snapshot-20020106

postfix/0README

@@ -103,6 +103,7 @@ wietse@porcupine.org to avoid duplication of effort.
 
 Documentation:
 
+    README_FILES/	Instructions for specific Postfix features
     html/		HTML format
     man/		UNIX on-line manual page format
 
@@ -127,6 +128,7 @@ Command-line utilities:
     src/postlock/	Postfix locking for shell scripts
     src/postlog/	Postfix logging for shell scripts
     src/postmap/	Postfix lookup table management
+    src/postqueue/	Postfix queue control program
     src/postsuper/	Postfix house keeping program
     src/sendmail/	Sendmail compatibility interface
 
@@ -151,7 +153,7 @@ Postfix daemons:
 Test programs:
 
     src/fsstone/	Measure file system overhead
-    src/smtpstone/	SMTP server torture test
+    src/smtpstone/	SMTP and QMQP server torture test
 
 Miscellaneous:
 

postfix/HISTORY

@@ -5902,6 +5902,16 @@ Apologies for any names omitted.
 	Security: additional run-time checks to discourage sharing
 	of Postfix user/group ID values with other accounts.
 
+20020104
+
+	Cleanup: SMTPD access maps now return DUNNO (undetermined)
+	instead of OK when a recipient address contains multiple
+	domains (user@dom1@dom2, etcetera).  Victor Duchovny, Morgan
+	Stanley.  File:  smtpd/smtpd_check.c.
+
+	Bugfix: SMTPD access maps did not handle address extensions.
+	File: smtpd/smtpd_check.c.
+
 Open problems:
 
 	Low: don't do user@domain and @domain lookups in
@@ -5917,9 +5927,6 @@ Open problems:
 	Medium: make address rewriting on/off configurable for
 	envelopes and/or headers.
 
-	Medium: smtpd access maps don't understand the recipient
-	delimiter setting.
-
 	Low: generic showq protocol, to allow for more intelligent
 	processing than just mailq. Maybe marry this with postsuper.
 

postfix/Makefile.in

@@ -6,8 +6,8 @@ DIRS	= src/util src/global src/dns src/master src/postfix src/smtpstone \
 	src/lmtp src/trivial-rewrite src/qmgr src/smtp src/bounce src/pipe \
 	src/showq src/postalias src/postcat src/postconf src/postdrop \
 	src/postkick src/postlock src/postlog src/postmap src/postqueue \
-	src/postsuper src/nqmgr src/qmqpd src/spawn src/flush src/virtual \
+	src/postsuper src/nqmgr src/qmqpd src/spawn src/flush src/virtual
-	# proto man html
+MANDIRS	= proto man html
 
 default: update
 
@@ -23,6 +23,11 @@ update printfck:
 	 (set -e; echo "[$$i]"; cd $$i; $(MAKE) $(OPTS) $@ MAKELEVEL=) || exit 1; \
 	done
 
+manpages:
+	set -e; for i in $(MANDIRS); do \
+	 (set -e; echo "[$$i]"; cd $$i; $(MAKE) -f Makefile.in $(OPTS) MAKELEVEL=) || exit 1; \
+	done
+
 printfck: update
 
 install: update

postfix/README_FILES/FILTER_README

@@ -2,60 +2,33 @@ This is a very first implementation of Postfix content filtering.
 A Postfix content filter receives unfiltered mail from Postfix and
 either bounces the mail or re-injects filtered mail back into Postfix.
 
-It involves an incompatible change to queue file formats.  Older
-Postfix versions will reject mail that needs to be content filtered,
-and will move the queue file to the "corrupt" mail queue subdirectory.
-
 This document describes two approaches to content filtering.
 
 Simple content filtering example
 ================================
 
-The first example is simpler to set up, but is also more resource
+The first example is simple to set up.  It uses a shell script that
-intensive.  With the shell script as shown you will lose a factor
+receives unfiltered mail from the Postfix pipe delivery agent, and
-of four in Postfix performance for transit mail that arrives and
+that feeds filtered mail back into the Postfix sendmail command.
-leaves via SMTP. You will lose another factor in transit performance
+Only mail arriving via SMTP will be content filtered.
-for each additional temporary file that is created and deleted in
-the process of content filtering.  The performance impact is less
-for mail that is submitted or delivered locally, because such
-deliveries are not as fast as SMTP transit mail.
 
-The example assumes that only mail arriving via SMTP needs to be
+                  ..................................
-content filtered.
+                  :            Postfix             :
-
+Unfiltered mail----->smtpd \                /local---->Filtered mail
-      ..................................
+                  :         -cleanup->queue-       :
-      :            Postfix             :
+               ---->pickup /                \smtp----->Filtered mail
-   ----->smtpd \                /local---->
+               ^  :                        |       :
-      :         -cleanup->queue-       :
+               |  :                         \pipe-----+
-   ---->pickup /                \smtp----->
+               |  ..................................  |
-   ^  :                        |       :
+               |                                      |
-   |  :                         \pipe-----+
+               |                                      |
-   |  ..................................  |
+               +-Postfix sendmail<----filter script<--+
-   |                                      |
-   |                                      |
-   +------sendmail<-------filter<---------+
-
-1 - Create a dedicated local user account called "filter".  The
-    user will never log in, and can be given a "*" password and
-    non-existent shell and home directory. This user handles all
-    potentially dangerous mail content - that is why it should be
-    a separate account.
-
-2 - Create a directory /var/spool/filter that is accessible only
-    to the "filter" user. This is where the content filtering will
-    store its temporary files.
-
-3 - Define a content filtering entry in the Postfix master file:
-
-    /etc/postfix/master.cf:
-      filter    unix  -       n       n       -       -       pipe
-        flags=Rq user=filter argv=/somewhere/filter -f ${sender} -- ${recipient}
 
 The /some/where/filter program can be a simple shell script like this:
 
     #!/bin/sh
 
-    # Localize these
+    # Localize these.
     INSPECT_DIR=/var/spool/filter
     SENDMAIL="/usr/sbin/sendmail -i"
 
@@ -88,21 +61,53 @@ exit status of the filter command is whatever exit status Postfix
 sendmail produces.
 
 I suggest that you play with this script for a while until you are
-satisfied with the results. Run it as the filter user, with a real
+satisfied with the results. Run it with a real message (headers+body)
-message (headers+body) as input:
+as input:
 
     % /some/where/filter -f sender recipient... <message-file
 
-Turn on content filtering for mail arriving via SMTP only, by
+Once you're satisfied with the content filtering script:
-appending "-o content_filter=filter:dummy" to the master.cf
+
-entry that defines the Postfix SMTP server:
+1 - Create a dedicated local user account called "filter".  This
+    user handles all potentially dangerous mail content - that is
+    why it should be a separate account. Do not use "nobody", and
+    most certainly do not use "root" or "postfix".  The user will
+    never log in, and can be given a "*" password and non-existent
+    shell and home directory.
+
+2 - Create a directory /var/spool/filter that is accessible only
+    to the "filter" user. This is where the content filtering script
+    is supposed to store its temporary files.
+
+3 - Define the content filter in the Postfix master file:
+
+    /etc/postfix/master.cf:
+      filter    unix  -       n       n       -       -       pipe
+        flags=Rq user=filter argv=/somewhere/filter -f ${sender} -- ${recipient}
+
+To turn on content filtering for mail arriving via SMTP only, append
+"-o content_filter=filter:" to the master.cf entry that defines
+the Postfix SMTP server:
 
     /etc/postfix/master.cf:
 	smtp      inet     ...stuff...      smtpd
-	    -o content_filter=filter:dummy
+	    -o content_filter=filter:
 
-The content_filter configuration parameter accepts the same
+Note the ":" at the end!!  The content_filter configuration parameter
-syntax as the right-hand side in a Postfix transport table.
+accepts the same syntax as the right-hand side in a Postfix transport
+table. Execute "postfix reload" to complete the change.
+
+To turn off content filtering, edit the master.cf file, remove the
+"-o content_filter=filter:" text from the entry that defines the
+Postfix SMTP server, and execute another "postfix reload".
+
+With the shell script as shown above you will lose a factor of four
+in Postfix performance for transit mail that arrives and leaves
+via SMTP. You will lose another factor in transit performance for
+each additional temporary file that is created and deleted in the
+process of content filtering.  The performance impact is less for
+mail that is submitted or delivered locally, because such deliveries
+are already slower than SMTP transit mail.
 
 Simple content filter limitations
 =================================

postfix/RELEASE_NOTES

@@ -1,4 +1,4 @@
-Incompatible changes with snapshot-200201XX
+Incompatible changes with snapshot-20020106
 ===========================================
 
 Postfix will not run if it detects that the postfix user or group
@@ -23,7 +23,13 @@ main.cf file as "alternate_config_directories = /dir1 /dir2 ...".
 Otherwise, some Postfix commands will no longer work (namely, the
 ones that are now implemented by set-group ID client programs).
 
-Major changes with snapshot-200201XX
+Postfix SMTP access maps no longer return OK for non-local recipient
+mail addresses that contain multiple domains (user@dom1@dom2,
+user%dom1@dom2, etcetera); the lookup now returns DUNNO (undetermined).
+Non-local multi-domain addresses were already prohibited from
+matching the permit_mx_backup and the relay_domains-based restrictions.
+
+Major changes with snapshot-20020106
 ====================================
 
 Simplification of the local Postfix security model.
@@ -70,12 +76,6 @@ address will be looked up as <> instead.
 Incompatible changes with snapshot-20011210
 ===========================================
 
-Postfix SMTPD access maps no longer match non-local mail addresses
-that contain multiple domains (user@dom1@dom2, user%dom1@dom2,
-etcetera).  This change prevents false or spurious matches.
-Non-local multi-domain addresses are already prohibited from matching
-permit_mx_backup and the relay_domains-based restrictions.
-
 Stricter checking of Postfix chroot configurations.  The Postfix
 startup procedure now warns if "system" directories (etc, bin, lib,
 usr) under the Postfix top-level queue directory are not owned by

postfix/conf/access

@@ -9,9 +9,9 @@
 # 
 # DESCRIPTION
 #        The  optional access table directs the Postfix SMTP server
-#        to selectively reject or accept mail from or  to  specific
+#        to selectively  reject  or  accept  mail.  Access  can  be
-#        hosts,   domains,   networks,   host   addresses  or  mail
+#        allowed  or  denied for specific host names, domain names,
-#        addresses.
+#        networks, host network addresses or mail addresses.
 # 
 #        Normally, the access table is specified  as  a  text  file
 #        that  serves  as  input  to  the  postmap(1) command.  The
@@ -36,50 +36,78 @@
 #               When pattern matches a mail address, domain or host
 #               address, perform the corresponding action.
 # 
+#        blank lines and comments
+#               Empty  lines and whitespace-only lines are ignored,
+#               as are lines whose first  non-whitespace  character
+#               is a `#'.
+# 
 #        multi-line text
-#               A  line  that starts with whitespace (space or tab)
+#               A  logical  line starts with non-whitespace text. A
-#               is a continuation of the previous  line.  An  empty
+#               line that starts with whitespace continues a  logi-
-#               line  terminates  the previous line, as does a line
+#               cal line.
-#               that starts with non-whitespace (text or  comment).
-#               A comment line that starts with whitespace does not
-#               terminate multi-line text.
 # 
-#        comments
+# EMAIL ADDRESS PATTERNS
-#               The # is recognized as the start of a comment,  but
-#               only  when it is the first non-whitespace character
-#               on a line.  A comment terminates at the end of  the
-#               line,  even  when the next line starts with whites-
-#               pace.
-# 
-# PATTERNS
 #        With lookups from indexed files such as DB or DBM, or from
-#        networked  tables  such  as NIS, LDAP or SQL, patterns are
+#        networked tables such as NIS, LDAP or SQL,  the  following
-#        tried in the order as listed below:
+#        lookup patterns are examined in the order as listed:
 # 
 #        user@domain
 #               Matches the specified mail address.
 # 
 #        domain.name
-#               Matches the domain.name itself  and  any  subdomain
+#               Matches  domain.name as the domain part of an email
-#               thereof,  either in hostnames or in mail addresses.
+#               address.
-#               Top-level domains will never be matched.
 # 
-#        user@  Matches all mail addresses with the specified  user
+#               The pattern domain.name  also  matches  subdomains,
+#               but  only  when  the  string  smtpd_access_maps  is
+#               listed in the Postfix  parent_domain_matches_subdo-
+#               mains  configuration  setting.   Otherwise, specify
+#               .domain.name (note the initial  dot)  in  order  to
+#               match subdomains.
+# 
+#        user@  Matches  all mail addresses with the specified user
 #               part.
 # 
+#        Note: lookup of the null sender address may not be  possi-
+#        ble with all supported types of lookup table. A workaround
+#        is to specify smtpd_null_access_lookup_key  =  <>  in  the
+#        Postfix  main.cf  file, and to specify <> as the left-hand
+#        field in the access table.
+# 
+# ADDRESS EXTENSION
+#        When a mail address localpart contains the optional recip-
+#        ient  delimiter  (e.g., user+foo@domain), the lookup order
+#        becomes: user+foo@domain, user@domain, domain,  user+foo@,
+#        and user@.
+# 
+# HOST NAME/ADDRESS PATTERNS
+#        With lookups from indexed files such as DB or DBM, or from
+#        networked tables such as NIS, LDAP or SQL,  the  following
+#        lookup patterns are examined in the order as listed:
+# 
+#        domain.name
+#               Matches domain.name.
+# 
+#               The  pattern  domain.name  also matches subdomains,
+#               but  only  when  the  string  smtpd_access_maps  is
+#               listed  in the Postfix parent_domain_matches_subdo-
+#               mains configuration  setting.   Otherwise,  specify
+#               .domain.name  (note  the  initial  dot) in order to
+#               match subdomains.
+# 
 #        net.work.addr.ess
 # 
 #        net.work.addr
 # 
 #        net.work
 # 
-#        net    Matches  any host address in the specified network.
+#        net    Matches any host address in the specified  network.
-#               A network address is a  sequence  of  one  or  more
+#               A  network  address  is  a  sequence of one or more
 #               octets separated by ".".
 # 
 # ACTIONS
 #        [45]NN text
-#               Reject  the  address etc. that matches the pattern,
+#               Reject the address etc. that matches  the  pattern,
 #               and respond with the numerical code and text.
 # 
 #        REJECT Reject the address etc. that matches the pattern. A
@@ -92,29 +120,30 @@
 #               reject_unauth_destination, and so on).
 # 
 # REGULAR EXPRESSION TABLES
-#        This section describes how the table lookups  change  when
+#        This  section  describes how the table lookups change when
 #        the table is given in the form of regular expressions. For
-#        a description of regular expression lookup  table  syntax,
+#        a  description  of regular expression lookup table syntax,
 #        see regexp_table(5) or pcre_table(5).
 # 
-#        Each  pattern  is  a regular expression that is applied to
+#        Each pattern is a regular expression that  is  applied  to
 #        the entire string being looked up. Depending on the appli-
-#        cation,  that  string  is  an  entire  client hostname, an
+#        cation, that string  is  an  entire  client  hostname,  an
 #        entire client IP address, or an entire mail address. Thus,
-#        no  parent  domain  or  parent network search is done, and
+#        no  parent  domain  or  parent  network  search  is  done,
-#        user@domain mail addresses are not broken  up  into  their
+#        user@domain  mail  addresses  are not broken up into their
-#        user@ and domain constituent parts.
+#        user@ and domain constituent parts, nor is user+foo broken
+#        up into user and foo.
 # 
 #        Patterns  are  applied  in  the  order as specified in the
 #        table, until a pattern is found that  matches  the  search
 #        string.
 # 
-#        Actions  are the same as with normal indexed file lookups,
+#        Actions  are  the  same as with indexed file lookups, with
-#        with the additional feature that parenthesized  substrings
+#        the additional feature that parenthesized substrings  from
-#        from  the pattern can be interpolated as $1, $2 and so on.
+#        the pattern can be interpolated as $1, $2 and so on.
 # 
 # BUGS
-#        The table format does not understand quoting  conventions.
+#        The  table format does not understand quoting conventions.
 # 
 # SEE ALSO
 #        postmap(1) create mapping table
@@ -123,7 +152,7 @@
 #        regexp_table(5) format of POSIX regular expression tables
 # 
 # LICENSE
-#        The  Secure  Mailer  license must be distributed with this
+#        The Secure Mailer license must be  distributed  with  this
 #        software.
 # 
 # AUTHOR(S)

postfix/conf/aliases

@@ -68,59 +68,54 @@ decode:		root
 # 
 #                    name: value1, value2, ...
 # 
-#        o      A line that starts with whitespace (space  or  tab)
+#        o      Empty lines and whitespace-only lines are  ignored,
-#               is  a  continuation  of the previous line. An empty
+#               as  are  lines whose first non-whitespace character
-#               line terminates the previous line, as does  a  line
+#               is a `#'.
-#               that  starts with non-whitespace (text or comment).
-#               A comment line that starts with whitespace does not
-#               terminate multi-line text.
 # 
-#        o      The  # is recognized as the start of a comment, but
+#        o      A logical line starts with non-whitespace  text.  A
-#               only when it is the first non-whitespace  character
+#               line  that starts with whitespace continues a logi-
-#               on  a line.  A comment terminates at the end of the
+#               cal line.
-#               line, even when the next line starts  with  whites-
-#               pace.
 # 
-#        The  name is a local address (no domain part).  Use double
+#        The name is a local address (no domain part).  Use  double
-#        quotes when the name contains any special characters  such
+#        quotes  when the name contains any special characters such
-#        as  whitespace,  `#',  `:',  or `@'. The name is folded to
+#        as whitespace, `#', `:', or `@'. The  name  is  folded  to
 #        lowercase, in order to make database lookups case insensi-
 #        tive.
 # 
 #        In addition, when an alias exists for owner-name, delivery
-#        diagnostics are directed to that address,  instead  of  to
+#        diagnostics  are  directed  to that address, instead of to
 #        the originator.  This is typically used to direct delivery
-#        errors to the owner of a mailing list, who is in a  better
+#        errors  to the owner of a mailing list, who is in a better
-#        position  to deal with mailing list delivery problems than
+#        position to deal with mailing list delivery problems  than
 #        the originator of the undelivered mail.
 # 
 #        The value contains one or more of the following:
 # 
 #        address
-#               Mail is forwarded to address, which  is  compatible
+#               Mail  is  forwarded to address, which is compatible
 #               with the RFC 822 standard.
 # 
 #        /file/name
-#               Mail  is  appended  to /file/name. See local(8) for
+#               Mail is appended to /file/name.  See  local(8)  for
-#               details of delivery to file.  Delivery is not  lim-
+#               details  of delivery to file.  Delivery is not lim-
-#               ited  to regular files.  For example, to dispose of
+#               ited to regular files.  For example, to dispose  of
 #               unwanted mail, deflect it to /dev/null.
 # 
 #        |command
-#               Mail is piped into command. Commands  that  contain
+#               Mail  is  piped into command. Commands that contain
-#               special  characters,  such as whitespace, should be
+#               special characters, such as whitespace,  should  be
-#               enclosed between double quotes.  See  local(8)  for
+#               enclosed  between  double  quotes. See local(8) for
 #               details of delivery to command.
 # 
 #               When the command fails, a limited amount of command
-#               output is mailed back  to  the  sender.   The  file
+#               output  is  mailed  back  to  the sender.  The file
-#               /usr/include/sysexits.h  defines  the expected exit
+#               /usr/include/sysexits.h defines the  expected  exit
-#               status codes. For example, use |"exit 67" to  simu-
+#               status  codes. For example, use |"exit 67" to simu-
-#               late  a  "user  unknown"  error,  and  |"exit 0" to
+#               late a "user  unknown"  error,  and  |"exit  0"  to
 #               implement an expensive black hole.
 # 
 #        :include:/file/name
-#               Mail is sent to  the  destinations  listed  in  the
+#               Mail  is  sent  to  the  destinations listed in the
 #               named file.  Lines in :include: files have the same
 #               syntax as the right-hand side of alias entries.
 # 
@@ -132,31 +127,31 @@ decode:		root
 # 
 # ADDRESS EXTENSION
 #        When alias database search fails, and the recipient local-
-#        part  contains  the  optional  recipient  delimiter (e.g.,
+#        part contains  the  optional  recipient  delimiter  (e.g.,
-#        user+foo), the  search  is  repeated  for  the  unextended
+#        user+foo),  the  search  is  repeated  for  the unextended
 #        address (e.g., user).
 # 
 # CONFIGURATION PARAMETERS
-#        The  following  main.cf parameters are especially relevant
+#        The following main.cf parameters are  especially  relevant
-#        to this topic. See the Postfix  main.cf  file  for  syntax
+#        to  this  topic.  See  the Postfix main.cf file for syntax
-#        details  and  for  default  values. Use the postfix reload
+#        details and for default values.  Use  the  postfix  reload
 #        command after a configuration change.
 # 
 #        alias_maps
 #               List of alias databases.
 # 
 #        allow_mail_to_commands
-#               Restrict the usage of  mail  delivery  to  external
+#               Restrict  the  usage  of  mail delivery to external
 #               command.
 # 
 #        allow_mail_to_files
-#               Restrict  the  usage  of  mail delivery to external
+#               Restrict the usage of  mail  delivery  to  external
 #               file.
 # 
 #        expand_owner_alias
 #               When delivering to an alias that has an owner- com-
-#               panion  alias,  set  the envelope sender address to
+#               panion alias, set the envelope  sender  address  to
-#               the right-hand side of  the  owner  alias,  instead
+#               the  right-hand  side  of  the owner alias, instead
 #               using of the left-hand side address.
 # 
 #        owner_request_special
@@ -164,7 +159,7 @@ decode:		root
 #               addresses.
 # 
 #        recipient_delimiter
-#               Delimiter that separates  recipients  from  address
+#               Delimiter  that  separates  recipients from address
 #               extensions.
 # 
 # STANDARDS
@@ -175,7 +170,7 @@ decode:		root
 #        postalias(1) alias database management
 # 
 # LICENSE
-#        The  Secure  Mailer  license must be distributed with this
+#        The Secure Mailer license must be  distributed  with  this
 #        software.
 # 
 # AUTHOR(S)

postfix/conf/canonical

@@ -51,77 +51,70 @@
 #               When pattern matches a mail address, replace it  by
 #               the corresponding result.
 # 
-#        multi-line text
+#        blank lines and comments
-#               A  line  that starts with whitespace (space or tab)
+#               Empty  lines and whitespace-only lines are ignored,
-#               is a continuation of the previous  line.  An  empty
+#               as are lines whose first  non-whitespace  character
-#               line  terminates  the previous line, as does a line
+#               is a `#'.
-#               that starts with non-whitespace (text or  comment).
-#               A comment line that starts with whitespace does not
-#               terminate multi-line text.
 # 
-#        comments
+#        multi-line text
-#               The # is recognized as the start of a comment,  but
+#               A  logical  line starts with non-whitespace text. A
-#               only  when it is the first non-whitespace character
+#               line that starts with whitespace continues a  logi-
-#               on a line.  A comment terminates at the end of  the
+#               cal line.
-#               line,  even  when the next line starts with whites-
-#               pace.
 # 
 #        With lookups from indexed files such as DB or DBM, or from
-#        networked  tables  such  as NIS, LDAP or SQL, patterns are
+#        networked tables such as NIS, LDAP or  SQL,  patterns  are
 #        tried in the order as listed below:
 # 
 #        user@domain address
-#               user@domain is replaced by address. This  form  has
+#               user@domain  is  replaced by address. This form has
 #               the highest precedence.
 # 
-#               This  form useful to clean up addresses produced by
+#               This form useful to clean up addresses produced  by
-#               legacy mail systems.  It can also be used  to  pro-
+#               legacy  mail  systems.  It can also be used to pro-
-#               duce  Firstname.Lastname  style  addresses, but see
+#               duce Firstname.Lastname style  addresses,  but  see
 #               below for a simpler solution.
 # 
 #        user address
 #               user@site is replaced by address when site is equal
-#               to  $myorigin,  when  site is listed in $mydestina-
+#               to $myorigin, when site is  listed  in  $mydestina-
 #               tion, or when it is listed in $inet_interfaces.
 # 
-#               This form is useful for replacing  login  names  by
+#               This  form  is  useful for replacing login names by
 #               Firstname.Lastname.
 # 
 #        @domain address
-#               Every  address  in  domain  is replaced by address.
+#               Every address in domain  is  replaced  by  address.
 #               This form has the lowest precedence.
 # 
-#        In all the above forms, when address has the form  @other-
+#        In  all the above forms, when address has the form @other-
 #        domain, the result is the same user in otherdomain.
 # 
 # ADDRESS EXTENSION
-#        When  table  lookup  fails, and the address localpart con-
+#        When a mail address localpart contains the optional recip-
-#        tains   the   optional    recipient    delimiter    (e.g.,
+#        ient  delimiter  (e.g., user+foo@domain), the lookup order
-#        user+foo@domain),  the  search  is  repeated for the unex-
+#        becomes: user+foo@domain, user@domain, user+foo, user, and
-#        tended address  (e.g.   user@domain),  and  the  unmatched
+#        @domain.   An unmatched address extension (+foo) is propa-
-#        extension is propagated to the result of table lookup. The
+#        gated to the result of table lookup.
-#        matching order is: user+foo@domain, user@domain, user+foo,
-#        user, and @domain.
 # 
 # REGULAR EXPRESSION TABLES
-#        This  section  describes how the table lookups change when
+#        This section describes how the table lookups  change  when
 #        the table is given in the form of regular expressions. For
-#        a  description  of regular expression lookup table syntax,
+#        a description of regular expression lookup  table  syntax,
 #        see regexp_table(5) or pcre_table(5).
 # 
-#        Each pattern is a regular expression that  is  applied  to
+#        Each  pattern  is  a regular expression that is applied to
 #        the entire address being looked up. Thus, user@domain mail
-#        addresses are not broken up into their  user  and  @domain
+#        addresses  are  not  broken up into their user and @domain
 #        constituent parts, nor is user+foo broken up into user and
 #        foo.
 # 
-#        Patterns are applied in the  order  as  specified  in  the
+#        Patterns  are  applied  in  the  order as specified in the
-#        table,  until  a  pattern is found that matches the search
+#        table, until a pattern is found that  matches  the  search
 #        string.
 # 
-#        Results are the same as with normal indexed file  lookups,
+#        Results  are  the  same as with indexed file lookups, with
-#        with  the additional feature that parenthesized substrings
+#        the additional feature that parenthesized substrings  from
-#        from the pattern can be interpolated as $1, $2 and so  on.
+#        the pattern can be interpolated as $1, $2 and so on.
 # 
 # BUGS
 #        The  table format does not understand quoting conventions.

postfix/conf/pcre_table

@@ -22,49 +22,44 @@
 #               When  pattern matches a search string, use the cor-
 #               responding result.
 # 
-#        multi-line text
+#        blank lines and comments
-#               A line that starts with whitespace (space  or  tab)
+#               Empty lines and whitespace-only lines are  ignored,
-#               is  a  continuation  of the previous line. An empty
+#               as  are  lines whose first non-whitespace character
-#               line terminates the previous line, as does  a  line
+#               is a `#'.
-#               that  starts with non-whitespace (text or comment).
-#               A comment line that starts with whitespace does not
-#               terminate multi-line text.
 # 
-#        comments
+#        multi-line text
-#               The  # is recognized as the start of a comment, but
+#               A logical line starts with non-whitespace  text.  A
-#               only when it is the first non-whitespace  character
+#               line  that starts with whitespace continues a logi-
-#               on  a line.  A comment terminates at the end of the
+#               cal line.
-#               line, even when the next line starts  with  whites-
-#               pace.
 # 
 #        Each  pattern  is  a  perl-like  regular  expression.  The
-#        expression delimiter can be any character, except  whites-
+#        expression  delimiter can be any character, except whites-
-#        pace  or  characters that have special meaning (tradition-
+#        pace or characters that have special  meaning  (tradition-
-#        ally the forward slash is used).  The  regular  expression
+#        ally  the  forward slash is used).  The regular expression
 #        can contain whitespace.
 # 
 #        By default, matching is case-insensitive, although follow-
-#        ing the second slash with an `i' flag will  reverse  this.
+#        ing  the  second slash with an `i' flag will reverse this.
-#        Other  flags  are supported, but the only other useful one
+#        Other flags are supported, but the only other  useful  one
 #        is `U', which makes matching ungreedy (see PCRE documenta-
 #        tion and source for more info).
 # 
-#        Each  pattern  is applied to the entire lookup key string.
+#        Each pattern is applied to the entire lookup  key  string.
-#        Depending on the application, that  string  is  an  entire
+#        Depending  on  the  application,  that string is an entire
 #        client hostname, an entire client IP address, or an entire
-#        mail address.  Thus, no parent domain  or  parent  network
+#        mail  address.   Thus,  no parent domain or parent network
-#        search  is  done,  and  user@domain mail addresses are not
+#        search is done, and user@domain  mail  addresses  are  not
-#        broken up into their user and  domain  constituent  parts,
+#        broken  up  into  their user and domain constituent parts,
 #        nor is user+foo broken up into user and foo.
 # 
-#        Patterns  are  applied  in  the  order as specified in the
+#        Patterns are applied in the  order  as  specified  in  the
-#        table, until a pattern is found that  matches  the  search
+#        table,  until  a  pattern is found that matches the search
 #        string.
 # 
-#        Substitution  of  substrings  from  the matched expression
+#        Substitution of substrings  from  the  matched  expression
-#        into the result string is possible using the  conventional
+#        into  the result string is possible using the conventional
-#        perl  syntax  ($1,  $2,  etc.).   The macros in the result
+#        perl syntax ($1, $2, etc.).   The  macros  in  the  result
-#        string may need to be written as  ${n}  or  $(n)  if  they
+#        string  may  need  to  be  written as ${n} or $(n) if they
 #        aren't followed by whitespace.
 # 
 # EXAMPLE SMTPD ACCESS MAP

postfix/conf/regexp_table

@@ -22,20 +22,15 @@
 #               When  pattern matches a search string, use the cor-
 #               responding result.
 # 
-#        multi-line text
+#        blank lines and comments
-#               A line that starts with whitespace (space  or  tab)
+#               Empty lines and whitespace-only lines are  ignored,
-#               is  a  continuation  of the previous line. An empty
+#               as  are  lines whose first non-whitespace character
-#               line terminates the previous line, as does  a  line
+#               is a `#'.
-#               that  starts with non-whitespace (text or comment).
-#               A comment line that starts with whitespace does not
-#               terminate multi-line text.
 # 
-#        comments
+#        multi-line text
-#               The  # is recognized as the start of a comment, but
+#               A logical line starts with non-whitespace  text.  A
-#               only when it is the first non-whitespace  character
+#               line  that starts with whitespace continues a logi-
-#               on  a line.  A comment terminates at the end of the
+#               cal line.
-#               line, even when the next line starts  with  whites-
-#               pace.
 # 
 #        pattern1!pattern2 result
 #               Matches pattern1 but not pattern2.
@@ -43,28 +38,28 @@
 #        Each pattern is a regular expression enclosed by a pair of
 #        delimiters.  The regular expression syntax is described in
 #        re_format(7).  The expression delimiter can be any charac-
-#        ter, except whitespace or  characters  that  have  special
+#        ter,  except  whitespace  or  characters that have special
-#        meaning  (traditionally  the  forward  slash is used). The
+#        meaning (traditionally the forward  slash  is  used).  The
 #        regular expression can contain whitespace.
 # 
 #        By default, matching is case-insensitive, although follow-
-#        ing  the  second slash with an `i' flag will reverse this.
+#        ing the second slash with an `i' flag will  reverse  this.
-#        Other flags are `x' (disable extended expression  syntax),
+#        Other  flags are `x' (disable extended expression syntax),
 #        and `m' (enable multi-line mode).
 # 
-#        Each  pattern  is applied to the entire lookup key string.
+#        Each pattern is applied to the entire lookup  key  string.
-#        Depending on the application, that  string  is  an  entire
+#        Depending  on  the  application,  that string is an entire
 #        client hostname, an entire client IP address, or an entire
-#        mail address.  Thus, no parent domain  or  parent  network
+#        mail  address.   Thus,  no parent domain or parent network
-#        search  is  done,  and  user@domain mail addresses are not
+#        search is done, and user@domain  mail  addresses  are  not
-#        broken up into their user and  domain  constituent  parts,
+#        broken  up  into  their user and domain constituent parts,
 #        nor is user+foo broken up into user and foo.
 # 
-#        Patterns  are  applied  in  the  order as specified in the
+#        Patterns are applied in the  order  as  specified  in  the
-#        table, until a pattern is found that  matches  the  search
+#        table,  until  a  pattern is found that matches the search
 #        string.
 # 
-#        Substitution  of  substrings  from  the matched expression
+#        Substitution of substrings  from  the  matched  expression
 #        into the result string is possible using $1, $2, etc.. The
 #        macros in the result string may need to be written as ${n}
 #        or $(n) if they aren't followed by whitespace.

postfix/conf/relocated

@@ -39,25 +39,20 @@
 #               such as an  email  address,  or  perhaps  a  street
 #               address or telephone number.
 # 
-#        o      A  line  that starts with whitespace (space or tab)
+#        o      Empty  lines and whitespace-only lines are ignored,
-#               is a continuation of the previous  line.  An  empty
+#               as are lines whose first  non-whitespace  character
-#               line  terminates  the previous line, as does a line
+#               is a `#'.
-#               that starts with non-whitespace (text or  comment).
-#               A comment line that starts with whitespace does not
-#               terminate multi-line text.
 # 
-#        o      The # is recognized as the start of a comment,  but
+#        o      A  logical  line starts with non-whitespace text. A
-#               only  when it is the first non-whitespace character
+#               line that starts with whitespace continues a  logi-
-#               on a line.  A comment terminates at the end of  the
+#               cal line.
-#               line,  even  when the next line starts with whites-
-#               pace.
 # 
 #        With lookups from indexed files such as DB or DBM, or from
-#        networked  tables  such as NIS, LDAP or SQL, the key field
+#        networked tables such as NIS, LDAP or SQL, the  key  field
 #        is one of the following:
 # 
 #        user@domain
-#               Matches user@domain. This form has precedence  over
+#               Matches  user@domain. This form has precedence over
 #               all other forms.
 # 
 #        user   Matches user@site when site is $myorigin, when site
@@ -65,34 +60,34 @@
 #               in $inet_interfaces.
 # 
 #        @domain
-#               Matches  every address in domain. This form has the
+#               Matches every address in domain. This form has  the
 #               lowest precedence.
 # 
 # ADDRESS EXTENSION
-#        When the search fails, and the address localpart  contains
+#        When a mail address localpart contains the optional recip-
-#        the  optional recipient delimiter (e.g., user+foo@domain),
+#        ient delimiter (e.g., user+foo@domain), the  lookup  order
-#        the search is repeated for the  unextended  address  (e.g.
+#        becomes: user+foo@domain, user@domain, user+foo, user, and
-#        user@domain).
+#        @domain.
 # 
 # REGULAR EXPRESSION TABLES
-#        This  section  describes how the table lookups change when
+#        This section describes how the table lookups  change  when
 #        the table is given in the form of regular expressions. For
-#        a  description  of regular expression lookup table syntax,
+#        a description of regular expression lookup  table  syntax,
 #        see regexp_table(5) or pcre_table(5).
 # 
-#        Each pattern is a regular expression that  is  applied  to
+#        Each  pattern  is  a regular expression that is applied to
 #        the entire address being looked up. Thus, user@domain mail
-#        addresses are not broken up into their  user  and  @domain
+#        addresses  are  not  broken up into their user and @domain
 #        constituent parts, nor is user+foo broken up into user and
 #        foo.
 # 
-#        Patterns are applied in the  order  as  specified  in  the
+#        Patterns  are  applied  in  the  order as specified in the
-#        table,  until  a  pattern is found that matches the search
+#        table, until a pattern is found that  matches  the  search
 #        string.
 # 
-#        Results are the same as with normal indexed file  lookups,
+#        Results  are  the  same as with indexed file lookups, with
-#        with  the additional feature that parenthesized substrings
+#        the additional feature that parenthesized substrings  from
-#        from the pattern can be interpolated as $1, $2 and so  on.
+#        the pattern can be interpolated as $1, $2 and so on.
 # 
 # BUGS
 #        The  table format does not understand quoting conventions.

postfix/conf/transport

@@ -36,112 +36,111 @@
 #               When pattern matches the  domain,  use  the  corre-
 #               sponding result.
 # 
-#        multi-line text
+#        blank lines and comments
-#               A  line  that starts with whitespace (space or tab)
+#               Empty  lines and whitespace-only lines are ignored,
-#               is a continuation of the previous  line.  An  empty
+#               as are lines whose first  non-whitespace  character
-#               line  terminates  the previous line, as does a line
+#               is a `#'.
-#               that starts with non-whitespace (text or  comment).
-#               A comment line that starts with whitespace does not
-#               terminate multi-line text.
 # 
-#        comments
+#        multi-line text
-#               The # is recognized as the start of a comment,  but
+#               A  logical  line starts with non-whitespace text. A
-#               only  when it is the first non-whitespace character
+#               line that starts with whitespace continues a  logi-
-#               on a line.  A comment terminates at the end of  the
+#               cal line.
-#               line,  even  when the next line starts with whites-
-#               pace.
 # 
 #        With lookups from indexed files such as DB or DBM, or from
-#        networked  tables  such  as NIS, LDAP or SQL, patterns are
+#        networked tables such as NIS, LDAP or  SQL,  patterns  are
 #        tried in the order as listed below:
 # 
 #        domain transport:nexthop
-#               Mail for domain is delivered through  transport  to
+#               Mail  for  domain is delivered through transport to
 #               nexthop.
 # 
 #        .domain transport:nexthop
-#               Mail  for  any  subdomain  of  domain  is delivered
+#               Mail for  any  subdomain  of  domain  is  delivered
-#               through transport to nexthop.
+#               through  transport  to  nexthop.  This applies only
+#               when the string transport_maps is not listed in the
+#               parent_domain_matches_subdomains configuration set-
+#               ting.  Otherwise, a domain name matches itself  and
+#               its subdomains.
 # 
-#        Note: transport map entries take precedence  over  domains
+#        Note:  transport  map entries take precedence over domains
-#        specified  in  the mydestination parameter. If you use the
+#        specified in the mydestination parameter. If you  use  the
 #        optional  transport  map,  it  may  be  safer  to  specify
-#        explicit  entries  for all domains specified in mydestina-
+#        explicit entries for all domains specified  in  mydestina-
 #        tion, for example:
 # 
 #             hostname.my.domain   local:
 #             localhost.my.domain      local:
 # 
-#        The interpretation  of  the  nexthop  field  is  transport
+#        The  interpretation  of  the  nexthop  field  is transport
 #        dependent. In the case of SMTP, specify host:service for a
-#        non-default server port, and use [host] or [host]:port  in
+#        non-default  server port, and use [host] or [host]:port in
-#        order  to  disable MX (mail exchanger) DNS lookups. The []
+#        order to disable MX (mail exchanger) DNS lookups.  The  []
-#        form can also be used with IP addresses instead  of  host-
+#        form  can  also be used with IP addresses instead of host-
 #        names.
 # 
 # EXAMPLES
-#        In  order  to send mail for foo.org and its subdomains via
+#        In order to send mail for foo.org and its  subdomains  via
 #        the uucp transport to the UUCP host named foo:
 # 
 #             foo.org      uucp:foo
 #             .foo.org     uucp:foo
 # 
-#        When no nexthop host name is  specified,  the  destination
+#        When  no  nexthop  host name is specified, the destination
-#        domain  name  is  used instead. For example, the following
+#        domain name is used instead. For  example,  the  following
-#        directs mail for user@foo.org via the slow transport to  a
+#        directs  mail for user@foo.org via the slow transport to a
-#        mail  exchanger  for foo.org.  The slow transport could be
+#        mail exchanger for foo.org.  The slow transport  could  be
-#        something that runs at most  one  delivery  process  at  a
+#        something  that  runs  at  most  one delivery process at a
 #        time:
 # 
 #             foo.org      slow:
 # 
-#        When  no  transport is specified, the default transport is
+#        When no transport is specified, the default  transport  is
 #        used, as specified via the default_transport configuration
-#        parameter.  The  following  sends all mail for foo.org and
+#        parameter. The following sends all mail  for  foo.org  and
 #        its subdomains to host gateway.foo.org:
 # 
 #             foo.org      :[gateway.foo.org]
 #             .foo.org     :[gateway.foo.org]
 # 
-#        In the above example, the  []  are  used  to  suppress  MX
+#        In  the  above  example,  the  []  are used to suppress MX
-#        lookups.   The  result  would  likely  point to your local
+#        lookups.  The result would  likely  point  to  your  local
 #        machine.
 # 
-#        In the case of delivery via SMTP, one  may  specify  host-
+#        In  the  case  of delivery via SMTP, one may specify host-
 #        name:service instead of just a host:
 # 
 #             foo.org      smtp:bar.org:2025
 # 
-#        This  directs  mail  for user@foo.org to host bar.org port
+#        This directs mail for user@foo.org to  host  bar.org  port
-#        2025. Instead of a numerical port a symbolic name  may  be
+#        2025.  Instead  of a numerical port a symbolic name may be
-#        used.  Specify  [] around the hostname in order to disable
+#        used. Specify [] around the hostname in order  to  disable
 #        MX lookups.
 # 
 #        The error mailer can be used to bounce mail:
 # 
-#             .foo.org      error:mail for *.foo.org is not  deliv-
+#             .foo.org       error:mail for *.foo.org is not deliv-
 #        erable
 # 
-#        This  causes  all  mail  for  user@anything.foo.org  to be
+#        This causes  all  mail  for  user@anything.foo.org  to  be
 #        bounced.
 # 
 # REGULAR EXPRESSION TABLES
-#        This section describes how the table lookups  change  when
+#        This  section  describes how the table lookups change when
 #        the table is given in the form of regular expressions. For
-#        a description of regular expression lookup  table  syntax,
+#        a  description  of regular expression lookup table syntax,
 #        see regexp_table(5) or pcre_table(5).
 # 
-#        Each  pattern  is  a regular expression that is applied to
+#        Each pattern is a regular expression that  is  applied  to
 #        the entire domain being looked up. Thus, some.domain.hier-
 #        archy is not broken up into parent domains.
 # 
-#        Patterns  are  applied  in  the  order as specified in the
+#        Patterns are applied in the  order  as  specified  in  the
-#        table, until a pattern is found that  matches  the  search
+#        table,  until  a  pattern is found that matches the search
 #        string.
 # 
-#        Results  are the same as with normal indexed file lookups,
+#        Results are the same as with indexed  file  lookups,  with
-#        with the additional feature that parenthesized  substrings
+#        the  additional feature that parenthesized substrings from
-#        from  the pattern can be interpolated as $1, $2 and so on.
+#        the pattern can be interpolated as $1, $2 and so on.
 # 
 # CONFIGURATION PARAMETERS
 #        The following main.cf parameters are  especially  relevant

postfix/conf/virtual

@@ -107,75 +107,69 @@
 #               When  pattern matches a mail address, replace it by
 #               the corresponding result.
 # 
-#        multi-line text
+#        blank lines and comments
-#               A line that starts with whitespace (space  or  tab)
+#               Empty lines and whitespace-only lines are  ignored,
-#               is  a  continuation  of the previous line. An empty
+#               as  are  lines whose first non-whitespace character
-#               line terminates the previous line, as does  a  line
+#               is a `#'.
-#               that  starts with non-whitespace (text or comment).
-#               A comment line that starts with whitespace does not
-#               terminate multi-line text.
 # 
-#        comments
+#        multi-line text
-#               The  # is recognized as the start of a comment, but
+#               A logical line starts with non-whitespace  text.  A
-#               only when it is the first non-whitespace  character
+#               line  that starts with whitespace continues a logi-
-#               on  a line.  A comment terminates at the end of the
+#               cal line.
-#               line, even when the next line starts  with  whites-
-#               pace.
 # 
 #        With lookups from indexed files such as DB or DBM, or from
-#        networked tables such as NIS, LDAP or  SQL,  patterns  are
+#        networked  tables  such  as NIS, LDAP or SQL, patterns are
 #        tried in the order as listed below:
 # 
 #        user@domain address, address, ...
-#               Mail  for  user@domain  is  redirected  to address.
+#               Mail for  user@domain  is  redirected  to  address.
 #               This form has the highest precedence.
 # 
 #        user address, address, ...
-#               Mail for user@site is redirected  to  address  when
+#               Mail  for  user@site  is redirected to address when
-#               site  is equal to $myorigin, when site is listed in
+#               site is equal to $myorigin, when site is listed  in
 #               $mydestination,   or   when   it   is   listed   in
 #               $inet_interfaces.
 # 
-#               This  functionality  overlaps with functionality of
+#               This functionality overlaps with  functionality  of
 #               the local alias(5) database. The difference is that
-#               virtual   mapping   can  be  applied  to  non-local
+#               virtual  mapping  can  be  applied   to   non-local
 #               addresses.
 # 
 #        @domain address, address, ...
-#               Mail for  any  user  in  domain  is  redirected  to
+#               Mail  for  any  user  in  domain  is  redirected to
 #               address.  This form has the lowest precedence.
 # 
-#        In  all the above forms, when address has the form @other-
+#        In all the above forms, when address has the form  @other-
-#        domain, the result is the same user in otherdomain.   This
+#        domain,  the result is the same user in otherdomain.  This
 #        works for the first address in the expansion only.
 # 
 # ADDRESS EXTENSION
-#        When  the search fails, and the address localpart contains
+#        When a mail address localpart contains the optional recip-
-#        the optional recipient delimiter (e.g.,  user+foo@domain),
+#        ient  delimiter  (e.g., user+foo@domain), the lookup order
-#        the  search  is  repeated for the unextended address (e.g.
+#        becomes: user+foo@domain, user@domain, user+foo, user, and
-#        user@domain), and the unmatched address extension is prop-
+#        @domain.   An unmatched address extension (+foo) is propa-
-#        agated  to the result of expansion. The matching order is:
+#        gated to the result of table lookup.
-#        user+foo@domain, user@domain, user+foo, user, and @domain.
 # 
 # REGULAR EXPRESSION TABLES
-#        This  section  describes how the table lookups change when
+#        This section describes how the table lookups  change  when
 #        the table is given in the form of regular expressions. For
-#        a  description  of regular expression lookup table syntax,
+#        a description of regular expression lookup  table  syntax,
 #        see regexp_table(5) or pcre_table(5).
 # 
-#        Each pattern is a regular expression that  is  applied  to
+#        Each  pattern  is  a regular expression that is applied to
 #        the entire address being looked up. Thus, user@domain mail
-#        addresses are not broken up into their  user  and  @domain
+#        addresses  are  not  broken up into their user and @domain
 #        constituent parts, nor is user+foo broken up into user and
 #        foo.
 # 
-#        Patterns are applied in the  order  as  specified  in  the
+#        Patterns  are  applied  in  the  order as specified in the
-#        table,  until  a  pattern is found that matches the search
+#        table, until a pattern is found that  matches  the  search
 #        string.
 # 
-#        Results are the same as with normal indexed file  lookups,
+#        Results  are  the  same as with indexed file lookups, with
-#        with  the additional feature that parenthesized substrings
+#        the additional feature that parenthesized substrings  from
-#        from the pattern can be interpolated as $1, $2 and so  on.
+#        the pattern can be interpolated as $1, $2 and so on.
 # 
 # BUGS
 #        The  table format does not understand quoting conventions.

postfix/html/access.5.html

@@ -10,9 +10,9 @@ ACCESS(5)                                               ACCESS(5)
 
 <b>DESCRIPTION</b>
        The  optional <b>access</b> table directs the Postfix SMTP server
-       to selectively reject or accept mail from or  to  specific
+       to selectively  reject  or  accept  mail.  Access  can  be
-       hosts,   domains,   networks,   host   addresses  or  mail
+       allowed  or  denied for specific host names, domain names,
-       addresses.
+       networks, host network addresses or mail addresses.
 
        Normally, the <b>access</b> table is specified  as  a  text  file
        that  serves  as  input  to  the  <a href="postmap.1.html"><b>postmap</b>(1)</a> command.  The
@@ -47,22 +47,55 @@ ACCESS(5)                                               ACCESS(5)
               line that starts with whitespace continues a  logi-
               cal line.
 
-<b>PATTERNS</b>
+<b>EMAIL</b> <b>ADDRESS</b> <b>PATTERNS</b>
        With lookups from indexed files such as DB or DBM, or from
-       networked tables such as NIS, LDAP or  SQL,  patterns  are
+       networked tables such as NIS, LDAP or SQL,  the  following
-       tried in the order as listed below:
+       lookup patterns are examined in the order as listed:
 
        <i>user</i>@<i>domain</i>
               Matches the specified mail address.
 
        <i>domain.name</i>
-              Matches  the  <i>domain.name</i>  itself and any subdomain
+              Matches  <i>domain.name</i> as the domain part of an email
-              thereof, either in hostnames or in mail  addresses.
+              address.
-              Top-level domains will never be matched.
+
+              The pattern <i>domain.name</i>  also  matches  subdomains,
+              but  only  when  the  string  <b>smtpd</b><i>_</i><b>access</b><i>_</i><b>maps</b>  is
+              listed in the Postfix  <b>parent</b><i>_</i><b>domain</b><i>_</i><b>matches</b><i>_</i><b>subdo-</b>
+              <b>mains</b>  configuration  setting.   Otherwise, specify
+              <i>.domain.name</i> (note the initial  dot)  in  order  to
+              match subdomains.
 
        <i>user</i>@  Matches  all mail addresses with the specified user
               part.
 
+       Note: lookup of the null sender address may not be  possi-
+       ble with all supported types of lookup table. A workaround
+       is to specify <b>smtpd</b><i>_</i><b>null</b><i>_</i><b>access</b><i>_</i><b>lookup</b><i>_</i><b>key</b>  <b>=</b>  &lt;&gt;  in  the
+       Postfix  <b>main.cf</b>  file, and to specify &lt;&gt; as the left-hand
+       field in the access table.
+
+<b>ADDRESS</b> <b>EXTENSION</b>
+       When a mail address localpart contains the optional recip-
+       ient  delimiter  (e.g., <i>user+foo</i>@<i>domain</i>), the lookup order
+       becomes: <i>user+foo</i>@<i>domain</i>, <i>user</i>@<i>domain</i>, <i>domain</i>,  <i>user+foo</i>@,
+       and <i>user</i>@.
+
+<b>HOST</b> <b>NAME/ADDRESS</b> <b>PATTERNS</b>
+       With lookups from indexed files such as DB or DBM, or from
+       networked tables such as NIS, LDAP or SQL,  the  following
+       lookup patterns are examined in the order as listed:
+
+       <i>domain.name</i>
+              Matches <i>domain.name</i>.
+
+              The  pattern  <i>domain.name</i>  also matches subdomains,
+              but  only  when  the  string  <b>smtpd</b><i>_</i><b>access</b><i>_</i><b>maps</b>  is
+              listed  in the Postfix <b>parent</b><i>_</i><b>domain</b><i>_</i><b>matches</b><i>_</i><b>subdo-</b>
+              <b>mains</b> configuration  setting.   Otherwise,  specify
+              <i>.domain.name</i>  (note  the  initial  dot) in order to
+              match subdomains.
+
        <i>net.work.addr.ess</i>
 
        <i>net.work.addr</i>
@@ -97,17 +130,18 @@ ACCESS(5)                                               ACCESS(5)
        the entire string being looked up. Depending on the appli-
        cation, that string  is  an  entire  client  hostname,  an
        entire client IP address, or an entire mail address. Thus,
-       no parent domain or parent network  search  is  done,  and
+       no  parent  domain  or  parent  network  search  is  done,
        <i>user@domain</i>  mail  addresses  are not broken up into their
-       <i>user@</i> and <i>domain</i> constituent parts.
+       <i>user@</i> and <i>domain</i> constituent parts, nor is <i>user+foo</i> broken
+       up into <i>user</i> and <i>foo</i>.
 
-       Patterns are applied in the  order  as  specified  in  the
+       Patterns  are  applied  in  the  order as specified in the
-       table,  until  a  pattern is found that matches the search
+       table, until a pattern is found that  matches  the  search
        string.
 
-       Actions are the same as with normal indexed file  lookups,
+       Actions  are  the  same as with indexed file lookups, with
-       with  the additional feature that parenthesized substrings
+       the additional feature that parenthesized substrings  from
-       from the pattern can be interpolated as <b>$1</b>, <b>$2</b> and so  on.
+       the pattern can be interpolated as <b>$1</b>, <b>$2</b> and so on.
 
 <b>BUGS</b>
        The  table format does not understand quoting conventions.

postfix/html/canonical.5.html

@@ -91,13 +91,11 @@ CANONICAL(5)                                         CANONICAL(5)
        <i>domain</i>, the result is the same user in <i>otherdomain</i>.
 
 <b>ADDRESS</b> <b>EXTENSION</b>
-       When table lookup fails, and the  address  localpart  con-
+       When a mail address localpart contains the optional recip-
-       tains    the    optional    recipient   delimiter   (e.g.,
+       ient  delimiter  (e.g., <i>user+foo</i>@<i>domain</i>), the lookup order
-       <i>user+foo</i>@<i>domain</i>), the search is  repeated  for  the  unex-
+       becomes: <i>user+foo</i>@<i>domain</i>, <i>user</i>@<i>domain</i>, <i>user+foo</i>, <i>user</i>, and
-       tended  address  (e.g.   <i>user</i>@<i>domain</i>),  and  the unmatched
+       @<i>domain</i>.   An unmatched address extension (<i>+foo</i>) is propa-
-       extension is propagated to the result of table lookup. The
+       gated to the result of table lookup.
-       matching order is: <i>user+foo</i>@<i>domain</i>, <i>user</i>@<i>domain</i>, <i>user+foo</i>,
-       <i>user</i>, and @<i>domain</i>.
 
 <b>REGULAR</b> <b>EXPRESSION</b> <b>TABLES</b>
        This section describes how the table lookups  change  when
@@ -115,17 +113,17 @@ CANONICAL(5)                                         CANONICAL(5)
        table, until a pattern is found that  matches  the  search
        string.
 
-       Results  are the same as with normal indexed file lookups,
+       Results  are  the  same as with indexed file lookups, with
-       with the additional feature that parenthesized  substrings
+       the additional feature that parenthesized substrings  from
-       from  the pattern can be interpolated as <b>$1</b>, <b>$2</b> and so on.
+       the pattern can be interpolated as <b>$1</b>, <b>$2</b> and so on.
 
 <b>BUGS</b>
-       The table format does not understand quoting  conventions.
+       The  table format does not understand quoting conventions.
 
 <b>CONFIGURATION</b> <b>PARAMETERS</b>
-       The  following  <b>main.cf</b> parameters are especially relevant
+       The following <b>main.cf</b> parameters are  especially  relevant
-       to this topic. See the Postfix  <b>main.cf</b>  file  for  syntax
+       to  this  topic.  See  the Postfix <b>main.cf</b> file for syntax
-       details  and  for  default  values. Use the <b>postfix</b> <b>reload</b>
+       details and for default values.  Use  the  <b>postfix</b>  <b>reload</b>
        command after a configuration change.
 
        <b>canonical</b><i>_</i><b>maps</b>
@@ -142,24 +140,24 @@ CANONICAL(5)                                         CANONICAL(5)
        Other parameters of interest:
 
        <b>inet</b><i>_</i><b>interfaces</b>
-              The network interface addresses  that  this  system
+              The  network  interface  addresses that this system
               receives mail on.
 
        <b>masquerade</b><i>_</i><b>classes</b>
-              List  of  address  classes subject to masquerading:
+              List of address classes  subject  to  masquerading:
-              zero or more of  <b>envelope</b><i>_</i><b>sender</b>,  <b>envelope</b><i>_</i><b>recipi-</b>
+              zero  or  more of <b>envelope</b><i>_</i><b>sender</b>, <b>envelope</b><i>_</i><b>recipi-</b>
               <b>ent</b>, <b>header</b><i>_</i><b>sender</b>, <b>header</b><i>_</i><b>recipient</b>.
 
        <b>masquerade</b><i>_</i><b>domains</b>
-              List  of  domains  that hide their subdomain struc-
+              List of domains that hide  their  subdomain  struc-
               ture.
 
        <b>masquerade</b><i>_</i><b>exceptions</b>
-              List of user names that are not subject to  address
+              List  of user names that are not subject to address
               masquerading.
 
        <b>mydestination</b>
-              List  of  domains  that  this mail system considers
+              List of domains that  this  mail  system  considers
               local.
 
        <b>myorigin</b>
@@ -177,7 +175,7 @@ CANONICAL(5)                                         CANONICAL(5)
        <a href="regexp_table.5.html">regexp_table(5)</a> format of POSIX regular expression tables
 
 <b>LICENSE</b>
-       The Secure Mailer license must be  distributed  with  this
+       The  Secure  Mailer  license must be distributed with this
        software.
 
 <b>AUTHOR(S)</b>

postfix/html/relocated.5.html

@@ -65,10 +65,10 @@ RELOCATED(5)                                         RELOCATED(5)
               lowest precedence.
 
 <b>ADDRESS</b> <b>EXTENSION</b>
-       When  the search fails, and the address localpart contains
+       When a mail address localpart contains the optional recip-
-       the optional recipient delimiter (e.g.,  <i>user+foo</i>@<i>domain</i>),
+       ient delimiter (e.g., <i>user+foo</i>@<i>domain</i>), the  lookup  order
-       the  search  is  repeated for the unextended address (e.g.
+       becomes: <i>user+foo</i>@<i>domain</i>, <i>user</i>@<i>domain</i>, <i>user+foo</i>, <i>user</i>, and
-       <i>user</i>@<i>domain</i>).
+       @<i>domain</i>.
 
 <b>REGULAR</b> <b>EXPRESSION</b> <b>TABLES</b>
        This section describes how the table lookups  change  when
@@ -86,17 +86,17 @@ RELOCATED(5)                                         RELOCATED(5)
        table, until a pattern is found that  matches  the  search
        string.
 
-       Results  are the same as with normal indexed file lookups,
+       Results  are  the  same as with indexed file lookups, with
-       with the additional feature that parenthesized  substrings
+       the additional feature that parenthesized substrings  from
-       from  the pattern can be interpolated as <b>$1</b>, <b>$2</b> and so on.
+       the pattern can be interpolated as <b>$1</b>, <b>$2</b> and so on.
 
 <b>BUGS</b>
-       The table format does not understand quoting  conventions.
+       The  table format does not understand quoting conventions.
 
 <b>CONFIGURATION</b> <b>PARAMETERS</b>
-       The  following  <b>main.cf</b> parameters are especially relevant
+       The following <b>main.cf</b> parameters are  especially  relevant
-       to this topic. See the Postfix  <b>main.cf</b>  file  for  syntax
+       to  this  topic.  See  the Postfix <b>main.cf</b> file for syntax
-       details  and  for  default  values. Use the <b>postfix</b> <b>reload</b>
+       details and for default values.  Use  the  <b>postfix</b>  <b>reload</b>
        command after a configuration change.
 
        <b>relocated</b><i>_</i><b>maps</b>
@@ -105,11 +105,11 @@ RELOCATED(5)                                         RELOCATED(5)
        Other parameters of interest:
 
        <b>inet</b><i>_</i><b>interfaces</b>
-              The  network  interface  addresses that this system
+              The network interface addresses  that  this  system
               receives mail on.
 
        <b>mydestination</b>
-              List of domains that  this  mail  system  considers
+              List  of  domains  that  this mail system considers
               local.
 
        <b>myorigin</b>
@@ -121,7 +121,7 @@ RELOCATED(5)                                         RELOCATED(5)
        <a href="regexp_table.5.html">regexp_table(5)</a> format of POSIX regular expression tables
 
 <b>LICENSE</b>
-       The Secure Mailer license must be  distributed  with  this
+       The  Secure  Mailer  license must be distributed with this
        software.
 
 <b>AUTHOR(S)</b>

postfix/html/transport.5.html

@@ -57,7 +57,11 @@ TRANSPORT(5)                                         TRANSPORT(5)
 
        <i>.domain</i> <i>transport</i>:<i>nexthop</i>
               Mail for  any  subdomain  of  <i>domain</i>  is  delivered
-              through <i>transport</i> to <i>nexthop</i>.
+              through  <i>transport</i>  to  <i>nexthop</i>.  This applies only
+              when the string <b>transport</b><i>_</i><b>maps</b> is not listed in the
+              <b>parent</b><i>_</i><b>domain</b><i>_</i><b>matches</b><i>_</i><b>subdomains</b> configuration set-
+              ting.  Otherwise, a domain name matches itself  and
+              its subdomains.
 
        Note:  transport  map entries take precedence over domains
        specified in the <b>mydestination</b> parameter. If you  use  the
@@ -135,18 +139,18 @@ TRANSPORT(5)                                         TRANSPORT(5)
        table,  until  a  pattern is found that matches the search
        string.
 
-       Results are the same as with normal indexed file  lookups,
+       Results are the same as with indexed  file  lookups,  with
-       with  the additional feature that parenthesized substrings
+       the  additional feature that parenthesized substrings from
-       from the pattern can be interpolated as <b>$1</b>, <b>$2</b> and so  on.
+       the pattern can be interpolated as <b>$1</b>, <b>$2</b> and so on.
 
 <b>CONFIGURATION</b> <b>PARAMETERS</b>
-       The  following  <b>main.cf</b> parameters are especially relevant
+       The following <b>main.cf</b> parameters are  especially  relevant
-       to this topic. See the Postfix  <b>main.cf</b>  file  for  syntax
+       to  this  topic.  See  the Postfix <b>main.cf</b> file for syntax
-       details  and  for  default  values. Use the <b>postfix</b> <b>reload</b>
+       details and for default values.  Use  the  <b>postfix</b>  <b>reload</b>
        command after a configuration change.
 
        <b>parent</b><i>_</i><b>domain</b><i>_</i><b>matches</b><i>_</i><b>subdomains</b> (versions &gt;= 20011119)
-              List of Postfix features that use <i>domain.name</i>  pat-
+              List  of Postfix features that use <i>domain.name</i> pat-
               terns  to  match  <i>sub.domain.name</i>  (as  opposed  to
               requiring <i>.domain.name</i> patterns).
 
@@ -156,7 +160,7 @@ TRANSPORT(5)                                         TRANSPORT(5)
        Other parameters of interest:
 
        <b>default</b><i>_</i><b>transport</b>
-              The transport to use when no transport  is  explic-
+              The  transport  to use when no transport is explic-
               itly specified.
 
        <b>relayhost</b>
@@ -170,7 +174,7 @@ TRANSPORT(5)                                         TRANSPORT(5)
        <a href="regexp_table.5.html">regexp_table(5)</a> format of POSIX regular expression tables
 
 <b>LICENSE</b>
-       The Secure Mailer license must be  distributed  with  this
+       The  Secure  Mailer  license must be distributed with this
        software.
 
 <b>AUTHOR(S)</b>

postfix/html/virtual.5.html

@@ -146,12 +146,11 @@ VIRTUAL(5)                                             VIRTUAL(5)
        works for the first address in the expansion only.
 
 <b>ADDRESS</b> <b>EXTENSION</b>
-       When the search fails, and the address localpart  contains
+       When a mail address localpart contains the optional recip-
-       the  optional recipient delimiter (e.g., <i>user+foo</i>@<i>domain</i>),
+       ient  delimiter  (e.g., <i>user+foo</i>@<i>domain</i>), the lookup order
-       the search is repeated for the  unextended  address  (e.g.
+       becomes: <i>user+foo</i>@<i>domain</i>, <i>user</i>@<i>domain</i>, <i>user+foo</i>, <i>user</i>, and
-       <i>user</i>@<i>domain</i>), and the unmatched address extension is prop-
+       @<i>domain</i>.   An unmatched address extension (<i>+foo</i>) is propa-
-       agated to the result of expansion. The matching order  is:
+       gated to the result of table lookup.
-       <i>user+foo</i>@<i>domain</i>, <i>user</i>@<i>domain</i>, <i>user+foo</i>, <i>user</i>, and @<i>domain</i>.
 
 <b>REGULAR</b> <b>EXPRESSION</b> <b>TABLES</b>
        This section describes how the table lookups  change  when
@@ -169,17 +168,17 @@ VIRTUAL(5)                                             VIRTUAL(5)
        table, until a pattern is found that  matches  the  search
        string.
 
-       Results  are the same as with normal indexed file lookups,
+       Results  are  the  same as with indexed file lookups, with
-       with the additional feature that parenthesized  substrings
+       the additional feature that parenthesized substrings  from
-       from  the pattern can be interpolated as <b>$1</b>, <b>$2</b> and so on.
+       the pattern can be interpolated as <b>$1</b>, <b>$2</b> and so on.
 
 <b>BUGS</b>
-       The table format does not understand quoting  conventions.
+       The  table format does not understand quoting conventions.
 
 <b>CONFIGURATION</b> <b>PARAMETERS</b>
-       The  following  <b>main.cf</b> parameters are especially relevant
+       The following <b>main.cf</b> parameters are  especially  relevant
-       to this topic. See the Postfix  <b>main.cf</b>  file  for  syntax
+       to  this  topic.  See  the Postfix <b>main.cf</b> file for syntax
-       details  and  for  default  values. Use the <b>postfix</b> <b>reload</b>
+       details and for default values.  Use  the  <b>postfix</b>  <b>reload</b>
        command after a configuration change.
 
        <b>virtual</b><i>_</i><b>maps</b>
@@ -188,11 +187,11 @@ VIRTUAL(5)                                             VIRTUAL(5)
        Other parameters of interest:
 
        <b>inet</b><i>_</i><b>interfaces</b>
-              The network interface addresses  that  this  system
+              The  network  interface  addresses that this system
               receives mail on.
 
        <b>mydestination</b>
-              List  of  domains  that  this mail system considers
+              List of domains that  this  mail  system  considers
               local.
 
        <b>myorigin</b>
@@ -209,7 +208,7 @@ VIRTUAL(5)                                             VIRTUAL(5)
        <a href="regexp_table.5.html">regexp_table(5)</a> format of POSIX regular expression tables
 
 <b>LICENSE</b>
-       The Secure Mailer license must be  distributed  with  this
+       The  Secure  Mailer  license must be distributed with this
        software.
 
 <b>AUTHOR(S)</b>

postfix/man/man5/access.5

@@ -13,8 +13,9 @@ format of Postfix access table
 .ad
 .fi
 The optional \fBaccess\fR table directs the Postfix SMTP server
-to selectively reject or accept mail from or to specific hosts,
+to selectively reject or accept mail. Access can be allowed or
-domains, networks, host addresses or mail addresses.
+denied for specific host names, domain names, networks, host
+network addresses or mail addresses.
 
 Normally, the \fBaccess\fR table is specified as a text file
 that serves as input to the \fBpostmap\fR(1) command.
@@ -44,22 +45,57 @@ are lines whose first non-whitespace character is a `#'.
 .IP "multi-line text"
 A logical line starts with non-whitespace text. A line that
 starts with whitespace continues a logical line.
-.SH PATTERNS
+.SH EMAIL ADDRESS PATTERNS
 .na
 .nf
 .ad
 .fi
 With lookups from indexed files such as DB or DBM, or from networked
-tables such as NIS, LDAP or SQL, patterns are tried in the order as
+tables such as NIS, LDAP or SQL, the following lookup patterns are
-listed below:
+examined in the order as listed:
 .IP \fIuser\fR@\fIdomain\fR
 Matches the specified mail address.
 .IP \fIdomain.name\fR
-Matches the \fIdomain.name\fR itself and any subdomain thereof,
+Matches \fIdomain.name\fR as the domain part of an email address.
-either in hostnames or in mail addresses. Top-level domains will
+.sp
-never be matched.
+The pattern \fIdomain.name\fR also matches subdomains, but only
+when the string \fBsmtpd_access_maps\fR is listed in the Postfix
+\fBparent_domain_matches_subdomains\fR configuration setting.
+Otherwise, specify \fI.domain.name\fR (note the initial dot) in
+order to match subdomains.
 .IP \fIuser\fR@
 Matches all mail addresses with the specified user part.
+.PP
+Note: lookup of the null sender address may not be possible with
+all supported types of lookup table. A workaround is to specify
+\fBsmtpd_null_access_lookup_key = <>\fR in the Postfix \fBmain.cf\fR
+file, and to specify \fB<>\fR as the left-hand field in the access
+table.
+.SH ADDRESS EXTENSION
+.na
+.nf
+.fi
+.ad
+When a mail address localpart contains the optional recipient delimiter
+(e.g., \fIuser+foo\fR@\fIdomain\fR), the lookup order becomes:
+\fIuser+foo\fR@\fIdomain\fR, \fIuser\fR@\fIdomain\fR, \fIdomain\fR,
+\fIuser+foo\fR@, and \fIuser\fR@.
+.SH HOST NAME/ADDRESS PATTERNS
+.na
+.nf
+.ad
+.fi
+With lookups from indexed files such as DB or DBM, or from networked
+tables such as NIS, LDAP or SQL, the following lookup patterns are
+examined in the order as listed:
+.IP \fIdomain.name\fR
+Matches \fIdomain.name\fR.
+.sp
+The pattern \fIdomain.name\fR also matches subdomains, but only
+when the string \fBsmtpd_access_maps\fR is listed in the Postfix
+\fBparent_domain_matches_subdomains\fR configuration setting.
+Otherwise, specify \fI.domain.name\fR (note the initial dot) in
+order to match subdomains.
 .IP \fInet.work.addr.ess\fR
 .IP \fInet.work.addr\fR
 .IP \fInet.work\fR
@@ -96,13 +132,14 @@ Each pattern is a regular expression that is applied to the entire
 string being looked up. Depending on the application, that string
 is an entire client hostname, an entire client IP address, or an
 entire mail address. Thus, no parent domain or parent network search
-is done, and \fIuser@domain\fR mail addresses are not broken up into
+is done, \fIuser@domain\fR mail addresses are not broken up into
-their \fIuser@\fR and \fIdomain\fR constituent parts.
+their \fIuser@\fR and \fIdomain\fR constituent parts, nor is
+\fIuser+foo\fR broken up into \fIuser\fR and \fIfoo\fR.
 
 Patterns are applied in the order as specified in the table, until a
 pattern is found that matches the search string.
 
-Actions are the same as with normal indexed file lookups, with
+Actions are the same as with indexed file lookups, with
 the additional feature that parenthesized substrings from the
 pattern can be interpolated as \fB$1\fR, \fB$2\fR and so on.
 .SH BUGS

postfix/man/man5/canonical.5

@@ -88,13 +88,11 @@ In all the above forms, when \fIaddress\fR has the form
 .nf
 .fi
 .ad
-When table lookup fails, and the address localpart contains the
+When a mail address localpart contains the optional recipient delimiter
-optional recipient delimiter (e.g., \fIuser+foo\fR@\fIdomain\fR), the
+(e.g., \fIuser+foo\fR@\fIdomain\fR), the lookup order becomes:
-search is repeated for the unextended address (e.g.
+\fIuser+foo\fR@\fIdomain\fR, \fIuser\fR@\fIdomain\fR, \fIuser+foo\fR,
-\fIuser\fR@\fIdomain\fR), and the unmatched extension is propagated
+\fIuser\fR, and @\fIdomain\fR.  An unmatched address extension
-to the result of table lookup. The matching order is:
+(\fI+foo\fR) is propagated to the result of table lookup.
-\fIuser+foo\fR@\fIdomain\fR, \fIuser\fR@\fIdomain\fR,
-\fIuser+foo\fR, \fIuser\fR, and @\fIdomain\fR.
 .SH REGULAR EXPRESSION TABLES
 .na
 .nf
@@ -113,7 +111,7 @@ nor is \fIuser+foo\fR broken up into \fIuser\fR and \fIfoo\fR.
 Patterns are applied in the order as specified in the table, until a
 pattern is found that matches the search string.
 
-Results are the same as with normal indexed file lookups, with
+Results are the same as with indexed file lookups, with
 the additional feature that parenthesized substrings from the
 pattern can be interpolated as \fB$1\fR, \fB$2\fR and so on.
 .SH BUGS

postfix/man/man5/relocated.5

@@ -68,10 +68,10 @@ precedence.
 .nf
 .fi
 .ad
-When the search fails, and the address localpart contains the
+When a mail address localpart contains the optional recipient delimiter
-optional recipient delimiter (e.g., \fIuser+foo\fR@\fIdomain\fR),
+(e.g., \fIuser+foo\fR@\fIdomain\fR), the lookup order becomes:
-the search is repeated for the unextended address (e.g.
+\fIuser+foo\fR@\fIdomain\fR, \fIuser\fR@\fIdomain\fR, \fIuser+foo\fR,
-\fIuser\fR@\fIdomain\fR).
+\fIuser\fR, and @\fIdomain\fR.
 .SH REGULAR EXPRESSION TABLES
 .na
 .nf
@@ -90,7 +90,7 @@ nor is \fIuser+foo\fR broken up into \fIuser\fR and \fIfoo\fR.
 Patterns are applied in the order as specified in the table, until a
 pattern is found that matches the search string.
 
-Results are the same as with normal indexed file lookups, with
+Results are the same as with indexed file lookups, with
 the additional feature that parenthesized substrings from the
 pattern can be interpolated as \fB$1\fR, \fB$2\fR and so on.
 .SH BUGS

postfix/man/man5/transport.5

@@ -53,7 +53,10 @@ Mail for \fIdomain\fR is delivered through \fItransport\fR to
 \fInexthop\fR.
 .IP "\fI.domain transport\fR:\fInexthop\fR"
 Mail for any subdomain of \fIdomain\fR is delivered through
-\fItransport\fR to \fInexthop\fR.
+\fItransport\fR to \fInexthop\fR. This applies only when the
+string \fBtransport_maps\fR is not listed in the
+\fBparent_domain_matches_subdomains\fR configuration setting.
+Otherwise, a domain name matches itself and its subdomains.
 .PP
 Note: transport map entries take precedence over domains
 specified in the \fBmydestination\fR parameter. If you use
@@ -140,7 +143,7 @@ broken up into parent domains.
 Patterns are applied in the order as specified in the table, until a
 pattern is found that matches the search string.
 
-Results are the same as with normal indexed file lookups, with
+Results are the same as with indexed file lookups, with
 the additional feature that parenthesized substrings from the
 pattern can be interpolated as \fB$1\fR, \fB$2\fR and so on.
 .SH CONFIGURATION PARAMETERS

postfix/man/man5/virtual.5

@@ -158,13 +158,11 @@ This works for the first address in the expansion only.
 .nf
 .fi
 .ad
-When the search fails, and the address localpart contains the
+When a mail address localpart contains the optional recipient delimiter
-optional recipient delimiter (e.g., \fIuser+foo\fR@\fIdomain\fR),
+(e.g., \fIuser+foo\fR@\fIdomain\fR), the lookup order becomes:
-the search is repeated for the unextended address (e.g.
+\fIuser+foo\fR@\fIdomain\fR, \fIuser\fR@\fIdomain\fR, \fIuser+foo\fR,
-\fIuser\fR@\fIdomain\fR), and the unmatched address extension is
+\fIuser\fR, and @\fIdomain\fR.  An unmatched address extension
-propagated to the result of expansion. The matching order is:
+(\fI+foo\fR) is propagated to the result of table lookup.
-\fIuser+foo\fR@\fIdomain\fR, \fIuser\fR@\fIdomain\fR,
-\fIuser+foo\fR, \fIuser\fR, and @\fIdomain\fR.
 .SH REGULAR EXPRESSION TABLES
 .na
 .nf
@@ -183,7 +181,7 @@ nor is \fIuser+foo\fR broken up into \fIuser\fR and \fIfoo\fR.
 Patterns are applied in the order as specified in the table, until a
 pattern is found that matches the search string.
 
-Results are the same as with normal indexed file lookups, with
+Results are the same as with indexed file lookups, with
 the additional feature that parenthesized substrings from the
 pattern can be interpolated as \fB$1\fR, \fB$2\fR and so on.
 .SH BUGS

postfix/proto/access

@@ -7,8 +7,9 @@
 #	\fBpostmap /etc/postfix/access\fR
 # DESCRIPTION
 #	The optional \fBaccess\fR table directs the Postfix SMTP server
-#	to selectively reject or accept mail from or to specific hosts,
+#	to selectively reject or accept mail. Access can be allowed or
-#	domains, networks, host addresses or mail addresses.
+#	denied for specific host names, domain names, networks, host
+#	network addresses or mail addresses.
 #
 #	Normally, the \fBaccess\fR table is specified as a text file
 #	that serves as input to the \fBpostmap\fR(1) command.
@@ -36,20 +37,51 @@
 # .IP "multi-line text"
 #	A logical line starts with non-whitespace text. A line that
 #	starts with whitespace continues a logical line.
-# PATTERNS
+# EMAIL ADDRESS PATTERNS
 # .ad
 # .fi
 #	With lookups from indexed files such as DB or DBM, or from networked
-#	tables such as NIS, LDAP or SQL, patterns are tried in the order as
+#	tables such as NIS, LDAP or SQL, the following lookup patterns are
-#	listed below:
+#	examined in the order as listed:
 # .IP \fIuser\fR@\fIdomain\fR
 #	Matches the specified mail address.
 # .IP \fIdomain.name\fR
-#	Matches the \fIdomain.name\fR itself and any subdomain thereof,
+#	Matches \fIdomain.name\fR as the domain part of an email address.
-#	either in hostnames or in mail addresses. Top-level domains will
+# .sp
-#	never be matched.
+#	The pattern \fIdomain.name\fR also matches subdomains, but only
+#	when the string \fBsmtpd_access_maps\fR is listed in the Postfix
+#	\fBparent_domain_matches_subdomains\fR configuration setting.
+#	Otherwise, specify \fI.domain.name\fR (note the initial dot) in
+#	order to match subdomains.
 # .IP \fIuser\fR@
 #	Matches all mail addresses with the specified user part.
+# .PP
+#	Note: lookup of the null sender address may not be possible with
+#	all supported types of lookup table. A workaround is to specify
+#	\fBsmtpd_null_access_lookup_key = <>\fR in the Postfix \fBmain.cf\fR
+#	file, and to specify \fB<>\fR as the left-hand field in the access
+#	table.
+# ADDRESS EXTENSION
+# .fi
+# .ad
+#	When a mail address localpart contains the optional recipient delimiter
+#	(e.g., \fIuser+foo\fR@\fIdomain\fR), the lookup order becomes:
+#	\fIuser+foo\fR@\fIdomain\fR, \fIuser\fR@\fIdomain\fR, \fIdomain\fR,
+#	\fIuser+foo\fR@, and \fIuser\fR@.
+# HOST NAME/ADDRESS PATTERNS
+# .ad
+# .fi
+#	With lookups from indexed files such as DB or DBM, or from networked
+#	tables such as NIS, LDAP or SQL, the following lookup patterns are
+#	examined in the order as listed:
+# .IP \fIdomain.name\fR
+#	Matches \fIdomain.name\fR.
+# .sp
+#	The pattern \fIdomain.name\fR also matches subdomains, but only
+#	when the string \fBsmtpd_access_maps\fR is listed in the Postfix
+#	\fBparent_domain_matches_subdomains\fR configuration setting.
+#	Otherwise, specify \fI.domain.name\fR (note the initial dot) in
+#	order to match subdomains.
 # .IP \fInet.work.addr.ess\fR
 # .IP \fInet.work.addr\fR
 # .IP \fInet.work\fR
@@ -82,13 +114,14 @@
 #	string being looked up. Depending on the application, that string
 #	is an entire client hostname, an entire client IP address, or an
 #	entire mail address. Thus, no parent domain or parent network search
-#	is done, and \fIuser@domain\fR mail addresses are not broken up into
+#	is done, \fIuser@domain\fR mail addresses are not broken up into
-#	their \fIuser@\fR and \fIdomain\fR constituent parts.
+#	their \fIuser@\fR and \fIdomain\fR constituent parts, nor is
+#	\fIuser+foo\fR broken up into \fIuser\fR and \fIfoo\fR.
 #
 #	Patterns are applied in the order as specified in the table, until a
 #	pattern is found that matches the search string.
 #
-#	Actions are the same as with normal indexed file lookups, with
+#	Actions are the same as with indexed file lookups, with
 #	the additional feature that parenthesized substrings from the
 #	pattern can be interpolated as \fB$1\fR, \fB$2\fR and so on.
 # BUGS

postfix/proto/canonical

@@ -78,13 +78,11 @@
 # ADDRESS EXTENSION
 # .fi
 # .ad
-#	When table lookup fails, and the address localpart contains the
+#	When a mail address localpart contains the optional recipient delimiter
-#	optional recipient delimiter (e.g., \fIuser+foo\fR@\fIdomain\fR), the
+#	(e.g., \fIuser+foo\fR@\fIdomain\fR), the lookup order becomes:
-#	search is repeated for the unextended address (e.g.
+#	\fIuser+foo\fR@\fIdomain\fR, \fIuser\fR@\fIdomain\fR, \fIuser+foo\fR,
-#	\fIuser\fR@\fIdomain\fR), and the unmatched extension is propagated
+#	\fIuser\fR, and @\fIdomain\fR.  An unmatched address extension
-#	to the result of table lookup. The matching order is:
+#	(\fI+foo\fR) is propagated to the result of table lookup.
-#	\fIuser+foo\fR@\fIdomain\fR, \fIuser\fR@\fIdomain\fR,
-#	\fIuser+foo\fR, \fIuser\fR, and @\fIdomain\fR.
 # REGULAR EXPRESSION TABLES
 # .ad
 # .fi
@@ -101,7 +99,7 @@
 #	Patterns are applied in the order as specified in the table, until a
 #	pattern is found that matches the search string.
 #
-#	Results are the same as with normal indexed file lookups, with
+#	Results are the same as with indexed file lookups, with
 #	the additional feature that parenthesized substrings from the
 #	pattern can be interpolated as \fB$1\fR, \fB$2\fR and so on.
 # BUGS

postfix/proto/relocated

@@ -58,10 +58,10 @@
 # ADDRESS EXTENSION
 # .fi
 # .ad
-#	When the search fails, and the address localpart contains the
+#       When a mail address localpart contains the optional recipient delimiter
-#	optional recipient delimiter (e.g., \fIuser+foo\fR@\fIdomain\fR),
+#       (e.g., \fIuser+foo\fR@\fIdomain\fR), the lookup order becomes:
-#	the search is repeated for the unextended address (e.g.
+#       \fIuser+foo\fR@\fIdomain\fR, \fIuser\fR@\fIdomain\fR, \fIuser+foo\fR,
-#	\fIuser\fR@\fIdomain\fR).
+#	\fIuser\fR, and @\fIdomain\fR.
 # REGULAR EXPRESSION TABLES
 # .ad
 # .fi
@@ -78,7 +78,7 @@
 #	Patterns are applied in the order as specified in the table, until a
 #	pattern is found that matches the search string.
 #
-#	Results are the same as with normal indexed file lookups, with
+#	Results are the same as with indexed file lookups, with
 #	the additional feature that parenthesized substrings from the
 #	pattern can be interpolated as \fB$1\fR, \fB$2\fR and so on.
 # BUGS

postfix/proto/transport

@@ -45,7 +45,10 @@
 #	\fInexthop\fR.
 # .IP "\fI.domain transport\fR:\fInexthop\fR"
 #	Mail for any subdomain of \fIdomain\fR is delivered through
-#	\fItransport\fR to \fInexthop\fR.
+#	\fItransport\fR to \fInexthop\fR. This applies only when the
+#	string \fBtransport_maps\fR is not listed in the
+#	\fBparent_domain_matches_subdomains\fR configuration setting.
+#	Otherwise, a domain name matches itself and its subdomains.
 # .PP
 #	Note: transport map entries take precedence over domains
 #	specified in the \fBmydestination\fR parameter. If you use
@@ -128,7 +131,7 @@
 #	Patterns are applied in the order as specified in the table, until a
 #	pattern is found that matches the search string.
 #
-#	Results are the same as with normal indexed file lookups, with
+#	Results are the same as with indexed file lookups, with
 #	the additional feature that parenthesized substrings from the
 #	pattern can be interpolated as \fB$1\fR, \fB$2\fR and so on.
 # CONFIGURATION PARAMETERS

postfix/proto/virtual

@@ -144,13 +144,11 @@
 # ADDRESS EXTENSION
 # .fi
 # .ad
-#	When the search fails, and the address localpart contains the
+#	When a mail address localpart contains the optional recipient delimiter
-#	optional recipient delimiter (e.g., \fIuser+foo\fR@\fIdomain\fR),
+#	(e.g., \fIuser+foo\fR@\fIdomain\fR), the lookup order becomes:
-#	the search is repeated for the unextended address (e.g.
+#	\fIuser+foo\fR@\fIdomain\fR, \fIuser\fR@\fIdomain\fR, \fIuser+foo\fR,
-#	\fIuser\fR@\fIdomain\fR), and the unmatched address extension is
+#	\fIuser\fR, and @\fIdomain\fR.  An unmatched address extension
-#	propagated to the result of expansion. The matching order is:
+#	(\fI+foo\fR) is propagated to the result of table lookup.
-#	\fIuser+foo\fR@\fIdomain\fR, \fIuser\fR@\fIdomain\fR,
-#	\fIuser+foo\fR, \fIuser\fR, and @\fIdomain\fR.
 # REGULAR EXPRESSION TABLES
 # .ad
 # .fi
@@ -167,7 +165,7 @@
 #	Patterns are applied in the order as specified in the table, until a
 #	pattern is found that matches the search string.
 #
-#	Results are the same as with normal indexed file lookups, with
+#	Results are the same as with indexed file lookups, with
 #	the additional feature that parenthesized substrings from the
 #	pattern can be interpolated as \fB$1\fR, \fB$2\fR and so on.
 # BUGS

postfix/src/global/mail_version.h

@@ -15,7 +15,7 @@
   * Version of this program.
   */
 #define VAR_MAIL_VERSION	"mail_version"
-#define DEF_MAIL_VERSION	"Snapshot-20020104"
+#define DEF_MAIL_VERSION	"Snapshot-20020106"
 extern char *var_mail_version;
 
 /* LICENSE

postfix/src/smtpd/smtpd_check.c

@@ -290,6 +290,7 @@
 #include <maps.h>
 #include <mail_addr_find.h>
 #include <match_parent_style.h>
+#include <split_addr.h>
 
 /* Application-specific. */
 
@@ -736,6 +737,29 @@ static const char *check_mail_addr_find(SMTPD_STATE *state,
     return (result);
 }
 
+/* resolve_final - do we do final delivery for the domain? */
+
+static int resolve_final(SMTPD_STATE *state, const char *reply_name, 
+const char *domain)
+{
+
+    /* If matches $mydestination or $inet_interfaces. */
+    if (resolve_local(domain))
+	return (1);
+
+    /* If Postfix-style virtual domain. */
+    if (*var_virtual_maps
+	&& check_maps_find(state, reply_name, virtual_maps, domain, 0))
+	return (1);
+
+    /* If virtual mailbox domain. */
+    if (*var_virt_mailbox_maps
+	&& check_maps_find(state, reply_name, virt_mailbox_maps, domain, 0))
+	return (1);
+
+    return (0);
+}
+
 /* reject_unknown_client - fail if client hostname is unknown */
 
 static int reject_unknown_client(SMTPD_STATE *state)
@@ -997,14 +1021,10 @@ static int permit_auth_destination(SMTPD_STATE *state, char *recipient)
     domain += 1;
 
     /*
-     * Permit final delivery: the destination matches mydestination or
+     * Permit final delivery: the destination matches mydestination, 
-     * virtual_maps.
+     * virtual_maps, or virtual_mailbox_maps.
      */
-    if (resolve_local(domain)
+    if (resolve_final(state, recipient, domain))
-	|| (*var_virtual_maps
-	    && check_maps_find(state, recipient, virtual_maps, domain, 0))
-	|| (*var_virt_mailbox_maps
-	&& check_maps_find(state, recipient, virt_mailbox_maps, domain, 0)))
 	return (SMTPD_CHECK_OK);
 
     /*
@@ -1261,11 +1281,7 @@ static int permit_mx_backup(SMTPD_STATE *state, const char *recipient)
     if ((domain = strrchr(CONST_STR(reply->recipient), '@')) == 0)
 	return (SMTPD_CHECK_OK);
     domain += 1;
-    if (resolve_local(domain)
+    if (resolve_final(state, recipient, domain))
-	|| (*var_virtual_maps
-	    && check_maps_find(state, recipient, virtual_maps, domain, 0))
-	|| (*var_virt_mailbox_maps
-	&& check_maps_find(state, recipient, virt_mailbox_maps, domain, 0)))
 	return (SMTPD_CHECK_OK);
 
     if (msg_verbose)
@@ -1397,11 +1413,7 @@ static int reject_unknown_address(SMTPD_STATE *state, const char *addr,
     if ((domain = strrchr(CONST_STR(reply->recipient), '@')) == 0)
 	return (SMTPD_CHECK_DUNNO);
     domain += 1;
-    if (resolve_local(domain)
+    if (resolve_final(state, reply_name, domain))
-	|| (*var_virtual_maps
-	    && check_maps_find(state, reply_name, virtual_maps, domain, 0))
-	|| (*var_virt_mailbox_maps
-       && check_maps_find(state, reply_name, virt_mailbox_maps, domain, 0)))
 	return (SMTPD_CHECK_DUNNO);
     if (domain[0] == '#')
 	return (SMTPD_CHECK_DUNNO);
@@ -1693,9 +1705,12 @@ static int check_mail_access(SMTPD_STATE *state, const char *table,
 {
     char   *myname = "check_mail_access";
     const RESOLVE_REPLY *reply;
-    const char *ratsign;
+    const char *domain;
     int     status;
     char   *local_at;
+    char   *bare_addr;
+    char   *bare_ext;
+    char   *bare_at;
 
     if (msg_verbose)
 	msg_info("%s: %s", myname, addr);
@@ -1709,50 +1724,114 @@ static int check_mail_access(SMTPD_STATE *state, const char *table,
      * Garbage in, garbage out. Every address from canon_addr_internal() and
      * from resolve_clnt_query() must be fully qualified.
      */
-    if ((ratsign = strrchr(CONST_STR(reply->recipient), '@')) == 0) {
+    if ((domain = strrchr(CONST_STR(reply->recipient), '@')) == 0) {
-	msg_warn("%s: no @domain in address: %s", myname, CONST_STR(reply->recipient));
+	msg_warn("%s: no @domain in address: %s", myname, 
+	CONST_STR(reply->recipient));
 	return (0);
     }
+    domain += 1;
 
     /*
-     * Avoid surprise matches with source-routed, non-local addresses.
+     * In case of address extensions.
      */
-    if (var_allow_untrust_route == 0
+    if (*var_rcpt_delim == 0) {
-	&& (reply->flags & RESOLVE_FLAG_ROUTED)
+	bare_addr = 0;
-	&& !resolve_local(ratsign + 1))
+    } else {
-	return (SMTPD_CHECK_DUNNO);
+	bare_addr = mystrdup(addr);
+	if ((bare_at = strrchr(bare_addr, '@')) != 0)
+	    *bare_at = 0;
+	if ((bare_ext = split_addr(bare_addr, *var_rcpt_delim)) != 0) {
+	    if (bare_at != 0) {
+		*bare_at = '@';
+		memmove(bare_ext - 1, bare_at, strlen(bare_at) + 1);
+		bare_at = bare_ext - 1;
+	    }
+	} else {
+	    myfree(bare_addr);
+	    bare_addr = 0;
+	}
+    }
+
+#define CHECK_MAIL_ACCESS_RETURN(x) \
+	{ if (bare_addr) myfree(bare_addr); return(x); }
 
     /*
-     * Look up the full address.
+     * Source-routed, non-local, recipient addresses are too suspicious for
+     * returning an "OK" result. The complicated expression below was brought
+     * to you by the keyboard of Victor Duchovny, Morgan Stanley and hacked
+     * up a bit by Wietse.
+     */
+#define SUSPICIOUS(domain, reply, state, reply_name, reply_class) \
+	(var_allow_untrust_route == 0 \
+	&& (reply->flags & RESOLVE_FLAG_ROUTED) \
+	&& strcmp(reply_class, SMTPD_NAME_RECIPIENT) == 0 \
+	&& !resolve_final(state, reply_name, domain))
+
+    /*
+     * Look up user+foo@domain if the address has an extension, user@domain
+     * otherwise.
      */
     if ((status = check_access(state, table, CONST_STR(reply->recipient), FULL,
 			       found, reply_name, reply_class, def_acl)) != 0
 	|| *found)
-	return (status);
+	CHECK_MAIL_ACCESS_RETURN(status == SMTPD_CHECK_OK
+	      && SUSPICIOUS(domain, reply, state, reply_name, reply_class) ?
+				 SMTPD_CHECK_DUNNO : status);
+
+    /*
+     * Try user@domain if the address has an extension.
+     */
+    if (bare_addr)
+	if ((status = check_access(state, table, bare_addr, PARTIAL,
+			      found, reply_name, reply_class, def_acl)) != 0
+	    || *found)
+	    CHECK_MAIL_ACCESS_RETURN(status == SMTPD_CHECK_OK
+	      && SUSPICIOUS(domain, reply, state, reply_name, reply_class) ?
+				     SMTPD_CHECK_DUNNO : status);
 
     /*
      * Look up the domain name, or parent domains thereof.
      */
-    if ((status = check_domain_access(state, table, ratsign + 1, PARTIAL,
+    if ((status = check_domain_access(state, table, domain, PARTIAL,
 			      found, reply_name, reply_class, def_acl)) != 0
 	|| *found)
-	return (status);
+	CHECK_MAIL_ACCESS_RETURN(status == SMTPD_CHECK_OK
+	      && SUSPICIOUS(domain, reply, state, reply_name, reply_class) ?
+				 SMTPD_CHECK_DUNNO : status);
 
     /*
-     * Look up localpart@
+     * Look up user+foo@ if the address has an extension, user@ otherwise.
+     * XXX This leaks a little memory if map lookup is aborted.
      */
     local_at = mystrndup(CONST_STR(reply->recipient),
-			 ratsign - CONST_STR(reply->recipient) + 1);
+			 domain - CONST_STR(reply->recipient));
     status = check_access(state, table, local_at, PARTIAL, found,
 			  reply_name, reply_class, def_acl);
     myfree(local_at);
     if (status != 0 || *found)
-	return (status);
+	CHECK_MAIL_ACCESS_RETURN(status == SMTPD_CHECK_OK
+	      && SUSPICIOUS(domain, reply, state, reply_name, reply_class) ?
+				 SMTPD_CHECK_DUNNO : status);
+
+    /*
+     * Look up user@ if the address has an extension. XXX Same problem here.
+     */
+    if (bare_addr) {
+	local_at = (bare_at ? mystrndup(bare_addr, bare_at + 1 - bare_addr) :
+		    mystrdup(bare_addr));
+	status = check_access(state, table, local_at, PARTIAL, found,
+			      reply_name, reply_class, def_acl);
+	myfree(local_at);
+	if (status != 0 || *found)
+	    CHECK_MAIL_ACCESS_RETURN(status == SMTPD_CHECK_OK
+	      && SUSPICIOUS(domain, reply, state, reply_name, reply_class) ?
+				     SMTPD_CHECK_DUNNO : status);
+    }
 
     /*
      * Undecided when no match found.
      */
-    return (SMTPD_CHECK_DUNNO);
+    CHECK_MAIL_ACCESS_RETURN(SMTPD_CHECK_DUNNO);
 }
 
 /* reject_maps_rbl - reject if client address in real-time blackhole list */

postfix/src/util/readlline.c

@@ -34,6 +34,9 @@
 /* DIAGNOSTICS
 /*	Warning: a continuation line that does not continue preceding text.
 /*	The invalid input is ignored, to avoid complicating caller code.
+/* SECURITY
+/*	readlline() imposes no logical line length limit therefore it
+/*	should be used for reading trusted information only.
 /* LICENSE
 /* .ad
 /* .fi