After a year of development, the release of the new stable version of the Postfix mail server — 3.6.0 — has occurred. At the same time, support for the Postfix 3.2 branch, released in early 2017, has been discontinued. Postfix is one of the few projects that combines high security, reliability, and performance, thanks to its thoughtful architecture and strict code and patch audit policies. The project code is distributed under the EPL 2.0 (Eclipse Public License) and IPL 1.0 (IBM Public License) licenses.
According to an automated survey conducted in April involving about 600 thousand mail servers, serversPostfix is used on 33.66% (down from 34.29% a year ago) of mail servers, while Exim holds 59.14% (up from 57.77%), Sendmail stands at 3.6% (down from 3.83%), MailEnable at 2.02% (down from 2.12%), MDaemon at 0.60% (down from 0.77%), and Microsoft Exchange at 0.32% (down from 0.47%).
Key innovations:
- Due to changes in the internal protocols used for interaction between Postfix components, it is essential to stop the mail server server using the command "postfix stop" before updating. Otherwise, issues may occur with the pickup, qmgr, verify, tlsproxy, and postscreen processes, which could lead to delays in sending emails until Postfix is restarted.
- The references to the terms 'white' and 'black', perceived by some members of the community as racial discrimination, have been removed. Instead of 'whitelist' and 'blacklist', it is now recommended to use 'allowlist' and 'denylist' (for example, the postscreen_allowlist_interfaces, postscreen_denylist_action, and postscreen_dnsbl_allowlist_threshold parameters). These changes affect the documentation, the configuration of the postscreen process (the built-in firewall), and the information logged. postfix/postscreen[pid]: ALLOWLIST VETO [address]:port postfix/postscreen[pid]: ALLOWLISTED [address]:port postfix/postscreen[pid]: DENYLISTED [address]:port
To retain the old terms in logs, the parameter 'respectful_logging = no' should be specified in main.cf before 'compatibility_level = 3.6'. Support for the old names of postscreen settings has been maintained for backward compatibility. The configuration file 'master.cf' also remains unchanged.
- In compatibility mode "compatibility_level = 3.6", the default transition to the use of the SHA256 hash function instead of MD5 has been implemented. When an earlier version is specified in the compatibility_level parameter, MD5 continues to be used, but for hash-related settings where the algorithm is not explicitly defined, a warning will be logged. Support for the export version of the Diffie-Hellman key exchange protocol has been discontinued (the tlsproxy_tls_dh512_param_file parameter value is now ignored).
- Diagnostics for issues related to specifying an incorrect handler program in master.cf have been simplified. To identify such errors, each internal service, including postdrop, now announces the protocol name before starting data exchange, and each client process, including sendmail, verifies that the declared protocol name matches the supported variant.
- A new type of match "local_login_sender_maps" has been added for flexible management of the sender envelope address (provided in the "MAIL FROM" command during the SMTP session) in sendmail and postdrop processes. For example, to allow local users, except for root and postfix, to specify only their logins in sendmail using UID binding to name, the following settings can be used: /etc/postfix/main.cf: local_login_sender_maps = inline:{ { root = *}, { postfix = * } }, pcre:/etc/postfix/login_senders /etc/postfix/login_senders: # Both logins and login@domain forms are allowed. /(.+) / $1 $1…@example.com
- A new setting "smtpd_relay_before_recipient_restrictions=yes" has been added and is activated by default, whereby the SMTP server will check smtpd_relay_restrictions before smtpd_recipient_restrictions, instead of the other way around, as it was previously.
- The parameter "smtpd_sasl_mechanism_list" has been added, with a default value of "!external, static:rest" to prevent confusing errors when the SASL backend declares support for the "EXTERNAL" mode, which is not supported in Postfix.
- A new API supporting multithreading (threadsafe) is now used by default for DNS name resolution. To build with the old API, specify during the build "make makefiles CCARGS="-DNO_RES_NCALLS…".
- The mode "enable_threaded_bounces = yes" has been added to substitute notifications regarding delivery issues, delayed delivery, or delivery confirmation with the same discussion identifier (the notification will be shown by the mail client in the same thread, along with other messages in the conversation).
- By default, the use of the system database /etc/services to determine TCP port numbers for SMTP and LMTP has been discontinued. Instead, port numbers are configured via the known_tcp_ports parameter (by default lmtp=24, smtp=25, smtps=submissions=465, submission=587). If any service is missing in known_tcp_ports, /etc/services will still be used.
- The compatibility level has been raised to the value "3.6" (previously, the parameter was changed twice, in addition to 3.6, supported values are 0 (default), 1, and 2). From now on, the "compatibility_level" will change to the version number in which the changes that break compatibility were made. Separate comparison operators, such as "<=level" and "< level", have been added for checking compatibility levels in main.cf and master.cf (standard comparison operators do not apply as they would consider 3.10 less than 3.9).
Source: opennet.ru
