![\"The](\"\/wp-content\/uploads\/2024\/03\/e675c9211d656f8603bcbc42ad9b67bf.gif\")
<\/center> <\/p>\nKey innovations: <\/p>\n
- \n
- A client for MongoDB has been added, allowing the storage of the database of virtual users, aliases, address mapping lists, and various verification tables in this DBMS. To configure access to MongoDB, a table type 'mongodb' has been added. For example, 'alias_maps = proxy:mongodb:\/etc\/postfix\/mongo.cf', where mongo.cf is the file containing the connection settings to MongoDB and the query filter.\n
- The local delivery agent has added the capability to export the forwarding identifier provided during the SMTP session via the ENVID (Envelope ID) parameter in the ESMTP MAIL command (RFC 3461). The identifier is recorded in the ENVID environment variable and passed to the delivery agent via the command line parameter '${envid}'.\n
- In the clients for storing data in MySQL ('mysql:') and PostgreSQL ('pgsql:'), parameters have been added: 'idle_interval' to specify the inactive time before closing the connection and 'retry_interval' to set the retry request timer. By default, these parameters are set to 60 seconds. The 'retry_interval' value can be decreased, for instance, to shorten recovery time after errors when using only one server in the 'hosts' attribute.\n
- In the MySQL client, a 'charset' setting has been added to specify the default character encoding. By default, the value 'utf8mb4' is used, corresponding to the default settings in MySQL 8.0 (earlier releases used 'latin1'). Support for versions older than MySQL 4.0 (i.e., versions released before 2003) has been discontinued.\n
- An optional feature has been provided to request a self-signed (raw) public key for TLS, not tied to a certification authority, instead of an X.509 certificate. Using raw keys for client and server authentication is enabled through the settings 'smtpd_tls_enable_rpk = yes' and 'smtp_tls_enable_rpk = yes', but the verification behavior greatly depends on the set security level and support for raw keys in the local TLS implementation (see documentation).\n
- Initial support for OpenSSL configuration files has been added. To specify a link to a file with TLS settings, the parameter tls_config_file is suggested, and for indicating the name of the section with settings from the configuration file, the parameter 'tls_config_name' is proposed. The binding to OpenSSL configuration files can be used to reduce dependence on distribution settings, the security level of which may lead to an increase in the number of messages sent without encryption.\n
- In message headers, the formatting of day numbers in dates has been changed \u2014 days 1 to 9 are now prefixed with a zero instead of a space (i.e., '01', '02', etc.). This change was made because RFC 5322 recommends using single spaces as separators in dates.\n
- Protection against certain types of 'Blind' attacks (SSRF attacks on web clients aimed at accessing the server via SMTP) has been added, which is applied with the setting 'smtpd_forbid_unauth_pipelining = yes' (by default).\n
- The setting 'smtpd_forbid_bare_newline = normalize' is enabled by default, providing the server protection against 'SMTP smuggling' attacks that allow a single message to be split into several different messages using a non-standard sequence to separate mails. Protection has also been added against outgoing SMTP smuggling attacks, where an attacker uses a Postfix-based server to attack another SMTP server. By default, the setting 'cleanup_replace_stray_cr_lf = yes' is enabled, replacing extra and characters with space.\n
- In the DNS client implementation, the size of returned results for DNS queries is now limited to 100 records, which is 20 times more than the maximum supported in the SMTP client. (the key to connect to is specified, and iroh finds the associated host and establishes an encrypted connection using the QUIC protocol). Direct P2P connections are established whenever possible, but if not, it falls back to using relays, which are also employed for host discovery by keys. You can run your own relay or connect to public relays supported by the community.<\/a> for a single server.\n
- The parameters 'disable_dns_lookup' and 'permit_mx_backup' have been deprecated, along with some TLS configuration parameters.\n
- Support for settings that were declared obsolete approximately 20 years ago has been discontinued: 'permit_naked_ip_address', 'check_relay_domains', and 'reject_maps_rbl'. <\/ul>\n