|
|
|
|
@@ -25,6 +25,54 @@ more recent Eclipse Public License 2.0. Recipients can choose to take
|
|
|
|
|
the software under the license of their choice. Those who are more
|
|
|
|
|
comfortable with the IPL can continue with that license.
|
|
|
|
|
|
|
|
|
|
Major changes - internal protocol identification
|
|
|
|
|
------------------------------------------------
|
|
|
|
|
|
|
|
|
|
[Incompat 20200920] Internal protocols have changed. You need to
|
|
|
|
|
"postfix stop" before updating, or before backing out to an earlier
|
|
|
|
|
release, otherwise long-running daemons (pickup, qmgr, verify, tlsproxy,
|
|
|
|
|
postscreen) may fail to communicate with the rest of Postfix, causing
|
|
|
|
|
mail delivery delays until Postfix is restarted.
|
|
|
|
|
|
|
|
|
|
This change does not affect message files in Postfix queue directories,
|
|
|
|
|
only the communication between running Postfix programs.
|
|
|
|
|
|
|
|
|
|
With this change, every Postfix internal service, including the postdrop
|
|
|
|
|
command, announces the name of its protocol before doing any other I/O.
|
|
|
|
|
Every Postfix client program, including the Postfix sendmail command,
|
|
|
|
|
will verify that the protocol name matches what it is supposed to be.
|
|
|
|
|
|
|
|
|
|
The purpose of this change is to produce better error messages, for
|
|
|
|
|
example, when someone configures the discard daemon as a bounce
|
|
|
|
|
service in master.cf, or vice versa.
|
|
|
|
|
|
|
|
|
|
This change may break third-party programs that implement a
|
|
|
|
|
Postfix-internal protocol such as qpsmtpd. Such programs have never
|
|
|
|
|
been supported. Fortunately, this will be an easy fix: look at the
|
|
|
|
|
first data from the cleanup daemon: if it is a protocol announcement,
|
|
|
|
|
you're talking to Postfix 3.6 or later. That's the only real change.
|
|
|
|
|
|
|
|
|
|
Major changes - tls
|
|
|
|
|
-------------------
|
|
|
|
|
|
|
|
|
|
[Incompat 20200705] The minimum supported OpenSSL version is 1.1.1,
|
|
|
|
|
which will reach the end of life by 2023-09-11. Postfix 3.6 is
|
|
|
|
|
expected to reach the end of support in 2025. Until then, Postfix
|
|
|
|
|
will be updated as needed for compatibility with OpenSSL.
|
|
|
|
|
|
|
|
|
|
The default fingerprint digest has changed from md5 to sha256 (Postfix
|
|
|
|
|
3.6 with compatibility_level >= 3.6). With a lower compatibility_level
|
|
|
|
|
setting, Postfix defaults to using md5, and logs a warning when a Postfix
|
|
|
|
|
configuration specifies no explicit digest type.
|
|
|
|
|
|
|
|
|
|
Export-grade Diffie-Hellman key exchange is no longer supported,
|
|
|
|
|
and the tlsproxy_tls_dh512_param_file parameter is ignored,
|
|
|
|
|
|
|
|
|
|
[Feature 20200906] The tlstype.pl helper script by Viktor Dukhovni
|
|
|
|
|
reports TLS information per message delivery. This processes output
|
|
|
|
|
from the collate.pl script. See auxiliary/collate/README.tlstype and
|
|
|
|
|
auxiliary/collate/tlstype.pl.
|
|
|
|
|
|
|
|
|
|
Major changes - compatibility level
|
|
|
|
|
-----------------------------------
|
|
|
|
|
|
|
|
|
|
@@ -37,75 +85,17 @@ omitted and defaults to zero. Earlier compatibility levels are 0, 1 and 2.
|
|
|
|
|
This also introduces main.cf and master.cf support for the <=level,
|
|
|
|
|
<level, and other operators to compare compatibility levels. With the
|
|
|
|
|
standard <=, <, etc. operators, compatibility level 3.10 would be less
|
|
|
|
|
than 3.9. which is undesirable.
|
|
|
|
|
than 3.9, which is undesirable.
|
|
|
|
|
|
|
|
|
|
Major changes - delivery logging
|
|
|
|
|
--------------------------------
|
|
|
|
|
Major changes - services(5) override
|
|
|
|
|
------------------------------------
|
|
|
|
|
|
|
|
|
|
[Incompat 20200531] Postfix delivery agents now log an explicit record
|
|
|
|
|
when delegating delivery to a different Postfix delivery agent.
|
|
|
|
|
|
|
|
|
|
For example, with "best_mx_transport = local", an SMTP delivery
|
|
|
|
|
agent will now log when a recipient will be delivered locally. This
|
|
|
|
|
makes the delegating delivery agent visible, where it would otherwise
|
|
|
|
|
have remained invisible, which would complicate troubleshooting.
|
|
|
|
|
|
|
|
|
|
postfix/smtp[pid]: queueid: passing <recipient> to transport=local
|
|
|
|
|
|
|
|
|
|
This will usually be followed by logging for an actual delivery:
|
|
|
|
|
|
|
|
|
|
postfix/local[pid]: queueid: to=<recipient>, relay=local, ...
|
|
|
|
|
|
|
|
|
|
Other examples: the local delivery agent defers mailbox delivery
|
|
|
|
|
through mailbox_transport or through fallback_transport.
|
|
|
|
|
|
|
|
|
|
Major changes - dns lookups
|
|
|
|
|
---------------------------
|
|
|
|
|
|
|
|
|
|
[Feature 20200509] The threadsafe resolver API (res_nxxx() calls) is now
|
|
|
|
|
the default, not because the API is threadsafe, but because new features
|
|
|
|
|
are being added there.
|
|
|
|
|
|
|
|
|
|
To build old style, build with:
|
|
|
|
|
|
|
|
|
|
make makefiles CCARGS="-DNO_RES_NCALLS..."
|
|
|
|
|
|
|
|
|
|
This is also the default for systems that are known not to support
|
|
|
|
|
the threadsafe resolver API.
|
|
|
|
|
|
|
|
|
|
Major changes - error logging
|
|
|
|
|
-----------------------------
|
|
|
|
|
|
|
|
|
|
[Incompat 20200531] Postfix programs will now log "Application error"
|
|
|
|
|
instead of "Success" or "Unknown error: 0" when an operation fails with
|
|
|
|
|
errno == 0.
|
|
|
|
|
|
|
|
|
|
Major changes - internal protocol identification
|
|
|
|
|
------------------------------------------------
|
|
|
|
|
|
|
|
|
|
[Incompat 20200920] Internal protocols have changed. You need to
|
|
|
|
|
"postfix stop" before updating, or before backing out to an earlier
|
|
|
|
|
release, otherwise long-running daemons (pickup, qmgr, verify, tlsproxy,
|
|
|
|
|
postscreen) may fail to communicate with the rest of Postfix, causing
|
|
|
|
|
warnings or timeouts.
|
|
|
|
|
|
|
|
|
|
The purpose of this change is to produce better error messages, for
|
|
|
|
|
example, when someone configures the discard daemon as a bounce
|
|
|
|
|
service in master.cf, or vice versa.
|
|
|
|
|
|
|
|
|
|
This change will break third-party programs that implement a
|
|
|
|
|
Postfix-internal protocol such as qpsmtpd. This is not a Postfix bug:
|
|
|
|
|
programs that depend on Postfix internal details have never been
|
|
|
|
|
supported.
|
|
|
|
|
|
|
|
|
|
Major changes - known tcp ports
|
|
|
|
|
-------------------------------
|
|
|
|
|
|
|
|
|
|
[Feature 20210418] The new "known_tcp_ports" configuration parameter
|
|
|
|
|
reduces Postfix dependency on the services(5) database. On some systems
|
|
|
|
|
the port 465 service is called "smtps", and on other systems it is called
|
|
|
|
|
"submissions". The default known_tcp_ports value is "lmtp=24, smtp=25,
|
|
|
|
|
smtps=submissions=465, submission=587".
|
|
|
|
|
[Feature 20210418] Postfix no longer uses the services(5) database
|
|
|
|
|
to look up the TCP ports for SMTP and LMTP services. Instead, this
|
|
|
|
|
information is configured with the new known_tcp_ports configuration
|
|
|
|
|
parameter (default: lmtp=24, smtp=25, smtps=submissions=465,
|
|
|
|
|
submission=587). When a service is not specified in known_tcp_ports,
|
|
|
|
|
Postfix will still query the services(5) database.
|
|
|
|
|
|
|
|
|
|
Major changes - local_login_sender_maps
|
|
|
|
|
---------------------------------------
|
|
|
|
|
@@ -120,8 +110,8 @@ space or comma. The default is backwards-compatible: every user may
|
|
|
|
|
specify any sender envelope address.
|
|
|
|
|
|
|
|
|
|
This feature is enforced by the postdrop command. When no UNIX login
|
|
|
|
|
name is available, the Postfix postdrop command will prepend "uid:"
|
|
|
|
|
to the numerical UID and use that instead.
|
|
|
|
|
name is available, the postdrop command will prepend "uid:" to the
|
|
|
|
|
numerical UID and use that instead.
|
|
|
|
|
|
|
|
|
|
This feature ignores address extensions in the user-specified
|
|
|
|
|
envelope sender address.
|
|
|
|
|
@@ -223,19 +213,13 @@ no" permanent in main.cf, for example:
|
|
|
|
|
To stop the reminder, configure the respectful_logging parameter to
|
|
|
|
|
"yes" or "no", or configure "compatibility_level = 3.6".
|
|
|
|
|
|
|
|
|
|
Major changes - smtpd_sasl_mechanism_list
|
|
|
|
|
-----------------------------------------
|
|
|
|
|
|
|
|
|
|
[Feature 20200906] The smtpd_sasl_mechanism_list parameter (default:
|
|
|
|
|
!external, static:rest) prevents confusing errors when a SASL backend
|
|
|
|
|
announces EXTERNAL support which Postfix does not support.
|
|
|
|
|
|
|
|
|
|
Major changes - threaded bounces
|
|
|
|
|
--------------------------------
|
|
|
|
|
|
|
|
|
|
[Feature 20201205] Support for threaded bounces. This allows mail readers
|
|
|
|
|
to present a bounce, delay, or success delivery notification in the same
|
|
|
|
|
email thread as the original message.
|
|
|
|
|
[Feature 20201205] Support for threaded bounces. This allows mail
|
|
|
|
|
readers to present a non-delivery, delayed delivery, or successful
|
|
|
|
|
delivery notification in the same email thread as the original
|
|
|
|
|
message.
|
|
|
|
|
|
|
|
|
|
Unfortunately, this also makes it easy for users to mistakenly delete
|
|
|
|
|
the whole email thread (all related messages), instead of deleting
|
|
|
|
|
@@ -243,22 +227,51 @@ only the delivery status notification.
|
|
|
|
|
|
|
|
|
|
To enable, specify "enable_threaded_bounces = yes".
|
|
|
|
|
|
|
|
|
|
Major changes - tls
|
|
|
|
|
-------------------
|
|
|
|
|
Other changes - smtpd_sasl_mechanism_list
|
|
|
|
|
-----------------------------------------
|
|
|
|
|
|
|
|
|
|
[Incompat 20200705] The minimum OpenSSL version is 1.1.1, which will
|
|
|
|
|
reach the end of life by 2023-09-11.
|
|
|
|
|
[Feature 20200906] The smtpd_sasl_mechanism_list parameter (default:
|
|
|
|
|
!external, static:rest) prevents confusing errors when a SASL backend
|
|
|
|
|
announces EXTERNAL support which Postfix does not support.
|
|
|
|
|
|
|
|
|
|
The default digest has changed from md5 to sha256 (Postfix 3.6 with
|
|
|
|
|
compatibility_level >= 3). With a lower compatibility_level setting,
|
|
|
|
|
Postfix defaults to using md5, and logs a warning when a Postfix
|
|
|
|
|
configuration specifies no explicit digest type.
|
|
|
|
|
Other changes - delivery logging
|
|
|
|
|
--------------------------------
|
|
|
|
|
|
|
|
|
|
Export-grade Diffie-Hellman key exchange is no longer supported,
|
|
|
|
|
and the tlsproxy_tls_dh512_param_file parameter is ignored,
|
|
|
|
|
[Incompat 20200531] Postfix delivery agents now log an explicit record
|
|
|
|
|
when delegating delivery to a different Postfix delivery agent.
|
|
|
|
|
|
|
|
|
|
[Feature 20200906] The tlstype.pl helper script by Viktor Dukhovni
|
|
|
|
|
reports TLS information per message delivery. This processes output
|
|
|
|
|
from the collate.pl script. See auxiliary/collate/README.tlstype and
|
|
|
|
|
auxiliary/collate/tlstype.pl.
|
|
|
|
|
For example, with "best_mx_transport = local", an SMTP delivery
|
|
|
|
|
agent will now log when a recipient will be delivered locally. This
|
|
|
|
|
makes the delegating delivery agent visible, where it would otherwise
|
|
|
|
|
have remained invisible, which would complicate troubleshooting.
|
|
|
|
|
|
|
|
|
|
postfix/smtp[pid]: queueid: passing <recipient> to transport=local
|
|
|
|
|
|
|
|
|
|
This will usually be followed by logging for an actual delivery:
|
|
|
|
|
|
|
|
|
|
postfix/local[pid]: queueid: to=<recipient>, relay=local, ...
|
|
|
|
|
|
|
|
|
|
Other examples: the local delivery agent will log a record that it
|
|
|
|
|
defers mailbox delivery through mailbox_transport or through
|
|
|
|
|
fallback_transport.
|
|
|
|
|
|
|
|
|
|
Other changes - error logging
|
|
|
|
|
-----------------------------
|
|
|
|
|
|
|
|
|
|
[Incompat 20200531] Postfix programs will now log "Application error"
|
|
|
|
|
instead of "Success" or "Unknown error: 0" when an operation fails with
|
|
|
|
|
errno == 0, i.e., the error originates from non-kernel code.
|
|
|
|
|
|
|
|
|
|
Other changes - dns lookups
|
|
|
|
|
---------------------------
|
|
|
|
|
|
|
|
|
|
[Feature 20200509] The threadsafe resolver API (res_nxxx() calls)
|
|
|
|
|
is now the default, not because the API is threadsafe, but because
|
|
|
|
|
this is the API where new features are being added.
|
|
|
|
|
|
|
|
|
|
To build old style, build with:
|
|
|
|
|
|
|
|
|
|
make makefiles CCARGS="-DNO_RES_NCALLS..."
|
|
|
|
|
|
|
|
|
|
This is the default for systems that are known not to support the
|
|
|
|
|
threadsafe resolver API.
|
|
|
|
|
|
Wietse Venema
Viktor Dukhovni