
 /* Global library. */
 
 #include 
-#include 
 #include 
 #include 
 #include 
@@ -531,8 +530,6 @@ static void post_jail_init(char *unused_name, char **unused_argv)
     var_idle_limit = 1;
 }
 
-MAIL_VERSION_STAMP_DECLARE;
-
 /* main - pass control to the multi-threaded skeleton code */
 
 int     main(int argc, char **argv)
@@ -572,11 +569,6 @@ int     main(int argc, char **argv)
 	0,
     };
 
-    /*
-     * Fingerprint executables and core dumps.
-     */
-    MAIL_VERSION_STAMP_ALLOCATE;
-
     multi_server_main(argc, argv, rewrite_service,
 		      MAIL_SERVER_STR_TABLE, str_table,
 		      MAIL_SERVER_BOOL_TABLE, bool_table,
diff --git a/postfix/src/util/attr_print0.c b/postfix/src/util/attr_print0.c
index 7c6767843..339388605 100644
--- a/postfix/src/util/attr_print0.c
+++ b/postfix/src/util/attr_print0.c
@@ -22,7 +22,7 @@
 /*	attr_scan0(). The stream is not flushed.
 /*
 /*	attr_vprint0() provides an alternate interface that is convenient
-/*	for calling from within variadic functions.
+/*	for calling from within variadoc functions.
 /*
 /*	Attributes are sent in the requested order as specified with the
 /*	attr_print0() argument list. This routine satisfies the formatting
diff --git a/postfix/src/util/attr_print64.c b/postfix/src/util/attr_print64.c
index 5fd3ed93b..f9cd51e0a 100644
--- a/postfix/src/util/attr_print64.c
+++ b/postfix/src/util/attr_print64.c
@@ -22,7 +22,7 @@
 /*	attr_scan64(). The stream is not flushed.
 /*
 /*	attr_vprint64() provides an alternate interface that is convenient
-/*	for calling from within variadic functions.
+/*	for calling from within variadoc functions.
 /*
 /*	Attributes are sent in the requested order as specified with the
 /*	attr_print64() argument list. This routine satisfies the formatting
diff --git a/postfix/src/util/attr_print_plain.c b/postfix/src/util/attr_print_plain.c
index cc01c781f..61106f7e3 100644
--- a/postfix/src/util/attr_print_plain.c
+++ b/postfix/src/util/attr_print_plain.c
@@ -22,7 +22,7 @@
 /*	attr_scan_plain(). The stream is not flushed.
 /*
 /*	attr_vprint_plain() provides an alternate interface that is convenient
-/*	for calling from within variadic functions.
+/*	for calling from within variadoc functions.
 /*
 /*	Attributes are sent in the requested order as specified with the
 /*	attr_print_plain() argument list. This routine satisfies the formatting
diff --git a/postfix/src/util/inet_listen.c b/postfix/src/util/inet_listen.c
index 72f277cc3..2c610a301 100644
--- a/postfix/src/util/inet_listen.c
+++ b/postfix/src/util/inet_listen.c
@@ -161,8 +161,5 @@ int     inet_listen(const char *addr, int backlog, int block_mode)
 
 int     inet_accept(int fd)
 {
-    struct sockaddr_storage ss;
-    SOCKADDR_SIZE ss_len = sizeof(ss);
-
-    return (sane_accept(fd, (struct sockaddr *) & ss, &ss_len));
+    return (sane_accept(fd, (struct sockaddr *) 0, (SOCKADDR_SIZE *) 0));
 }
diff --git a/postfix/src/util/sane_accept.c b/postfix/src/util/sane_accept.c
index 5c49aa036..a4560c2c5 100644
--- a/postfix/src/util/sane_accept.c
+++ b/postfix/src/util/sane_accept.c
@@ -108,11 +108,7 @@ int     sane_accept(int sock, struct sockaddr * sa, SOCKADDR_SIZE *len)
      * timer.
      */
 #if defined(BROKEN_READ_SELECT_ON_TCP_SOCKET) && defined(SO_KEEPALIVE)
-    else if (sa && (sa->sa_family == AF_INET
-#ifdef HAS_IPV6
-		    || sa->sa_family == AF_INET6
-#endif
-		    )) {
+    else if (sa != 0 && sa->sa_family == AF_INET) {
 	int     on = 1;
 
 	(void) setsockopt(fd, SOL_SOCKET, SO_KEEPALIVE,
diff --git a/postfix/src/util/sys_defs.h b/postfix/src/util/sys_defs.h
index 14ee3eef0..96608aa4c 100644
--- a/postfix/src/util/sys_defs.h
+++ b/postfix/src/util/sys_defs.h
@@ -208,8 +208,6 @@
 #define NATIVE_NEWALIAS_PATH "/usr/bin/newaliases"
 #define NATIVE_COMMAND_DIR "/usr/sbin"
 #define NATIVE_DAEMON_DIR "/usr/libexec/postfix"
-#define SOCKADDR_SIZE	socklen_t
-#define SOCKOPT_SIZE	socklen_t
 #endif
 
  /*
diff --git a/postfix/src/verify/Makefile.in b/postfix/src/verify/Makefile.in
index 0bb5c159d..f9671f8da 100644
--- a/postfix/src/verify/Makefile.in
+++ b/postfix/src/verify/Makefile.in
@@ -65,13 +65,11 @@ verify.o: ../../include/dict.h
 verify.o: ../../include/dict_ht.h
 verify.o: ../../include/dsn.h
 verify.o: ../../include/htable.h
-verify.o: ../../include/int_filt.h
 verify.o: ../../include/iostuff.h
 verify.o: ../../include/mail_conf.h
 verify.o: ../../include/mail_params.h
 verify.o: ../../include/mail_proto.h
 verify.o: ../../include/mail_server.h
-verify.o: ../../include/mail_version.h
 verify.o: ../../include/msg.h
 verify.o: ../../include/msg_stats.h
 verify.o: ../../include/mymalloc.h
diff --git a/postfix/src/verify/verify.c b/postfix/src/verify/verify.c
index 13db73fd8..c1771fa56 100644
--- a/postfix/src/verify/verify.c
+++ b/postfix/src/verify/verify.c
@@ -186,7 +186,6 @@
 
 #include 
 #include 
-#include 
 #include 
 #include 
 #include 
@@ -563,8 +562,6 @@ static void pre_jail_init(char *unused_name, char **unused_argv)
     setsid();
 }
 
-MAIL_VERSION_STAMP_DECLARE;
-
 /* main - pass control to the multi-threaded skeleton */
 
 int     main(int argc, char **argv)
@@ -582,11 +579,6 @@ int     main(int argc, char **argv)
 	0,
     };
 
-    /*
-     * Fingerprint executables and core dumps.
-     */
-    MAIL_VERSION_STAMP_ALLOCATE;
-
     multi_server_main(argc, argv, verify_service,
 		      MAIL_SERVER_STR_TABLE, str_table,
 		      MAIL_SERVER_TIME_TABLE, time_table,
diff --git a/postfix/src/virtual/Makefile.in b/postfix/src/virtual/Makefile.in
index 9aed39f41..51360fe43 100644
--- a/postfix/src/virtual/Makefile.in
+++ b/postfix/src/virtual/Makefile.in
@@ -187,7 +187,6 @@ virtual.o: ../../include/mail_conf.h
 virtual.o: ../../include/mail_params.h
 virtual.o: ../../include/mail_queue.h
 virtual.o: ../../include/mail_server.h
-virtual.o: ../../include/mail_version.h
 virtual.o: ../../include/maps.h
 virtual.o: ../../include/mbox_conf.h
 virtual.o: ../../include/msg.h
diff --git a/postfix/src/virtual/virtual.c b/postfix/src/virtual/virtual.c
index c52227874..51329cf26 100644
--- a/postfix/src/virtual/virtual.c
+++ b/postfix/src/virtual/virtual.c
@@ -224,11 +224,11 @@
 /*	The time limit for sending or receiving information over an internal
 /*	communication channel.
 /* .IP "\fBmax_idle (100s)\fR"
-/*	The maximum amount of time that an idle Postfix daemon process waits
-/*	for an incoming connection before terminating voluntarily.
+/*	The maximum amount of time that an idle Postfix daemon process
+/*	waits for the next service request before exiting.
 /* .IP "\fBmax_use (100)\fR"
-/*	The maximal number of incoming connections that a Postfix daemon
-/*	process will service before terminating voluntarily.
+/*	The maximal number of connection requests before a Postfix daemon
+/*	process terminates.
 /* .IP "\fBprocess_id (read-only)\fR"
 /*	The process ID of a Postfix command or daemon process.
 /* .IP "\fBprocess_name (read-only)\fR"
@@ -303,7 +303,6 @@
 #include 
 #include 
 #include 
-#include 
 #include 
 #include 
 #include 
@@ -483,8 +482,6 @@ static void pre_init(char *unused_name, char **unused_argv)
     flush_init();
 }
 
-MAIL_VERSION_STAMP_DECLARE;
-
 /* main - pass control to the single-threaded skeleton */
 
 int     main(int argc, char **argv)
@@ -504,11 +501,6 @@ int     main(int argc, char **argv)
 	0,
     };
 
-    /*
-     * Fingerprint executables and core dumps.
-     */
-    MAIL_VERSION_STAMP_ALLOCATE;
-
     single_server_main(argc, argv, local_service,
 		       MAIL_SERVER_INT_TABLE, int_table,
 		       MAIL_SERVER_STR_TABLE, str_table,