407 lines
No EOL
132 KiB
HTML
407 lines
No EOL
132 KiB
HTML
<!DOCTYPE html><html lang="en" dir="ltr" data-theme="dark" data-has-toc data-has-sidebar class="astro-bguv2lll"> <head><meta charset="utf-8"/><meta name="viewport" content="width=device-width, initial-scale=1"/><title>Sending / Relaying | ISPmail Guide</title><link rel="canonical" href="https://workaround.org/ispmail-trixie/relaying/"/><link rel="sitemap" href="/sitemap-index.xml"/><script src="https://rybbit.workaround.org/api/script.js" data-site-id="1" async defer></script><link rel="shortcut icon" href="/favicon.svg" type="image/svg+xml"/><meta name="generator" content="Astro v5.16.6"/><meta name="generator" content="Starlight v0.35.3"/><meta property="og:title" content="Sending / Relaying"/><meta property="og:type" content="article"/><meta property="og:url" content="https://workaround.org/ispmail-trixie/relaying/"/><meta property="og:locale" content="en"/><meta property="og:description"/><meta property="og:site_name" content="ISPmail Guide"/><meta name="twitter:card" content="summary_large_image"/><script>
|
||
window.StarlightThemeProvider = (() => {
|
||
const storedTheme =
|
||
typeof localStorage !== 'undefined' && localStorage.getItem('starlight-theme');
|
||
const theme =
|
||
storedTheme ||
|
||
(window.matchMedia('(prefers-color-scheme: light)').matches ? 'light' : 'dark');
|
||
document.documentElement.dataset.theme = theme === 'light' ? 'light' : 'dark';
|
||
return {
|
||
updatePickers(theme = storedTheme || 'auto') {
|
||
document.querySelectorAll('starlight-theme-select').forEach((picker) => {
|
||
const select = picker.querySelector('select');
|
||
if (select) select.value = theme;
|
||
/** @type {HTMLTemplateElement | null} */
|
||
const tmpl = document.querySelector(`#theme-icons`);
|
||
const newIcon = tmpl && tmpl.content.querySelector('.' + theme);
|
||
if (newIcon) {
|
||
const oldIcon = picker.querySelector('svg.label-icon');
|
||
if (oldIcon) {
|
||
oldIcon.replaceChildren(...newIcon.cloneNode(true).childNodes);
|
||
}
|
||
}
|
||
});
|
||
},
|
||
};
|
||
})();
|
||
</script><template id="theme-icons"><svg aria-hidden="true" class="light astro-c6vsoqas" width="16" height="16" viewBox="0 0 24 24" fill="currentColor" style="--sl-icon-size: 1em;"><path d="M5 12a1 1 0 0 0-1-1H3a1 1 0 0 0 0 2h1a1 1 0 0 0 1-1Zm.64 5-.71.71a1 1 0 0 0 0 1.41 1 1 0 0 0 1.41 0l.71-.71A1 1 0 0 0 5.64 17ZM12 5a1 1 0 0 0 1-1V3a1 1 0 0 0-2 0v1a1 1 0 0 0 1 1Zm5.66 2.34a1 1 0 0 0 .7-.29l.71-.71a1 1 0 1 0-1.41-1.41l-.66.71a1 1 0 0 0 0 1.41 1 1 0 0 0 .66.29Zm-12-.29a1 1 0 0 0 1.41 0 1 1 0 0 0 0-1.41l-.71-.71a1.004 1.004 0 1 0-1.43 1.41l.73.71ZM21 11h-1a1 1 0 0 0 0 2h1a1 1 0 0 0 0-2Zm-2.64 6A1 1 0 0 0 17 18.36l.71.71a1 1 0 0 0 1.41 0 1 1 0 0 0 0-1.41l-.76-.66ZM12 6.5a5.5 5.5 0 1 0 5.5 5.5A5.51 5.51 0 0 0 12 6.5Zm0 9a3.5 3.5 0 1 1 0-7 3.5 3.5 0 0 1 0 7Zm0 3.5a1 1 0 0 0-1 1v1a1 1 0 0 0 2 0v-1a1 1 0 0 0-1-1Z"/></svg><svg aria-hidden="true" class="dark astro-c6vsoqas" width="16" height="16" viewBox="0 0 24 24" fill="currentColor" style="--sl-icon-size: 1em;"><path d="M21.64 13a1 1 0 0 0-1.05-.14 8.049 8.049 0 0 1-3.37.73 8.15 8.15 0 0 1-8.14-8.1 8.59 8.59 0 0 1 .25-2A1 1 0 0 0 8 2.36a10.14 10.14 0 1 0 14 11.69 1 1 0 0 0-.36-1.05Zm-9.5 6.69A8.14 8.14 0 0 1 7.08 5.22v.27a10.15 10.15 0 0 0 10.14 10.14 9.784 9.784 0 0 0 2.1-.22 8.11 8.11 0 0 1-7.18 4.32v-.04Z"/></svg><svg aria-hidden="true" class="auto astro-c6vsoqas" width="16" height="16" viewBox="0 0 24 24" fill="currentColor" style="--sl-icon-size: 1em;"><path d="M21 14h-1V7a3 3 0 0 0-3-3H7a3 3 0 0 0-3 3v7H3a1 1 0 0 0-1 1v2a3 3 0 0 0 3 3h14a3 3 0 0 0 3-3v-2a1 1 0 0 0-1-1ZM6 7a1 1 0 0 1 1-1h10a1 1 0 0 1 1 1v7H6V7Zm14 10a1 1 0 0 1-1 1H5a1 1 0 0 1-1-1v-1h16v1Z"/></svg></template><link rel="stylesheet" href="/_astro/print.DNXP8c50.css" media="print"><link rel="stylesheet" href="/_astro/index.DpSp7KkT.css">
|
||
<style>@layer starlight.components{:root{--sl-badge-default-border: var(--sl-color-accent);--sl-badge-default-bg: var(--sl-color-accent-low);--sl-badge-default-text: #fff;--sl-badge-note-border: var(--sl-color-blue);--sl-badge-note-bg: var(--sl-color-blue-low);--sl-badge-note-text: #fff;--sl-badge-danger-border: var(--sl-color-red);--sl-badge-danger-bg: var(--sl-color-red-low);--sl-badge-danger-text: #fff;--sl-badge-success-border: var(--sl-color-green);--sl-badge-success-bg: var(--sl-color-green-low);--sl-badge-success-text: #fff;--sl-badge-caution-border: var(--sl-color-orange);--sl-badge-caution-bg: var(--sl-color-orange-low);--sl-badge-caution-text: #fff;--sl-badge-tip-border: var(--sl-color-purple);--sl-badge-tip-bg: var(--sl-color-purple-low);--sl-badge-tip-text: #fff}[data-theme=light]:root{--sl-badge-default-bg: var(--sl-color-accent-high);--sl-badge-note-bg: var(--sl-color-blue-high);--sl-badge-danger-bg: var(--sl-color-red-high);--sl-badge-success-bg: var(--sl-color-green-high);--sl-badge-caution-bg: var(--sl-color-orange-high);--sl-badge-tip-bg: var(--sl-color-purple-high)}.sl-badge:where(.astro-avdet4wd){display:inline-block;border:1px solid var(--sl-color-border-badge);border-radius:.25rem;font-family:var(--sl-font-system-mono);line-height:normal;color:var(--sl-color-text-badge);background-color:var(--sl-color-bg-badge);overflow-wrap:anywhere}.sidebar-content .sl-badge:where(.astro-avdet4wd){line-height:1;font-size:var(--sl-text-xs);padding:.125rem .375rem}.sidebar-content a[aria-current=page]>.sl-badge:where(.astro-avdet4wd){--sl-color-bg-badge: transparent;--sl-color-border-badge: currentColor;color:inherit}.default:where(.astro-avdet4wd){--sl-color-bg-badge: var(--sl-badge-default-bg);--sl-color-border-badge: var(--sl-badge-default-border);--sl-color-text-badge: var(--sl-badge-default-text)}.note:where(.astro-avdet4wd){--sl-color-bg-badge: var(--sl-badge-note-bg);--sl-color-border-badge: var(--sl-badge-note-border);--sl-color-text-badge: var(--sl-badge-note-text)}.danger:where(.astro-avdet4wd){--sl-color-bg-badge: var(--sl-badge-danger-bg);--sl-color-border-badge: var(--sl-badge-danger-border);--sl-color-text-badge: var(--sl-badge-danger-text)}.success:where(.astro-avdet4wd){--sl-color-bg-badge: var(--sl-badge-success-bg);--sl-color-border-badge: var(--sl-badge-success-border);--sl-color-text-badge: var(--sl-badge-success-text)}.tip:where(.astro-avdet4wd){--sl-color-bg-badge: var(--sl-badge-tip-bg);--sl-color-border-badge: var(--sl-badge-tip-border);--sl-color-text-badge: var(--sl-badge-tip-text)}.caution:where(.astro-avdet4wd){--sl-color-bg-badge: var(--sl-badge-caution-bg);--sl-color-border-badge: var(--sl-badge-caution-border);--sl-color-text-badge: var(--sl-badge-caution-text)}.small:where(.astro-avdet4wd){font-size:var(--sl-text-xs);padding:.125rem .25rem}.medium:where(.astro-avdet4wd){font-size:var(--sl-text-sm);padding:.175rem .35rem}.large:where(.astro-avdet4wd){font-size:var(--sl-text-base);padding:.225rem .45rem}.sl-markdown-content :is(h1,h2,h3,h4,h5,h6) .sl-badge:where(.astro-avdet4wd){vertical-align:middle}}
|
||
@layer starlight.components{.card-grid:where(.astro-zntqmydn){display:grid;grid-template-columns:100%;gap:1rem}.card-grid:where(.astro-zntqmydn)>*{margin-top:0!important}@media(min-width:50rem){.card-grid:where(.astro-zntqmydn){grid-template-columns:1fr 1fr;gap:1.5rem}.stagger:where(.astro-zntqmydn){--stagger-height: 5rem;padding-bottom:var(--stagger-height)}.stagger:where(.astro-zntqmydn)>*:nth-child(2n){transform:translateY(var(--stagger-height))}}}
|
||
@layer starlight.components{.card:where(.astro-v5tidmuc){--sl-card-border: var(--sl-color-purple);--sl-card-bg: var(--sl-color-purple-low);border:1px solid var(--sl-color-gray-5);background-color:var(--sl-color-black);padding:clamp(1rem,calc(.125rem + 3vw),2.5rem);flex-direction:column;gap:clamp(.5rem,calc(.125rem + 1vw),1rem)}.card:where(.astro-v5tidmuc):nth-child(4n+1){--sl-card-border: var(--sl-color-orange);--sl-card-bg: var(--sl-color-orange-low)}.card:where(.astro-v5tidmuc):nth-child(4n+3){--sl-card-border: var(--sl-color-green);--sl-card-bg: var(--sl-color-green-low)}.card:where(.astro-v5tidmuc):nth-child(4n+4){--sl-card-border: var(--sl-color-red);--sl-card-bg: var(--sl-color-red-low)}.card:where(.astro-v5tidmuc):nth-child(4n+5){--sl-card-border: var(--sl-color-blue);--sl-card-bg: var(--sl-color-blue-low)}.title:where(.astro-v5tidmuc){font-weight:600;font-size:var(--sl-text-h4);color:var(--sl-color-white);line-height:var(--sl-line-height-headings);gap:1rem;align-items:center}.card:where(.astro-v5tidmuc) .icon:where(.astro-v5tidmuc){border:1px solid var(--sl-card-border);background-color:var(--sl-card-bg);padding:.2em;border-radius:.25rem;flex-shrink:0}.card:where(.astro-v5tidmuc) .body:where(.astro-v5tidmuc){margin:0;font-size:clamp(var(--sl-text-sm),calc(.5rem + 1vw),var(--sl-text-body))}}
|
||
@layer starlight.components{svg:where(.astro-c6vsoqas){color:var(--sl-icon-color);font-size:var(--sl-icon-size, 1em);width:1em;height:1em}}
|
||
@layer starlight.components{starlight-tabs:where(.astro-esqgolmp){display:block}.tablist-wrapper:where(.astro-esqgolmp){overflow-x:auto}:where(.astro-esqgolmp)[role=tablist]{display:flex;list-style:none;border-bottom:2px solid var(--sl-color-gray-5);padding:0}.tab:where(.astro-esqgolmp){margin-bottom:-2px}.tab:where(.astro-esqgolmp)>:where(.astro-esqgolmp)[role=tab]{display:flex;align-items:center;gap:.5rem;padding:0 1.25rem;text-decoration:none;border-bottom:2px solid var(--sl-color-gray-5);color:var(--sl-color-gray-3);outline-offset:var(--sl-outline-offset-inside);overflow-wrap:initial}.tab:where(.astro-esqgolmp) :where(.astro-esqgolmp)[role=tab][aria-selected=true]{color:var(--sl-color-white);border-color:var(--sl-color-text-accent);font-weight:600}.tablist-wrapper:where(.astro-esqgolmp)~[role=tabpanel]{margin-top:1rem}}
|
||
@layer starlight.components{.sl-steps{--bullet-size: calc(var(--sl-line-height) * 1rem);--bullet-margin: .375rem;list-style:none;counter-reset:steps-counter var(--sl-steps-start, 0);padding-inline-start:0}.sl-steps>li{counter-increment:steps-counter;position:relative;padding-inline-start:calc(var(--bullet-size) + 1rem);padding-bottom:1px;min-height:calc(var(--bullet-size) + var(--bullet-margin))}.sl-steps>li+li{margin-top:0}.sl-steps>li:before{content:counter(steps-counter);position:absolute;top:0;inset-inline-start:0;width:var(--bullet-size);height:var(--bullet-size);line-height:var(--bullet-size);font-size:var(--sl-text-xs);font-weight:600;text-align:center;color:var(--sl-color-white);background-color:var(--sl-color-gray-6);border-radius:99rem;box-shadow:inset 0 0 0 1px var(--sl-color-gray-5)}.sl-steps>li:after{--guide-width: 1px;content:"";position:absolute;top:calc(var(--bullet-size) + var(--bullet-margin));bottom:var(--bullet-margin);inset-inline-start:calc((var(--bullet-size) - var(--guide-width)) / 2);width:var(--guide-width);background-color:var(--sl-color-hairline-light)}}@layer starlight.content{.sl-steps>li>:first-child{--lh: calc(1em * var(--sl-line-height));--shift-y: calc(.5 * (var(--bullet-size) - var(--lh)));transform:translateY(var(--shift-y));margin-bottom:var(--shift-y)}.sl-steps>li>:first-child:where(h1,h2,h3,h4,h5,h6){--lh: calc(1em * var(--sl-line-height-headings))}@supports (--prop: 1lh){.sl-steps>li>:first-child{--lh: 1lh}}}
|
||
@layer starlight.components{starlight-file-tree:where(.astro-p67cqifm){--x-space: 1.5rem;--y-space: .125rem;--y-pad: 0;display:block;border:1px solid var(--sl-color-gray-5);padding:1rem;background-color:var(--sl-color-gray-6);font-size:var(--sl-text-xs);font-family:var(--__sl-font-mono);overflow-x:auto}starlight-file-tree:where(.astro-p67cqifm) .directory>details{border:0;padding:0;padding-inline-start:var(--x-space);background:transparent}starlight-file-tree:where(.astro-p67cqifm) .directory>details>summary{margin-inline-start:calc(-1 * var(--x-space));border:0;padding:var(--y-pad) .625rem;font-weight:400;color:var(--sl-color-white);max-width:100%}starlight-file-tree:where(.astro-p67cqifm) .directory>details>summary::marker,starlight-file-tree:where(.astro-p67cqifm) .directory>details>summary::-webkit-details-marker{color:var(--sl-color-gray-3)}starlight-file-tree:where(.astro-p67cqifm) .directory>details>summary:hover,starlight-file-tree:where(.astro-p67cqifm) .directory>details>summary:hover .tree-icon{cursor:pointer;color:var(--sl-color-text-accent);fill:currentColor}starlight-file-tree:where(.astro-p67cqifm) .directory>details>summary:hover~ul{border-color:var(--sl-color-gray-4)}starlight-file-tree:where(.astro-p67cqifm) .directory>details>summary:hover .highlight .tree-icon{color:var(--sl-color-text-invert);fill:currentColor}starlight-file-tree:where(.astro-p67cqifm) ul{margin-inline-start:.5rem;border-inline-start:1px solid var(--sl-color-gray-5);padding:0;padding-inline-start:.125rem;list-style:none}starlight-file-tree:where(.astro-p67cqifm)>ul{margin:0;border:0;padding:0}starlight-file-tree:where(.astro-p67cqifm) li{margin:var(--y-space) 0;padding:var(--y-pad) 0}starlight-file-tree:where(.astro-p67cqifm) .file{margin-inline-start:calc(var(--x-space) - .125rem);color:var(--sl-color-white)}starlight-file-tree:where(.astro-p67cqifm) .tree-entry{display:inline-flex;align-items:flex-start;flex-wrap:wrap;max-width:calc(100% - 1rem)}@media(min-width:30em){starlight-file-tree:where(.astro-p67cqifm) .tree-entry{flex-wrap:nowrap}}starlight-file-tree:where(.astro-p67cqifm) .tree-entry>:first-child{flex-shrink:0}starlight-file-tree:where(.astro-p67cqifm) .empty{color:var(--sl-color-gray-3);padding-inline-start:.375rem}starlight-file-tree:where(.astro-p67cqifm) .comment{color:var(--sl-color-gray-3);padding-inline-start:1.625rem;max-width:24rem;min-width:12rem}starlight-file-tree:where(.astro-p67cqifm) .highlight{display:inline-block;border-radius:.25rem;padding-inline-end:.5rem;color:var(--sl-color-text-invert);background-color:var(--sl-color-text-accent)}starlight-file-tree:where(.astro-p67cqifm) svg{display:inline;fill:var(--sl-color-gray-3);vertical-align:middle;margin-inline:.25rem .375rem;width:.875rem;height:.875rem}starlight-file-tree:where(.astro-p67cqifm) .highlight svg.tree-icon{fill:currentColor}}
|
||
@layer starlight.components{.sl-link-button:where(.astro-xwgiixxa){align-items:center;border:1px solid transparent;border-radius:999rem;display:inline-flex;font-size:var(--sl-text-sm);gap:.5em;line-height:1.1875;outline-offset:.25rem;padding:.4375rem 1.125rem;text-decoration:none}.sl-link-button:where(.astro-xwgiixxa).primary{background:var(--sl-color-text-accent);border-color:var(--sl-color-text-accent);color:var(--sl-color-black)}.sl-link-button:where(.astro-xwgiixxa).primary:hover{color:var(--sl-color-black)}.sl-link-button:where(.astro-xwgiixxa).secondary{border-color:inherit;color:var(--sl-color-white)}.sl-link-button:where(.astro-xwgiixxa).minimal{color:var(--sl-color-white);padding-inline:0}.sl-link-button:where(.astro-xwgiixxa) svg{flex-shrink:0}@media(min-width:50rem){.sl-link-button:where(.astro-xwgiixxa){font-size:var(--sl-text-base);padding:.9375rem 1.25rem}}.sl-markdown-content .sl-link-button:where(.astro-xwgiixxa){margin-inline-end:1rem}.sl-markdown-content .sl-link-button:where(.astro-xwgiixxa):not(:where(p *)){margin-block:1rem}}
|
||
</style><script type="module" src="/_astro/page.B1D-nYk3.js"></script></head> <body class="astro-bguv2lll"> <a href="#_top" class="astro-7q3lir66">Skip to content</a> <div class="page sl-flex astro-vrdttmbt"> <header class="header astro-vrdttmbt"><div class="header astro-kmkmnagf"> <div class="title-wrapper sl-flex astro-kmkmnagf"> <a href="/" class="site-title sl-flex astro-m46x6ez3"> <img class="light:sl-hidden print:hidden astro-m46x6ez3" alt src="/_astro/logo-dark.DlBk_-6-.svg" width="146" height="37"> <img class="dark:sl-hidden print:block astro-m46x6ez3" alt src="/_astro/logo.DfR9nmxN.svg" width="146" height="37"> <span class="sr-only astro-m46x6ez3" translate="no"> ISPmail Guide </span> </a> </div> <div class="sl-flex print:hidden astro-kmkmnagf"> <site-search class="astro-kmkmnagf astro-v37mnknz" data-translations="{"placeholder":"Search"}"> <button data-open-modal disabled aria-label="Search" aria-keyshortcuts="Control+K" class="astro-v37mnknz"> <svg aria-hidden="true" class="astro-v37mnknz astro-c6vsoqas" width="16" height="16" viewBox="0 0 24 24" fill="currentColor" style="--sl-icon-size: 1em;"><path d="M21.71 20.29 18 16.61A9 9 0 1 0 16.61 18l3.68 3.68a.999.999 0 0 0 1.42 0 1 1 0 0 0 0-1.39ZM11 18a7 7 0 1 1 0-14 7 7 0 0 1 0 14Z"/></svg> <span class="sl-hidden md:sl-block astro-v37mnknz" aria-hidden="true">Search</span> <kbd class="sl-hidden md:sl-flex astro-v37mnknz" style="display: none;"> <kbd class="astro-v37mnknz">Ctrl</kbd><kbd class="astro-v37mnknz">K</kbd> </kbd> </button> <dialog style="padding:0" aria-label="Search" class="astro-v37mnknz"> <div class="dialog-frame sl-flex astro-v37mnknz"> <button data-close-modal class="sl-flex md:sl-hidden astro-v37mnknz"> Cancel </button> <div class="search-container astro-v37mnknz"> <div id="starlight__search" class="astro-v37mnknz"></div> </div> </div> </dialog> </site-search> <script>
|
||
(() => {
|
||
const openBtn = document.querySelector('button[data-open-modal]');
|
||
const shortcut = openBtn?.querySelector('kbd');
|
||
if (!openBtn || !(shortcut instanceof HTMLElement)) return;
|
||
const platformKey = shortcut.querySelector('kbd');
|
||
if (platformKey && /(Mac|iPhone|iPod|iPad)/i.test(navigator.platform)) {
|
||
platformKey.textContent = '⌘';
|
||
openBtn.setAttribute('aria-keyshortcuts', 'Meta+K');
|
||
}
|
||
shortcut.style.display = '';
|
||
})();
|
||
</script> <script type="module" src="/_astro/Search.astro_astro_type_script_index_0_lang.cjYDvRdi.js"></script> </div> <div class="sl-hidden md:sl-flex print:hidden right-group astro-kmkmnagf"> <div class="sl-flex social-icons astro-kmkmnagf"> <a href="https://git.workaround.org/chaas/ispmail-workaround-org" rel="me" class="sl-flex astro-wy4te6ga"><span class="sr-only astro-wy4te6ga">Git</span><svg aria-hidden="true" class="astro-wy4te6ga astro-c6vsoqas" width="16" height="16" viewBox="0 0 24 24" fill="currentColor" style="--sl-icon-size: 1em;"><path d="M0.355 12.231L0.355 12.231L0.355 11.853Q0.397 11.517 0.565 11.265L0.565 11.265Q0.691 11.097 0.943 10.803L0.943 10.803L1.279 10.425L7.831 3.831L7.873 3.873Q7.957 3.873 7.957 3.957L7.957 3.957L10.309 6.351Q10.519 6.519 10.309 6.729L10.309 6.729Q10.225 7.317 10.435 7.863Q10.645 8.409 11.107 8.703L11.107 8.703Q11.275 8.787 11.317 8.892Q11.359 8.997 11.359 9.207L11.359 9.207L11.359 15.003Q11.359 15.255 11.107 15.507L11.107 15.507Q10.603 15.843 10.372 16.389Q10.141 16.935 10.330 17.502Q10.519 18.069 10.981 18.447Q11.443 18.825 12.031 18.825Q12.619 18.825 13.081 18.489Q13.543 18.153 13.732 17.586Q13.921 17.019 13.753 16.473Q13.585 15.927 13.081 15.507L13.081 15.507Q12.913 15.423 12.871 15.318Q12.829 15.213 12.829 15.003L12.829 15.003L12.829 9.081L12.955 9.081L15.055 11.181Q15.139 11.265 15.139 11.391L15.139 11.391L15.181 11.475L15.181 12.231Q15.265 13.029 15.874 13.470Q16.483 13.911 17.281 13.806Q18.079 13.701 18.562 13.029Q19.045 12.357 18.835 11.601L18.835 11.601Q18.751 10.929 18.100 10.488Q17.449 10.047 16.735 10.131L16.735 10.131Q16.483 10.131 16.231 10.005L16.231 10.005L14.005 7.779Q13.879 7.653 13.879 7.401L13.879 7.401Q14.005 6.813 13.711 6.267Q13.417 5.721 12.871 5.448Q12.325 5.175 11.779 5.301L11.779 5.301Q11.359 5.301 11.359 5.175L11.359 5.175Q9.805 3.579 9.007 2.907L9.007 2.907Q8.797 2.739 9.007 2.529L9.007 2.529Q9.469 2.193 10.183 1.353L10.183 1.353L10.729 0.807Q11.905-0.369 13.081 0.807L13.081 0.807L23.035 10.803Q24.253 11.979 23.035 13.155L23.035 13.155L13.291 22.941Q12.913 23.319 12.745 23.445L12.745 23.445Q12.409 23.739 12.031 23.781L12.031 23.781L11.779 23.781L11.569 23.697Q11.065 23.487 10.855 23.277L10.855 23.277L10.057 22.479Q8.881 21.387 8.335 20.757L8.335 20.757L1.153 13.575Q1.069 13.365 0.775 13.029L0.775 13.029Q0.397 12.525 0.355 12.231Z"/></svg></a><a href="https://riot.im/app/#/room/#ispmail:matrix.org" rel="me" class="sl-flex astro-wy4te6ga"><span class="sr-only astro-wy4te6ga">Matrix</span><svg aria-hidden="true" class="astro-wy4te6ga astro-c6vsoqas" width="16" height="16" viewBox="0 0 24 24" fill="currentColor" style="--sl-icon-size: 1em;"><path d="M22.5 1.5v21h-2.25V24H24V0h-3.75v1.5h2.25ZM7.46 7.95V9.1h.04a3.02 3.02 0 0 1 2.61-1.39c.54 0 1.03.1 1.48.32.44.2.78.58 1.01 1.1.26-.37.6-.7 1.03-.99.44-.28.95-.43 1.55-.43.45 0 .87.06 1.26.17.38.11.71.29.99.53.27.24.49.56.64.95.15.4.23.86.23 1.42v5.72h-2.34v-4.85c0-.29-.01-.56-.04-.8a1.73 1.73 0 0 0-.18-.67 1.1 1.1 0 0 0-.44-.45 1.6 1.6 0 0 0-.78-.16c-.33 0-.6.06-.8.19-.2.12-.37.29-.48.5a2 2 0 0 0-.23.69c-.04.26-.06.52-.06.78v4.77H10.6v-4.8l-.01-.75a2.29 2.29 0 0 0-.14-.69c-.08-.2-.23-.38-.42-.5a1.5 1.5 0 0 0-.85-.2c-.15.01-.3.04-.44.08-.19.06-.37.15-.52.28-.18.14-.32.34-.44.6-.12.26-.18.6-.18 1.02v4.96H5.25V7.94h2.21ZM1.5 1.5v21h2.25V24H0V0h3.75v1.5H1.5Z"/></svg></a><a href="https://comentario.workaround.org/api/rss/comments?domain=0f111a27-fbfa-48af-8beb-ab12e612d92f" rel="me" class="sl-flex astro-wy4te6ga"><span class="sr-only astro-wy4te6ga">Feed</span><svg aria-hidden="true" class="astro-wy4te6ga astro-c6vsoqas" width="16" height="16" viewBox="0 0 24 24" fill="currentColor" style="--sl-icon-size: 1em;"><path d="M2.88 16.88a3 3 0 0 0 0 4.24 3 3 0 0 0 4.24 0 3 3 0 0 0-4.24-4.24Zm2.83 2.83a1 1 0 0 1-1.42-1.42 1 1 0 0 1 1.42 0 1 1 0 0 1 0 1.42ZM5 12a1 1 0 0 0 0 2 5 5 0 0 1 5 5 1 1 0 0 0 2 0 7 7 0 0 0-7-7Zm0-4a1 1 0 0 0 0 2 9 9 0 0 1 9 9 1 1 0 0 0 2 0 11.08 11.08 0 0 0-3.22-7.78A11.08 11.08 0 0 0 5 8Zm10.61.39A15.11 15.11 0 0 0 5 4a1 1 0 0 0 0 2 13 13 0 0 1 13 13 1 1 0 0 0 2 0 15.11 15.11 0 0 0-4.39-10.61Z"/></svg></a> </div> <starlight-theme-select> <label style="--sl-select-width: 6.25em" class="astro-4yphtoen"> <span class="sr-only astro-4yphtoen">Select theme</span> <svg aria-hidden="true" class="icon label-icon astro-4yphtoen astro-c6vsoqas" width="16" height="16" viewBox="0 0 24 24" fill="currentColor" style="--sl-icon-size: 1em;"><path d="M21 14h-1V7a3 3 0 0 0-3-3H7a3 3 0 0 0-3 3v7H3a1 1 0 0 0-1 1v2a3 3 0 0 0 3 3h14a3 3 0 0 0 3-3v-2a1 1 0 0 0-1-1ZM6 7a1 1 0 0 1 1-1h10a1 1 0 0 1 1 1v7H6V7Zm14 10a1 1 0 0 1-1 1H5a1 1 0 0 1-1-1v-1h16v1Z"/></svg> <select autocomplete="off" class="astro-4yphtoen"> <option value="dark" class="astro-4yphtoen">Dark</option><option value="light" class="astro-4yphtoen">Light</option><option value="auto" selected class="astro-4yphtoen">Auto</option> </select> <svg aria-hidden="true" class="icon caret astro-4yphtoen astro-c6vsoqas" width="16" height="16" viewBox="0 0 24 24" fill="currentColor" style="--sl-icon-size: 1em;"><path d="M17 9.17a1 1 0 0 0-1.41 0L12 12.71 8.46 9.17a1 1 0 1 0-1.41 1.42l4.24 4.24a1.002 1.002 0 0 0 1.42 0L17 10.59a1.002 1.002 0 0 0 0-1.42Z"/></svg> </label> </starlight-theme-select> <script>
|
||
StarlightThemeProvider.updatePickers();
|
||
</script> <script type="module">const r="starlight-theme",o=e=>e==="auto"||e==="dark"||e==="light"?e:"auto",c=()=>o(typeof localStorage<"u"&&localStorage.getItem(r));function n(e){typeof localStorage<"u"&&localStorage.setItem(r,e==="light"||e==="dark"?e:"")}const l=()=>matchMedia("(prefers-color-scheme: light)").matches?"light":"dark";function t(e){StarlightThemeProvider.updatePickers(e),document.documentElement.dataset.theme=e==="auto"?l():e,n(e)}matchMedia("(prefers-color-scheme: light)").addEventListener("change",()=>{c()==="auto"&&t("auto")});class s extends HTMLElement{constructor(){super(),t(c()),this.querySelector("select")?.addEventListener("change",a=>{a.currentTarget instanceof HTMLSelectElement&&t(o(a.currentTarget.value))})}}customElements.define("starlight-theme-select",s);</script> <script type="module">class s extends HTMLElement{constructor(){super();const e=this.querySelector("select");e&&(e.addEventListener("change",t=>{t.currentTarget instanceof HTMLSelectElement&&(window.location.pathname=t.currentTarget.value)}),window.addEventListener("pageshow",t=>{if(!t.persisted)return;const n=e.querySelector("option[selected]")?.index;n!==e.selectedIndex&&(e.selectedIndex=n??0)}))}}customElements.define("starlight-lang-select",s);</script> </div> </div> </header> <nav class="sidebar print:hidden astro-vrdttmbt" aria-label="Main"> <starlight-menu-button class="print:hidden astro-jif73yzw"> <button aria-expanded="false" aria-label="Menu" aria-controls="starlight__sidebar" class="sl-flex md:sl-hidden astro-jif73yzw"> <svg aria-hidden="true" class="open-menu astro-jif73yzw astro-c6vsoqas" width="16" height="16" viewBox="0 0 24 24" fill="currentColor" style="--sl-icon-size: 1em;"><path d="M3 8h18a1 1 0 1 0 0-2H3a1 1 0 0 0 0 2Zm18 8H3a1 1 0 0 0 0 2h18a1 1 0 0 0 0-2Zm0-5H3a1 1 0 0 0 0 2h18a1 1 0 0 0 0-2Z"/></svg> <svg aria-hidden="true" class="close-menu astro-jif73yzw astro-c6vsoqas" width="16" height="16" viewBox="0 0 24 24" fill="currentColor" style="--sl-icon-size: 1em;"><path d="m13.41 12 6.3-6.29a1.004 1.004 0 1 0-1.42-1.42L12 10.59l-6.29-6.3a1.004 1.004 0 0 0-1.42 1.42l6.3 6.29-6.3 6.29a1 1 0 0 0 0 1.42.998.998 0 0 0 1.42 0l6.29-6.3 6.29 6.3a.999.999 0 0 0 1.42 0 1 1 0 0 0 0-1.42L13.41 12Z"/></svg> </button> </starlight-menu-button> <script type="module">class s extends HTMLElement{constructor(){super(),this.btn=this.querySelector("button"),this.btn.addEventListener("click",()=>this.toggleExpanded());const t=this.closest("nav");t&&t.addEventListener("keyup",e=>this.closeOnEscape(e))}setExpanded(t){this.setAttribute("aria-expanded",String(t)),document.body.toggleAttribute("data-mobile-menu-expanded",t)}toggleExpanded(){this.setExpanded(this.getAttribute("aria-expanded")!=="true")}closeOnEscape(t){t.code==="Escape"&&(this.setExpanded(!1),this.btn.focus())}}customElements.define("starlight-menu-button",s);</script> <div id="starlight__sidebar" class="sidebar-pane astro-vrdttmbt"> <div class="sidebar-content sl-flex astro-vrdttmbt"> <sl-sidebar-state-persist data-hash="01h4vp7" class="astro-kku4brbg"> <script aria-hidden="true">
|
||
(() => {
|
||
try {
|
||
if (!matchMedia('(min-width: 50em)').matches) return;
|
||
/** @type {HTMLElement | null} */
|
||
const target = document.querySelector('sl-sidebar-state-persist');
|
||
const state = JSON.parse(sessionStorage.getItem('sl-sidebar-state') || '0');
|
||
if (!target || !state || target.dataset.hash !== state.hash) return;
|
||
window._starlightScrollRestore = state.scroll;
|
||
customElements.define(
|
||
'sl-sidebar-restore',
|
||
class SidebarRestore extends HTMLElement {
|
||
connectedCallback() {
|
||
try {
|
||
const idx = parseInt(this.dataset.index || '');
|
||
const details = this.closest('details');
|
||
if (details && typeof state.open[idx] === 'boolean') details.open = state.open[idx];
|
||
} catch {}
|
||
}
|
||
}
|
||
);
|
||
} catch {}
|
||
})();
|
||
</script> <ul class="top-level astro-3ii7xxms"> <li class="astro-3ii7xxms"> <details open class="astro-3ii7xxms"> <sl-sidebar-restore data-index="0"></sl-sidebar-restore> <summary class="astro-3ii7xxms"> <span class="group-label astro-3ii7xxms"> <span class="large astro-3ii7xxms">ISPmail for Debian 13</span> </span> <svg aria-hidden="true" class="caret astro-3ii7xxms astro-c6vsoqas" width="16" height="16" viewBox="0 0 24 24" fill="currentColor" style="--sl-icon-size: 1.25rem;"><path d="m14.83 11.29-4.24-4.24a1 1 0 1 0-1.42 1.41L12.71 12l-3.54 3.54a1 1 0 0 0 0 1.41 1 1 0 0 0 .71.29 1 1 0 0 0 .71-.29l4.24-4.24a1.002 1.002 0 0 0 0-1.42Z"/></svg> </summary> <ul class="astro-3ii7xxms"> <li class="astro-3ii7xxms"> <a href="/ispmail-trixie/" aria-current="false" class="astro-3ii7xxms"> <span class="astro-3ii7xxms">Start here</span> </a> </li><li class="astro-3ii7xxms"> <a href="/ispmail-trixie/upgrading/" aria-current="false" class="astro-3ii7xxms"> <span class="astro-3ii7xxms">Upgrading from Debian Bookworm</span> </a> </li><li class="astro-3ii7xxms"> <a href="/ispmail-trixie/install-debian/" aria-current="false" class="astro-3ii7xxms"> <span class="astro-3ii7xxms">Installing Debian</span> </a> </li><li class="astro-3ii7xxms"> <a href="/ispmail-trixie/install-the-software-packages/" aria-current="false" class="astro-3ii7xxms"> <span class="astro-3ii7xxms">Install software packages</span> </a> </li><li class="astro-3ii7xxms"> <a href="/ispmail-trixie/virtual-domains/" aria-current="false" class="astro-3ii7xxms"> <span class="astro-3ii7xxms">Virtual domains</span> </a> </li><li class="astro-3ii7xxms"> <a href="/ispmail-trixie/database/" aria-current="false" class="astro-3ii7xxms"> <span class="astro-3ii7xxms">Database setup</span> </a> </li><li class="astro-3ii7xxms"> <a href="/ispmail-trixie/overview/" aria-current="false" class="astro-3ii7xxms"> <span class="astro-3ii7xxms">Big picture</span> </a> </li><li class="astro-3ii7xxms"> <a href="/ispmail-trixie/dns-records/" aria-current="false" class="astro-3ii7xxms"> <span class="astro-3ii7xxms">DNS records</span> </a> </li><li class="astro-3ii7xxms"> <a href="/ispmail-trixie/tls-certificate/" aria-current="false" class="astro-3ii7xxms"> <span class="astro-3ii7xxms">TLS certificate</span> </a> </li><li class="astro-3ii7xxms"> <a href="/ispmail-trixie/postfix/" aria-current="false" class="astro-3ii7xxms"> <span class="astro-3ii7xxms">Postfix</span> </a> </li><li class="astro-3ii7xxms"> <a href="/ispmail-trixie/dovecot/" aria-current="false" class="astro-3ii7xxms"> <span class="astro-3ii7xxms">Dovecot</span> </a> </li><li class="astro-3ii7xxms"> <a href="/ispmail-trixie/lmtp/" aria-current="false" class="astro-3ii7xxms"> <span class="astro-3ii7xxms">LMTP</span> </a> </li><li class="astro-3ii7xxms"> <a href="/ispmail-trixie/webmail/" aria-current="false" class="astro-3ii7xxms"> <span class="astro-3ii7xxms">Webmail using Roundcube</span> </a> </li><li class="astro-3ii7xxms"> <a href="/ispmail-trixie/relaying/" aria-current="page" class="astro-3ii7xxms"> <span class="astro-3ii7xxms">Sending / Relaying</span> </a> </li><li class="astro-3ii7xxms"> <a href="/ispmail-trixie/imap/" aria-current="false" class="astro-3ii7xxms"> <span class="astro-3ii7xxms">IMAP</span> </a> </li><li class="astro-3ii7xxms"> <a href="/ispmail-trixie/managing-users-aliases-and-domains/" aria-current="false" class="astro-3ii7xxms"> <span class="astro-3ii7xxms">Managing users, aliases and domains</span> </a> </li><li class="astro-3ii7xxms"> <a href="/ispmail-trixie/catching-spam-with-rspamd/" aria-current="false" class="astro-3ii7xxms"> <span class="astro-3ii7xxms">Catching spam with rspamd</span> </a> </li><li class="astro-3ii7xxms"> <a href="/ispmail-trixie/anti-spoofing-dkim-spf/" aria-current="false" class="astro-3ii7xxms"> <span class="astro-3ii7xxms">Prevent spoofing using DKIM and SPF</span> </a> </li><li class="astro-3ii7xxms"> <a href="/ispmail-trixie/catch-all/" aria-current="false" class="astro-3ii7xxms"> <span class="astro-3ii7xxms">Catch-all addresses</span> </a> </li><li class="astro-3ii7xxms"> <a href="/ispmail-trixie/quotas/" aria-current="false" class="astro-3ii7xxms"> <span class="astro-3ii7xxms">Quotas</span> </a> </li><li class="astro-3ii7xxms"> <a href="/ispmail-trixie/going-live/" aria-current="false" class="astro-3ii7xxms"> <span class="astro-3ii7xxms">Going live</span> </a> </li><li class="astro-3ii7xxms"> <a href="/ispmail-trixie/automated-installation/" aria-current="false" class="astro-3ii7xxms"> <span class="astro-3ii7xxms">Automated installation</span> </a> </li> </ul> </details> </li><li class="astro-3ii7xxms"> <details open class="astro-3ii7xxms"> <sl-sidebar-restore data-index="1"></sl-sidebar-restore> <summary class="astro-3ii7xxms"> <span class="group-label astro-3ii7xxms"> <span class="large astro-3ii7xxms">ISPmail for Debian 12</span> </span> <svg aria-hidden="true" class="caret astro-3ii7xxms astro-c6vsoqas" width="16" height="16" viewBox="0 0 24 24" fill="currentColor" style="--sl-icon-size: 1.25rem;"><path d="m14.83 11.29-4.24-4.24a1 1 0 1 0-1.42 1.41L12.71 12l-3.54 3.54a1 1 0 0 0 0 1.41 1 1 0 0 0 .71.29 1 1 0 0 0 .71-.29l4.24-4.24a1.002 1.002 0 0 0 0-1.42Z"/></svg> </summary> <ul class="astro-3ii7xxms"> <li class="astro-3ii7xxms"> <a href="/ispmail-bookworm/" aria-current="false" class="astro-3ii7xxms"> <span class="astro-3ii7xxms">Start here</span> </a> </li><li class="astro-3ii7xxms"> <a href="/ispmail-bookworm/whats-new/" aria-current="false" class="astro-3ii7xxms"> <span class="astro-3ii7xxms">What's new</span> </a> </li><li class="astro-3ii7xxms"> <a href="/ispmail-bookworm/migrating-from-a-bullseye-to-a-bookworm-server/" aria-current="false" class="astro-3ii7xxms"> <span class="astro-3ii7xxms">Migrating from your old (Bullseye) server</span> </a> </li><li class="astro-3ii7xxms"> <a href="/ispmail-bookworm/big-picture/" aria-current="false" class="astro-3ii7xxms"> <span class="astro-3ii7xxms">The big picture</span> </a> </li><li class="astro-3ii7xxms"> <a href="/ispmail-bookworm/types-of-email-domains/" aria-current="false" class="astro-3ii7xxms"> <span class="astro-3ii7xxms">Types of email domains</span> </a> </li><li class="astro-3ii7xxms"> <a href="/ispmail-bookworm/install-debian-bookworm-on-your-server/" aria-current="false" class="astro-3ii7xxms"> <span class="astro-3ii7xxms">Installing Debian</span> </a> </li><li class="astro-3ii7xxms"> <a href="/ispmail-bookworm/install-the-software-packages/" aria-current="false" class="astro-3ii7xxms"> <span class="astro-3ii7xxms">Install software packages</span> </a> </li><li class="astro-3ii7xxms"> <a href="/ispmail-bookworm/creating-a-tls-encryption-key-and-certificate/" aria-current="false" class="astro-3ii7xxms"> <span class="astro-3ii7xxms">TLS certificate</span> </a> </li><li class="astro-3ii7xxms"> <a href="/ispmail-bookworm/prepare-the-database/" aria-current="false" class="astro-3ii7xxms"> <span class="astro-3ii7xxms">Preparing the database</span> </a> </li><li class="astro-3ii7xxms"> <a href="/ispmail-bookworm/making-postfix-get-its-information-from-the-mariadb-database/" aria-current="false" class="astro-3ii7xxms"> <span class="astro-3ii7xxms">Let Postfix access MariaDB</span> </a> </li><li class="astro-3ii7xxms"> <a href="/ispmail-bookworm/catchall-aliases/" aria-current="false" class="astro-3ii7xxms"> <span class="astro-3ii7xxms">Catch-all aliases</span> </a> </li><li class="astro-3ii7xxms"> <a href="/ispmail-bookworm/setting-up-dovecot/" aria-current="false" class="astro-3ii7xxms"> <span class="astro-3ii7xxms">Setting up Dovecot</span> </a> </li><li class="astro-3ii7xxms"> <a href="/ispmail-bookworm/let-postfix-send-emails-to-dovecot/" aria-current="false" class="astro-3ii7xxms"> <span class="astro-3ii7xxms">Let Postfix send emails to Dovecot</span> </a> </li><li class="astro-3ii7xxms"> <a href="/ispmail-bookworm/quotas/" aria-current="false" class="astro-3ii7xxms"> <span class="astro-3ii7xxms">Quotas</span> </a> </li><li class="astro-3ii7xxms"> <a href="/ispmail-bookworm/testing-imap/" aria-current="false" class="astro-3ii7xxms"> <span class="astro-3ii7xxms">Testing IMAP</span> </a> </li><li class="astro-3ii7xxms"> <a href="/ispmail-bookworm/webmail-using-roundcube/" aria-current="false" class="astro-3ii7xxms"> <span class="astro-3ii7xxms">Webmail using Roundcube</span> </a> </li><li class="astro-3ii7xxms"> <a href="/ispmail-bookworm/testing-email-delivery/" aria-current="false" class="astro-3ii7xxms"> <span class="astro-3ii7xxms">Testing email delivery</span> </a> </li><li class="astro-3ii7xxms"> <a href="/ispmail-bookworm/relaying-outgoing-emails-through-postfix/" aria-current="false" class="astro-3ii7xxms"> <span class="astro-3ii7xxms">Relaying outgoing emails through Postfix</span> </a> </li><li class="astro-3ii7xxms"> <a href="/ispmail-bookworm/catching-spam-with-rspamd/" aria-current="false" class="astro-3ii7xxms"> <span class="astro-3ii7xxms">Catching spam with rspamd</span> </a> </li><li class="astro-3ii7xxms"> <a href="/ispmail-bookworm/setting-dns-records/" aria-current="false" class="astro-3ii7xxms"> <span class="astro-3ii7xxms">Setting DNS records</span> </a> </li><li class="astro-3ii7xxms"> <a href="/ispmail-bookworm/prevent-spoofing-using-dkim/" aria-current="false" class="astro-3ii7xxms"> <span class="astro-3ii7xxms">Prevent spoofing using DKIM</span> </a> </li><li class="astro-3ii7xxms"> <a href="/ispmail-bookworm/managing-users-aliases-and-domains/" aria-current="false" class="astro-3ii7xxms"> <span class="astro-3ii7xxms">Managing users, aliases and domains</span> </a> </li><li class="astro-3ii7xxms"> <a href="/ispmail-bookworm/monitoring-and-backup/" aria-current="false" class="astro-3ii7xxms"> <span class="astro-3ii7xxms">Monitoring and Backup</span> </a> </li><li class="astro-3ii7xxms"> <a href="/ispmail-bookworm/automatic-installation-with-ansible/" aria-current="false" class="astro-3ii7xxms"> <span class="astro-3ii7xxms">Automatic installation with Ansible</span> </a> </li><li class="astro-3ii7xxms"> <a href="/ispmail-bookworm/success-stories/" aria-current="false" class="astro-3ii7xxms"> <span class="astro-3ii7xxms">Success stories</span> </a> </li><li class="astro-3ii7xxms"> <a href="/ispmail-bookworm/faq-frequently-asked-questions/" aria-current="false" class="astro-3ii7xxms"> <span class="astro-3ii7xxms">FAQ (frequently asked questions)</span> </a> </li> </ul> </details> </li><li class="astro-3ii7xxms"> <details open class="astro-3ii7xxms"> <sl-sidebar-restore data-index="2"></sl-sidebar-restore> <summary class="astro-3ii7xxms"> <span class="group-label astro-3ii7xxms"> <span class="large astro-3ii7xxms">Misc articles</span> </span> <svg aria-hidden="true" class="caret astro-3ii7xxms astro-c6vsoqas" width="16" height="16" viewBox="0 0 24 24" fill="currentColor" style="--sl-icon-size: 1.25rem;"><path d="m14.83 11.29-4.24-4.24a1 1 0 1 0-1.42 1.41L12.71 12l-3.54 3.54a1 1 0 0 0 0 1.41 1 1 0 0 0 .71.29 1 1 0 0 0 .71-.29l4.24-4.24a1.002 1.002 0 0 0 0-1.42Z"/></svg> </summary> <ul class="astro-3ii7xxms"> <li class="astro-3ii7xxms"> <a href="/article/updating-the-bios-on-lenovo-laptops-from-linux-using-a-usb-flash-stick/" aria-current="false" class="astro-3ii7xxms"> <span class="astro-3ii7xxms">Updating the BIOS on Lenovo laptops from Linux using a USB flash stick</span> </a> </li><li class="astro-3ii7xxms"> <a href="/bacula-cheatsheet/" aria-current="false" class="astro-3ii7xxms"> <span class="astro-3ii7xxms">Bareos/Bacula Cheat Sheet</span> </a> </li><li class="astro-3ii7xxms"> <a href="/debian-packages-are-so-old/" aria-current="false" class="astro-3ii7xxms"> <span class="astro-3ii7xxms">Debian packages are so old</span> </a> </li><li class="astro-3ii7xxms"> <a href="/getting-help-on-irc/" aria-current="false" class="astro-3ii7xxms"> <span class="astro-3ii7xxms">Getting help on IRC</span> </a> </li><li class="astro-3ii7xxms"> <a href="/linux/renaming-multiple-files/" aria-current="false" class="astro-3ii7xxms"> <span class="astro-3ii7xxms">Renaming multiple files</span> </a> </li><li class="astro-3ii7xxms"> <a href="/linuxtip/pipes/" aria-current="false" class="astro-3ii7xxms"> <span class="astro-3ii7xxms">Pipes and redirection</span> </a> </li><li class="astro-3ii7xxms"> <a href="/rsnapshot-and-usb-drives/" aria-current="false" class="astro-3ii7xxms"> <span class="astro-3ii7xxms">Backups with rsnaphot to external USB drives</span> </a> </li><li class="astro-3ii7xxms"> <a href="/squid-acls/" aria-current="false" class="astro-3ii7xxms"> <span class="astro-3ii7xxms">How Squid ACLs work</span> </a> </li><li class="astro-3ii7xxms"> <a href="/understanding-lvm/" aria-current="false" class="astro-3ii7xxms"> <span class="astro-3ii7xxms">Understanding the Logical Volume Manager (LVM)</span> </a> </li> </ul> </details> </li> </ul> <script aria-hidden="true">
|
||
(() => {
|
||
const scroller = document.getElementById('starlight__sidebar');
|
||
if (!window._starlightScrollRestore || !scroller) return;
|
||
scroller.scrollTop = window._starlightScrollRestore;
|
||
delete window._starlightScrollRestore;
|
||
})();
|
||
</script> </sl-sidebar-state-persist> <div class="md:sl-hidden"> <div class="mobile-preferences sl-flex astro-wu23bvmt"> <div class="social-icons astro-wu23bvmt"> <a href="https://git.workaround.org/chaas/ispmail-workaround-org" rel="me" class="sl-flex astro-wy4te6ga"><span class="sr-only astro-wy4te6ga">Git</span><svg aria-hidden="true" class="astro-wy4te6ga astro-c6vsoqas" width="16" height="16" viewBox="0 0 24 24" fill="currentColor" style="--sl-icon-size: 1em;"><path d="M0.355 12.231L0.355 12.231L0.355 11.853Q0.397 11.517 0.565 11.265L0.565 11.265Q0.691 11.097 0.943 10.803L0.943 10.803L1.279 10.425L7.831 3.831L7.873 3.873Q7.957 3.873 7.957 3.957L7.957 3.957L10.309 6.351Q10.519 6.519 10.309 6.729L10.309 6.729Q10.225 7.317 10.435 7.863Q10.645 8.409 11.107 8.703L11.107 8.703Q11.275 8.787 11.317 8.892Q11.359 8.997 11.359 9.207L11.359 9.207L11.359 15.003Q11.359 15.255 11.107 15.507L11.107 15.507Q10.603 15.843 10.372 16.389Q10.141 16.935 10.330 17.502Q10.519 18.069 10.981 18.447Q11.443 18.825 12.031 18.825Q12.619 18.825 13.081 18.489Q13.543 18.153 13.732 17.586Q13.921 17.019 13.753 16.473Q13.585 15.927 13.081 15.507L13.081 15.507Q12.913 15.423 12.871 15.318Q12.829 15.213 12.829 15.003L12.829 15.003L12.829 9.081L12.955 9.081L15.055 11.181Q15.139 11.265 15.139 11.391L15.139 11.391L15.181 11.475L15.181 12.231Q15.265 13.029 15.874 13.470Q16.483 13.911 17.281 13.806Q18.079 13.701 18.562 13.029Q19.045 12.357 18.835 11.601L18.835 11.601Q18.751 10.929 18.100 10.488Q17.449 10.047 16.735 10.131L16.735 10.131Q16.483 10.131 16.231 10.005L16.231 10.005L14.005 7.779Q13.879 7.653 13.879 7.401L13.879 7.401Q14.005 6.813 13.711 6.267Q13.417 5.721 12.871 5.448Q12.325 5.175 11.779 5.301L11.779 5.301Q11.359 5.301 11.359 5.175L11.359 5.175Q9.805 3.579 9.007 2.907L9.007 2.907Q8.797 2.739 9.007 2.529L9.007 2.529Q9.469 2.193 10.183 1.353L10.183 1.353L10.729 0.807Q11.905-0.369 13.081 0.807L13.081 0.807L23.035 10.803Q24.253 11.979 23.035 13.155L23.035 13.155L13.291 22.941Q12.913 23.319 12.745 23.445L12.745 23.445Q12.409 23.739 12.031 23.781L12.031 23.781L11.779 23.781L11.569 23.697Q11.065 23.487 10.855 23.277L10.855 23.277L10.057 22.479Q8.881 21.387 8.335 20.757L8.335 20.757L1.153 13.575Q1.069 13.365 0.775 13.029L0.775 13.029Q0.397 12.525 0.355 12.231Z"/></svg></a><a href="https://riot.im/app/#/room/#ispmail:matrix.org" rel="me" class="sl-flex astro-wy4te6ga"><span class="sr-only astro-wy4te6ga">Matrix</span><svg aria-hidden="true" class="astro-wy4te6ga astro-c6vsoqas" width="16" height="16" viewBox="0 0 24 24" fill="currentColor" style="--sl-icon-size: 1em;"><path d="M22.5 1.5v21h-2.25V24H24V0h-3.75v1.5h2.25ZM7.46 7.95V9.1h.04a3.02 3.02 0 0 1 2.61-1.39c.54 0 1.03.1 1.48.32.44.2.78.58 1.01 1.1.26-.37.6-.7 1.03-.99.44-.28.95-.43 1.55-.43.45 0 .87.06 1.26.17.38.11.71.29.99.53.27.24.49.56.64.95.15.4.23.86.23 1.42v5.72h-2.34v-4.85c0-.29-.01-.56-.04-.8a1.73 1.73 0 0 0-.18-.67 1.1 1.1 0 0 0-.44-.45 1.6 1.6 0 0 0-.78-.16c-.33 0-.6.06-.8.19-.2.12-.37.29-.48.5a2 2 0 0 0-.23.69c-.04.26-.06.52-.06.78v4.77H10.6v-4.8l-.01-.75a2.29 2.29 0 0 0-.14-.69c-.08-.2-.23-.38-.42-.5a1.5 1.5 0 0 0-.85-.2c-.15.01-.3.04-.44.08-.19.06-.37.15-.52.28-.18.14-.32.34-.44.6-.12.26-.18.6-.18 1.02v4.96H5.25V7.94h2.21ZM1.5 1.5v21h2.25V24H0V0h3.75v1.5H1.5Z"/></svg></a><a href="https://comentario.workaround.org/api/rss/comments?domain=0f111a27-fbfa-48af-8beb-ab12e612d92f" rel="me" class="sl-flex astro-wy4te6ga"><span class="sr-only astro-wy4te6ga">Feed</span><svg aria-hidden="true" class="astro-wy4te6ga astro-c6vsoqas" width="16" height="16" viewBox="0 0 24 24" fill="currentColor" style="--sl-icon-size: 1em;"><path d="M2.88 16.88a3 3 0 0 0 0 4.24 3 3 0 0 0 4.24 0 3 3 0 0 0-4.24-4.24Zm2.83 2.83a1 1 0 0 1-1.42-1.42 1 1 0 0 1 1.42 0 1 1 0 0 1 0 1.42ZM5 12a1 1 0 0 0 0 2 5 5 0 0 1 5 5 1 1 0 0 0 2 0 7 7 0 0 0-7-7Zm0-4a1 1 0 0 0 0 2 9 9 0 0 1 9 9 1 1 0 0 0 2 0 11.08 11.08 0 0 0-3.22-7.78A11.08 11.08 0 0 0 5 8Zm10.61.39A15.11 15.11 0 0 0 5 4a1 1 0 0 0 0 2 13 13 0 0 1 13 13 1 1 0 0 0 2 0 15.11 15.11 0 0 0-4.39-10.61Z"/></svg></a> </div> <starlight-theme-select> <label style="--sl-select-width: 6.25em" class="astro-4yphtoen"> <span class="sr-only astro-4yphtoen">Select theme</span> <svg aria-hidden="true" class="icon label-icon astro-4yphtoen astro-c6vsoqas" width="16" height="16" viewBox="0 0 24 24" fill="currentColor" style="--sl-icon-size: 1em;"><path d="M21 14h-1V7a3 3 0 0 0-3-3H7a3 3 0 0 0-3 3v7H3a1 1 0 0 0-1 1v2a3 3 0 0 0 3 3h14a3 3 0 0 0 3-3v-2a1 1 0 0 0-1-1ZM6 7a1 1 0 0 1 1-1h10a1 1 0 0 1 1 1v7H6V7Zm14 10a1 1 0 0 1-1 1H5a1 1 0 0 1-1-1v-1h16v1Z"/></svg> <select autocomplete="off" class="astro-4yphtoen"> <option value="dark" class="astro-4yphtoen">Dark</option><option value="light" class="astro-4yphtoen">Light</option><option value="auto" selected class="astro-4yphtoen">Auto</option> </select> <svg aria-hidden="true" class="icon caret astro-4yphtoen astro-c6vsoqas" width="16" height="16" viewBox="0 0 24 24" fill="currentColor" style="--sl-icon-size: 1em;"><path d="M17 9.17a1 1 0 0 0-1.41 0L12 12.71 8.46 9.17a1 1 0 1 0-1.41 1.42l4.24 4.24a1.002 1.002 0 0 0 1.42 0L17 10.59a1.002 1.002 0 0 0 0-1.42Z"/></svg> </label> </starlight-theme-select> <script>
|
||
StarlightThemeProvider.updatePickers();
|
||
</script> </div> </div> </div> </div> </nav> <div class="main-frame astro-vrdttmbt"> <script type="module">const a=document.getElementById("starlight__sidebar"),n=a?.querySelector("sl-sidebar-state-persist"),o="sl-sidebar-state",i=()=>{let t=[];const e=n?.dataset.hash||"";try{const s=sessionStorage.getItem(o),r=JSON.parse(s||"{}");Array.isArray(r.open)&&r.hash===e&&(t=r.open)}catch{}return{hash:e,open:t,scroll:a?.scrollTop||0}},c=t=>{try{sessionStorage.setItem(o,JSON.stringify(t))}catch{}},d=()=>c(i()),l=(t,e)=>{const s=i();s.open[e]=t,c(s)};n?.addEventListener("click",t=>{if(!(t.target instanceof Element))return;const e=t.target.closest("summary")?.closest("details");if(!e)return;const s=e.querySelector("sl-sidebar-restore"),r=parseInt(s?.dataset.index||"");isNaN(r)||l(!e.open,r)});addEventListener("visibilitychange",()=>{document.visibilityState==="hidden"&&d()});addEventListener("pageHide",d);</script> <div class="lg:sl-flex astro-67yu43on"> <aside class="right-sidebar-container print:hidden astro-67yu43on"> <div class="right-sidebar astro-67yu43on"> <div class="lg:sl-hidden astro-pb3aqygn"><mobile-starlight-toc data-min-h="2" data-max-h="3" class="astro-doynk5tl"><nav aria-labelledby="starlight__on-this-page--mobile" class="astro-doynk5tl"><details id="starlight__mobile-toc" class="astro-doynk5tl"><summary id="starlight__on-this-page--mobile" class="sl-flex astro-doynk5tl"><span class="toggle sl-flex astro-doynk5tl">On this page<svg aria-hidden="true" class="caret astro-doynk5tl astro-c6vsoqas" width="16" height="16" viewBox="0 0 24 24" fill="currentColor" style="--sl-icon-size: 1rem;"><path d="m14.83 11.29-4.24-4.24a1 1 0 1 0-1.42 1.41L12.71 12l-3.54 3.54a1 1 0 0 0 0 1.41 1 1 0 0 0 .71.29 1 1 0 0 0 .71-.29l4.24-4.24a1.002 1.002 0 0 0 0-1.42Z"/></svg></span><span class="display-current astro-doynk5tl"></span></summary><div class="dropdown astro-doynk5tl"><ul class="isMobile astro-g2bywc46" style="--depth: 0;"> <li class="astro-g2bywc46" style="--depth: 0;"> <a href="#_top" class="astro-g2bywc46" style="--depth: 0;"> <span class="astro-g2bywc46" style="--depth: 0;">Overview</span> </a> </li><li class="astro-g2bywc46" style="--depth: 0;"> <a href="#smtp-versus-submission" class="astro-g2bywc46" style="--depth: 0;"> <span class="astro-g2bywc46" style="--depth: 0;">SMTP versus Submission</span> </a> </li><li class="astro-g2bywc46" style="--depth: 0;"> <a href="#configure-the-submissions-services" class="astro-g2bywc46" style="--depth: 0;"> <span class="astro-g2bywc46" style="--depth: 0;">Configure the submission[s] services</span> </a> </li><li class="astro-g2bywc46" style="--depth: 0;"> <a href="#set-up-encryption" class="astro-g2bywc46" style="--depth: 0;"> <span class="astro-g2bywc46" style="--depth: 0;">Set up encryption</span> </a> </li><li class="astro-g2bywc46" style="--depth: 0;"> <a href="#protecting-against-forged-sender-addresses" class="astro-g2bywc46" style="--depth: 0;"> <span class="astro-g2bywc46" style="--depth: 0;">Protecting against forged sender addresses</span> </a> </li><li class="astro-g2bywc46" style="--depth: 0;"> <a href="#test-it" class="astro-g2bywc46" style="--depth: 0;"> <span class="astro-g2bywc46" style="--depth: 0;">Test it</span> </a> <ul class="isMobile astro-g2bywc46" style="--depth: 1;"> <li class="astro-g2bywc46" style="--depth: 1;"> <a href="#no-encryption-no-authentication" class="astro-g2bywc46" style="--depth: 1;"> <span class="astro-g2bywc46" style="--depth: 1;">No encryption, no authentication</span> </a> </li><li class="astro-g2bywc46" style="--depth: 1;"> <a href="#with-encryption-no-authentication" class="astro-g2bywc46" style="--depth: 1;"> <span class="astro-g2bywc46" style="--depth: 1;">With encryption, no authentication</span> </a> </li><li class="astro-g2bywc46" style="--depth: 1;"> <a href="#with-encryption-and-authentication" class="astro-g2bywc46" style="--depth: 1;"> <span class="astro-g2bywc46" style="--depth: 1;">With encryption and authentication</span> </a> </li> </ul> </li><li class="astro-g2bywc46" style="--depth: 0;"> <a href="#gory-details-of-authentication" class="astro-g2bywc46" style="--depth: 0;"> <span class="astro-g2bywc46" style="--depth: 0;">Gory details of authentication</span> </a> </li><li class="astro-g2bywc46" style="--depth: 0;"> <a href="#footnote-label" class="astro-g2bywc46" style="--depth: 0;"> <span class="astro-g2bywc46" style="--depth: 0;">Footnotes</span> </a> </li> </ul> </div></details></nav></mobile-starlight-toc><script type="module" src="/_astro/MobileTableOfContents.astro_astro_type_script_index_0_lang.C181hMzK.js"></script></div><div class="right-sidebar-panel sl-hidden lg:sl-block astro-pb3aqygn"><div class="sl-container astro-pb3aqygn"><starlight-toc data-min-h="2" data-max-h="3"><nav aria-labelledby="starlight__on-this-page"><h2 id="starlight__on-this-page">On this page</h2><ul class="astro-g2bywc46" style="--depth: 0;"> <li class="astro-g2bywc46" style="--depth: 0;"> <a href="#_top" class="astro-g2bywc46" style="--depth: 0;"> <span class="astro-g2bywc46" style="--depth: 0;">Overview</span> </a> </li><li class="astro-g2bywc46" style="--depth: 0;"> <a href="#smtp-versus-submission" class="astro-g2bywc46" style="--depth: 0;"> <span class="astro-g2bywc46" style="--depth: 0;">SMTP versus Submission</span> </a> </li><li class="astro-g2bywc46" style="--depth: 0;"> <a href="#configure-the-submissions-services" class="astro-g2bywc46" style="--depth: 0;"> <span class="astro-g2bywc46" style="--depth: 0;">Configure the submission[s] services</span> </a> </li><li class="astro-g2bywc46" style="--depth: 0;"> <a href="#set-up-encryption" class="astro-g2bywc46" style="--depth: 0;"> <span class="astro-g2bywc46" style="--depth: 0;">Set up encryption</span> </a> </li><li class="astro-g2bywc46" style="--depth: 0;"> <a href="#protecting-against-forged-sender-addresses" class="astro-g2bywc46" style="--depth: 0;"> <span class="astro-g2bywc46" style="--depth: 0;">Protecting against forged sender addresses</span> </a> </li><li class="astro-g2bywc46" style="--depth: 0;"> <a href="#test-it" class="astro-g2bywc46" style="--depth: 0;"> <span class="astro-g2bywc46" style="--depth: 0;">Test it</span> </a> <ul class="astro-g2bywc46" style="--depth: 1;"> <li class="astro-g2bywc46" style="--depth: 1;"> <a href="#no-encryption-no-authentication" class="astro-g2bywc46" style="--depth: 1;"> <span class="astro-g2bywc46" style="--depth: 1;">No encryption, no authentication</span> </a> </li><li class="astro-g2bywc46" style="--depth: 1;"> <a href="#with-encryption-no-authentication" class="astro-g2bywc46" style="--depth: 1;"> <span class="astro-g2bywc46" style="--depth: 1;">With encryption, no authentication</span> </a> </li><li class="astro-g2bywc46" style="--depth: 1;"> <a href="#with-encryption-and-authentication" class="astro-g2bywc46" style="--depth: 1;"> <span class="astro-g2bywc46" style="--depth: 1;">With encryption and authentication</span> </a> </li> </ul> </li><li class="astro-g2bywc46" style="--depth: 0;"> <a href="#gory-details-of-authentication" class="astro-g2bywc46" style="--depth: 0;"> <span class="astro-g2bywc46" style="--depth: 0;">Gory details of authentication</span> </a> </li><li class="astro-g2bywc46" style="--depth: 0;"> <a href="#footnote-label" class="astro-g2bywc46" style="--depth: 0;"> <span class="astro-g2bywc46" style="--depth: 0;">Footnotes</span> </a> </li> </ul> </nav></starlight-toc><script type="module" src="/_astro/TableOfContents.astro_astro_type_script_index_0_lang.CKWWgpjV.js"></script></div></div> </div> </aside> <div class="main-pane astro-67yu43on"> <main data-pagefind-body class="astro-bguv2lll" lang="en" dir="ltr"> <div class="content-panel astro-7nkwcw3z"> <div class="sl-container astro-7nkwcw3z"> <h1 id="_top" class="astro-j6tvhyss">Sending / Relaying</h1> </div> </div> <div class="content-panel astro-7nkwcw3z"> <div class="sl-container astro-7nkwcw3z"> <div class="sl-markdown-content"> <p>Your mail server is almost ready for use. But one puzzle piece is missing. Your users can receive emails but they cannot
|
||
send them yet. This part of the guide is a bit longer than others because forwarding emails has security implications.</p>
|
||
<p>Let’s begin with the difference of how <strong>users</strong> send emails versus how <strong>mail servers</strong> send emails.</p>
|
||
<ul>
|
||
<li>A <strong>mail server</strong> fetches the <em>MX</em> record for the destination domain of the recipient’s email address from DNS. That
|
||
tells it which mail server to talk to. Then it opens an SMTP connection (TCP port 25) and sends the email. A mail
|
||
server will not relay an email meant for someone else. It will only accept emails for its own users.</li>
|
||
<li>An <strong>end user</strong> with a mail client such as Thunderbird or Roundcube cannot do that. Mail clients do not include any
|
||
functionality for fetching MX records. In addition, the user is usually on a dynamic IP address that other mail
|
||
servers will not trust and will likely reject. Instead, end users are expected to send their emails through their
|
||
provider’s (=your) mail server: they authenticate with their login credentials and then send the message. This process
|
||
is called relaying, because your mail server acts as an intermediary between the user and other mail servers on the
|
||
internet. For security reasons, authentication is required before the user is allowed to send emails. Users are also
|
||
expected to use the TCP port 587 which is called the <em>submission</em> port. More on that later.</li>
|
||
</ul>
|
||
<p>Postfix must only accept an email <strong>from a user</strong>, if…</p>
|
||
<ul>
|
||
<li>The user uses the <strong>submission</strong> port (and not the standard SMTP port)</li>
|
||
<li>The user <strong>authenticates</strong> with the username (in our setup: the email address) and the password</li>
|
||
<li>The connection is <strong>encrypted</strong> so that the password can be safely transmitted</li>
|
||
<li>The <strong>sender address</strong> of the email matches the user’s account</li>
|
||
</ul>
|
||
<div class="sl-heading-wrapper level-h2"><h2 id="smtp-versus-submission">SMTP versus Submission</h2><a class="sl-anchor-link" href="#smtp-versus-submission"><span aria-hidden="true" class="sl-anchor-icon"><svg width="16" height="16" viewBox="0 0 24 24"><path fill="currentcolor" d="m12.11 15.39-3.88 3.88a2.52 2.52 0 0 1-3.5 0 2.47 2.47 0 0 1 0-3.5l3.88-3.88a1 1 0 0 0-1.42-1.42l-3.88 3.89a4.48 4.48 0 0 0 6.33 6.33l3.89-3.88a1 1 0 1 0-1.42-1.42Zm8.58-12.08a4.49 4.49 0 0 0-6.33 0l-3.89 3.88a1 1 0 0 0 1.42 1.42l3.88-3.88a2.52 2.52 0 0 1 3.5 0 2.47 2.47 0 0 1 0 3.5l-3.88 3.88a1 1 0 1 0 1.42 1.42l3.88-3.89a4.49 4.49 0 0 0 0-6.33ZM8.83 15.17a1 1 0 0 0 1.1.22 1 1 0 0 0 .32-.22l4.92-4.92a1 1 0 0 0-1.42-1.42l-4.92 4.92a1 1 0 0 0 0 1.42Z"></path></svg></span><span class="sr-only">Section titled “SMTP versus Submission”</span></a></div>
|
||
<p>Let’s compare those services and ports side-by-side:</p>
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
<table><thead><tr><th>Service name</th><th>SMTP</th><th>Submission</th><th>SubmissionS (S=secure)</th></tr></thead><tbody><tr><td>TCP Port</td><td>25</td><td>587</td><td>465</td></tr><tr><td>Meant for</td><td>Other mail servers</td><td>Our users</td><td>Our users</td></tr><tr><td>Used by</td><td>Mail transport agent (MTA)</td><td>Mail user agent (MUA)</td><td>Mail user agent (MUA)</td></tr><tr><td>Transport encryption</td><td><strong>Off</strong>. STARTTLS optional.</td><td><strong>Off</strong>. STARTTLS mandatory.</td><td>TLS all the time</td></tr><tr><td>Authentication</td><td>Optional <sup><a href="#user-content-fn-1" id="user-content-fnref-1" data-footnote-ref="" aria-describedby="footnote-label">1</a></sup></td><td>Mandatory</td><td>Mandatory</td></tr><tr><td>Accepted sender</td><td>Anyone</td><td>Our own users</td><td>Our own users</td></tr><tr><td>Accepted receivers</td><td>Our own users</td><td>Anyone</td><td>Anyone</td></tr><tr><td>Your home ISP</td><td>may block this port</td><td>will allow this port</td><td>will allow this port</td></tr></tbody></table>
|
||
<p>I hope this helps clarify the distinction. Human users must use the submission service on either port 587 or 465. The
|
||
key difference is that connections on port 587 start unencrypted, and the email client must issue the STARTTLS command
|
||
to enable encryption. In contrast, port 465 requires the email client to use TLS encryption right from the first byte of
|
||
communication.</p>
|
||
<div class="sl-heading-wrapper level-h2"><h2 id="configure-the-submissions-services">Configure the submission[s] services</h2><a class="sl-anchor-link" href="#configure-the-submissions-services"><span aria-hidden="true" class="sl-anchor-icon"><svg width="16" height="16" viewBox="0 0 24 24"><path fill="currentcolor" d="m12.11 15.39-3.88 3.88a2.52 2.52 0 0 1-3.5 0 2.47 2.47 0 0 1 0-3.5l3.88-3.88a1 1 0 0 0-1.42-1.42l-3.88 3.89a4.48 4.48 0 0 0 6.33 6.33l3.89-3.88a1 1 0 1 0-1.42-1.42Zm8.58-12.08a4.49 4.49 0 0 0-6.33 0l-3.89 3.88a1 1 0 0 0 1.42 1.42l3.88-3.88a2.52 2.52 0 0 1 3.5 0 2.47 2.47 0 0 1 0 3.5l-3.88 3.88a1 1 0 1 0 1.42 1.42l3.88-3.89a4.49 4.49 0 0 0 0-6.33ZM8.83 15.17a1 1 0 0 0 1.1.22 1 1 0 0 0 .32-.22l4.92-4.92a1 1 0 0 0-1.42-1.42l-4.92 4.92a1 1 0 0 0 0 1.42Z"></path></svg></span><span class="sr-only">Section titled “Configure the submission[s] services”</span></a></div>
|
||
<p>All Postfix services are declared in the <code dir="auto">/etc/postfix/master.cf</code> file. Most of them are used by Postfix internally,
|
||
like <code dir="auto">pickup</code>, <code dir="auto">cleanup</code>, <code dir="auto">rewrite</code> or <code dir="auto">bounce</code>. But <code dir="auto">submission</code> is not configured by default. Let’s fix that.</p>
|
||
<div class="expressive-code"><link rel="stylesheet" href="/_astro/ec.v4551.css"><script type="module" src="/_astro/ec.0vx5m.js"></script><figure class="frame is-terminal has-title not-content"><figcaption class="header"><span class="title">Run this on your server</span></figcaption><pre data-language="sh"><code><div class="ec-line"><div class="code"><span style="--0:#82AAFF;--1:#3B61B0">postconf</span><span style="--0:#D6DEEB;--1:#403F53"> </span><span style="--0:#82AAFF;--1:#3B61B0">-M</span><span style="--0:#D6DEEB;--1:#403F53"> </span><span style="--0:#ECC48D;--1:#3B61B0">submission/inet=</span><span style="--0:#D9F5DD;--1:#111111">"</span><span style="--0:#ECC48D;--1:#984E4D">submission inet n - y - - smtpd</span><span style="--0:#D9F5DD;--1:#111111">"</span></div></div><div class="ec-line"><div class="code"><span style="--0:#82AAFF;--1:#3B61B0">postconf</span><span style="--0:#D6DEEB;--1:#403F53"> </span><span style="--0:#82AAFF;--1:#3B61B0">-P</span><span style="--0:#D6DEEB;--1:#403F53"> </span><span style="--0:#D9F5DD;--1:#111111">"</span><span style="--0:#ECC48D;--1:#984E4D">submission/inet/syslog_name=postfix/submission</span><span style="--0:#D9F5DD;--1:#111111">"</span></div></div><div class="ec-line"><div class="code"><span style="--0:#82AAFF;--1:#3B61B0">postconf</span><span style="--0:#D6DEEB;--1:#403F53"> </span><span style="--0:#82AAFF;--1:#3B61B0">-P</span><span style="--0:#D6DEEB;--1:#403F53"> </span><span style="--0:#D9F5DD;--1:#111111">"</span><span style="--0:#ECC48D;--1:#984E4D">submission/inet/smtpd_tls_security_level=encrypt</span><span style="--0:#D9F5DD;--1:#111111">"</span></div></div><div class="ec-line"><div class="code"><span style="--0:#82AAFF;--1:#3B61B0">postconf</span><span style="--0:#D6DEEB;--1:#403F53"> </span><span style="--0:#82AAFF;--1:#3B61B0">-P</span><span style="--0:#D6DEEB;--1:#403F53"> </span><span style="--0:#D9F5DD;--1:#111111">"</span><span style="--0:#ECC48D;--1:#984E4D">submission/inet/smtpd_sasl_auth_enable=yes</span><span style="--0:#D9F5DD;--1:#111111">"</span></div></div><div class="ec-line"><div class="code"><span style="--0:#82AAFF;--1:#3B61B0">postconf</span><span style="--0:#D6DEEB;--1:#403F53"> </span><span style="--0:#82AAFF;--1:#3B61B0">-P</span><span style="--0:#D6DEEB;--1:#403F53"> </span><span style="--0:#D9F5DD;--1:#111111">"</span><span style="--0:#ECC48D;--1:#984E4D">submission/inet/smtpd_sasl_type=dovecot</span><span style="--0:#D9F5DD;--1:#111111">"</span></div></div><div class="ec-line"><div class="code"><span style="--0:#82AAFF;--1:#3B61B0">postconf</span><span style="--0:#D6DEEB;--1:#403F53"> </span><span style="--0:#82AAFF;--1:#3B61B0">-P</span><span style="--0:#D6DEEB;--1:#403F53"> </span><span style="--0:#D9F5DD;--1:#111111">"</span><span style="--0:#ECC48D;--1:#984E4D">submission/inet/smtpd_sasl_path=private/dovecot-auth</span><span style="--0:#D9F5DD;--1:#111111">"</span></div></div><div class="ec-line"><div class="code"><span style="--0:#82AAFF;--1:#3B61B0">postconf</span><span style="--0:#D6DEEB;--1:#403F53"> </span><span style="--0:#82AAFF;--1:#3B61B0">-P</span><span style="--0:#D6DEEB;--1:#403F53"> </span><span style="--0:#D9F5DD;--1:#111111">"</span><span style="--0:#ECC48D;--1:#984E4D">submission/inet/smtpd_recipient_restrictions=permit_sasl_authenticated,reject</span><span style="--0:#D9F5DD;--1:#111111">"</span></div></div><div class="ec-line"><div class="code"><span style="--0:#82AAFF;--1:#3B61B0">postconf</span><span style="--0:#D6DEEB;--1:#403F53"> </span><span style="--0:#82AAFF;--1:#3B61B0">-P</span><span style="--0:#D6DEEB;--1:#403F53"> </span><span style="--0:#D9F5DD;--1:#111111">"</span><span style="--0:#ECC48D;--1:#984E4D">submission/inet/smtpd_sender_restrictions=reject_sender_login_mismatch,permit_sasl_authenticated,reject</span><span style="--0:#D9F5DD;--1:#111111">"</span></div></div><div class="ec-line"><div class="code">
|
||
</div></div><div class="ec-line"><div class="code"><span style="--0:#82AAFF;--1:#3B61B0">postfix</span><span style="--0:#D6DEEB;--1:#403F53"> </span><span style="--0:#ECC48D;--1:#3B61B0">reload</span></div></div></code></pre><div class="copy"><div aria-live="polite"></div><button title="Copy to clipboard" data-copied="Copied!" data-code="postconf -M submission/inet="submission inet n - y - - smtpd"postconf -P "submission/inet/syslog_name=postfix/submission"postconf -P "submission/inet/smtpd_tls_security_level=encrypt"postconf -P "submission/inet/smtpd_sasl_auth_enable=yes"postconf -P "submission/inet/smtpd_sasl_type=dovecot"postconf -P "submission/inet/smtpd_sasl_path=private/dovecot-auth"postconf -P "submission/inet/smtpd_recipient_restrictions=permit_sasl_authenticated,reject"postconf -P "submission/inet/smtpd_sender_restrictions=reject_sender_login_mismatch,permit_sasl_authenticated,reject"postfix reload"><div></div></button></div></figure></div>
|
||
<p>These commands added a <code dir="auto">submission</code> service to the <code dir="auto">/etc/postfix/master.cf</code> file. You could have achieved the same thing
|
||
by editing that file and adding the following section, but I wanted to make it simpler for you to just copy/paste the
|
||
commands into your shell.</p>
|
||
<div class="expressive-code"><figure class="frame has-title not-content"><figcaption class="header"><span class="title">What it did…</span></figcaption><pre data-language="text"><code><div class="ec-line"><div class="code"><span style="--0:#d6deeb;--1:#403f53">submission inet n - y - - smtpd</span></div></div><div class="ec-line"><div class="code"><span class="indent"><span style="--0:#d6deeb;--1:#403f53"> </span></span><span style="--0:#d6deeb;--1:#403f53">-o syslog_name=postfix/submission</span></div></div><div class="ec-line"><div class="code"><span class="indent"><span style="--0:#d6deeb;--1:#403f53"> </span></span><span style="--0:#d6deeb;--1:#403f53">-o smtpd_tls_security_level=encrypt</span></div></div><div class="ec-line"><div class="code"><span class="indent"><span style="--0:#d6deeb;--1:#403f53"> </span></span><span style="--0:#d6deeb;--1:#403f53">-o smtpd_sasl_auth_enable=yes</span></div></div><div class="ec-line"><div class="code"><span class="indent"><span style="--0:#d6deeb;--1:#403f53"> </span></span><span style="--0:#d6deeb;--1:#403f53">-o smtpd_sasl_type=dovecot</span></div></div><div class="ec-line"><div class="code"><span class="indent"><span style="--0:#d6deeb;--1:#403f53"> </span></span><span style="--0:#d6deeb;--1:#403f53">-o smtpd_sasl_path=private/dovecot-auth</span></div></div><div class="ec-line"><div class="code"><span class="indent"><span style="--0:#d6deeb;--1:#403f53"> </span></span><span style="--0:#d6deeb;--1:#403f53">-o smtpd_recipient_restrictions=permit_sasl_authenticated,reject</span></div></div></code></pre><div class="copy"><div aria-live="polite"></div><button title="Copy to clipboard" data-copied="Copied!" data-code="submission inet n - y - - smtpd -o syslog_name=postfix/submission -o smtpd_tls_security_level=encrypt -o smtpd_sasl_auth_enable=yes -o smtpd_sasl_type=dovecot -o smtpd_sasl_path=private/dovecot-auth -o smtpd_recipient_restrictions=permit_sasl_authenticated,reject"><div></div></button></div></figure></div>
|
||
<p>Some notes on that:</p>
|
||
<ul>
|
||
<li>Lines with <strong>options</strong> (<code dir="auto">-o</code>) need to be indented so that Postfix understands that they belong to the same service.</li>
|
||
<li>The word <strong>submission</strong> refers to the definition of the service in the <code dir="auto">/etc/services</code> file. So it translates to TCP
|
||
port 587.</li>
|
||
<li>The <strong>smtpd</strong> in the last column of the first row tells Postfix that connections should be handled as incoming SMTP
|
||
connections.</li>
|
||
<li><strong>syslog_name</strong> is adding <code dir="auto">postfix/submission</code> to log files so that you can distinguish it from other connections.</li>
|
||
<li><strong>smtpd_tls_security_level</strong> enabled and enforces the use of STARTTLS. The connection starts without encryption but
|
||
the remote party is required to send the <code dir="auto">STARTTLS</code> command to switch to an encrypted connection.</li>
|
||
<li><strong>smtpd_sasl_auth_enable</strong> enables authentication on this port. SASL is short for <em>Simple Authentication and Security
|
||
Layer</em>. That way only our own users can use this service.</li>
|
||
<li><strong>smtpd_sasl_type</strong> tells Postfix to use Dovecot’s service to authentication a uaser.</li>
|
||
<li><strong>smtpd_sasl_path</strong> tells Postfix that it should talk to Dovecot through the socket file
|
||
<code dir="auto">/var/spool/postfix/private/dovecot-auth</code>. Earlier in this guide you told Dovecot to create that socket at that
|
||
location.</li>
|
||
<li><strong>smtpd_recipient_restrictions</strong> define that only authenticated connections are permitted. Without a username and a
|
||
password your connection will be rejected. The <strong>recipient</strong> keyword tells us that this restricts who the recipient
|
||
can be.</li>
|
||
<li><strong>smtpd_sender_restrictions</strong> restricts who the <strong>sender</strong> may be. I will explain that
|
||
<a href="#protecting-against-forged-sender-addresses">later</a>.</li>
|
||
</ul>
|
||
<p>While you are at it, create the <code dir="auto">submissions</code> (with an “s” at the end) service as well:</p>
|
||
<div class="expressive-code"><figure class="frame is-terminal has-title not-content"><figcaption class="header"><span class="title">Run this on your server</span></figcaption><pre data-language="sh"><code><div class="ec-line"><div class="code"><span style="--0:#82AAFF;--1:#3B61B0">postconf</span><span style="--0:#D6DEEB;--1:#403F53"> </span><span style="--0:#82AAFF;--1:#3B61B0">-M</span><span style="--0:#D6DEEB;--1:#403F53"> </span><span style="--0:#ECC48D;--1:#3B61B0">submissions/inet=</span><span style="--0:#D9F5DD;--1:#111111">"</span><span style="--0:#ECC48D;--1:#984E4D">submissions inet n - y - - smtpd</span><span style="--0:#D9F5DD;--1:#111111">"</span></div></div><div class="ec-line"><div class="code"><span style="--0:#82AAFF;--1:#3B61B0">postconf</span><span style="--0:#D6DEEB;--1:#403F53"> </span><span style="--0:#82AAFF;--1:#3B61B0">-P</span><span style="--0:#D6DEEB;--1:#403F53"> </span><span style="--0:#D9F5DD;--1:#111111">"</span><span style="--0:#ECC48D;--1:#984E4D">submissions/inet/syslog_name=postfix/submissions</span><span style="--0:#D9F5DD;--1:#111111">"</span></div></div><div class="ec-line"><div class="code"><span style="--0:#82AAFF;--1:#3B61B0">postconf</span><span style="--0:#D6DEEB;--1:#403F53"> </span><span style="--0:#82AAFF;--1:#3B61B0">-P</span><span style="--0:#D6DEEB;--1:#403F53"> </span><span style="--0:#D9F5DD;--1:#111111">"</span><span style="--0:#ECC48D;--1:#984E4D">submissions/inet/smtpd_tls_wrappermode=yes</span><span style="--0:#D9F5DD;--1:#111111">"</span></div></div><div class="ec-line"><div class="code"><span style="--0:#82AAFF;--1:#3B61B0">postconf</span><span style="--0:#D6DEEB;--1:#403F53"> </span><span style="--0:#82AAFF;--1:#3B61B0">-P</span><span style="--0:#D6DEEB;--1:#403F53"> </span><span style="--0:#D9F5DD;--1:#111111">"</span><span style="--0:#ECC48D;--1:#984E4D">submissions/inet/smtpd_sasl_auth_enable=yes</span><span style="--0:#D9F5DD;--1:#111111">"</span></div></div><div class="ec-line"><div class="code"><span style="--0:#82AAFF;--1:#3B61B0">postconf</span><span style="--0:#D6DEEB;--1:#403F53"> </span><span style="--0:#82AAFF;--1:#3B61B0">-P</span><span style="--0:#D6DEEB;--1:#403F53"> </span><span style="--0:#D9F5DD;--1:#111111">"</span><span style="--0:#ECC48D;--1:#984E4D">submissions/inet/smtpd_sasl_type=dovecot</span><span style="--0:#D9F5DD;--1:#111111">"</span></div></div><div class="ec-line"><div class="code"><span style="--0:#82AAFF;--1:#3B61B0">postconf</span><span style="--0:#D6DEEB;--1:#403F53"> </span><span style="--0:#82AAFF;--1:#3B61B0">-P</span><span style="--0:#D6DEEB;--1:#403F53"> </span><span style="--0:#D9F5DD;--1:#111111">"</span><span style="--0:#ECC48D;--1:#984E4D">submissions/inet/smtpd_sasl_path=private/dovecot-auth</span><span style="--0:#D9F5DD;--1:#111111">"</span></div></div><div class="ec-line"><div class="code"><span style="--0:#82AAFF;--1:#3B61B0">postconf</span><span style="--0:#D6DEEB;--1:#403F53"> </span><span style="--0:#82AAFF;--1:#3B61B0">-P</span><span style="--0:#D6DEEB;--1:#403F53"> </span><span style="--0:#D9F5DD;--1:#111111">"</span><span style="--0:#ECC48D;--1:#984E4D">submissions/inet/smtpd_recipient_restrictions=permit_sasl_authenticated,reject</span><span style="--0:#D9F5DD;--1:#111111">"</span></div></div><div class="ec-line"><div class="code"><span style="--0:#82AAFF;--1:#3B61B0">postconf</span><span style="--0:#D6DEEB;--1:#403F53"> </span><span style="--0:#82AAFF;--1:#3B61B0">-P</span><span style="--0:#D6DEEB;--1:#403F53"> </span><span style="--0:#D9F5DD;--1:#111111">"</span><span style="--0:#ECC48D;--1:#984E4D">submissions/inet/smtpd_sender_restrictions=reject_sender_login_mismatch,permit_sasl_authenticated,reject</span><span style="--0:#D9F5DD;--1:#111111">"</span></div></div><div class="ec-line"><div class="code"><span style="--0:#82AAFF;--1:#3B61B0">postfix</span><span style="--0:#D6DEEB;--1:#403F53"> </span><span style="--0:#ECC48D;--1:#3B61B0">reload</span></div></div></code></pre><div class="copy"><div aria-live="polite"></div><button title="Copy to clipboard" data-copied="Copied!" data-code="postconf -M submissions/inet="submissions inet n - y - - smtpd"postconf -P "submissions/inet/syslog_name=postfix/submissions"postconf -P "submissions/inet/smtpd_tls_wrappermode=yes"postconf -P "submissions/inet/smtpd_sasl_auth_enable=yes"postconf -P "submissions/inet/smtpd_sasl_type=dovecot"postconf -P "submissions/inet/smtpd_sasl_path=private/dovecot-auth"postconf -P "submissions/inet/smtpd_recipient_restrictions=permit_sasl_authenticated,reject"postconf -P "submissions/inet/smtpd_sender_restrictions=reject_sender_login_mismatch,permit_sasl_authenticated,reject"postfix reload"><div></div></button></div></figure></div>
|
||
<p>The only difference to the <code dir="auto">submission</code> (without the “s” at the end) is the <code dir="auto">smtpd_tls_wrappermode</code> that switches on TLS
|
||
encryption right from the start of a connection.</p>
|
||
<div class="sl-heading-wrapper level-h2"><h2 id="set-up-encryption">Set up encryption</h2><a class="sl-anchor-link" href="#set-up-encryption"><span aria-hidden="true" class="sl-anchor-icon"><svg width="16" height="16" viewBox="0 0 24 24"><path fill="currentcolor" d="m12.11 15.39-3.88 3.88a2.52 2.52 0 0 1-3.5 0 2.47 2.47 0 0 1 0-3.5l3.88-3.88a1 1 0 0 0-1.42-1.42l-3.88 3.89a4.48 4.48 0 0 0 6.33 6.33l3.89-3.88a1 1 0 1 0-1.42-1.42Zm8.58-12.08a4.49 4.49 0 0 0-6.33 0l-3.89 3.88a1 1 0 0 0 1.42 1.42l3.88-3.88a2.52 2.52 0 0 1 3.5 0 2.47 2.47 0 0 1 0 3.5l-3.88 3.88a1 1 0 1 0 1.42 1.42l3.88-3.89a4.49 4.49 0 0 0 0-6.33ZM8.83 15.17a1 1 0 0 0 1.1.22 1 1 0 0 0 .32-.22l4.92-4.92a1 1 0 0 0-1.42-1.42l-4.92 4.92a1 1 0 0 0 0 1.42Z"></path></svg></span><span class="sr-only">Section titled “Set up encryption”</span></a></div>
|
||
<p>Whenever possible we should encrypt our traffic. For our users’ passwords we make it mandatory. But even for
|
||
server-to-server connections we should encourage it. Do not confuse it with end-to-end encryption of emails. That
|
||
required using PGP or S/MIME. What we are dealing here is <em>transport encryption</em>. It encrypts the communication between
|
||
a peer server and your mail server. What the peer server does with our email is beyond our control.</p>
|
||
<aside aria-label="Important" class="starlight-aside starlight-aside--danger"> <p class="starlight-aside__title" aria-hidden="true"> <svg aria-hidden="true" class="starlight-aside__icon astro-c6vsoqas" width="16" height="16" viewBox="0 0 24 24" fill="currentColor" style="--sl-icon-size: 1em;"><path d="M12 7a1 1 0 0 0-1 1v4a1 1 0 0 0 2 0V8a1 1 0 0 0-1-1Zm0 8a1 1 0 1 0 0 2 1 1 0 0 0 0-2Zm9.71-7.44-5.27-5.27a1.05 1.05 0 0 0-.71-.29H8.27a1.05 1.05 0 0 0-.71.29L2.29 7.56a1.05 1.05 0 0 0-.29.71v7.46c.004.265.107.518.29.71l5.27 5.27c.192.183.445.286.71.29h7.46a1.05 1.05 0 0 0 .71-.29l5.27-5.27a1.05 1.05 0 0 0 .29-.71V8.27a1.05 1.05 0 0 0-.29-.71ZM20 15.31 15.31 20H8.69L4 15.31V8.69L8.69 4h6.62L20 8.69v6.62Z"/></svg>Important </p> <div class="starlight-aside__content"> <p>Please replace <code dir="auto">mail.example.org</code> by the FQDN you chose.</p> </div> </aside>
|
||
<div class="expressive-code"><figure class="frame is-terminal has-title not-content"><figcaption class="header"><span class="title">Run this on your server</span></figcaption><pre data-language="sh"><code><div class="ec-line"><div class="code"><span style="--0:#82AAFF;--1:#3B61B0">postconf</span><span style="--0:#D6DEEB;--1:#403F53"> </span><span style="--0:#ECC48D;--1:#3B61B0">smtp_tls_security_level=encrypt</span></div></div><div class="ec-line"><div class="code"><span style="--0:#82AAFF;--1:#3B61B0">postconf</span><span style="--0:#D6DEEB;--1:#403F53"> </span><span style="--0:#ECC48D;--1:#3B61B0">smtpd_tls_security_level=encrypt</span></div></div><div class="ec-line"><div class="code"><span style="--0:#82AAFF;--1:#3B61B0">postconf</span><span style="--0:#D6DEEB;--1:#403F53"> </span><span style="--0:#ECC48D;--1:#3B61B0">smtp_tls_mandatory_protocols=</span><span style="--0:#D9F5DD;--1:#111111">"</span><span style="--0:#ECC48D;--1:#984E4D">>=TLSv1.2</span><span style="--0:#D9F5DD;--1:#111111">"</span></div></div><div class="ec-line"><div class="code"><span style="--0:#82AAFF;--1:#3B61B0">postconf</span><span style="--0:#D6DEEB;--1:#403F53"> </span><span style="--0:#ECC48D;--1:#3B61B0">smtpd_tls_mandatory_protocols=</span><span style="--0:#D9F5DD;--1:#111111">"</span><span style="--0:#ECC48D;--1:#984E4D">>=TLSv1.2</span><span style="--0:#D9F5DD;--1:#111111">"</span></div></div><div class="ec-line"><div class="code"><span style="--0:#82AAFF;--1:#3B61B0">postconf</span><span style="--0:#D6DEEB;--1:#403F53"> </span><span style="--0:#ECC48D;--1:#3B61B0">smtp_tls_mandatory_ciphers=high</span></div></div><div class="ec-line"><div class="code"><span style="--0:#82AAFF;--1:#3B61B0">postconf</span><span style="--0:#D6DEEB;--1:#403F53"> </span><span style="--0:#ECC48D;--1:#3B61B0">smtpd_tls_mandatory_ciphers=high</span></div></div><div class="ec-line"><div class="code"><span style="--0:#82AAFF;--1:#3B61B0">postconf</span><span style="--0:#D6DEEB;--1:#403F53"> </span><span style="--0:#ECC48D;--1:#3B61B0">smtpd_tls_cert_file=/etc/letsencrypt/live/mail.example.org/fullchain.pem</span></div></div><div class="ec-line"><div class="code"><span style="--0:#82AAFF;--1:#3B61B0">postconf</span><span style="--0:#D6DEEB;--1:#403F53"> </span><span style="--0:#ECC48D;--1:#3B61B0">smtpd_tls_key_file=/etc/letsencrypt/live/mail.example.org/privkey.pem</span></div></div></code></pre><div class="copy"><div aria-live="polite"></div><button title="Copy to clipboard" data-copied="Copied!" data-code="postconf smtp_tls_security_level=encryptpostconf smtpd_tls_security_level=encryptpostconf smtp_tls_mandatory_protocols=">=TLSv1.2"postconf smtpd_tls_mandatory_protocols=">=TLSv1.2"postconf smtp_tls_mandatory_ciphers=highpostconf smtpd_tls_mandatory_ciphers=highpostconf smtpd_tls_cert_file=/etc/letsencrypt/live/mail.example.org/fullchain.pempostconf smtpd_tls_key_file=/etc/letsencrypt/live/mail.example.org/privkey.pem"><div></div></button></div></figure></div>
|
||
<p>What it means:</p>
|
||
<ul>
|
||
<li><strong>smtp_tls_security_level</strong>: <br>
|
||
Enforce encrypted <em>outgoing</em> SMTP connections.</li>
|
||
<li><strong>smtpd_tls_security_level</strong>: <br>
|
||
Enforce encrypted <em>incoming</em> SMTP connections.</li>
|
||
<li><strong>smtp_tls_mandatory_protocols</strong> / <strong>smtpd_tls_mandatory_protocols</strong>: <br>
|
||
Only allow recommended versions of <a href="https://en.wikipedia.org/wiki/Transport_Layer_Security">TLS</a>. Version 1.2 has been
|
||
introduced 2008. Version 1.3 is from 2018.</li>
|
||
<li><strong>smtp_tls_mandatory_ciphers</strong> / <strong>smtpd_tls_mandatory_ciphers</strong>: <br>
|
||
The list of encryption algorithms that you allow for communnication. Default is <em>medium</em>.</li>
|
||
<li><strong>smtpd_tls_cert_file</strong> and <strong>smtpd_tls_key_file</strong>: <br>
|
||
Where to find the private key and certificate for encryption.</li>
|
||
</ul>
|
||
<aside aria-label="Losen the encryption?" class="starlight-aside starlight-aside--tip"> <p class="starlight-aside__title" aria-hidden="true"> <svg aria-hidden="true" class="starlight-aside__icon astro-c6vsoqas" width="16" height="16" viewBox="0 0 24 24" fill="currentColor" style="--sl-icon-size: 1em;"><path fill-rule="evenodd" d="M1.44 8.855v-.001l3.527-3.516c.34-.344.802-.541 1.285-.548h6.649l.947-.947c3.07-3.07 6.207-3.072 7.62-2.868a1.821 1.821 0 0 1 1.557 1.557c.204 1.413.203 4.55-2.868 7.62l-.946.946v6.649a1.845 1.845 0 0 1-.549 1.286l-3.516 3.528a1.844 1.844 0 0 1-3.11-.944l-.858-4.275-4.52-4.52-2.31-.463-1.964-.394A1.847 1.847 0 0 1 .98 10.693a1.843 1.843 0 0 1 .46-1.838Zm5.379 2.017-3.873-.776L6.32 6.733h4.638l-4.14 4.14Zm8.403-5.655c2.459-2.46 4.856-2.463 5.89-2.33.134 1.035.13 3.432-2.329 5.891l-6.71 6.71-3.561-3.56 6.71-6.711Zm-1.318 15.837-.776-3.873 4.14-4.14v4.639l-3.364 3.374Z" clip-rule="evenodd"/><path d="M9.318 18.345a.972.972 0 0 0-1.86-.561c-.482 1.435-1.687 2.204-2.934 2.619a8.22 8.22 0 0 1-1.23.302c.062-.365.157-.79.303-1.229.415-1.247 1.184-2.452 2.62-2.935a.971.971 0 1 0-.62-1.842c-.12.04-.236.084-.35.13-2.02.828-3.012 2.588-3.493 4.033a10.383 10.383 0 0 0-.51 2.845l-.001.016v.063c0 .536.434.972.97.972H2.24a7.21 7.21 0 0 0 .878-.065c.527-.063 1.248-.19 2.02-.447 1.445-.48 3.205-1.472 4.033-3.494a5.828 5.828 0 0 0 .147-.407Z"/></svg>Losen the encryption? </p> <div class="starlight-aside__content"> <p>In rare cases you may fail to communicate with other computers because they only support older TLS versions (up to
|
||
1.1) or ciphers that are not considered secure nowadays. In that case you can remove the <code dir="auto">smtpd_tls_security_level</code>,
|
||
<code dir="auto">smtpd_tls_mandatory_protocols</code> and <code dir="auto">smtpd_tls_mandatory_ciphers</code> settings from your <code dir="auto">main.cf</code> file and fall back to
|
||
the relaxed security requirements.</p> </div> </aside>
|
||
<p>Please note that configuration in <code dir="auto">main.cf</code> applies to all Postfix services. So the above configuration enabled
|
||
encryption for both server-to-server and human-to-server (<code dir="auto">submission</code>) services. The <code dir="auto">smtpd_sasl_auth_enable</code> will only
|
||
be set for the <code dir="auto">submission</code> service to enable authentication there.<sup><a href="#user-content-fn-1" id="user-content-fnref-1-2" data-footnote-ref="" aria-describedby="footnote-label">1</a></sup></p>
|
||
<aside aria-label="smtp or smtpd?" class="starlight-aside starlight-aside--tip"> <p class="starlight-aside__title" aria-hidden="true"> <svg aria-hidden="true" class="starlight-aside__icon astro-c6vsoqas" width="16" height="16" viewBox="0 0 24 24" fill="currentColor" style="--sl-icon-size: 1em;"><path fill-rule="evenodd" d="M1.44 8.855v-.001l3.527-3.516c.34-.344.802-.541 1.285-.548h6.649l.947-.947c3.07-3.07 6.207-3.072 7.62-2.868a1.821 1.821 0 0 1 1.557 1.557c.204 1.413.203 4.55-2.868 7.62l-.946.946v6.649a1.845 1.845 0 0 1-.549 1.286l-3.516 3.528a1.844 1.844 0 0 1-3.11-.944l-.858-4.275-4.52-4.52-2.31-.463-1.964-.394A1.847 1.847 0 0 1 .98 10.693a1.843 1.843 0 0 1 .46-1.838Zm5.379 2.017-3.873-.776L6.32 6.733h4.638l-4.14 4.14Zm8.403-5.655c2.459-2.46 4.856-2.463 5.89-2.33.134 1.035.13 3.432-2.329 5.891l-6.71 6.71-3.561-3.56 6.71-6.711Zm-1.318 15.837-.776-3.873 4.14-4.14v4.639l-3.364 3.374Z" clip-rule="evenodd"/><path d="M9.318 18.345a.972.972 0 0 0-1.86-.561c-.482 1.435-1.687 2.204-2.934 2.619a8.22 8.22 0 0 1-1.23.302c.062-.365.157-.79.303-1.229.415-1.247 1.184-2.452 2.62-2.935a.971.971 0 1 0-.62-1.842c-.12.04-.236.084-.35.13-2.02.828-3.012 2.588-3.493 4.033a10.383 10.383 0 0 0-.51 2.845l-.001.016v.063c0 .536.434.972.97.972H2.24a7.21 7.21 0 0 0 .878-.065c.527-.063 1.248-.19 2.02-.447 1.445-.48 3.205-1.472 4.033-3.494a5.828 5.828 0 0 0 .147-.407Z"/></svg>smtp or smtpd? </p> <div class="starlight-aside__content"> <p>Look closely. Some settings start with <code dir="auto">smtp_</code> and others start with with <code dir="auto">smtpd_</code>. That is not a typo. <code dir="auto">smtp_</code> refers
|
||
to the SMTP <em>client</em>. That is the component that sends out emails <strong>from</strong> Postfix <strong>to</strong> other servers. Whereas
|
||
<code dir="auto">smtpd_</code> means the SMTP <em>server.</em> That in turn is the component that <strong>receives</strong> emails <strong>from</strong> other systems –
|
||
either from a remote mail server or one of your users.</p> </div> </aside>
|
||
<div class="sl-heading-wrapper level-h2"><h2 id="protecting-against-forged-sender-addresses">Protecting against forged sender addresses</h2><a class="sl-anchor-link" href="#protecting-against-forged-sender-addresses"><span aria-hidden="true" class="sl-anchor-icon"><svg width="16" height="16" viewBox="0 0 24 24"><path fill="currentcolor" d="m12.11 15.39-3.88 3.88a2.52 2.52 0 0 1-3.5 0 2.47 2.47 0 0 1 0-3.5l3.88-3.88a1 1 0 0 0-1.42-1.42l-3.88 3.89a4.48 4.48 0 0 0 6.33 6.33l3.89-3.88a1 1 0 1 0-1.42-1.42Zm8.58-12.08a4.49 4.49 0 0 0-6.33 0l-3.89 3.88a1 1 0 0 0 1.42 1.42l3.88-3.88a2.52 2.52 0 0 1 3.5 0 2.47 2.47 0 0 1 0 3.5l-3.88 3.88a1 1 0 1 0 1.42 1.42l3.88-3.89a4.49 4.49 0 0 0 0-6.33ZM8.83 15.17a1 1 0 0 0 1.1.22 1 1 0 0 0 .32-.22l4.92-4.92a1 1 0 0 0-1.42-1.42l-4.92 4.92a1 1 0 0 0 0 1.42Z"></path></svg></span><span class="sr-only">Section titled “Protecting against forged sender addresses”</span></a></div>
|
||
<p>Before we can actually test the setup, there is another security issue we need to address. While Postfix is configured
|
||
to relay emails only after a successful login with a valid username and password, it does not prevent an authenticated
|
||
user from impersonating another sender. For example, someone could log in as <code dir="auto">john@example.org</code> but send an email
|
||
appearing to come from <code dir="auto">brunhilde@example.net</code>.</p>
|
||
<p>We should fix that. For that purpose Postfix provides a setting called
|
||
<a href="http://www.postfix.org/postconf.5.html#smtpd_sender_login_maps">smtpd_sender_login_maps</a>. From the “maps” part you can
|
||
deduce that it expects a <em>mapping</em> again:</p>
|
||
<ul>
|
||
<li><em>Question</em>: who you <strong>claim</strong> to be (email’s sender address)</li>
|
||
<li><em>Answer</em>: who you <strong>logged in as</strong> (user name after authentiation)</li>
|
||
</ul>
|
||
<p>If you think of it, the mapping is simple. The <em>question</em> must match the <em>answer</em>. If <code dir="auto">john@example.org</code> wants to be the
|
||
sender, he must also authenticate as <code dir="auto">john@example.org</code>.</p>
|
||
<p>As we use the email address also as a user name we simply need a mapping where the email address is listed on both
|
||
sides. Let’s create it:</p>
|
||
<div class="expressive-code"><figure class="frame is-terminal has-title not-content"><figcaption class="header"><span class="title">Run this on your server</span></figcaption><pre data-language="sh"><code><div class="ec-line"><div class="code"><span style="--0:#919F9F;--1:#5F636F"># Create a mapping configuration from the user to themself</span></div></div><div class="ec-line"><div class="code"><span style="--0:#82AAFF;--1:#3B61B0">cat</span><span style="--0:#D6DEEB;--1:#403F53"> </span><span style="--0:#7FDBCA;--1:#096E72">></span><span style="--0:#D6DEEB;--1:#403F53"> </span><span style="--0:#ECC48D;--1:#3B61B0">/etc/postfix/mariadb-email2email.cf</span><span style="--0:#D6DEEB;--1:#403F53"> </span><span style="--0:#7FDBCA;--1:#096E72"><<</span><span style="--0:#D6DEEB;--1:#403F53"> </span><span style="--0:#D9F5DD;--1:#111111">EOF</span></div></div><div class="ec-line"><div class="code"><span style="--0:#ECC48D;--1:#3B61B0">user = mailserver</span></div></div><div class="ec-line"><div class="code"><span style="--0:#ECC48D;--1:#3B61B0">password = MAILSERVER-PASSWORD-HERE</span></div></div><div class="ec-line"><div class="code"><span style="--0:#ECC48D;--1:#3B61B0">hosts = 127.0.0.1</span></div></div><div class="ec-line"><div class="code"><span style="--0:#ECC48D;--1:#3B61B0">dbname = mailserver</span></div></div><div class="ec-line"><div class="code"><span style="--0:#ECC48D;--1:#3B61B0">query = SELECT email FROM virtual_users WHERE email='%s'</span></div></div><div class="ec-line"><div class="code"><span style="--0:#D9F5DD;--1:#111111">EOF</span></div></div><div class="ec-line"><div class="code">
|
||
</div></div><div class="ec-line"><div class="code"><span style="--0:#919F9F;--1:#5F636F"># Fix permissions</span></div></div><div class="ec-line"><div class="code"><span style="--0:#82AAFF;--1:#3B61B0">chown</span><span style="--0:#D6DEEB;--1:#403F53"> </span><span style="--0:#ECC48D;--1:#3B61B0">root:postfix</span><span style="--0:#D6DEEB;--1:#403F53"> </span><span style="--0:#ECC48D;--1:#3B61B0">/etc/postfix/mariadb-email2email.cf</span></div></div><div class="ec-line"><div class="code"><span style="--0:#82AAFF;--1:#3B61B0">chmod</span><span style="--0:#D6DEEB;--1:#403F53"> </span><span style="--0:#ECC48D;--1:#3B61B0">u=rw,g=r,o=</span><span style="--0:#D6DEEB;--1:#403F53"> </span><span style="--0:#ECC48D;--1:#3B61B0">/etc/postfix/mariadb-email2email.cf</span></div></div><div class="ec-line"><div class="code">
|
||
</div></div><div class="ec-line"><div class="code"><span style="--0:#919F9F;--1:#5F636F"># Tell Postfix to use this mapping</span></div></div><div class="ec-line"><div class="code"><span style="--0:#82AAFF;--1:#3B61B0">postconf</span><span style="--0:#D6DEEB;--1:#403F53"> </span><span style="--0:#ECC48D;--1:#3B61B0">smtpd_sender_login_maps=mysql:/etc/postfix/mariadb-email2email.cf</span></div></div></code></pre><div class="copy"><div aria-live="polite"></div><button title="Copy to clipboard" data-copied="Copied!" data-code="# Create a mapping configuration from the user to themselfcat > /etc/postfix/mariadb-email2email.cf << EOFuser = mailserverpassword = MAILSERVER-PASSWORD-HEREhosts = 127.0.0.1dbname = mailserverquery = SELECT email FROM virtual_users WHERE email='%s'EOF# Fix permissionschown root:postfix /etc/postfix/mariadb-email2email.cfchmod u=rw,g=r,o= /etc/postfix/mariadb-email2email.cf# Tell Postfix to use this mappingpostconf smtpd_sender_login_maps=mysql:/etc/postfix/mariadb-email2email.cf"><div></div></button></div></figure></div>
|
||
<p>What you accomplished:</p>
|
||
<ol>
|
||
<li>Create the <em>mapping</em> file</li>
|
||
<li>Fix the permissions of it so that only Postfix can read it (there is a password in it)</li>
|
||
<li>Make Postfix use that mapping for its <code dir="auto">smtpd_sender_login_maps</code> setting</li>
|
||
<li>Add <code dir="auto">smtpd_sender_restrictions=reject_sender_login_mismatch</code> to the <code dir="auto">submission</code> and <code dir="auto">submissions</code> services</li>
|
||
</ol>
|
||
<p>You can now try to send email as a different user than you are logged in. Let’s us swaks again to send a spoofed email:</p>
|
||
<div class="expressive-code"><figure class="frame is-terminal has-title not-content"><figcaption class="header"><span class="title">Run this on your server</span></figcaption><pre data-language="sh"><code><div class="ec-line"><div class="code"><span style="--0:#82AAFF;--1:#3B61B0">swaks</span><span style="--0:#D6DEEB;--1:#403F53"> </span><span style="--0:#82AAFF;--1:#3B61B0">--server</span><span style="--0:#D6DEEB;--1:#403F53"> </span><span style="--0:#ECC48D;--1:#3B61B0">localhost:587</span><span style="--0:#D6DEEB;--1:#403F53"> </span><span style="--0:#F78C6C;--1:#AA0982">\</span></div></div><div class="ec-line"><div class="code"><span class="indent"> </span><span style="--0:#82AAFF;--1:#3B61B0">--from</span><span style="--0:#D6DEEB;--1:#403F53"> </span><span style="--0:#ECC48D;--1:#3B61B0">brunhilde@example.org</span><span style="--0:#D6DEEB;--1:#403F53"> </span><span style="--0:#F78C6C;--1:#AA0982">\</span></div></div><div class="ec-line"><div class="code"><span class="indent"> </span><span style="--0:#82AAFF;--1:#3B61B0">--to</span><span style="--0:#D6DEEB;--1:#403F53"> </span><span style="--0:#ECC48D;--1:#3B61B0">list@example.com</span><span style="--0:#D6DEEB;--1:#403F53"> </span><span style="--0:#F78C6C;--1:#AA0982">\</span></div></div><div class="ec-line"><div class="code"><span class="indent"> </span><span style="--0:#82AAFF;--1:#3B61B0">--tls</span><span style="--0:#D6DEEB;--1:#403F53"> </span><span style="--0:#F78C6C;--1:#AA0982">\</span></div></div><div class="ec-line"><div class="code"><span class="indent"> </span><span style="--0:#82AAFF;--1:#3B61B0">--auth-user</span><span style="--0:#D6DEEB;--1:#403F53"> </span><span style="--0:#ECC48D;--1:#3B61B0">john@example.org</span><span style="--0:#D6DEEB;--1:#403F53"> </span><span style="--0:#F78C6C;--1:#AA0982">\</span></div></div><div class="ec-line"><div class="code"><span class="indent"> </span><span style="--0:#82AAFF;--1:#3B61B0">--auth-password</span><span style="--0:#D6DEEB;--1:#403F53"> </span><span style="--0:#ECC48D;--1:#3B61B0">summersun</span></div></div></code></pre><div class="copy"><div aria-live="polite"></div><button title="Copy to clipboard" data-copied="Copied!" data-code="swaks --server localhost:587 \ --from brunhilde@example.org \ --to list@example.com \ --tls \ --auth-user john@example.org \ --auth-password summersun"><div></div></button></div></figure></div>
|
||
<p>The server should rightfully reject that wrong sender:</p>
|
||
<div class="expressive-code"><figure class="frame not-content"><figcaption class="header"></figcaption><pre data-language="plaintext"><code><div class="ec-line"><div class="code"><span style="--0:#d6deeb;--1:#403f53">~> MAIL FROM:john@example.com</span></div></div><div class="ec-line"><div class="code"><span style="--0:#d6deeb;--1:#403f53"><~ 250 2.1.0 Ok</span></div></div><div class="ec-line"><div class="code"><span style="--0:#d6deeb;--1:#403f53">~> RCPT TO:john@example.org</span></div></div><div class="ec-line"><div class="code"><span style="--0:#d6deeb;--1:#403f53"><~ * 553 5.7.1 john@example.com: Sender address rejected: not owned by user john@example.org</span></div></div></code></pre><div class="copy"><div aria-live="polite"></div><button title="Copy to clipboard" data-copied="Copied!" data-code="~> MAIL FROM:john@example.com<~ 250 2.1.0 Ok~> RCPT TO:john@example.org<~ * 553 5.7.1 john@example.com: Sender address rejected: not owned by user john@example.org"><div></div></button></div></figure></div>
|
||
<p>Now let’s send a proper email from John:</p>
|
||
<div class="expressive-code"><figure class="frame is-terminal has-title not-content"><figcaption class="header"><span class="title">Run this on your server</span></figcaption><pre data-language="sh"><code><div class="ec-line"><div class="code"><span style="--0:#82AAFF;--1:#3B61B0">swaks</span><span style="--0:#D6DEEB;--1:#403F53"> </span><span style="--0:#82AAFF;--1:#3B61B0">--server</span><span style="--0:#D6DEEB;--1:#403F53"> </span><span style="--0:#ECC48D;--1:#3B61B0">localhost:587</span><span style="--0:#D6DEEB;--1:#403F53"> </span><span style="--0:#F78C6C;--1:#AA0982">\</span></div></div><div class="ec-line"><div class="code"><span class="indent"> </span><span style="--0:#82AAFF;--1:#3B61B0">--from</span><span style="--0:#D6DEEB;--1:#403F53"> </span><span style="--0:#ECC48D;--1:#3B61B0">john@example.org</span><span style="--0:#D6DEEB;--1:#403F53"> </span><span style="--0:#F78C6C;--1:#AA0982">\</span></div></div><div class="ec-line"><div class="code"><span class="indent"> </span><span style="--0:#82AAFF;--1:#3B61B0">--to</span><span style="--0:#D6DEEB;--1:#403F53"> </span><span style="--0:#ECC48D;--1:#3B61B0">list@example.com</span><span style="--0:#D6DEEB;--1:#403F53"> </span><span style="--0:#F78C6C;--1:#AA0982">\</span></div></div><div class="ec-line"><div class="code"><span class="indent"> </span><span style="--0:#82AAFF;--1:#3B61B0">--tls</span><span style="--0:#D6DEEB;--1:#403F53"> </span><span style="--0:#F78C6C;--1:#AA0982">\</span></div></div><div class="ec-line"><div class="code"><span class="indent"> </span><span style="--0:#82AAFF;--1:#3B61B0">--auth-user</span><span style="--0:#D6DEEB;--1:#403F53"> </span><span style="--0:#ECC48D;--1:#3B61B0">john@example.org</span><span style="--0:#D6DEEB;--1:#403F53"> </span><span style="--0:#F78C6C;--1:#AA0982">\</span></div></div><div class="ec-line"><div class="code"><span class="indent"> </span><span style="--0:#82AAFF;--1:#3B61B0">--auth-password</span><span style="--0:#D6DEEB;--1:#403F53"> </span><span style="--0:#ECC48D;--1:#3B61B0">summersun</span></div></div></code></pre><div class="copy"><div aria-live="polite"></div><button title="Copy to clipboard" data-copied="Copied!" data-code="swaks --server localhost:587 \ --from john@example.org \ --to list@example.com \ --tls \ --auth-user john@example.org \ --auth-password summersun"><div></div></button></div></figure></div>
|
||
<p>That will work:</p>
|
||
<div class="expressive-code"><figure class="frame not-content"><figcaption class="header"></figcaption><pre data-language="plaintext"><code><div class="ec-line"><div class="code"><span style="--0:#d6deeb;--1:#403f53"><~ 250 2.0.0 Ok: queued as AFFF12292A</span></div></div></code></pre><div class="copy"><div aria-live="polite"></div><button title="Copy to clipboard" data-copied="Copied!" data-code="<~ 250 2.0.0 Ok: queued as AFFF12292A"><div></div></button></div></figure></div>
|
||
<aside aria-label="Allow aliases?" class="starlight-aside starlight-aside--tip"> <p class="starlight-aside__title" aria-hidden="true"> <svg aria-hidden="true" class="starlight-aside__icon astro-c6vsoqas" width="16" height="16" viewBox="0 0 24 24" fill="currentColor" style="--sl-icon-size: 1em;"><path fill-rule="evenodd" d="M1.44 8.855v-.001l3.527-3.516c.34-.344.802-.541 1.285-.548h6.649l.947-.947c3.07-3.07 6.207-3.072 7.62-2.868a1.821 1.821 0 0 1 1.557 1.557c.204 1.413.203 4.55-2.868 7.62l-.946.946v6.649a1.845 1.845 0 0 1-.549 1.286l-3.516 3.528a1.844 1.844 0 0 1-3.11-.944l-.858-4.275-4.52-4.52-2.31-.463-1.964-.394A1.847 1.847 0 0 1 .98 10.693a1.843 1.843 0 0 1 .46-1.838Zm5.379 2.017-3.873-.776L6.32 6.733h4.638l-4.14 4.14Zm8.403-5.655c2.459-2.46 4.856-2.463 5.89-2.33.134 1.035.13 3.432-2.329 5.891l-6.71 6.71-3.561-3.56 6.71-6.711Zm-1.318 15.837-.776-3.873 4.14-4.14v4.639l-3.364 3.374Z" clip-rule="evenodd"/><path d="M9.318 18.345a.972.972 0 0 0-1.86-.561c-.482 1.435-1.687 2.204-2.934 2.619a8.22 8.22 0 0 1-1.23.302c.062-.365.157-.79.303-1.229.415-1.247 1.184-2.452 2.62-2.935a.971.971 0 1 0-.62-1.842c-.12.04-.236.084-.35.13-2.02.828-3.012 2.588-3.493 4.033a10.383 10.383 0 0 0-.51 2.845l-.001.016v.063c0 .536.434.972.97.972H2.24a7.21 7.21 0 0 0 .878-.065c.527-.063 1.248-.19 2.02-.447 1.445-.48 3.205-1.472 4.033-3.494a5.828 5.828 0 0 0 .147-.407Z"/></svg>Allow aliases? </p> <div class="starlight-aside__content"> <p>The setup so far works for personal mails from John. But if John would be a member of a distribution list
|
||
<code dir="auto">pizza@example.org</code> then would not be able to use <code dir="auto">pizza@example.org</code> as a sender address.</p><p>If you want to allow that, create a new *.cf file with a mapping query like this:
|
||
<code dir="auto">SELECT email FROM virtual_users WHERE email='%s' UNION SELECT destination FROM virtual_aliases WHERE source='%s'</code>.</p> </div> </aside>
|
||
<aside aria-label="Check your $mydestination" class="starlight-aside starlight-aside--danger"> <p class="starlight-aside__title" aria-hidden="true"> <svg aria-hidden="true" class="starlight-aside__icon astro-c6vsoqas" width="16" height="16" viewBox="0 0 24 24" fill="currentColor" style="--sl-icon-size: 1em;"><path d="M12 7a1 1 0 0 0-1 1v4a1 1 0 0 0 2 0V8a1 1 0 0 0-1-1Zm0 8a1 1 0 1 0 0 2 1 1 0 0 0 0-2Zm9.71-7.44-5.27-5.27a1.05 1.05 0 0 0-.71-.29H8.27a1.05 1.05 0 0 0-.71.29L2.29 7.56a1.05 1.05 0 0 0-.29.71v7.46c.004.265.107.518.29.71l5.27 5.27c.192.183.445.286.71.29h7.46a1.05 1.05 0 0 0 .71-.29l5.27-5.27a1.05 1.05 0 0 0 .29-.71V8.27a1.05 1.05 0 0 0-.29-.71ZM20 15.31 15.31 20H8.69L4 15.31V8.69L8.69 4h6.62L20 8.69v6.62Z"/></svg>Check your $mydestination </p> <div class="starlight-aside__content"> <p>Please check the <code dir="auto">mydestination</code> setting in your <code dir="auto">main.cf</code> file. Make sure that it does not contain any domain name that
|
||
you also use as one of your <em>virtual domains</em>. If in doubt just set it to <code dir="auto">localhost</code>.</p> </div> </aside>
|
||
<div class="sl-heading-wrapper level-h2"><h2 id="test-it">Test it</h2><a class="sl-anchor-link" href="#test-it"><span aria-hidden="true" class="sl-anchor-icon"><svg width="16" height="16" viewBox="0 0 24 24"><path fill="currentcolor" d="m12.11 15.39-3.88 3.88a2.52 2.52 0 0 1-3.5 0 2.47 2.47 0 0 1 0-3.5l3.88-3.88a1 1 0 0 0-1.42-1.42l-3.88 3.89a4.48 4.48 0 0 0 6.33 6.33l3.89-3.88a1 1 0 1 0-1.42-1.42Zm8.58-12.08a4.49 4.49 0 0 0-6.33 0l-3.89 3.88a1 1 0 0 0 1.42 1.42l3.88-3.88a2.52 2.52 0 0 1 3.5 0 2.47 2.47 0 0 1 0 3.5l-3.88 3.88a1 1 0 1 0 1.42 1.42l3.88-3.89a4.49 4.49 0 0 0 0-6.33ZM8.83 15.17a1 1 0 0 0 1.1.22 1 1 0 0 0 .32-.22l4.92-4.92a1 1 0 0 0-1.42-1.42l-4.92 4.92a1 1 0 0 0 0 1.42Z"></path></svg></span><span class="sr-only">Section titled “Test it”</span></a></div>
|
||
<div class="sl-heading-wrapper level-h3"><h3 id="no-encryption-no-authentication">No encryption, no authentication</h3><a class="sl-anchor-link" href="#no-encryption-no-authentication"><span aria-hidden="true" class="sl-anchor-icon"><svg width="16" height="16" viewBox="0 0 24 24"><path fill="currentcolor" d="m12.11 15.39-3.88 3.88a2.52 2.52 0 0 1-3.5 0 2.47 2.47 0 0 1 0-3.5l3.88-3.88a1 1 0 0 0-1.42-1.42l-3.88 3.89a4.48 4.48 0 0 0 6.33 6.33l3.89-3.88a1 1 0 1 0-1.42-1.42Zm8.58-12.08a4.49 4.49 0 0 0-6.33 0l-3.89 3.88a1 1 0 0 0 1.42 1.42l3.88-3.88a2.52 2.52 0 0 1 3.5 0 2.47 2.47 0 0 1 0 3.5l-3.88 3.88a1 1 0 1 0 1.42 1.42l3.88-3.89a4.49 4.49 0 0 0 0-6.33ZM8.83 15.17a1 1 0 0 0 1.1.22 1 1 0 0 0 .32-.22l4.92-4.92a1 1 0 0 0-1.42-1.42l-4.92 4.92a1 1 0 0 0 0 1.42Z"></path></svg></span><span class="sr-only">Section titled “No encryption, no authentication”</span></a></div>
|
||
<p>So far you have set up the <code dir="auto">submission</code> service(s), enabled encryption and connected Postfix to Dovecot for
|
||
authentication. Let’s try it. Our first test email will be sent without encryption and authentication:</p>
|
||
<div class="expressive-code"><figure class="frame is-terminal has-title not-content"><figcaption class="header"><span class="title">Run this on your server</span></figcaption><pre data-language="sh"><code><div class="ec-line"><div class="code"><span style="--0:#82AAFF;--1:#3B61B0">swaks</span><span style="--0:#D6DEEB;--1:#403F53"> </span><span style="--0:#82AAFF;--1:#3B61B0">--server</span><span style="--0:#D6DEEB;--1:#403F53"> </span><span style="--0:#ECC48D;--1:#3B61B0">localhost:587</span><span style="--0:#D6DEEB;--1:#403F53"> </span><span style="--0:#F78C6C;--1:#AA0982">\</span></div></div><div class="ec-line"><div class="code"><span class="indent"> </span><span style="--0:#82AAFF;--1:#3B61B0">--from</span><span style="--0:#D6DEEB;--1:#403F53"> </span><span style="--0:#ECC48D;--1:#3B61B0">john@example.org</span><span style="--0:#D6DEEB;--1:#403F53"> </span><span style="--0:#F78C6C;--1:#AA0982">\</span></div></div><div class="ec-line"><div class="code"><span class="indent"> </span><span style="--0:#82AAFF;--1:#3B61B0">--to</span><span style="--0:#D6DEEB;--1:#403F53"> </span><span style="--0:#ECC48D;--1:#3B61B0">lisa@example.com</span></div></div></code></pre><div class="copy"><div aria-live="polite"></div><button title="Copy to clipboard" data-copied="Copied!" data-code="swaks --server localhost:587 \ --from john@example.org \ --to lisa@example.com"><div></div></button></div></figure></div>
|
||
<p>Postfix should tell you that it will not accept an email without encryption:</p>
|
||
<div class="expressive-code"><figure class="frame not-content"><figcaption class="header"></figcaption><pre data-language="plaintext"><code><div class="ec-line"><div class="code"><span style="--0:#d6deeb;--1:#403f53"><** 530 5.7.0 Must issue a STARTTLS command first</span></div></div></code></pre><div class="copy"><div aria-live="polite"></div><button title="Copy to clipboard" data-copied="Copied!" data-code="<** 530 5.7.0 Must issue a STARTTLS command first"><div></div></button></div></figure></div>
|
||
<div class="sl-heading-wrapper level-h3"><h3 id="with-encryption-no-authentication">With encryption, no authentication</h3><a class="sl-anchor-link" href="#with-encryption-no-authentication"><span aria-hidden="true" class="sl-anchor-icon"><svg width="16" height="16" viewBox="0 0 24 24"><path fill="currentcolor" d="m12.11 15.39-3.88 3.88a2.52 2.52 0 0 1-3.5 0 2.47 2.47 0 0 1 0-3.5l3.88-3.88a1 1 0 0 0-1.42-1.42l-3.88 3.89a4.48 4.48 0 0 0 6.33 6.33l3.89-3.88a1 1 0 1 0-1.42-1.42Zm8.58-12.08a4.49 4.49 0 0 0-6.33 0l-3.89 3.88a1 1 0 0 0 1.42 1.42l3.88-3.88a2.52 2.52 0 0 1 3.5 0 2.47 2.47 0 0 1 0 3.5l-3.88 3.88a1 1 0 1 0 1.42 1.42l3.88-3.89a4.49 4.49 0 0 0 0-6.33ZM8.83 15.17a1 1 0 0 0 1.1.22 1 1 0 0 0 .32-.22l4.92-4.92a1 1 0 0 0-1.42-1.42l-4.92 4.92a1 1 0 0 0 0 1.42Z"></path></svg></span><span class="sr-only">Section titled “With encryption, no authentication”</span></a></div>
|
||
<p>Our second attempt will <strong>enable</strong> (STARTTLS) encryption – but still no authentication:</p>
|
||
<div class="expressive-code"><figure class="frame is-terminal has-title not-content"><figcaption class="header"><span class="title">Run this on your server</span></figcaption><pre data-language="sh"><code><div class="ec-line"><div class="code"><span style="--0:#82AAFF;--1:#3B61B0">swaks</span><span style="--0:#D6DEEB;--1:#403F53"> </span><span style="--0:#82AAFF;--1:#3B61B0">--server</span><span style="--0:#D6DEEB;--1:#403F53"> </span><span style="--0:#ECC48D;--1:#3B61B0">localhost:587</span><span style="--0:#D6DEEB;--1:#403F53"> </span><span style="--0:#F78C6C;--1:#AA0982">\</span></div></div><div class="ec-line"><div class="code"><span class="indent"> </span><span style="--0:#82AAFF;--1:#3B61B0">--from</span><span style="--0:#D6DEEB;--1:#403F53"> </span><span style="--0:#ECC48D;--1:#3B61B0">john@example.org</span><span style="--0:#D6DEEB;--1:#403F53"> </span><span style="--0:#F78C6C;--1:#AA0982">\</span></div></div><div class="ec-line"><div class="code"><span class="indent"> </span><span style="--0:#82AAFF;--1:#3B61B0">--to</span><span style="--0:#D6DEEB;--1:#403F53"> </span><span style="--0:#ECC48D;--1:#3B61B0">lisa@example.com</span><span style="--0:#D6DEEB;--1:#403F53"> </span><span style="--0:#F78C6C;--1:#AA0982">\</span></div></div><div class="ec-line"><div class="code"><span class="indent"> </span><span style="--0:#82AAFF;--1:#3B61B0">-tls</span></div></div></code></pre><div class="copy"><div aria-live="polite"></div><button title="Copy to clipboard" data-copied="Copied!" data-code="swaks --server localhost:587 \ --from john@example.org \ --to lisa@example.com \ -tls"><div></div></button></div></figure></div>
|
||
<p>Postfix will still reject the email because we refused to authenticate:</p>
|
||
<div class="expressive-code"><figure class="frame not-content"><figcaption class="header"></figcaption><pre data-language="plaintext"><code><div class="ec-line"><div class="code"><span class="indent"><span style="--0:#d6deeb;--1:#403f53"> </span></span><span style="--0:#d6deeb;--1:#403f53">~> MAIL FROM:<john@example.org></span></div></div><div class="ec-line"><div class="code"><span style="--0:#d6deeb;--1:#403f53"><~ 250 2.1.0 Ok</span></div></div><div class="ec-line"><div class="code"><span class="indent"><span style="--0:#d6deeb;--1:#403f53"> </span></span><span style="--0:#d6deeb;--1:#403f53">~> RCPT TO:<lisa@example.com></span></div></div><div class="ec-line"><div class="code"><span style="--0:#d6deeb;--1:#403f53"><~* 553 5.7.1 <john@example.org>: Sender address rejected: not logged in</span></div></div></code></pre><div class="copy"><div aria-live="polite"></div><button title="Copy to clipboard" data-copied="Copied!" data-code=" ~> MAIL FROM:<john@example.org><~ 250 2.1.0 Ok ~> RCPT TO:<lisa@example.com><~* 553 5.7.1 <john@example.org>: Sender address rejected: not logged in"><div></div></button></div></figure></div>
|
||
<div class="sl-heading-wrapper level-h3"><h3 id="with-encryption-and-authentication">With encryption and authentication</h3><a class="sl-anchor-link" href="#with-encryption-and-authentication"><span aria-hidden="true" class="sl-anchor-icon"><svg width="16" height="16" viewBox="0 0 24 24"><path fill="currentcolor" d="m12.11 15.39-3.88 3.88a2.52 2.52 0 0 1-3.5 0 2.47 2.47 0 0 1 0-3.5l3.88-3.88a1 1 0 0 0-1.42-1.42l-3.88 3.89a4.48 4.48 0 0 0 6.33 6.33l3.89-3.88a1 1 0 1 0-1.42-1.42Zm8.58-12.08a4.49 4.49 0 0 0-6.33 0l-3.89 3.88a1 1 0 0 0 1.42 1.42l3.88-3.88a2.52 2.52 0 0 1 3.5 0 2.47 2.47 0 0 1 0 3.5l-3.88 3.88a1 1 0 1 0 1.42 1.42l3.88-3.89a4.49 4.49 0 0 0 0-6.33ZM8.83 15.17a1 1 0 0 0 1.1.22 1 1 0 0 0 .32-.22l4.92-4.92a1 1 0 0 0-1.42-1.42l-4.92 4.92a1 1 0 0 0 0 1.42Z"></path></svg></span><span class="sr-only">Section titled “With encryption and authentication”</span></a></div>
|
||
<div class="expressive-code"><figure class="frame is-terminal has-title not-content"><figcaption class="header"><span class="title">Run this on your server</span></figcaption><pre data-language="sh"><code><div class="ec-line"><div class="code"><span style="--0:#82AAFF;--1:#3B61B0">swaks</span><span style="--0:#D6DEEB;--1:#403F53"> </span><span style="--0:#82AAFF;--1:#3B61B0">--server</span><span style="--0:#D6DEEB;--1:#403F53"> </span><span style="--0:#ECC48D;--1:#3B61B0">localhost:587</span><span style="--0:#D6DEEB;--1:#403F53"> </span><span style="--0:#F78C6C;--1:#AA0982">\</span></div></div><div class="ec-line"><div class="code"><span class="indent"> </span><span style="--0:#82AAFF;--1:#3B61B0">--from</span><span style="--0:#D6DEEB;--1:#403F53"> </span><span style="--0:#ECC48D;--1:#3B61B0">john@example.org</span><span style="--0:#D6DEEB;--1:#403F53"> </span><span style="--0:#F78C6C;--1:#AA0982">\</span></div></div><div class="ec-line"><div class="code"><span class="indent"> </span><span style="--0:#82AAFF;--1:#3B61B0">--to</span><span style="--0:#D6DEEB;--1:#403F53"> </span><span style="--0:#ECC48D;--1:#3B61B0">lisa@example.com</span><span style="--0:#D6DEEB;--1:#403F53"> </span><span style="--0:#F78C6C;--1:#AA0982">\</span></div></div><div class="ec-line"><div class="code"><span class="indent"> </span><span style="--0:#82AAFF;--1:#3B61B0">-tls</span><span style="--0:#D6DEEB;--1:#403F53"> </span><span style="--0:#F78C6C;--1:#AA0982">\</span></div></div><div class="ec-line"><div class="code"><span class="indent"> </span><span style="--0:#82AAFF;--1:#3B61B0">--auth-user</span><span style="--0:#D6DEEB;--1:#403F53"> </span><span style="--0:#ECC48D;--1:#3B61B0">john@example.org</span><span style="--0:#D6DEEB;--1:#403F53"> </span><span style="--0:#F78C6C;--1:#AA0982">\</span></div></div><div class="ec-line"><div class="code"><span class="indent"> </span><span style="--0:#82AAFF;--1:#3B61B0">--auth-password</span><span style="--0:#D6DEEB;--1:#403F53"> </span><span style="--0:#ECC48D;--1:#3B61B0">summersun</span></div></div></code></pre><div class="copy"><div aria-live="polite"></div><button title="Copy to clipboard" data-copied="Copied!" data-code="swaks --server localhost:587 \ --from john@example.org \ --to lisa@example.com \ -tls \ --auth-user john@example.org \ --auth-password summersun"><div></div></button></div></figure></div>
|
||
<p>Also give the <code dir="auto">submissions</code> service a try:</p>
|
||
<div class="expressive-code"><figure class="frame is-terminal has-title not-content"><figcaption class="header"><span class="title">Run this on your server</span></figcaption><pre data-language="sh"><code><div class="ec-line"><div class="code"><span style="--0:#82AAFF;--1:#3B61B0">swaks</span><span style="--0:#D6DEEB;--1:#403F53"> </span><span style="--0:#82AAFF;--1:#3B61B0">--server</span><span style="--0:#D6DEEB;--1:#403F53"> </span><span style="--0:#ECC48D;--1:#3B61B0">localhost:465</span><span style="--0:#D6DEEB;--1:#403F53"> </span><span style="--0:#F78C6C;--1:#AA0982">\</span></div></div><div class="ec-line"><div class="code"><span class="indent"> </span><span style="--0:#82AAFF;--1:#3B61B0">--from</span><span style="--0:#D6DEEB;--1:#403F53"> </span><span style="--0:#ECC48D;--1:#3B61B0">john@example.org</span><span style="--0:#D6DEEB;--1:#403F53"> </span><span style="--0:#F78C6C;--1:#AA0982">\</span></div></div><div class="ec-line"><div class="code"><span class="indent"> </span><span style="--0:#82AAFF;--1:#3B61B0">--to</span><span style="--0:#D6DEEB;--1:#403F53"> </span><span style="--0:#ECC48D;--1:#3B61B0">lisa@example.com</span><span style="--0:#D6DEEB;--1:#403F53"> </span><span style="--0:#F78C6C;--1:#AA0982">\</span></div></div><div class="ec-line"><div class="code"><span class="indent"> </span><span style="--0:#82AAFF;--1:#3B61B0">--tls-on-connect</span><span style="--0:#D6DEEB;--1:#403F53"> </span><span style="--0:#F78C6C;--1:#AA0982">\</span></div></div><div class="ec-line"><div class="code"><span class="indent"> </span><span style="--0:#82AAFF;--1:#3B61B0">--auth-user</span><span style="--0:#D6DEEB;--1:#403F53"> </span><span style="--0:#ECC48D;--1:#3B61B0">john@example.org</span><span style="--0:#D6DEEB;--1:#403F53"> </span><span style="--0:#F78C6C;--1:#AA0982">\</span></div></div><div class="ec-line"><div class="code"><span class="indent"> </span><span style="--0:#82AAFF;--1:#3B61B0">--auth-password</span><span style="--0:#D6DEEB;--1:#403F53"> </span><span style="--0:#ECC48D;--1:#3B61B0">summersun</span></div></div></code></pre><div class="copy"><div aria-live="polite"></div><button title="Copy to clipboard" data-copied="Copied!" data-code="swaks --server localhost:465 \ --from john@example.org \ --to lisa@example.com \ --tls-on-connect \ --auth-user john@example.org \ --auth-password summersun"><div></div></button></div></figure></div>
|
||
<p>Did you notice the difference? The second time we used port <strong>465</strong> and instead of the <code dir="auto">-tls</code> option (which uses
|
||
STARTTLS to switch to encryption) we use <code dir="auto">--tls-on-connect</code> that uses TLS right from from the start.</p>
|
||
<p>Put simply, a mail server will accept an email if…</p>
|
||
<ul>
|
||
<li>it is responsible for handling mail for the recipient’s domain (the domain is listed as a virtual domain), or</li>
|
||
<li>the sender has authenticated successfully with a valid username and password.</li>
|
||
</ul>
|
||
<p>I have created two illustrations to explain it.</p>
|
||
<div class="sl-heading-wrapper level-h2"><h2 id="gory-details-of-authentication">Gory details of authentication</h2><a class="sl-anchor-link" href="#gory-details-of-authentication"><span aria-hidden="true" class="sl-anchor-icon"><svg width="16" height="16" viewBox="0 0 24 24"><path fill="currentcolor" d="m12.11 15.39-3.88 3.88a2.52 2.52 0 0 1-3.5 0 2.47 2.47 0 0 1 0-3.5l3.88-3.88a1 1 0 0 0-1.42-1.42l-3.88 3.89a4.48 4.48 0 0 0 6.33 6.33l3.89-3.88a1 1 0 1 0-1.42-1.42Zm8.58-12.08a4.49 4.49 0 0 0-6.33 0l-3.89 3.88a1 1 0 0 0 1.42 1.42l3.88-3.88a2.52 2.52 0 0 1 3.5 0 2.47 2.47 0 0 1 0 3.5l-3.88 3.88a1 1 0 1 0 1.42 1.42l3.88-3.89a4.49 4.49 0 0 0 0-6.33ZM8.83 15.17a1 1 0 0 0 1.1.22 1 1 0 0 0 .32-.22l4.92-4.92a1 1 0 0 0-1.42-1.42l-4.92 4.92a1 1 0 0 0 0 1.42Z"></path></svg></span><span class="sr-only">Section titled “Gory details of authentication”</span></a></div>
|
||
<aside aria-label="For science" class="starlight-aside starlight-aside--tip"> <p class="starlight-aside__title" aria-hidden="true"> <svg aria-hidden="true" class="starlight-aside__icon astro-c6vsoqas" width="16" height="16" viewBox="0 0 24 24" fill="currentColor" style="--sl-icon-size: 1em;"><path fill-rule="evenodd" d="M1.44 8.855v-.001l3.527-3.516c.34-.344.802-.541 1.285-.548h6.649l.947-.947c3.07-3.07 6.207-3.072 7.62-2.868a1.821 1.821 0 0 1 1.557 1.557c.204 1.413.203 4.55-2.868 7.62l-.946.946v6.649a1.845 1.845 0 0 1-.549 1.286l-3.516 3.528a1.844 1.844 0 0 1-3.11-.944l-.858-4.275-4.52-4.52-2.31-.463-1.964-.394A1.847 1.847 0 0 1 .98 10.693a1.843 1.843 0 0 1 .46-1.838Zm5.379 2.017-3.873-.776L6.32 6.733h4.638l-4.14 4.14Zm8.403-5.655c2.459-2.46 4.856-2.463 5.89-2.33.134 1.035.13 3.432-2.329 5.891l-6.71 6.71-3.561-3.56 6.71-6.711Zm-1.318 15.837-.776-3.873 4.14-4.14v4.639l-3.364 3.374Z" clip-rule="evenodd"/><path d="M9.318 18.345a.972.972 0 0 0-1.86-.561c-.482 1.435-1.687 2.204-2.934 2.619a8.22 8.22 0 0 1-1.23.302c.062-.365.157-.79.303-1.229.415-1.247 1.184-2.452 2.62-2.935a.971.971 0 1 0-.62-1.842c-.12.04-.236.084-.35.13-2.02.828-3.012 2.588-3.493 4.033a10.383 10.383 0 0 0-.51 2.845l-.001.016v.063c0 .536.434.972.97.972H2.24a7.21 7.21 0 0 0 .878-.065c.527-.063 1.248-.19 2.02-.447 1.445-.48 3.205-1.472 4.033-3.494a5.828 5.828 0 0 0 .147-.407Z"/></svg>For science </p> <div class="starlight-aside__content"> <p>This section is just here to show you the communication that happens on the network when relaying an email. It is no
|
||
mandatory reading matter. But relaying is a complex matter where things can go wrong. So taking a peek under hood may
|
||
improve your understanding.</p> </div> </aside>
|
||
<div class="expressive-code"><figure class="frame not-content"><figcaption class="header"></figcaption><pre data-language="plaintext"><code><div class="ec-line"><div class="code"><span style="--0:#d6deeb;--1:#403f53">telnet localhost submission</span></div></div></code></pre><div class="copy"><div aria-live="polite"></div><button title="Copy to clipboard" data-copied="Copied!" data-code="telnet localhost submission"><div></div></button></div></figure></div>
|
||
<p>The server will let you in:</p>
|
||
<div class="expressive-code"><figure class="frame not-content"><figcaption class="header"></figcaption><pre data-language="plaintext"><code><div class="ec-line"><div class="code"><span style="--0:#d6deeb;--1:#403f53">Trying 127.0.0.1…</span></div></div><div class="ec-line"><div class="code"><span style="--0:#d6deeb;--1:#403f53">Connected to localhost.</span></div></div><div class="ec-line"><div class="code"><span style="--0:#d6deeb;--1:#403f53">Escape character is '^]'.</span></div></div><div class="ec-line"><div class="code"><span style="--0:#d6deeb;--1:#403f53">220 webmail ESMTP Postfix (Debian)</span></div></div></code></pre><div class="copy"><div aria-live="polite"></div><button title="Copy to clipboard" data-copied="Copied!" data-code="Trying 127.0.0.1…Connected to localhost.Escape character is '^]'.220 webmail ESMTP Postfix (Debian)"><div></div></button></div></figure></div>
|
||
<p>Say hello:</p>
|
||
<div class="expressive-code"><figure class="frame not-content"><figcaption class="header"></figcaption><pre data-language="plaintext"><code><div class="ec-line"><div class="code"><span style="--0:#d6deeb;--1:#403f53">ehlo example.com</span></div></div></code></pre><div class="copy"><div aria-live="polite"></div><button title="Copy to clipboard" data-copied="Copied!" data-code="ehlo example.com"><div></div></button></div></figure></div>
|
||
<p>Postfix will present a list of features that are available for you:</p>
|
||
<div class="expressive-code"><figure class="frame not-content"><figcaption class="header"></figcaption><pre data-language="plaintext"><code><div class="ec-line"><div class="code"><span style="--0:#d6deeb;--1:#403f53">250-mailtest</span></div></div><div class="ec-line"><div class="code"><span style="--0:#d6deeb;--1:#403f53">250-PIPELINING</span></div></div><div class="ec-line"><div class="code"><span style="--0:#d6deeb;--1:#403f53">250-SIZE 10240000</span></div></div><div class="ec-line"><div class="code"><span style="--0:#d6deeb;--1:#403f53">250-VRFY</span></div></div><div class="ec-line"><div class="code"><span style="--0:#d6deeb;--1:#403f53">250-ETRN</span></div></div><div class="ec-line"><div class="code"><span style="--0:#d6deeb;--1:#403f53">250-STARTTLS</span></div></div><div class="ec-line"><div class="code"><span style="--0:#d6deeb;--1:#403f53">250-ENHANCEDSTATUSCODES</span></div></div><div class="ec-line"><div class="code"><span style="--0:#d6deeb;--1:#403f53">250-8BITMIME</span></div></div><div class="ec-line"><div class="code"><span style="--0:#d6deeb;--1:#403f53">250-DSN</span></div></div><div class="ec-line"><div class="code"><span style="--0:#d6deeb;--1:#403f53">250-SMTPUTF8</span></div></div><div class="ec-line"><div class="code"><span style="--0:#d6deeb;--1:#403f53">250 CHUNKING</span></div></div></code></pre><div class="copy"><div aria-live="polite"></div><button title="Copy to clipboard" data-copied="Copied!" data-code="250-mailtest250-PIPELINING250-SIZE 10240000250-VRFY250-ETRN250-STARTTLS250-ENHANCEDSTATUSCODES250-8BITMIME250-DSN250-SMTPUTF8250 CHUNKING"><div></div></button></div></figure></div>
|
||
<p>Let me briefly explain what these lines mean:</p>
|
||
<ul>
|
||
<li>PIPELINING<br>
|
||
This is a feature to speed up SMTP communication. Usually the remote system has to wait for a response to every
|
||
command it sends. Pipelining allows the remote server to send several commands in a batch without waiting for a
|
||
response. Postfix will just store these commands and execute them one by one. If you told Postfix to forbid pipelining
|
||
it would disconnect the remote server when it tries to send bulks of commands without waiting for the proper reply. It
|
||
is mainly a feature against rogue senders.</li>
|
||
<li>SIZE 10240000<br>
|
||
The remote server is allowed to send emails up to 10 MB large. This has long been a common maximum size for emails.
|
||
However nowadays 40 MB or even more are more common sizes because emails have grown larger. Some mail servers even
|
||
allow 100 MB.</li>
|
||
<li>VRFY<br>
|
||
Allows remote servers to verify a given name or email address. For example the remote server could send “VRFY john”
|
||
and your server might respond <code dir="auto">250 Jo You can skip it for now.hn Doe <john@example.org></code>. It can be used to verify
|
||
that a certain recipient email address is deliverable</li>
|
||
<li>ETRN<br>
|
||
A command that a remote system can send to flush the Postfix queue of mails for a certain domain. It can be used if
|
||
the remote system had technical problems and failed to receive email for a while. Then it could send an ETRN command
|
||
to make your server start sending outstanding emails for that domain. It is rarely used.</li>
|
||
<li>STARTTLS<br>
|
||
This tells the remote system that it might start switching from this unencrypted to an encrypted connection by
|
||
sending the “STARTTLS” command. It will then start negotiating a TLS-encrypted connection. You could compare it to an
|
||
HTTP connection that suddenly switches over to an encrypted HTTPS connection. The advantage is that you can start
|
||
talking SMTP on TCP port 25 and don’t have to open up a second TCP port like 465 which is the “SSMTP” (secure SMTP)
|
||
port and only accepts encrypted connections.</li>
|
||
<li>ENHANCEDSTATUSCODES<br>
|
||
This enables more three-digit return codes for various conditions. See the
|
||
<a href="http://tools.ietf.org/html/rfc2034">RFC2034</a> if you are curious.</li>
|
||
<li>8BITMIME<br>
|
||
In ancient times SMTP only processed 7-bit characters. You couldn’t transfer special characters like “Ä” or “ß”
|
||
without special encoding. 8BITMIME allows a transmission of emails using 8-bit characters. Still many emails are
|
||
specially encoded using ISO8859-1 or UTF-8.</li>
|
||
<li>DSN<br>
|
||
It enables DSNs (delivery status notofications) that allows the sender to control the messages that Postfix creates
|
||
when an email could not be delivered as intended.</li>
|
||
<li>SMTPUTF8<br>
|
||
In addition to 8BITMIME you can use UTF8 encoded characters in header fields.</li>
|
||
<li>CHUNKING<br>
|
||
This feature (described in <a href="https://tools.ietf.org/html/rfc3030">RFC 3030</a>) makes sending of large emails more
|
||
efficient.</li>
|
||
</ul>
|
||
<p>However one important line is missing here that would allow us to send our username and password:</p>
|
||
<div class="expressive-code"><figure class="frame not-content"><figcaption class="header"></figcaption><pre data-language="plaintext"><code><div class="ec-line"><div class="code"><span style="--0:#d6deeb;--1:#403f53">250-AUTH PLAIN LOGIN</span></div></div></code></pre><div class="copy"><div aria-live="polite"></div><button title="Copy to clipboard" data-copied="Copied!" data-code="250-AUTH PLAIN LOGIN"><div></div></button></div></figure></div>
|
||
<p>We told Postfix to only allow authentication when the connection is encrypted. So we are not offered authentication over
|
||
this plain text connection. That’s what we want.</p>
|
||
<p>Are you still connected? Okay, good. So we need an encrypted connection using TLS. Using the STARTTLS feature we can
|
||
switch over from unencrypted to encrypted without having to reconnect. Enter…</p>
|
||
<div class="expressive-code"><figure class="frame not-content"><figcaption class="header"></figcaption><pre data-language="plaintext"><code><div class="ec-line"><div class="code"><span style="--0:#d6deeb;--1:#403f53">STARTTLS</span></div></div></code></pre><div class="copy"><div aria-live="polite"></div><button title="Copy to clipboard" data-copied="Copied!" data-code="STARTTLS"><div></div></button></div></figure></div>
|
||
<p>And the server replies:</p>
|
||
<div class="expressive-code"><figure class="frame not-content"><figcaption class="header"></figcaption><pre data-language="plaintext"><code><div class="ec-line"><div class="code"><span style="--0:#d6deeb;--1:#403f53">220 2.0.0 Ready to start TLS</span></div></div></code></pre><div class="copy"><div aria-live="polite"></div><button title="Copy to clipboard" data-copied="Copied!" data-code="220 2.0.0 Ready to start TLS"><div></div></button></div></figure></div>
|
||
<p>However now it’s getting weird because you would have to speak TLS encryption which is not a language that humans speak.
|
||
So let’s quit this using the “QUIT” command and do that differently:</p>
|
||
<div class="expressive-code"><figure class="frame not-content"><figcaption class="header"></figcaption><pre data-language="plaintext"><code><div class="ec-line"><div class="code"><span style="--0:#d6deeb;--1:#403f53">QUIT</span></div></div></code></pre><div class="copy"><div aria-live="polite"></div><button title="Copy to clipboard" data-copied="Copied!" data-code="QUIT"><div></div></button></div></figure></div>
|
||
<p>We can use OpenSSL to help us with the decryption. Run:</p>
|
||
<div class="expressive-code"><figure class="frame not-content"><figcaption class="header"></figcaption><pre data-language="plaintext"><code><div class="ec-line"><div class="code"><span style="--0:#d6deeb;--1:#403f53">openssl s_client -connect localhost:submission -starttls smtp</span></div></div></code></pre><div class="copy"><div aria-live="polite"></div><button title="Copy to clipboard" data-copied="Copied!" data-code="openssl s_client -connect localhost:submission -starttls smtp"><div></div></button></div></figure></div>
|
||
<p>You will see a lot of output. OpenSSL has connected to TCP port 25 and issued a STARTTLS command to switch to an
|
||
encrypted connection. So whatever you type now will get encrypted. Enter:</p>
|
||
<div class="expressive-code"><figure class="frame not-content"><figcaption class="header"></figcaption><pre data-language="plaintext"><code><div class="ec-line"><div class="code"><span style="--0:#d6deeb;--1:#403f53">EHLO example.com</span></div></div></code></pre><div class="copy"><div aria-live="polite"></div><button title="Copy to clipboard" data-copied="Copied!" data-code="EHLO example.com"><div></div></button></div></figure></div>
|
||
<p>And Postfix will send a list of capabilities that will look like this:</p>
|
||
<div class="expressive-code"><figure class="frame not-content"><figcaption class="header"></figcaption><pre data-language="plaintext"><code><div class="ec-line"><div class="code"><span style="--0:#d6deeb;--1:#403f53">250-PIPELINING</span></div></div><div class="ec-line"><div class="code"><span style="--0:#d6deeb;--1:#403f53">250-SIZE 10240000</span></div></div><div class="ec-line"><div class="code"><span style="--0:#d6deeb;--1:#403f53">250-VRFY</span></div></div><div class="ec-line"><div class="code"><span style="--0:#d6deeb;--1:#403f53">250-ETRN</span></div></div><div class="ec-line"><div class="code"><span style="--0:#d6deeb;--1:#403f53">250-AUTH PLAIN LOGIN</span></div></div><div class="ec-line"><div class="code"><span style="--0:#d6deeb;--1:#403f53">250-ENHANCEDSTATUSCODES</span></div></div><div class="ec-line"><div class="code"><span style="--0:#d6deeb;--1:#403f53">250-8BITMIME</span></div></div><div class="ec-line"><div class="code"><span style="--0:#d6deeb;--1:#403f53">250 DSN</span></div></div></code></pre><div class="copy"><div aria-live="polite"></div><button title="Copy to clipboard" data-copied="Copied!" data-code="250-PIPELINING250-SIZE 10240000250-VRFY250-ETRN250-AUTH PLAIN LOGIN250-ENHANCEDSTATUSCODES250-8BITMIME250 DSN"><div></div></button></div></figure></div>
|
||
<p>And now that we are using an encrypted connection Postfix offers us to authenticate. So let us send the authentication
|
||
string with a Base64-encoded password:</p>
|
||
<div class="expressive-code"><figure class="frame not-content"><figcaption class="header"></figcaption><pre data-language="plaintext"><code><div class="ec-line"><div class="code"><span style="--0:#d6deeb;--1:#403f53">AUTH PLAIN AGpvaG5AZXhhbXBsZS5vcmcAc3VtbWVyc3Vu</span></div></div></code></pre><div class="copy"><div aria-live="polite"></div><button title="Copy to clipboard" data-copied="Copied!" data-code="AUTH PLAIN AGpvaG5AZXhhbXBsZS5vcmcAc3VtbWVyc3Vu"><div></div></button></div></figure></div>
|
||
<p>Unless you have changed John’s password to something else than “summersun” the server should accept that authentication:</p>
|
||
<div class="expressive-code"><figure class="frame not-content"><figcaption class="header"></figcaption><pre data-language="plaintext"><code><div class="ec-line"><div class="code"><span style="--0:#d6deeb;--1:#403f53">235 2.7.0 Authentication successful</span></div></div></code></pre><div class="copy"><div aria-live="polite"></div><button title="Copy to clipboard" data-copied="Copied!" data-code="235 2.7.0 Authentication successful"><div></div></button></div></figure></div>
|
||
<p>Excellent. You are logged in through SMTP. You could now send an email to be forwarded to another mail server. I just
|
||
wanted to show that authentication works if you use an encrypted connection.</p>
|
||
<p>Disconnect from Postfix:</p>
|
||
<div class="expressive-code"><figure class="frame not-content"><figcaption class="header"></figcaption><pre data-language="plaintext"><code><div class="ec-line"><div class="code"><span style="--0:#d6deeb;--1:#403f53">QUIT</span></div></div></code></pre><div class="copy"><div aria-live="polite"></div><button title="Copy to clipboard" data-copied="Copied!" data-code="QUIT"><div></div></button></div></figure></div>
|
||
<p>Authentication works. Well done.</p>
|
||
<p>Wait a minute. What was that crazy cryptic string? There was no username and password in it. Was it encrypted?</p>
|
||
<p>No, that was no encryption. It was merely an <em>encoded</em> version of the username and password. Why that? Well usually in
|
||
SMTP you can only transfer ASCII characters. But the password may contain special characters which are not covered by
|
||
ASCII. So in the <em>PLAIN</em> method that information is <a href="https://en.wikipedia.org/wiki/Base64">Base64</a> encoded.</p>
|
||
<p>What is actually converted to Base64…</p>
|
||
<div class="expressive-code"><figure class="frame not-content"><figcaption class="header"></figcaption><pre data-language="plaintext"><code><div class="ec-line"><div class="code"><span style="--0:#d6deeb;--1:#403f53">NULL-BYTE + USERNAME + NULL-BYTE + PASSWORD</span></div></div></code></pre><div class="copy"><div aria-live="polite"></div><button title="Copy to clipboard" data-copied="Copied!" data-code="NULL-BYTE + USERNAME + NULL-BYTE + PASSWORD"><div></div></button></div></figure></div>
|
||
<p>So for John’s case you can easily create the Base64 string using:</p>
|
||
<div class="expressive-code"><figure class="frame not-content"><figcaption class="header"></figcaption><pre data-language="plaintext"><code><div class="ec-line"><div class="code"><span style="--0:#d6deeb;--1:#403f53">printf '\0john@example.org\0summersun' | base64</span></div></div></code></pre><div class="copy"><div aria-live="polite"></div><button title="Copy to clipboard" data-copied="Copied!" data-code="printf '\0john@example.org\0summersun' | base64"><div></div></button></div></figure></div>
|
||
<p>As a result you will get the exact same string you used above with “AUTH PLAIN”.</p>
|
||
<section data-footnotes="" class="footnotes"><div class="sl-heading-wrapper level-h2"><h2 class="sr-only" id="footnote-label">Footnotes</h2><a class="sl-anchor-link" href="#footnote-label"><span aria-hidden="true" class="sl-anchor-icon"><svg width="16" height="16" viewBox="0 0 24 24"><path fill="currentcolor" d="m12.11 15.39-3.88 3.88a2.52 2.52 0 0 1-3.5 0 2.47 2.47 0 0 1 0-3.5l3.88-3.88a1 1 0 0 0-1.42-1.42l-3.88 3.89a4.48 4.48 0 0 0 6.33 6.33l3.89-3.88a1 1 0 1 0-1.42-1.42Zm8.58-12.08a4.49 4.49 0 0 0-6.33 0l-3.89 3.88a1 1 0 0 0 1.42 1.42l3.88-3.88a2.52 2.52 0 0 1 3.5 0 2.47 2.47 0 0 1 0 3.5l-3.88 3.88a1 1 0 1 0 1.42 1.42l3.88-3.89a4.49 4.49 0 0 0 0-6.33ZM8.83 15.17a1 1 0 0 0 1.1.22 1 1 0 0 0 .32-.22l4.92-4.92a1 1 0 0 0-1.42-1.42l-4.92 4.92a1 1 0 0 0 0 1.42Z"></path></svg></span><span class="sr-only">Section titled “Footnotes”</span></a></div>
|
||
<ol>
|
||
<li id="user-content-fn-1">
|
||
<p>In previous guides I recommended to set <code dir="auto">smtpd_sasl_auth_enable=yes</code> globally in the <code dir="auto">main.cf</code>. That would indeed
|
||
enable authentication on port 25. For a clearer separation I now rather suggest to leave it out (default is <code dir="auto">no</code>)
|
||
and just enable authentication on the <code dir="auto">submission</code> service in the <code dir="auto">master.cf</code> file. A possible scenario that
|
||
required this setting to be <code dir="auto">on</code> would be if your server were a relay (<em>smarthost</em>) for other servers using
|
||
authentication.. <a href="#user-content-fnref-1" data-footnote-backref="" aria-label="Back to reference 1" class="data-footnote-backref">↩</a> <a href="#user-content-fnref-1-2" data-footnote-backref="" aria-label="Back to reference 1-2" class="data-footnote-backref">↩<sup>2</sup></a></p>
|
||
</li>
|
||
</ol>
|
||
</section> </div> <footer> <footer class="sl-flex astro-3yyafb3n"> <div class="meta sl-flex astro-3yyafb3n"> <p>Last updated: <time datetime="2025-11-01T00:00:00.000Z">Nov 1, 2025</time></p> </div> <div class="pagination-links print:hidden astro-u2l5gyhi" dir="ltr"> <a href="/ispmail-trixie/webmail/" rel="prev" class="astro-u2l5gyhi"> <svg aria-hidden="true" class="astro-u2l5gyhi astro-c6vsoqas" width="16" height="16" viewBox="0 0 24 24" fill="currentColor" style="--sl-icon-size: 1.5rem;"><path d="M17 11H9.41l3.3-3.29a1.004 1.004 0 1 0-1.42-1.42l-5 5a1 1 0 0 0-.21.33 1 1 0 0 0 0 .76 1 1 0 0 0 .21.33l5 5a1.002 1.002 0 0 0 1.639-.325 1 1 0 0 0-.219-1.095L9.41 13H17a1 1 0 0 0 0-2Z"/></svg> <span class="astro-u2l5gyhi"> Previous <br class="astro-u2l5gyhi"> <span class="link-title astro-u2l5gyhi">Webmail using Roundcube</span> </span> </a> <a href="/ispmail-trixie/imap/" rel="next" class="astro-u2l5gyhi"> <svg aria-hidden="true" class="astro-u2l5gyhi astro-c6vsoqas" width="16" height="16" viewBox="0 0 24 24" fill="currentColor" style="--sl-icon-size: 1.5rem;"><path d="M17.92 11.62a1.001 1.001 0 0 0-.21-.33l-5-5a1.003 1.003 0 1 0-1.42 1.42l3.3 3.29H7a1 1 0 0 0 0 2h7.59l-3.3 3.29a1.002 1.002 0 0 0 .325 1.639 1 1 0 0 0 1.095-.219l5-5a1 1 0 0 0 .21-.33 1 1 0 0 0 0-.76Z"/></svg> <span class="astro-u2l5gyhi"> Next <br class="astro-u2l5gyhi"> <span class="link-title astro-u2l5gyhi">IMAP</span> </span> </a> </div> </footer> <script defer src="https://comentario.workaround.org/comentario.js"></script>
|
||
<comentario-comments no-fonts="true" id="comments"></comentario-comments> <div class="myfooter">
|
||
This guide is maintained by <a href="mailto:ispmail@christoph-haas.de">Christoph Haas</a> since 2003. All content on workaround.org can be used under the terms of
|
||
the
|
||
<a href="https://creativecommons.org/licenses/by-nc-sa/4.0/" target="_blank">Creative Commons BY-NC-SA license</a>.
|
||
Penguin image based on AI art because I suck at drawing.
|
||
</div> </footer> </div> </div> </main> </div> </div> </div> </div> </body></html> |