1SMTPD(8)                    System Manager's Manual                   SMTPD(8)
2
3
4

NAME

6       smtpd - Postfix SMTP server
7

SYNOPSIS

9       smtpd [generic Postfix daemon options]
10
11       sendmail -bs
12

DESCRIPTION

14       The  SMTP  server accepts network connection requests and performs zero
15       or more SMTP transactions per connection.   Each  received  message  is
16       piped  through  the  cleanup(8) daemon, and is placed into the incoming
17       queue as one single queue file.  For this mode of operation,  the  pro‐
18       gram expects to be run from the master(8) process manager.
19
20       Alternatively,  the SMTP server be can run in stand-alone mode; this is
21       traditionally obtained with "sendmail -bs".  When the SMTP server  runs
22       stand-alone  with  non  $mail_owner  privileges,  it receives mail even
23       while the mail system is not running, deposits messages  directly  into
24       the  maildrop queue, and disables the SMTP server's access policies. As
25       of Postfix version 2.3, the SMTP server refuses to  receive  mail  from
26       the network when it runs with non $mail_owner privileges.
27
28       The  SMTP  server  implements  a variety of policies for connection re‐
29       quests, and for parameters given to HELO, ETRN,  MAIL  FROM,  VRFY  and
30       RCPT TO commands. They are detailed below and in the main.cf configura‐
31       tion file.
32

SECURITY

34       The SMTP server is moderately  security-sensitive.  It  talks  to  SMTP
35       clients  and  to DNS servers on the network. The SMTP server can be run
36       chrooted at fixed low privilege.
37

STANDARDS

39       RFC 821 (SMTP protocol)
40       RFC 1123 (Host requirements)
41       RFC 1652 (8bit-MIME transport)
42       RFC 1869 (SMTP service extensions)
43       RFC 1870 (Message size declaration)
44       RFC 1985 (ETRN command)
45       RFC 2034 (SMTP enhanced status codes)
46       RFC 2554 (AUTH command)
47       RFC 2821 (SMTP protocol)
48       RFC 2920 (SMTP pipelining)
49       RFC 3030 (CHUNKING without BINARYMIME)
50       RFC 3207 (STARTTLS command)
51       RFC 3461 (SMTP DSN extension)
52       RFC 3463 (Enhanced status codes)
53       RFC 3848 (ESMTP transmission types)
54       RFC 4409 (Message submission)
55       RFC 4954 (AUTH command)
56       RFC 5321 (SMTP protocol)
57       RFC 6531 (Internationalized SMTP)
58       RFC 6533 (Internationalized Delivery Status Notifications)
59       RFC 7505 ("Null MX" No Service Resource Record)
60

DIAGNOSTICS

62       Problems and transactions are logged to syslogd(8) or postlogd(8).
63
64       Depending on the setting of the notify_classes parameter, the  postmas‐
65       ter  is  notified of bounces, protocol problems, policy violations, and
66       of other trouble.
67

CONFIGURATION PARAMETERS

69       Changes to main.cf are picked up automatically, as  smtpd(8)  processes
70       run for only a limited amount of time. Use the command "postfix reload"
71       to speed up a change.
72
73       The text below provides only a parameter summary. See  postconf(5)  for
74       more details including examples.
75

COMPATIBILITY CONTROLS

77       The  following  parameters  work  around implementation errors in other
78       software, and/or allow you to override standards in  order  to  prevent
79       undesirable use.
80
81       broken_sasl_auth_clients (no)
82              Enable  interoperability with remote SMTP clients that implement
83              an obsolete version of the AUTH command (RFC 4954).
84
85       disable_vrfy_command (no)
86              Disable the SMTP VRFY command.
87
88       smtpd_noop_commands (empty)
89              List of commands that the Postfix SMTP server  replies  to  with
90              "250  Ok",  without doing any syntax checks and without changing
91              state.
92
93       strict_rfc821_envelopes (no)
94              Require that addresses received in SMTP MAIL FROM  and  RCPT  TO
95              commands  are  enclosed with <>, and that those addresses do not
96              contain RFC 822 style comments or phrases.
97
98       Available in Postfix version 2.1 and later:
99
100       smtpd_reject_unlisted_sender (no)
101              Request that the Postfix SMTP server rejects mail  from  unknown
102              sender  addresses,  even when no explicit reject_unlisted_sender
103              access restriction is specified.
104
105       smtpd_sasl_exceptions_networks (empty)
106              What remote SMTP clients the Postfix SMTP server will not  offer
107              AUTH support to.
108
109       Available in Postfix version 2.2 and later:
110
111       smtpd_discard_ehlo_keyword_address_maps (empty)
112              Lookup  tables,  indexed by the remote SMTP client address, with
113              case insensitive lists of EHLO keywords  (pipelining,  starttls,
114              auth,  etc.)  that  the Postfix SMTP server will not send in the
115              EHLO response to a remote SMTP client.
116
117       smtpd_discard_ehlo_keywords (empty)
118              A case insensitive list of EHLO keywords (pipelining,  starttls,
119              auth,  etc.)  that  the Postfix SMTP server will not send in the
120              EHLO response to a remote SMTP client.
121
122       smtpd_delay_open_until_valid_rcpt (yes)
123              Postpone the start of an SMTP mail  transaction  until  a  valid
124              RCPT TO command is received.
125
126       Available in Postfix version 2.3 and later:
127
128       smtpd_tls_always_issue_session_ids (yes)
129              Force  the  Postfix  SMTP server to issue a TLS session id, even
130              when  TLS  session  caching  is   turned   off   (smtpd_tls_ses‐
131              sion_cache_database is empty).
132
133       Available in Postfix version 2.6 and later:
134
135       tcp_windowsize (0)
136              An  optional  workaround for routers that break TCP window scal‐
137              ing.
138
139       Available in Postfix version 2.7 and later:
140
141       smtpd_command_filter (empty)
142              A mechanism to transform commands from remote SMTP clients.
143
144       Available in Postfix version 2.9 - 3.6:
145
146       smtpd_per_record_deadline (normal: no, overload: yes)
147              Change  the  behavior  of  the  smtpd_timeout  and  smtpd_start‐
148              tls_timeout  time  limits,  from  a time limit per read or write
149              system call, to a time limit  to  send  or  receive  a  complete
150              record  (an  SMTP command line, SMTP response line, SMTP message
151              content line, or TLS protocol message).
152
153       Available in Postfix version 3.0 and later:
154
155       smtpd_dns_reply_filter (empty)
156              Optional filter for Postfix SMTP server DNS lookup results.
157
158       Available in Postfix version 3.6 and later:
159
160       smtpd_relay_before_recipient_restrictions (see 'postconf -d' output)
161              Evaluate  smtpd_relay_restrictions  before   smtpd_recipient_re‐
162              strictions.
163
164       known_tcp_ports   (lmtp=24,   smtp=25,  smtps=submissions=465,  submis‐
165       sion=587)
166              Optional setting that avoids lookups in  the  services(5)  data‐
167              base.
168
169       Available in Postfix version 3.7 and later:
170
171       smtpd_per_request_deadline (normal: no, overload: yes)
172              Change  the  behavior  of  the  smtpd_timeout  and  smtpd_start‐
173              tls_timeout time limits, from a time limit per plaintext or  TLS
174              read  or  write  call,  to a combined time limit for receiving a
175              complete SMTP request and for sending a complete SMTP response.
176
177       smtpd_min_data_rate (500)
178              The minimum plaintext data transfer  rate  in  bytes/second  for
179              DATA   and  BDAT  requests,  when  deadlines  are  enabled  with
180              smtpd_per_request_deadline.
181

ADDRESS REWRITING CONTROLS

183       See the ADDRESS_REWRITING_README document for a detailed discussion  of
184       Postfix address rewriting.
185
186       receive_override_options (empty)
187              Enable or disable recipient validation, built-in content filter‐
188              ing, or address mapping.
189
190       Available in Postfix version 2.2 and later:
191
192       local_header_rewrite_clients (permit_inet_interfaces)
193              Rewrite message header addresses in mail from these clients  and
194              update incomplete addresses with the domain name in $myorigin or
195              $mydomain; either  don't  rewrite  message  headers  from  other
196              clients at all, or rewrite message headers and update incomplete
197              addresses with the domain  specified  in  the  remote_header_re‐
198              write_domain parameter.
199

BEFORE-SMTPD PROXY AGENT

201       Available in Postfix version 2.10 and later:
202
203       smtpd_upstream_proxy_protocol (empty)
204              The  name of the proxy protocol used by an optional before-smtpd
205              proxy agent.
206
207       smtpd_upstream_proxy_timeout (5s)
208              The time  limit  for  the  proxy  protocol  specified  with  the
209              smtpd_upstream_proxy_protocol parameter.
210

AFTER QUEUE EXTERNAL CONTENT INSPECTION CONTROLS

212       As of version 1.0, Postfix can be configured to send new mail to an ex‐
213       ternal content filter AFTER the mail is queued. This content filter  is
214       expected  to inject mail back into a (Postfix or other) MTA for further
215       delivery. See the FILTER_README document for details.
216
217       content_filter (empty)
218              After the message is queued, send  the  entire  message  to  the
219              specified transport:destination.
220

BEFORE QUEUE EXTERNAL CONTENT INSPECTION CONTROLS

222       As  of  version  2.1, the Postfix SMTP server can be configured to send
223       incoming mail to a real-time SMTP-based content filter BEFORE  mail  is
224       queued.  This content filter is expected to inject mail back into Post‐
225       fix.  See the SMTPD_PROXY_README document for details on how to config‐
226       ure and operate this feature.
227
228       smtpd_proxy_filter (empty)
229              The hostname and TCP port of the mail filtering proxy server.
230
231       smtpd_proxy_ehlo ($myhostname)
232              How  the  Postfix SMTP server announces itself to the proxy fil‐
233              ter.
234
235       smtpd_proxy_options (empty)
236              List of options that control how the Postfix SMTP server  commu‐
237              nicates with a before-queue content filter.
238
239       smtpd_proxy_timeout (100s)
240              The  time limit for connecting to a proxy filter and for sending
241              or receiving information.
242

BEFORE QUEUE MILTER CONTROLS

244       As of version 2.3, Postfix supports the Sendmail version 8 Milter (mail
245       filter)  protocol.  These content filters run outside Postfix. They can
246       inspect the SMTP command stream and the message content,  and  can  re‐
247       quest  modifications  before  mail  is queued. For details see the MIL‐
248       TER_README document.
249
250       smtpd_milters (empty)
251              A list of Milter (mail filter) applications for  new  mail  that
252              arrives via the Postfix smtpd(8) server.
253
254       milter_protocol (6)
255              The  mail  filter  protocol version and optional protocol exten‐
256              sions for communication with  a  Milter  application;  prior  to
257              Postfix 2.6 the default protocol is 2.
258
259       milter_default_action (tempfail)
260              The  default  action when a Milter (mail filter) response is un‐
261              available (for example,  bad  Postfix  configuration  or  Milter
262              failure).
263
264       milter_macro_daemon_name ($myhostname)
265              The  {daemon_name} macro value for Milter (mail filter) applica‐
266              tions.
267
268       milter_macro_v ($mail_name $mail_version)
269              The {v} macro value for Milter (mail filter) applications.
270
271       milter_connect_timeout (30s)
272              The time limit for connecting to a Milter (mail filter) applica‐
273              tion, and for negotiating protocol options.
274
275       milter_command_timeout (30s)
276              The  time  limit  for  sending an SMTP command to a Milter (mail
277              filter) application, and for receiving the response.
278
279       milter_content_timeout (300s)
280              The time limit for sending message content  to  a  Milter  (mail
281              filter) application, and for receiving the response.
282
283       milter_connect_macros (see 'postconf -d' output)
284              The  macros  that  are sent to Milter (mail filter) applications
285              after completion of an SMTP connection.
286
287       milter_helo_macros (see 'postconf -d' output)
288              The macros that are sent to Milter  (mail  filter)  applications
289              after the SMTP HELO or EHLO command.
290
291       milter_mail_macros (see 'postconf -d' output)
292              The  macros  that  are sent to Milter (mail filter) applications
293              after the SMTP MAIL FROM command.
294
295       milter_rcpt_macros (see 'postconf -d' output)
296              The macros that are sent to Milter  (mail  filter)  applications
297              after the SMTP RCPT TO command.
298
299       milter_data_macros (see 'postconf -d' output)
300              The  macros  that  are  sent to version 4 or higher Milter (mail
301              filter) applications after the SMTP DATA command.
302
303       milter_unknown_command_macros (see 'postconf -d' output)
304              The macros that are sent to version 3  or  higher  Milter  (mail
305              filter) applications after an unknown SMTP command.
306
307       milter_end_of_header_macros (see 'postconf -d' output)
308              The  macros  that  are sent to Milter (mail filter) applications
309              after the end of the message header.
310
311       milter_end_of_data_macros (see 'postconf -d' output)
312              The macros that are sent to Milter  (mail  filter)  applications
313              after the message end-of-data.
314
315       Available in Postfix version 3.1 and later:
316
317       milter_macro_defaults (empty)
318              Optional  list  of  name=value pairs that specify default values
319              for arbitrary macros that Postfix may send  to  Milter  applica‐
320              tions.
321
322       Available in Postfix version 3.2 and later:
323
324       smtpd_milter_maps (empty)
325              Lookup tables with Milter settings per remote SMTP client IP ad‐
326              dress.
327

GENERAL CONTENT INSPECTION CONTROLS

329       The following parameters are applicable for both built-in and  external
330       content filters.
331
332       Available in Postfix version 2.1 and later:
333
334       receive_override_options (empty)
335              Enable or disable recipient validation, built-in content filter‐
336              ing, or address mapping.
337

EXTERNAL CONTENT INSPECTION CONTROLS

339       The following parameters are applicable for both before-queue  and  af‐
340       ter-queue content filtering.
341
342       Available in Postfix version 2.1 and later:
343
344       smtpd_authorized_xforward_hosts (empty)
345              What  remote  SMTP  clients are allowed to use the XFORWARD fea‐
346              ture.
347

SASL AUTHENTICATION CONTROLS

349       Postfix SASL support (RFC 4954) can be used to authenticate remote SMTP
350       clients  to  the  Postfix  SMTP server, and to authenticate the Postfix
351       SMTP client to a remote SMTP server.  See the SASL_README document  for
352       details.
353
354       broken_sasl_auth_clients (no)
355              Enable  interoperability with remote SMTP clients that implement
356              an obsolete version of the AUTH command (RFC 4954).
357
358       smtpd_sasl_auth_enable (no)
359              Enable SASL authentication in the Postfix SMTP server.
360
361       smtpd_sasl_local_domain (empty)
362              The name of the Postfix SMTP server's local SASL  authentication
363              realm.
364
365       smtpd_sasl_security_options (noanonymous)
366              Postfix SMTP server SASL security options; as of Postfix 2.3 the
367              list of available features depends on the SASL server  implemen‐
368              tation that is selected with smtpd_sasl_type.
369
370       smtpd_sender_login_maps (empty)
371              Optional  lookup  table  with  the SASL login names that own the
372              sender (MAIL FROM) addresses.
373
374       Available in Postfix version 2.1 and later:
375
376       smtpd_sasl_exceptions_networks (empty)
377              What remote SMTP clients the Postfix SMTP server will not  offer
378              AUTH support to.
379
380       Available in Postfix version 2.1 and 2.2:
381
382       smtpd_sasl_application_name (smtpd)
383              The  application name that the Postfix SMTP server uses for SASL
384              server initialization.
385
386       Available in Postfix version 2.3 and later:
387
388       smtpd_sasl_authenticated_header (no)
389              Report the SASL authenticated user name in the smtpd(8) Received
390              message header.
391
392       smtpd_sasl_path (smtpd)
393              Implementation-specific information that the Postfix SMTP server
394              passes through to the SASL plug-in implementation  that  is  se‐
395              lected with smtpd_sasl_type.
396
397       smtpd_sasl_type (cyrus)
398              The  SASL  plug-in  type that the Postfix SMTP server should use
399              for authentication.
400
401       Available in Postfix version 2.5 and later:
402
403       cyrus_sasl_config_path (empty)
404              Search path for Cyrus SASL application configuration files, cur‐
405              rently used only to locate the $smtpd_sasl_path.conf file.
406
407       Available in Postfix version 2.11 and later:
408
409       smtpd_sasl_service (smtp)
410              The  service name that is passed to the SASL plug-in that is se‐
411              lected with smtpd_sasl_type and smtpd_sasl_path.
412
413       Available in Postfix version 3.4 and later:
414
415       smtpd_sasl_response_limit (12288)
416              The maximum length of a SASL client's response to a server chal‐
417              lenge.
418
419       Available in Postfix 3.6 and later:
420
421       smtpd_sasl_mechanism_filter (!external, static:rest)
422              If  non-empty,  a  filter  for the SASL mechanism names that the
423              Postfix SMTP server will announce in the EHLO response.
424

STARTTLS SUPPORT CONTROLS

426       Detailed information about STARTTLS configuration may be found  in  the
427       TLS_README document.
428
429       smtpd_tls_security_level (empty)
430              The  SMTP TLS security level for the Postfix SMTP server; when a
431              non-empty value is specified, this overrides the obsolete param‐
432              eters smtpd_use_tls and smtpd_enforce_tls.
433
434       smtpd_sasl_tls_security_options ($smtpd_sasl_security_options)
435              The  SASL  authentication security options that the Postfix SMTP
436              server uses for TLS encrypted SMTP sessions.
437
438       smtpd_starttls_timeout (see 'postconf -d' output)
439              The time limit for Postfix SMTP server write and read operations
440              during TLS startup and shutdown handshake procedures.
441
442       smtpd_tls_CAfile (empty)
443              A  file  containing  (PEM  format)  CA  certificates of root CAs
444              trusted to sign either remote SMTP client certificates or inter‐
445              mediate CA certificates.
446
447       smtpd_tls_CApath (empty)
448              A  directory containing (PEM format) CA certificates of root CAs
449              trusted to sign either remote SMTP client certificates or inter‐
450              mediate CA certificates.
451
452       smtpd_tls_always_issue_session_ids (yes)
453              Force  the  Postfix  SMTP server to issue a TLS session id, even
454              when  TLS  session  caching  is   turned   off   (smtpd_tls_ses‐
455              sion_cache_database is empty).
456
457       smtpd_tls_ask_ccert (no)
458              Ask a remote SMTP client for a client certificate.
459
460       smtpd_tls_auth_only (no)
461              When  TLS  encryption is optional in the Postfix SMTP server, do
462              not announce or accept SASL authentication over unencrypted con‐
463              nections.
464
465       smtpd_tls_ccert_verifydepth (9)
466              The verification depth for remote SMTP client certificates.
467
468       smtpd_tls_cert_file (empty)
469              File with the Postfix SMTP server RSA certificate in PEM format.
470
471       smtpd_tls_exclude_ciphers (empty)
472              List  of ciphers or cipher types to exclude from the SMTP server
473              cipher list at all TLS security levels.
474
475       smtpd_tls_dcert_file (empty)
476              File with the Postfix SMTP server DSA certificate in PEM format.
477
478       smtpd_tls_dh1024_param_file (empty)
479              File with DH parameters that the Postfix SMTP server should  use
480              with non-export EDH ciphers.
481
482       smtpd_tls_dh512_param_file (empty)
483              File  with DH parameters that the Postfix SMTP server should use
484              with export-grade EDH ciphers.
485
486       smtpd_tls_dkey_file ($smtpd_tls_dcert_file)
487              File with the Postfix SMTP server DSA private key in PEM format.
488
489       smtpd_tls_key_file ($smtpd_tls_cert_file)
490              File with the Postfix SMTP server RSA private key in PEM format.
491
492       smtpd_tls_loglevel (0)
493              Enable additional Postfix SMTP server logging of TLS activity.
494
495       smtpd_tls_mandatory_ciphers (medium)
496              The minimum TLS cipher grade that the Postfix SMTP  server  will
497              use with mandatory TLS encryption.
498
499       smtpd_tls_mandatory_exclude_ciphers (empty)
500              Additional  list  of ciphers or cipher types to exclude from the
501              Postfix SMTP server cipher list at mandatory TLS  security  lev‐
502              els.
503
504       smtpd_tls_mandatory_protocols (see 'postconf -d' output)
505              TLS protocols accepted by the Postfix SMTP server with mandatory
506              TLS encryption.
507
508       smtpd_tls_received_header (no)
509              Request that the Postfix SMTP server produces Received:  message
510              headers  that  include information about the protocol and cipher
511              used, as well as the remote SMTP client  CommonName  and  client
512              certificate issuer CommonName.
513
514       smtpd_tls_req_ccert (no)
515              With  mandatory  TLS  encryption,  require a trusted remote SMTP
516              client certificate in order to allow TLS connections to proceed.
517
518       smtpd_tls_wrappermode (no)
519              Run the Postfix SMTP server in the non-standard "wrapper"  mode,
520              instead of using the STARTTLS command.
521
522       tls_daemon_random_bytes (32)
523              The  number  of  pseudo-random bytes that an smtp(8) or smtpd(8)
524              process requests from the tlsmgr(8) server in order to seed  its
525              internal pseudo random number generator (PRNG).
526
527       tls_high_cipherlist (see 'postconf -d' output)
528              The OpenSSL cipherlist for "high" grade ciphers.
529
530       tls_medium_cipherlist (see 'postconf -d' output)
531              The OpenSSL cipherlist for "medium" or higher grade ciphers.
532
533       tls_low_cipherlist (see 'postconf -d' output)
534              The OpenSSL cipherlist for "low" or higher grade ciphers.
535
536       tls_export_cipherlist (see 'postconf -d' output)
537              The OpenSSL cipherlist for "export" or higher grade ciphers.
538
539       tls_null_cipherlist (eNULL:!aNULL)
540              The OpenSSL cipherlist for "NULL" grade ciphers that provide au‐
541              thentication without encryption.
542
543       Available in Postfix version 2.5 and later:
544
545       smtpd_tls_fingerprint_digest (see 'postconf -d' output)
546              The  message  digest  algorithm   to   construct   remote   SMTP
547              client-certificate   fingerprints  or  public  key  fingerprints
548              (Postfix  2.9  and  later)  for  check_ccert_access   and   per‐
549              mit_tls_clientcerts.
550
551       Available in Postfix version 2.6 and later:
552
553       smtpd_tls_protocols (see postconf -d output)
554              TLS  protocols  accepted  by the Postfix SMTP server with oppor‐
555              tunistic TLS encryption.
556
557       smtpd_tls_ciphers (medium)
558              The minimum TLS cipher grade that the Postfix SMTP  server  will
559              use with opportunistic TLS encryption.
560
561       smtpd_tls_eccert_file (empty)
562              File  with the Postfix SMTP server ECDSA certificate in PEM for‐
563              mat.
564
565       smtpd_tls_eckey_file ($smtpd_tls_eccert_file)
566              File with the Postfix SMTP server ECDSA private key in PEM  for‐
567              mat.
568
569       smtpd_tls_eecdh_grade (see 'postconf -d' output)
570              The  Postfix  SMTP  server  security  grade for ephemeral ellip‐
571              tic-curve Diffie-Hellman (EECDH) key exchange.
572
573       tls_eecdh_strong_curve (prime256v1)
574              The elliptic curve used by the Postfix SMTP server for  sensibly
575              strong ephemeral ECDH key exchange.
576
577       tls_eecdh_ultra_curve (secp384r1)
578              The elliptic curve used by the Postfix SMTP server for maximally
579              strong ephemeral ECDH key exchange.
580
581       Available in Postfix version 2.8 and later:
582
583       tls_preempt_cipherlist (no)
584              With SSLv3 and later, use the Postfix SMTP server's cipher pref‐
585              erence  order  instead  of the remote client's cipher preference
586              order.
587
588       tls_disable_workarounds (see 'postconf -d' output)
589              List or bit-mask of OpenSSL bug work-arounds to disable.
590
591       Available in Postfix version 2.11 and later:
592
593       tlsmgr_service_name (tlsmgr)
594              The name of the tlsmgr(8) service entry in master.cf.
595
596       Available in Postfix version 3.0 and later:
597
598       tls_session_ticket_cipher (Postfix >= 3.0: aes-256-cbc, Postfix <  3.0:
599       aes-128-cbc)
600              Algorithm used to encrypt RFC5077 TLS session tickets.
601
602       Available in Postfix version 3.2 and later:
603
604       tls_eecdh_auto_curves (see 'postconf -d' output)
605              The prioritized list of elliptic curves supported by the Postfix
606              SMTP client and server.
607
608       Available in Postfix version 3.4 and later:
609
610       smtpd_tls_chain_files (empty)
611              List of one or more PEM files, each holding one or more  private
612              keys directly followed by a corresponding certificate chain.
613
614       tls_server_sni_maps (empty)
615              Optional  lookup tables that map names received from remote SMTP
616              clients via the TLS Server Name Indication  (SNI)  extension  to
617              the appropriate keys and certificate chains.
618
619       Available in Postfix 3.5, 3.4.6, 3.3.5, 3.2.10, 3.1.13 and later:
620
621       tls_fast_shutdown_enable (yes)
622              A  workaround  for implementations that hang Postfix while shut‐
623              ting down a TLS session, until Postfix times out.
624
625       Available in Postfix 3.5 and later:
626
627       info_log_address_format (external)
628              The email address form that will be used  in  non-debug  logging
629              (info, warning, etc.).
630

OBSOLETE STARTTLS CONTROLS

632       The  following  configuration  parameters  exist for compatibility with
633       Postfix versions before 2.3. Support for these will be removed in a fu‐
634       ture release.
635
636       smtpd_use_tls (no)
637              Opportunistic  TLS:  announce  STARTTLS  support  to remote SMTP
638              clients, but do not require that clients use TLS encryption.
639
640       smtpd_enforce_tls (no)
641              Mandatory TLS: announce STARTTLS support to remote SMTP clients,
642              and require that clients use TLS encryption.
643
644       smtpd_tls_cipherlist (empty)
645              Obsolete  Postfix  < 2.3 control for the Postfix SMTP server TLS
646              cipher list.
647

SMTPUTF8 CONTROLS

649       Preliminary SMTPUTF8 support is introduced with Postfix 3.0.
650
651       smtputf8_enable (yes)
652              Enable preliminary SMTPUTF8 support for the protocols  described
653              in RFC 6531..6533.
654
655       strict_smtputf8 (no)
656              Enable stricter enforcement of the SMTPUTF8 protocol.
657
658       smtputf8_autodetect_classes (sendmail, verify)
659              Detect  that  a message requires SMTPUTF8 support for the speci‐
660              fied mail origin classes.
661
662       Available in Postfix version 3.2 and later:
663
664       enable_idna2003_compatibility (no)
665              Enable  'transitional'  compatibility   between   IDNA2003   and
666              IDNA2008,  when  converting UTF-8 domain names to/from the ASCII
667              form that is used for DNS lookups.
668

VERP SUPPORT CONTROLS

670       With VERP style delivery, each recipient of a message receives  a  cus‐
671       tomized  copy of the message with his/her own recipient address encoded
672       in the envelope sender address.  The VERP_README file describes config‐
673       uration  and operation details of Postfix support for variable envelope
674       return path addresses.  VERP style delivery is requested with the  SMTP
675       XVERP  command  or  with  the  "sendmail -V" command-line option and is
676       available in Postfix version 1.1 and later.
677
678       default_verp_delimiters (+=)
679              The two default VERP delimiter characters.
680
681       verp_delimiter_filter (-=+)
682              The characters Postfix accepts as VERP delimiter  characters  on
683              the Postfix sendmail(1) command line and in SMTP commands.
684
685       Available in Postfix version 1.1 and 2.0:
686
687       authorized_verp_clients ($mynetworks)
688              What  remote  SMTP clients are allowed to specify the XVERP com‐
689              mand.
690
691       Available in Postfix version 2.1 and later:
692
693       smtpd_authorized_verp_clients ($authorized_verp_clients)
694              What remote SMTP clients are allowed to specify the  XVERP  com‐
695              mand.
696

TROUBLE SHOOTING CONTROLS

698       The  DEBUG_README  document describes how to debug parts of the Postfix
699       mail system. The methods vary from making the software log a lot of de‐
700       tail,  to  running some daemon processes under control of a call tracer
701       or debugger.
702
703       debug_peer_level (2)
704              The increment in verbose logging level when a  nexthop  destina‐
705              tion,  remote client or server name or network address matches a
706              pattern given with the debug_peer_list parameter.
707
708       debug_peer_list (empty)
709              Optional list of nexthop destination, remote  client  or  server
710              name  or  network  address  patterns that, if matched, cause the
711              verbose logging level to increase by  the  amount  specified  in
712              $debug_peer_level.
713
714       error_notice_recipient (postmaster)
715              The  recipient  of  postmaster notifications about mail delivery
716              problems that are caused by policy, resource, software or proto‐
717              col errors.
718
719       internal_mail_filter_classes (empty)
720              What  categories  of  Postfix-generated  mail are subject to be‐
721              fore-queue    content    inspection    by     non_smtpd_milters,
722              header_checks and body_checks.
723
724       notify_classes (resource, software)
725              The list of error classes that are reported to the postmaster.
726
727       smtpd_reject_footer (empty)
728              Optional  information  that  is appended after each Postfix SMTP
729              server 4XX or 5XX response.
730
731       soft_bounce (no)
732              Safety net to keep mail queued that would otherwise be  returned
733              to the sender.
734
735       Available in Postfix version 2.1 and later:
736
737       smtpd_authorized_xclient_hosts (empty)
738              What remote SMTP clients are allowed to use the XCLIENT feature.
739
740       Available in Postfix version 2.10 and later:
741
742       smtpd_log_access_permit_actions (empty)
743              Enable  logging of the named "permit" actions in SMTP server ac‐
744              cess lists (by default, the SMTP server  logs  "reject"  actions
745              but not "permit" actions).
746

KNOWN VERSUS UNKNOWN RECIPIENT CONTROLS

748       As of Postfix version 2.0, the SMTP server rejects mail for unknown re‐
749       cipients. This prevents the mail queue from clogging up with undeliver‐
750       able MAILER-DAEMON messages. Additional information on this topic is in
751       the LOCAL_RECIPIENT_README and ADDRESS_CLASS_README documents.
752
753       show_user_unknown_table_name (yes)
754              Display the name of the recipient table in  the  "User  unknown"
755              responses.
756
757       canonical_maps (empty)
758              Optional  address  mapping lookup tables for message headers and
759              envelopes.
760
761       recipient_canonical_maps (empty)
762              Optional address mapping lookup tables for envelope  and  header
763              recipient addresses.
764
765       sender_canonical_maps (empty)
766              Optional  address  mapping lookup tables for envelope and header
767              sender addresses.
768
769       Parameters concerning known/unknown local recipients:
770
771       mydestination ($myhostname, localhost.$mydomain, localhost)
772              The list of domains that are delivered via the  $local_transport
773              mail delivery transport.
774
775       inet_interfaces (all)
776              The  network  interface addresses that this mail system receives
777              mail on.
778
779       proxy_interfaces (empty)
780              The network interface addresses that this mail  system  receives
781              mail on by way of a proxy or network address translation unit.
782
783       inet_protocols (see 'postconf -d output')
784              The  Internet  protocols Postfix will attempt to use when making
785              or accepting connections.
786
787       local_recipient_maps (proxy:unix:passwd.byname $alias_maps)
788              Lookup tables with all names or addresses of local recipients: a
789              recipient  address  is local when its domain matches $mydestina‐
790              tion, $inet_interfaces or $proxy_interfaces.
791
792       unknown_local_recipient_reject_code (550)
793              The numerical Postfix SMTP server response code when a recipient
794              address  is local, and $local_recipient_maps specifies a list of
795              lookup tables that does not match the recipient.
796
797       Parameters concerning known/unknown recipients of relay destinations:
798
799       relay_domains (Postfix >= 3.0: empty, Postfix < 3.0: $mydestination)
800              What destination domains (and subdomains  thereof)  this  system
801              will relay mail to.
802
803       relay_recipient_maps (empty)
804              Optional  lookup  tables with all valid addresses in the domains
805              that match $relay_domains.
806
807       unknown_relay_recipient_reject_code (550)
808              The numerical Postfix SMTP server reply code  when  a  recipient
809              address  matches $relay_domains, and relay_recipient_maps speci‐
810              fies a list of lookup tables that does not match  the  recipient
811              address.
812
813       Parameters  concerning  known/unknown  recipients  in virtual alias do‐
814       mains:
815
816       virtual_alias_domains ($virtual_alias_maps)
817              Postfix is final destination for the specified list  of  virtual
818              alias  domains,  that  is,  domains  for which all addresses are
819              aliased to addresses in other local or remote domains.
820
821       virtual_alias_maps ($virtual_maps)
822              Optional lookup tables that alias specific mail addresses or do‐
823              mains to other local or remote address.
824
825       unknown_virtual_alias_reject_code (550)
826              The  Postfix  SMTP  server  reply  code when a recipient address
827              matches $virtual_alias_domains, and  $virtual_alias_maps  speci‐
828              fies  a  list of lookup tables that does not match the recipient
829              address.
830
831       Parameters concerning known/unknown recipients in virtual  mailbox  do‐
832       mains:
833
834       virtual_mailbox_domains ($virtual_mailbox_maps)
835              Postfix  is final destination for the specified list of domains;
836              mail is  delivered  via  the  $virtual_transport  mail  delivery
837              transport.
838
839       virtual_mailbox_maps (empty)
840              Optional  lookup  tables with all valid addresses in the domains
841              that match $virtual_mailbox_domains.
842
843       unknown_virtual_mailbox_reject_code (550)
844              The Postfix SMTP server reply  code  when  a  recipient  address
845              matches   $virtual_mailbox_domains,   and  $virtual_mailbox_maps
846              specifies a list of lookup tables that does not match the recip‐
847              ient address.
848

RESOURCE AND RATE CONTROLS

850       The following parameters limit resource usage by the SMTP server and/or
851       control client request rates.
852
853       line_length_limit (2048)
854              Upon input, long lines are chopped up into  pieces  of  at  most
855              this length; upon delivery, long lines are reconstructed.
856
857       queue_minfree (0)
858              The minimal amount of free space in bytes in the queue file sys‐
859              tem that is needed to receive mail.
860
861       message_size_limit (10240000)
862              The maximal size in bytes of a message, including  envelope  in‐
863              formation.
864
865       smtpd_recipient_limit (1000)
866              The  maximal  number  of recipients that the Postfix SMTP server
867              accepts per message delivery request.
868
869       smtpd_timeout (normal: 300s, overload: 10s)
870              When the Postfix SMTP server wants to send an  SMTP  server  re‐
871              sponse, how long the Postfix SMTP server will wait for an under‐
872              lying network write operation to complete; and when the  Postfix
873              SMTP server Postfix wants to receive an SMTP client request, how
874              long the Postfix SMTP server will wait for an underlying network
875              read operation to complete.
876
877       smtpd_history_flush_threshold (100)
878              The  maximal  number of lines in the Postfix SMTP server command
879              history before it is flushed upon receipt of EHLO, RSET, or  end
880              of DATA.
881
882       Available in Postfix version 2.3 and later:
883
884       smtpd_peername_lookup (yes)
885              Attempt  to  look up the remote SMTP client hostname, and verify
886              that the name matches the client IP address.
887
888       The per SMTP client connection count and request rate limits are imple‐
889       mented  in co-operation with the anvil(8) service, and are available in
890       Postfix version 2.2 and later.
891
892       smtpd_client_connection_count_limit (50)
893              How many simultaneous connections any client is allowed to  make
894              to this service.
895
896       smtpd_client_connection_rate_limit (0)
897              The  maximal number of connection attempts any client is allowed
898              to make to this service per time unit.
899
900       smtpd_client_message_rate_limit (0)
901              The maximal number of message delivery requests that any  client
902              is  allowed to make to this service per time unit, regardless of
903              whether or not Postfix actually accepts those messages.
904
905       smtpd_client_recipient_rate_limit (0)
906              The maximal number of recipient addresses that any client is al‐
907              lowed  to  send  to  this  service  per time unit, regardless of
908              whether or not Postfix actually accepts those recipients.
909
910       smtpd_client_event_limit_exceptions ($mynetworks)
911              Clients that are excluded  from  smtpd_client_*_count/rate_limit
912              restrictions.
913
914       Available in Postfix version 2.3 and later:
915
916       smtpd_client_new_tls_session_rate_limit (0)
917              The  maximal  number of new (i.e., uncached) TLS sessions that a
918              remote SMTP client is allowed to negotiate with this service per
919              time unit.
920
921       Available in Postfix version 2.9 - 3.6:
922
923       smtpd_per_record_deadline (normal: no, overload: yes)
924              Change  the  behavior  of  the  smtpd_timeout  and  smtpd_start‐
925              tls_timeout time limits, from a time limit  per  read  or  write
926              system  call,  to  a  time  limit  to send or receive a complete
927              record (an SMTP command line, SMTP response line,  SMTP  message
928              content line, or TLS protocol message).
929
930       Available in Postfix version 3.1 and later:
931
932       smtpd_client_auth_rate_limit (0)
933              The  maximal  number of AUTH commands that any client is allowed
934              to send to this service per time unit, regardless of whether  or
935              not Postfix actually accepts those commands.
936
937       Available in Postfix version 3.7 and later:
938
939       smtpd_per_request_deadline (normal: no, overload: yes)
940              Change  the  behavior  of  the  smtpd_timeout  and  smtpd_start‐
941              tls_timeout time limits, from a time limit per plaintext or  TLS
942              read  or  write  call,  to a combined time limit for receiving a
943              complete SMTP request and for sending a complete SMTP response.
944
945       smtpd_min_data_rate (500)
946              The minimum plaintext data transfer  rate  in  bytes/second  for
947              DATA   and  BDAT  requests,  when  deadlines  are  enabled  with
948              smtpd_per_request_deadline.
949
950       header_from_format (standard)
951              The format of the Postfix-generated From: header.
952

TARPIT CONTROLS

954       When a remote SMTP client makes errors, the Postfix SMTP server can in‐
955       sert  delays  before  responding.  This  can help to slow down run-away
956       software.  The behavior is controlled by an error counter  that  counts
957       the number of errors within an SMTP session that a client makes without
958       delivering mail.
959
960       smtpd_error_sleep_time (1s)
961              With Postfix version 2.1 and later: the SMTP server response de‐
962              lay  after  a  client has made more than $smtpd_soft_error_limit
963              errors, and fewer than $smtpd_hard_error_limit  errors,  without
964              delivering mail.
965
966       smtpd_soft_error_limit (10)
967              The  number  of  errors  a remote SMTP client is allowed to make
968              without delivering mail before the  Postfix  SMTP  server  slows
969              down all its responses.
970
971       smtpd_hard_error_limit (normal: 20, overload: 1)
972              The  maximal number of errors a remote SMTP client is allowed to
973              make without delivering mail.
974
975       smtpd_junk_command_limit (normal: 100, overload: 1)
976              The number of junk commands (NOOP, VRFY, ETRN or  RSET)  that  a
977              remote  SMTP  client  can  send  before  the Postfix SMTP server
978              starts to increment the error counter with each junk command.
979
980       Available in Postfix version 2.1 and later:
981
982       smtpd_recipient_overshoot_limit (1000)
983              The number of recipients that a remote SMTP client can  send  in
984              excess  of  the limit specified with $smtpd_recipient_limit, be‐
985              fore the Postfix SMTP server increments  the  per-session  error
986              count for each excess recipient.
987

ACCESS POLICY DELEGATION CONTROLS

989       As  of version 2.1, Postfix can be configured to delegate access policy
990       decisions to an external server that runs  outside  Postfix.   See  the
991       file SMTPD_POLICY_README for more information.
992
993       smtpd_policy_service_max_idle (300s)
994              The  time after which an idle SMTPD policy service connection is
995              closed.
996
997       smtpd_policy_service_max_ttl (1000s)
998              The time after which an active SMTPD policy  service  connection
999              is closed.
1000
1001       smtpd_policy_service_timeout (100s)
1002              The  time limit for connecting to, writing to, or receiving from
1003              a delegated SMTPD policy server.
1004
1005       Available in Postfix version 3.0 and later:
1006
1007       smtpd_policy_service_default_action  (451  4.3.5  Server  configuration
1008       problem)
1009              The default action when an SMTPD policy service request fails.
1010
1011       smtpd_policy_service_request_limit (0)
1012              The  maximal number of requests per SMTPD policy service connec‐
1013              tion, or zero (no limit).
1014
1015       smtpd_policy_service_try_limit (2)
1016              The maximal number of attempts to send an SMTPD  policy  service
1017              request before giving up.
1018
1019       smtpd_policy_service_retry_delay (1s)
1020              The  delay between attempts to resend a failed SMTPD policy ser‐
1021              vice request.
1022
1023       Available in Postfix version 3.1 and later:
1024
1025       smtpd_policy_service_policy_context (empty)
1026              Optional information that the Postfix SMTP server  specifies  in
1027              the  "policy_context"  attribute  of  a  policy  service request
1028              (originally, to share the same service endpoint  among  multiple
1029              check_policy_service clients).
1030

ACCESS CONTROLS

1032       The  SMTPD_ACCESS_README document gives an introduction to all the SMTP
1033       server access control features.
1034
1035       smtpd_delay_reject (yes)
1036              Wait   until   the   RCPT   TO   command    before    evaluating
1037              $smtpd_client_restrictions,     $smtpd_helo_restrictions     and
1038              $smtpd_sender_restrictions, or wait until the ETRN  command  be‐
1039              fore  evaluating  $smtpd_client_restrictions and $smtpd_helo_re‐
1040              strictions.
1041
1042       parent_domain_matches_subdomains (see 'postconf -d' output)
1043              A list of Postfix features where the pattern "example.com"  also
1044              matches  subdomains  of example.com, instead of requiring an ex‐
1045              plicit ".example.com" pattern.
1046
1047       smtpd_client_restrictions (empty)
1048              Optional restrictions that the Postfix SMTP  server  applies  in
1049              the context of a client connection request.
1050
1051       smtpd_helo_required (no)
1052              Require  that  a  remote  SMTP client introduces itself with the
1053              HELO or EHLO command before sending the MAIL  command  or  other
1054              commands that require EHLO negotiation.
1055
1056       smtpd_helo_restrictions (empty)
1057              Optional  restrictions  that  the Postfix SMTP server applies in
1058              the context of a client HELO command.
1059
1060       smtpd_sender_restrictions (empty)
1061              Optional restrictions that the Postfix SMTP  server  applies  in
1062              the context of a client MAIL FROM command.
1063
1064       smtpd_recipient_restrictions (see 'postconf -d' output)
1065              Optional  restrictions  that  the Postfix SMTP server applies in
1066              the context of a client RCPT TO command,  after  smtpd_relay_re‐
1067              strictions.
1068
1069       smtpd_etrn_restrictions (empty)
1070              Optional  restrictions  that  the Postfix SMTP server applies in
1071              the context of a client ETRN command.
1072
1073       allow_untrusted_routing (no)
1074              Forward  mail  with   sender-specified   routing   (user[@%!]re‐
1075              mote[@%!]site)  from  untrusted clients to destinations matching
1076              $relay_domains.
1077
1078       smtpd_restriction_classes (empty)
1079              User-defined aliases for groups of access restrictions.
1080
1081       smtpd_null_access_lookup_key (<>)
1082              The lookup key to be used in SMTP access(5)  tables  instead  of
1083              the null sender address.
1084
1085       permit_mx_backup_networks (empty)
1086              Restrict  the use of the permit_mx_backup SMTP access feature to
1087              only domains whose primary MX hosts match the listed networks.
1088
1089       Available in Postfix version 2.0 and later:
1090
1091       smtpd_data_restrictions (empty)
1092              Optional access restrictions that the Postfix  SMTP  server  ap‐
1093              plies in the context of the SMTP DATA command.
1094
1095       smtpd_expansion_filter (see 'postconf -d' output)
1096              What  characters  are  allowed  in $name expansions of RBL reply
1097              templates.
1098
1099       Available in Postfix version 2.1 and later:
1100
1101       smtpd_reject_unlisted_sender (no)
1102              Request that the Postfix SMTP server rejects mail  from  unknown
1103              sender  addresses,  even when no explicit reject_unlisted_sender
1104              access restriction is specified.
1105
1106       smtpd_reject_unlisted_recipient (yes)
1107              Request that the Postfix SMTP server rejects  mail  for  unknown
1108              recipient  addresses,  even when no explicit reject_unlisted_re‐
1109              cipient access restriction is specified.
1110
1111       Available in Postfix version 2.2 and later:
1112
1113       smtpd_end_of_data_restrictions (empty)
1114              Optional access restrictions that the Postfix  SMTP  server  ap‐
1115              plies in the context of the SMTP END-OF-DATA command.
1116
1117       Available in Postfix version 2.10 and later:
1118
1119       smtpd_relay_restrictions (permit_mynetworks, permit_sasl_authenticated,
1120       defer_unauth_destination)
1121              Access restrictions for mail relay control that the Postfix SMTP
1122              server  applies  in  the  context of the RCPT TO command, before
1123              smtpd_recipient_restrictions.
1124

SENDER AND RECIPIENT ADDRESS VERIFICATION CONTROLS

1126       Postfix version 2.1 introduces sender and recipient  address  verifica‐
1127       tion.  This feature is implemented by sending probe email messages that
1128       are not actually delivered.  This feature  is  requested  via  the  re‐
1129       ject_unverified_sender  and reject_unverified_recipient access restric‐
1130       tions.  The status of verification probes is  maintained  by  the  ver‐
1131       ify(8)  server.   See the file ADDRESS_VERIFICATION_README for informa‐
1132       tion about how to configure and operate  the  Postfix  sender/recipient
1133       address verification service.
1134
1135       address_verify_poll_count (normal: 3, overload: 1)
1136              How many times to query the verify(8) service for the completion
1137              of an address verification request in progress.
1138
1139       address_verify_poll_delay (3s)
1140              The delay between queries for the completion of an address veri‐
1141              fication request in progress.
1142
1143       address_verify_sender ($double_bounce_sender)
1144              The  sender address to use in address verification probes; prior
1145              to Postfix 2.5 the default was "postmaster".
1146
1147       unverified_sender_reject_code (450)
1148              The numerical Postfix SMTP server response code when a recipient
1149              address is rejected by the reject_unverified_sender restriction.
1150
1151       unverified_recipient_reject_code (450)
1152              The  numerical Postfix SMTP server response when a recipient ad‐
1153              dress is rejected by  the  reject_unverified_recipient  restric‐
1154              tion.
1155
1156       Available in Postfix version 2.6 and later:
1157
1158       unverified_sender_defer_code (450)
1159              The  numerical  Postfix  SMTP server response code when a sender
1160              address probe fails due to a temporary error condition.
1161
1162       unverified_recipient_defer_code (450)
1163              The numerical Postfix SMTP server response when a recipient  ad‐
1164              dress probe fails due to a temporary error condition.
1165
1166       unverified_sender_reject_reason (empty)
1167              The  Postfix  SMTP  server's  reply when rejecting mail with re‐
1168              ject_unverified_sender.
1169
1170       unverified_recipient_reject_reason (empty)
1171              The Postfix SMTP server's reply when  rejecting  mail  with  re‐
1172              ject_unverified_recipient.
1173
1174       unverified_sender_tempfail_action ($reject_tempfail_action)
1175              The  Postfix  SMTP server's action when reject_unverified_sender
1176              fails due to a temporary error condition.
1177
1178       unverified_recipient_tempfail_action ($reject_tempfail_action)
1179              The Postfix SMTP server's action when  reject_unverified_recipi‐
1180              ent fails due to a temporary error condition.
1181
1182       Available with Postfix 2.9 and later:
1183
1184       address_verify_sender_ttl (0s)
1185              The  time  between  changes in the time-dependent portion of ad‐
1186              dress verification probe sender addresses.
1187

ACCESS CONTROL RESPONSES

1189       The following parameters control numerical SMTP reply codes and/or text
1190       responses.
1191
1192       access_map_reject_code (554)
1193              The numerical Postfix SMTP server response code for an access(5)
1194              map "reject" action.
1195
1196       defer_code (450)
1197              The numerical Postfix SMTP server response code  when  a  remote
1198              SMTP client request is rejected by the "defer" restriction.
1199
1200       invalid_hostname_reject_code (501)
1201              The  numerical Postfix SMTP server response code when the client
1202              HELO or EHLO command parameter is  rejected  by  the  reject_in‐
1203              valid_helo_hostname restriction.
1204
1205       maps_rbl_reject_code (554)
1206              The  numerical  Postfix  SMTP server response code when a remote
1207              SMTP client request is blocked  by  the  reject_rbl_client,  re‐
1208              ject_rhsbl_client,        reject_rhsbl_reverse_client,       re‐
1209              ject_rhsbl_sender or reject_rhsbl_recipient restriction.
1210
1211       non_fqdn_reject_code (504)
1212              The numerical Postfix SMTP server reply code when a  client  re‐
1213              quest  is  rejected  by  the  reject_non_fqdn_helo_hostname, re‐
1214              ject_non_fqdn_sender or reject_non_fqdn_recipient restriction.
1215
1216       plaintext_reject_code (450)
1217              The numerical Postfix SMTP server response code when  a  request
1218              is rejected by the reject_plaintext_session restriction.
1219
1220       reject_code (554)
1221              The  numerical  Postfix  SMTP server response code when a remote
1222              SMTP client request is rejected by the "reject" restriction.
1223
1224       relay_domains_reject_code (554)
1225              The numerical Postfix SMTP server response code  when  a  client
1226              request  is  rejected by the reject_unauth_destination recipient
1227              restriction.
1228
1229       unknown_address_reject_code (450)
1230              The numerical response code when the Postfix SMTP server rejects
1231              a sender or recipient address because its domain is unknown.
1232
1233       unknown_client_reject_code (450)
1234              The  numerical  Postfix  SMTP server response code when a client
1235              without valid address <=> name mapping is rejected  by  the  re‐
1236              ject_unknown_client_hostname restriction.
1237
1238       unknown_hostname_reject_code (450)
1239              The  numerical  Postfix SMTP server response code when the host‐
1240              name specified with the HELO or EHLO command is rejected by  the
1241              reject_unknown_helo_hostname restriction.
1242
1243       Available in Postfix version 2.0 and later:
1244
1245       default_rbl_reply (see 'postconf -d' output)
1246              The  default Postfix SMTP server response template for a request
1247              that is rejected by an RBL-based restriction.
1248
1249       multi_recipient_bounce_reject_code (550)
1250              The numerical Postfix SMTP server response code  when  a  remote
1251              SMTP  client  request  is  blocked  by  the reject_multi_recipi‐
1252              ent_bounce restriction.
1253
1254       rbl_reply_maps (empty)
1255              Optional lookup tables with RBL response templates.
1256
1257       Available in Postfix version 2.6 and later:
1258
1259       access_map_defer_code (450)
1260              The numerical Postfix SMTP server response code for an access(5)
1261              map "defer" action, including "defer_if_permit" or "defer_if_re‐
1262              ject".
1263
1264       reject_tempfail_action (defer_if_permit)
1265              The Postfix SMTP server's action when a reject-type  restriction
1266              fails due to a temporary error condition.
1267
1268       unknown_helo_hostname_tempfail_action ($reject_tempfail_action)
1269              The  Postfix SMTP server's action when reject_unknown_helo_host‐
1270              name fails due to a temporary error condition.
1271
1272       unknown_address_tempfail_action ($reject_tempfail_action)
1273              The Postfix SMTP server's action when  reject_unknown_sender_do‐
1274              main  or reject_unknown_recipient_domain fail due to a temporary
1275              error condition.
1276

MISCELLANEOUS CONTROLS

1278       config_directory (see 'postconf -d' output)
1279              The default location of the Postfix main.cf and  master.cf  con‐
1280              figuration files.
1281
1282       daemon_timeout (18000s)
1283              How  much time a Postfix daemon process may take to handle a re‐
1284              quest before it is terminated by a built-in watchdog timer.
1285
1286       command_directory (see 'postconf -d' output)
1287              The location of all postfix administrative commands.
1288
1289       double_bounce_sender (double-bounce)
1290              The sender address of postmaster notifications that  are  gener‐
1291              ated by the mail system.
1292
1293       ipc_timeout (3600s)
1294              The  time limit for sending or receiving information over an in‐
1295              ternal communication channel.
1296
1297       mail_name (Postfix)
1298              The mail system name that is displayed in Received: headers,  in
1299              the SMTP greeting banner, and in bounced mail.
1300
1301       mail_owner (postfix)
1302              The  UNIX  system  account  that owns the Postfix queue and most
1303              Postfix daemon processes.
1304
1305       max_idle (100s)
1306              The maximum amount of time that an idle Postfix  daemon  process
1307              waits for an incoming connection before terminating voluntarily.
1308
1309       max_use (100)
1310              The maximal number of incoming connections that a Postfix daemon
1311              process will service before terminating voluntarily.
1312
1313       myhostname (see 'postconf -d' output)
1314              The internet hostname of this mail system.
1315
1316       mynetworks (see 'postconf -d' output)
1317              The list of "trusted" remote SMTP clients that have more  privi‐
1318              leges than "strangers".
1319
1320       myorigin ($myhostname)
1321              The  domain  name that locally-posted mail appears to come from,
1322              and that locally posted mail is delivered to.
1323
1324       process_id (read-only)
1325              The process ID of a Postfix command or daemon process.
1326
1327       process_name (read-only)
1328              The process name of a Postfix command or daemon process.
1329
1330       queue_directory (see 'postconf -d' output)
1331              The location of the Postfix top-level queue directory.
1332
1333       recipient_delimiter (empty)
1334              The set of characters that can separate an email address  local‐
1335              part, user name, or a .forward file name from its extension.
1336
1337       smtpd_banner ($myhostname ESMTP $mail_name)
1338              The  text  that follows the 220 status code in the SMTP greeting
1339              banner.
1340
1341       syslog_facility (mail)
1342              The syslog facility of Postfix logging.
1343
1344       syslog_name (see 'postconf -d' output)
1345              A prefix that  is  prepended  to  the  process  name  in  syslog
1346              records, so that, for example, "smtpd" becomes "prefix/smtpd".
1347
1348       Available in Postfix version 2.2 and later:
1349
1350       smtpd_forbidden_commands (CONNECT GET POST regexp:{{/^[^A-Z]/ Bogus}})
1351              List  of  commands that cause the Postfix SMTP server to immedi‐
1352              ately terminate the session with a 221 code.
1353
1354       Available in Postfix version 2.5 and later:
1355
1356       smtpd_client_port_logging (no)
1357              Enable logging of the remote SMTP client port in addition to the
1358              hostname and IP address.
1359
1360       Available in Postfix 3.3 and later:
1361
1362       service_name (read-only)
1363              The master.cf service name of a Postfix daemon process.
1364
1365       Available in Postfix 3.4 and later:
1366
1367       smtpd_reject_footer_maps (empty)
1368              Lookup  tables,  indexed by the complete Postfix SMTP server 4xx
1369              or 5xx response, with reject footer templates.
1370

SEE ALSO

1372       anvil(8), connection/rate limiting
1373       cleanup(8), message canonicalization
1374       tlsmgr(8), TLS session and PRNG management
1375       trivial-rewrite(8), address resolver
1376       verify(8), address verification service
1377       postconf(5), configuration parameters
1378       master(5), generic daemon options
1379       master(8), process manager
1380       postlogd(8), Postfix logging
1381       syslogd(8), system logging
1382

README FILES

1384       Use "postconf readme_directory" or "postconf html_directory" to  locate
1385       this information.
1386       ADDRESS_CLASS_README, blocking unknown hosted or relay recipients
1387       ADDRESS_REWRITING_README, Postfix address manipulation
1388       BDAT_README, Postfix CHUNKING support
1389       FILTER_README, external after-queue content filter
1390       LOCAL_RECIPIENT_README, blocking unknown local recipients
1391       MILTER_README, before-queue mail filter applications
1392       SMTPD_ACCESS_README, built-in access policies
1393       SMTPD_POLICY_README, external policy server
1394       SMTPD_PROXY_README, external before-queue content filter
1395       SASL_README, Postfix SASL howto
1396       TLS_README, Postfix STARTTLS howto
1397       VERP_README, Postfix XVERP extension
1398       XCLIENT_README, Postfix XCLIENT extension
1399       XFORWARD_README, Postfix XFORWARD extension
1400

LICENSE

1402       The Secure Mailer license must be distributed with this software.
1403

AUTHOR(S)

1405       Wietse Venema
1406       IBM T.J. Watson Research
1407       P.O. Box 704
1408       Yorktown Heights, NY 10598, USA
1409
1410       Wietse Venema
1411       Google, Inc.
1412       111 8th Avenue
1413       New York, NY 10011, USA
1414
1415       SASL support originally by:
1416       Till Franke
1417       SuSE Rhein/Main AG
1418       65760 Eschborn, Germany
1419
1420       TLS support originally by:
1421       Lutz Jaenicke
1422       BTU Cottbus
1423       Allgemeine Elektrotechnik
1424       Universitaetsplatz 3-4
1425       D-03044 Cottbus, Germany
1426
1427       Revised TLS support by:
1428       Victor Duchovni
1429       Morgan Stanley
1430
1431
1432
1433                                                                      SMTPD(8)
Impressum