From e14a8a626a141ecc4e03eae20bb1d81159a596fb Mon Sep 17 00:00:00 2001 From: Wietse Venema Date: Fri, 26 Dec 2003 00:00:00 -0500 Subject: [PATCH] postfix-2.0.16-20031226 --- postfix/HISTORY | 20 +- postfix/README_FILES/SMTPD_PROXY_README | 4 +- postfix/README_FILES/XCLIENT_README | 21 +- postfix/README_FILES/XFORWARD_README | 9 +- postfix/RELEASE_NOTES | 11 ++ postfix/conf/sample-rate.cf | 12 ++ postfix/html/nqmgr.8.html | 132 ++++++------- postfix/html/postsuper.1.html | 63 +++--- postfix/html/qmgr.8.html | 96 +++++----- postfix/html/rate.html | 7 + postfix/html/smtpd.8.html | 242 ++++++++++++------------ postfix/man/man1/postsuper.1 | 4 +- postfix/man/man8/nqmgr.8 | 7 +- postfix/man/man8/qmgr.8 | 7 +- postfix/man/man8/smtpd.8 | 24 +-- postfix/src/global/mail_params.h | 6 +- postfix/src/global/mail_version.h | 2 +- postfix/src/global/resolve_clnt.c | 28 ++- postfix/src/master/Makefile.in | 2 +- postfix/src/master/master.h | 4 - postfix/src/nqmgr/qmgr.c | 9 +- postfix/src/nqmgr/qmgr_active.c | 3 +- postfix/src/postsuper/postsuper.c | 4 +- postfix/src/qmgr/qmgr.c | 9 +- postfix/src/qmgr/qmgr_active.c | 3 +- postfix/src/smtp/smtp.c | 6 +- postfix/src/smtp/smtp.h | 21 +- postfix/src/smtp/smtp_addr.c | 64 ++++--- postfix/src/smtp/smtp_addr.h | 4 +- postfix/src/smtp/smtp_connect.c | 59 +++--- postfix/src/smtp/smtp_proto.c | 19 +- postfix/src/smtp/smtp_rcpt.c | 2 +- postfix/src/smtpd/smtpd.c | 54 +++--- postfix/src/smtpd/smtpd.h | 74 +++++--- postfix/src/smtpd/smtpd_check.c | 31 +++ postfix/src/smtpd/smtpd_check.h | 1 + postfix/src/trivial-rewrite/resolve.c | 5 +- 37 files changed, 616 insertions(+), 453 deletions(-) diff --git a/postfix/HISTORY b/postfix/HISTORY index ab1b56f4a..8ef99027b 100644 --- a/postfix/HISTORY +++ b/postfix/HISTORY @@ -8920,14 +8920,28 @@ Apologies for any names omitted. Cleanup: eliminated binary hashes from anvil server. Anvil client information is now stored on top of its VSTREAM. +20031226 + + Feature: bounce_queue_lifetime parameter (default: + $maximal_queue_life_time) that bounds the time that + MAILER-DAEMON messages spend in the queue before they are + considered undeliverable. + + Feature: disable "mail loops back to myself" protection + when SMTP mail is sent to a non-standard port. This makes + setting up content filters less painful. + + Cleanup: disallow bare x.x.x.x numeric IP addresses in + email addresses. The form user@[x.x.x.x] is still allowed. + + Cleanup: cleaned up the naming of internal symbols in the + SMTP client. + Open problems: Low: in the SMTP client, pass the session, request and state structures as separate arguments. - Low: in the SMTP client, turn off "mail loops back to - myself" detection if a non-default TCP port is specified. - High: when virtual aliasing is turned off after content filtering, local submissions may escape virtual aliasing. diff --git a/postfix/README_FILES/SMTPD_PROXY_README b/postfix/README_FILES/SMTPD_PROXY_README index c6f63acbf..3243ecee2 100644 --- a/postfix/README_FILES/SMTPD_PROXY_README +++ b/postfix/README_FILES/SMTPD_PROXY_README @@ -122,7 +122,7 @@ for testing, of course. smtp inet n - n - - smtpd -o smtpd_proxy_filter=26 :26 inet n - n - - smtpd - -o smtpd_authorized_xclient_hosts=127.0.0.0/8 + -o smtpd_authorized_xforward_hosts=127.0.0.0/8 -o smtpd_client_restrictions= -o smtpd_helo_restrictions= -o smtpd_sender_restrictions= @@ -135,7 +135,7 @@ Note: do not specify spaces around the "=" or "," characters. The ":26" causes Postfix to listen on the localhost address only. DO NOT expose the secondary SMTP server to the Internet :-) -The smtpd_authorized_xclient_hosts parameter allows the before +The smtpd_authorized_xforward_hosts parameter allows the before filter SMTP server to forward remote SMTP client information to the after-filter SMTP server, so that the after-filter Postfix daemons log the remote SMTP client information instead of logging diff --git a/postfix/README_FILES/XCLIENT_README b/postfix/README_FILES/XCLIENT_README index 147809766..2fe74bb0a 100644 --- a/postfix/README_FILES/XCLIENT_README +++ b/postfix/README_FILES/XCLIENT_README @@ -22,7 +22,7 @@ server's Received: message header. style content filter applications, the filter can be simplified if it can delegate decisions concerning mail relay and other access control to the MTA. This is especially useful when the filter acts -as a transparent proxy for SMTP commands. As in the first example, +as a transparent proxy for SMTP commands. As in the other examples, this requires that the filter can override the MTA's idea of the SMTP client hostname, network address, and other information. @@ -68,8 +68,8 @@ is not enclosed with []. The PROTO attribute specifies either SMTP or ESMTP. -The HELO attribute specifies a HELO parameter value, or the value -[UNAVAILABLE] when the information is unavailable. +The HELO attribute specifies an SMTP HELO parameter value, or the +value [UNAVAILABLE] when the information is unavailable. Note 1: syntactically valid NAME and HELO attributes can be up to 255 characters long. The client must not send XCLIENT commands that @@ -81,16 +81,15 @@ upper case, lower case or mixed case. Security ======== -The XCLIENT command changes audit trails and/or client access +The XCLIENT command changes audit trails and/or SMTP client access permissions. Use of this command must be restricted to authorized -clients. - -The XCLIENT should not override its own access control mechanism. +SMTP clients. However, the XCLIENT command should not override its +own access control mechanism. SMTP connection caching ======================= -SMTP connection caching makes it possible to deliver multiple -messages within the same SMTP session. The XCLIENT attributes are -persistent across an SMTP session, and need to be reset as appropriate -in between deliveries. +XCLIENT attributes persist until the end of an SMTP session. If +one session is used to deliver mail from different SMTP clients, +the XCLIENT attributes need to be reset as appropriate in between +deliveries. diff --git a/postfix/README_FILES/XFORWARD_README b/postfix/README_FILES/XFORWARD_README index bbd126bd2..fffe00223 100644 --- a/postfix/README_FILES/XFORWARD_README +++ b/postfix/README_FILES/XFORWARD_README @@ -12,11 +12,12 @@ remote client and/or message identifying information through the content filter to MTA2, so that the information could be logged as part of mail handling transactions. -This extension is implemented as a separate command, so that it -can be used to transmit client or message attributes incrementally. -It is not implemented by passing additional parameters via the MAIL +This extension is implemented as a separate command, and can be +used to transmit client or message attributes incrementally. It +is not implemented by passing additional parameters via the MAIL FROM command, because doing so would require extending the MAIL -FROM command length limit by another 600 or more characters. +FROM command length limit by another 600 or more characters beyond +the space needed by other extensions such as AUTH. Command syntax ============== diff --git a/postfix/RELEASE_NOTES b/postfix/RELEASE_NOTES index 1b10ccf82..1977e4107 100644 --- a/postfix/RELEASE_NOTES +++ b/postfix/RELEASE_NOTES @@ -22,6 +22,17 @@ snapshot release). Patches change the patchlevel and the release date. Snapshots change only the release date, unless they include the same bugfixes as a patch release. +Incompatible changes with Postfix snapshot 2.0.16-20031226 +========================================================== + +Postfix no longer allows mail addresses with bare numeric IP +addresses (user@1.2.3.4). The form user@[ipaddress] is still +allowed. + +Bounce messages now have a separate queue life time. This is +controlled by the bounce_queue_lifetime parameter. The default is +$maximal_queue_life_time. + Incompatible changes with Postfix snapshot 2.0.16-20031223 ========================================================== diff --git a/postfix/conf/sample-rate.cf b/postfix/conf/sample-rate.cf index d0ba93b3c..36a580279 100644 --- a/postfix/conf/sample-rate.cf +++ b/postfix/conf/sample-rate.cf @@ -46,6 +46,18 @@ maximal_backoff_time = 4000s # maximal_queue_lifetime = 5d +# The bounce_queue_lifetime parameter specifies the maximal time +# a bounce message is queued before it is considered undeliverable. +# By default, this is the same as the queue life time for regular +# mail. +# +# Time units: s (seconds), m (minutes), h (hours), d (days), w (weeks). +# The default time unit is d (days). +# +# Specify 0 when mail delivery should be tried only once. +# +bounce_queue_lifetime = $maximal_queue_lifetime + # The minimal_backoff_time parameter specifies the minimal time # between attempts to deliver a deferred message. This parameter # also limits the time an unreachable destination is kept in the diff --git a/postfix/html/nqmgr.8.html b/postfix/html/nqmgr.8.html index 90cf9d859..16ead7ae5 100644 --- a/postfix/html/nqmgr.8.html +++ b/postfix/html/nqmgr.8.html @@ -1,4 +1,4 @@ - 
+  
 NQMGR(8)                                                 NQMGR(8)
 
 NAME
@@ -111,25 +111,25 @@ NQMGR(8)                                                 NQMGR(8)
        actions (the message is followed by the symbolic  constant
        used internally by the software):
 
-       D (QMGR_REQ_SCAN_DEFERRED)
+       D (QMGR_REQ_SCAN_DEFERRED)
               Start  a  deferred queue scan.  If a deferred queue
               scan is already in  progress,  that  scan  will  be
               restarted as soon as it finishes.
 
-       I (QMGR_REQ_SCAN_INCOMING)
+       I (QMGR_REQ_SCAN_INCOMING)
               Start  an incoming queue scan. If an incoming queue
               scan is already in  progress,  that  scan  will  be
               restarted as soon as it finishes.
 
-       A (QMGR_REQ_SCAN_ALL)
+       A (QMGR_REQ_SCAN_ALL)
               Ignore deferred queue file time stamps. The request
               affects the next deferred queue scan.
 
-       F (QMGR_REQ_FLUSH_DEAD)
+       F (QMGR_REQ_FLUSH_DEAD)
               Purge all information  about  dead  transports  and
               destinations.
 
-       W (TRIGGER_REQ_WAKEUP)
+       W (TRIGGER_REQ_WAKEUP)
               Wakeup  call,  This is used by the master server to
               instantiate servers that should not  go  away  for-
               ever.  The  action  is  to  start an incoming queue
@@ -159,7 +159,7 @@ NQMGR(8)                                                 NQMGR(8)
        Corrupted message files are saved to the corrupt queue for
        further inspection.
 
-       Depending  on the setting of the notify_classes parameter,
+       Depending  on the setting of the notify_classes parameter,
        the postmaster is notified of bounces and of  other  trou-
        ble.
 
@@ -176,54 +176,54 @@ NQMGR(8)                                                 NQMGR(8)
        command after a configuration change.
 
 Miscellaneous
-       allow_min_user
+       allow_min_user
               Do  not  bounce recipient addresses that begin with
               '-'.
 
-       queue_directory
+       queue_directory
               Top-level directory of the Postfix queue.
 
 Active queue controls
        In the text below, transport is the first field in a  mas-
        ter.cf entry.
 
-       qmgr_clog_warn_time
+       qmgr_clog_warn_time
               Minimal delay between warnings that a specific des-
               tination is clogging up the active queue. Specify 0
               to disable.
 
-       qmgr_message_active_limit
+       qmgr_message_active_limit
               Limit the number of messages in the active queue.
 
-       qmgr_message_recipient_limit
+       qmgr_message_recipient_limit
               Limit the number of in-memory recipients.
 
               This  parameter  also limits the size of the short-
               term, in-memory destination cache.
 
-       qmgr_message_recipient_minimum
+       qmgr_message_recipient_minimum
               Per message minimum of in-memory recipients.
 
-       default_recipient_limit
+       default_recipient_limit
               Default limit on the number of in-memory recipients
               per transport.
 
-       transport_recipient_limit
+       transport_recipient_limit
               Limit  on  the  number of in-memory recipients, for
               the named message transport.
 
-       default_extra_recipient_limit
+       default_extra_recipient_limit
               Default limit on the total number of per  transport
               in-memory  recipients  that the preempting messages
               can have.
 
-       transport_extra_recipient_limit
+       transport_extra_recipient_limit
               Limit on the number of in-memory  recipients  which
               all  preempting messages delivered by the transport
               transport can have.
 
 Timing controls
-       minimal_backoff_time
+       minimal_backoff_time
               Minimal time in seconds between  delivery  attempts
               of a deferred message.
 
@@ -231,89 +231,93 @@ NQMGR(8)                                                 NQMGR(8)
               destination is kept in  the  short-term,  in-memory
               destination status cache.
 
-       maximal_backoff_time
+       maximal_backoff_time
               Maximal  time  in seconds between delivery attempts
               of a deferred message.
 
-       maximal_queue_lifetime
-              Maximal time in days a message is queued before  it
-              is sent back as undeliverable.
+       maximal_queue_lifetime
+              Maximal time (default: in days) a  regular  message
+              is queued before it is considered undeliverable.
 
-       queue_run_delay
+       bounce_queue_lifetime
+              Maximal time (default: in days) a bounce message is
+              queued before it is considered undeliverable.
+
+       queue_run_delay
               Time in seconds between deferred queue scans. Queue
               scans do not overlap.
 
-       transport_retry_time
-              Time in seconds between attempts to contact a  bro-
+       transport_retry_time
+              Time  in seconds between attempts to contact a bro-
               ken delivery transport.
 
 Concurrency controls
-       initial_destination_concurrency
-              Initial  per-destination concurrency level for par-
+       initial_destination_concurrency
+              Initial per-destination concurrency level for  par-
               allel delivery to the same destination.
 
-       default_destination_concurrency_limit
-              Default limit on the number of parallel  deliveries
+       default_destination_concurrency_limit
+              Default  limit on the number of parallel deliveries
               to the same destination.
 
-       transport_destination_concurrency_limit
-              Limit  on  the number of parallel deliveries to the
-              same destination, for delivery via the  named  mes-
+       transport_destination_concurrency_limit
+              Limit on the number of parallel deliveries  to  the
+              same  destination,  for delivery via the named mes-
               sage transport.
 
 Recipient controls
-       default_destination_recipient_limit
-              Default  limit on the number of recipients per mes-
+       default_destination_recipient_limit
+              Default limit on the number of recipients per  mes-
               sage transfer.
 
-       transport_destination_recipient_limit
-              Limit on  the  number  of  recipients  per  message
+       transport_destination_recipient_limit
+              Limit  on  the  number  of  recipients  per message
               transfer, for the named message transport.
 
 Message scheduling
-       transport_delivery_slot_cost (valid range: 0,2,3...)
-              This  parameter basically controls how often a mes-
-              sage delivered by transport  can  be  preempted  by
+       transport_delivery_slot_cost (valid range: 0,2,3...)
+              This parameter basically controls how often a  mes-
+              sage  delivered  by  transport  can be preempted by
               another message.  An internal per-message/transport
-              counter is  incremented  by  one  for  each  trans-
-              port_delivery_slot_cost   deliveries   handled   by
-              transport. This counter represents  the  number  of
-              "available  delivery  slots"  for use by other mes-
+              counter  is  incremented  by  one  for  each trans-
+              port_delivery_slot_cost   deliveries   handled   by
+              transport.  This  counter  represents the number of
+              "available delivery slots" for use  by  other  mes-
               sages.  Current message can be preempted by another
-              message  when  that  other message can be delivered
-              using less transport agents than the value  of  the
+              message when that other message  can  be  delivered
+              using  less  transport agents than the value of the
               "available delivery slots" counter.
 
-              Value  equal  to  0 disables the message preemption
+              Value equal to 0 disables  the  message  preemption
               for transport.
 
-       transport_minimum_delivery_slots
+       transport_minimum_delivery_slots
               Message preemption is not attempted at all whenever
-              a  message  that  can't  ever  accumulate  at least
-              transport_minimum_delivery_slots available delivery
+              a message  that  can't  ever  accumulate  at  least
+              transport_minimum_delivery_slots available delivery
               slots is being delivered by transport.
 
-       transport_delivery_slot_discount (valid range: 0..100)
+       transport_delivery_slot_discount (valid range: 0..100)
 
-       transport_delivery_slot_loan
+       transport_delivery_slot_loan
               These parameters speed up the moment when a message
-              preemption can happen.  Instead  of  waiting  until
-              the  full  amount  of  delivery  slots  required is
-              available, the preemption can  happen  when  trans-
-              port_delivery_slot_discount percent of the required
-              amount  plus   transport_delivery_slot_loan   still
-              remains  to  be  accumulated.  Note  that  the full
-              amount will still have  to  be  accumulated  before
+              preemption  can  happen.   Instead of waiting until
+              the full  amount  of  delivery  slots  required  is
+              available,  the  preemption  can happen when trans-
+              port_delivery_slot_discount percent of the required
+              amount   plus   transport_delivery_slot_loan  still
+              remains to  be  accumulated.  Note  that  the  full
+              amount  will  still  have  to be accumulated before
               another preemption can take place later.
 
-       default_delivery_slot_cost
+       default_delivery_slot_cost
 
-       default_minimum_delivery_slots
+       default_minimum_delivery_slots
 
-       default_delivery_slot_discount
+       default_delivery_slot_discount
 
-       default_delivery_slot_loan
-              Default  values  for the transport specific parame-
+       default_delivery_slot_loan
+              Default values for the transport  specific  parame-
               ters described above.
 
 SEE ALSO
@@ -322,7 +326,7 @@ NQMGR(8)                                                 NQMGR(8)
        trivial-rewrite(8), address routing
 
 LICENSE
-       The Secure Mailer license must be  distributed  with  this
+       The  Secure  Mailer  license must be distributed with this
        software.
 
 AUTHOR(S)
diff --git a/postfix/html/postsuper.1.html b/postfix/html/postsuper.1.html
index 1364a46d4..794a79e15 100644
--- a/postfix/html/postsuper.1.html
+++ b/postfix/html/postsuper.1.html
@@ -84,75 +84,76 @@ POSTSUPER(1)                                         POSTSUPER(1)
 
               Note: while mail is "on hold" it  will  not  expire
               when  its  time  in  the  queue  exceeds  the maxi-
-              mal_queue_lifetime setting. It becomes  subject  to
-              expiration after it is released from "hold".
+              mal_queue_lifetime  or  bounce_queue_lifetime  set-
+              ting.  It becomes subject to expiration after it is
+              released from "hold".
 
        -H queue_id
               Release mail that was put "on hold".  Move one mes-
-              sage with the named queue ID from  the  named  mail
+              sage  with  the  named queue ID from the named mail
               queue(s) (default: hold) to the deferred queue.  If
-              a queue_id of - is  specified,  the  program  reads
+              a  queue_id  of  -  is specified, the program reads
               queue IDs from standard input.
 
-              Specify  -H  ALL  to  release  all mail that is "on
-              hold".  As a safety measure, the word ALL  must  be
+              Specify -H ALL to release  all  mail  that  is  "on
+              hold".   As  a safety measure, the word ALL must be
               specified in upper case.
 
-       -p     Purge  old temporary files that are left over after
+       -p     Purge old temporary files that are left over  after
               system or software crashes.
 
        -r queue_id
-              Requeue the message with the named  queue  ID  from
-              the  named  mail queue(s) (default: hold, incoming,
-              active and deferred).   To  requeue  multiple  mes-
-              sages,  specify  multiple  -r command-line options.
+              Requeue  the  message  with the named queue ID from
+              the named mail queue(s) (default:  hold,  incoming,
+              active  and  deferred).   To  requeue multiple mes-
+              sages, specify multiple  -r  command-line  options.
               Alternatively, if a queue_id of - is specified, the
               program reads queue IDs from standard input.
 
               Specify -r ALL to requeue all messages. As a safety
-              measure, the word ALL must be  specified  in  upper
+              measure,  the  word  ALL must be specified in upper
               case.
 
-              A  requeued message is moved to the maildrop queue,
-              from where it is copied by the pickup daemon  to  a
-              new  file whose name is guaranteed to match the new
+              A requeued message is moved to the maildrop  queue,
+              from  where  it is copied by the pickup daemon to a
+              new file whose name is guaranteed to match the  new
               queue file inode number. The new queue file is sub-
-              jected  again to mail address rewriting and substi-
+              jected again to mail address rewriting and  substi-
               tution. This is useful when rewriting rules or vir-
               tual mappings have changed.
 
-              Postfix  queue  IDs  are  reused.   There is a very
+              Postfix queue IDs are  reused.   There  is  a  very
               small possibility that postsuper requeues the wrong
-              message  file when it is executed while the Postfix
+              message file when it is executed while the  Postfix
               mail system is running, but no harm should be done.
 
        -s     Structure check and structure repair.  It is highly
-              recommended to perform this operation  once  before
+              recommended  to  perform this operation once before
               Postfix startup.
 
-              o      Rename  files  whose name does not match the
+              o      Rename files whose name does not  match  the
                      message file inode number. This operation is
-                     necessary  after restoring a mail queue from
+                     necessary after restoring a mail queue  from
                      a different machine, or from backup media.
 
               o      Move queue files that are in the wrong place
                      in the file system hierarchy and remove sub-
                      directories that are no longer needed.  File
-                     position  rearrangements are necessary after
+                     position rearrangements are necessary  after
                      a  change  in  the  hash_queue_names  and/or
                      hash_queue_depth configuration parameters.
 
        -v     Enable verbose logging for debugging purposes. Mul-
-              tiple -v options  make  the  software  increasingly
+              tiple  -v  options  make  the software increasingly
               verbose.
 
 DIAGNOSTICS
-       Problems  are reported to the standard error stream and to
+       Problems are reported to the standard error stream and  to
        syslogd.
 
-       postsuper reports the number of messages deleted with  -d,
+       postsuper  reports the number of messages deleted with -d,
        the number of messages requeued with -r, and the number of
-       messages whose queue file name  was  fixed  with  -s.  The
+       messages  whose  queue  file  name  was fixed with -s. The
        report is written to the standard error stream and to sys-
        logd.
 
@@ -161,22 +162,22 @@ POSTSUPER(1)                                         POSTSUPER(1)
               Directory with the main.cf file.
 
 BUGS
-       Mail that is not sanitized by Postfix (i.e.  mail  in  the
+       Mail  that  is  not sanitized by Postfix (i.e. mail in the
        maildrop queue) cannot be placed "on hold".
 
 CONFIGURATION PARAMETERS
-       See  the  Postfix  main.cf file for syntax details and for
+       See the Postfix main.cf file for syntax  details  and  for
        default values.
 
        hash_queue_depth
               Number of subdirectory levels for hashed queues.
 
        hash_queue_names
-              The names of queues that are organized into  multi-
+              The  names of queues that are organized into multi-
               ple levels of subdirectories.
 
        queue_directory
-              Top-level  directory  of the Postfix queue. This is
+              Top-level directory of the Postfix queue.  This  is
               also the root directory of Postfix daemons that run
               chrooted.
 
@@ -185,7 +186,7 @@ POSTSUPER(1)                                         POSTSUPER(1)
        postqueue(1) unprivileged queue operations
 
 LICENSE
-       The  Secure  Mailer  license must be distributed with this
+       The Secure Mailer license must be  distributed  with  this
        software.
 
 AUTHOR(S)
diff --git a/postfix/html/qmgr.8.html b/postfix/html/qmgr.8.html
index 8e741d266..ca13a844e 100644
--- a/postfix/html/qmgr.8.html
+++ b/postfix/html/qmgr.8.html
@@ -1,4 +1,4 @@
-    
+  
 QMGR(8)                                                   QMGR(8)
 
 NAME
@@ -105,25 +105,25 @@ QMGR(8)                                                   QMGR(8)
        actions  (the message is followed by the symbolic constant
        used internally by the software):
 
-       D (QMGR_REQ_SCAN_DEFERRED)
+       D (QMGR_REQ_SCAN_DEFERRED)
               Start a deferred queue scan.  If a  deferred  queue
               scan  is  already  in  progress,  that scan will be
               restarted as soon as it finishes.
 
-       I (QMGR_REQ_SCAN_INCOMING)
+       I (QMGR_REQ_SCAN_INCOMING)
               Start an incoming queue scan. If an incoming  queue
               scan  is  already  in  progress,  that scan will be
               restarted as soon as it finishes.
 
-       A (QMGR_REQ_SCAN_ALL)
+       A (QMGR_REQ_SCAN_ALL)
               Ignore deferred queue file time stamps. The request
               affects the next deferred queue scan.
 
-       F (QMGR_REQ_FLUSH_DEAD)
+       F (QMGR_REQ_FLUSH_DEAD)
               Purge  all  information  about  dead transports and
               destinations.
 
-       W (TRIGGER_REQ_WAKEUP)
+       W (TRIGGER_REQ_WAKEUP)
               Wakeup call, This is used by the master  server  to
               instantiate  servers  that  should not go away for-
               ever. The action is  to  start  an  incoming  queue
@@ -152,7 +152,7 @@ QMGR(8)                                                   QMGR(8)
        Corrupted message files are saved to the corrupt queue for
        further inspection.
 
-       Depending  on the setting of the notify_classes parameter,
+       Depending  on the setting of the notify_classes parameter,
        the postmaster is notified of bounces and of  other  trou-
        ble.
 
@@ -169,30 +169,30 @@ QMGR(8)                                                   QMGR(8)
        command after a configuration change.
 
 Miscellaneous
-       allow_min_user
+       allow_min_user
               Do  not  bounce recipient addresses that begin with
               '-'.
 
-       queue_directory
+       queue_directory
               Top-level directory of the Postfix queue.
 
 Active queue controls
-       qmgr_clog_warn_time
+       qmgr_clog_warn_time
               Minimal delay between warnings that a specific des-
               tination is clogging up the active queue. Specify 0
               to disable.
 
-       qmgr_message_active_limit
+       qmgr_message_active_limit
               Limit the number of messages in the active queue.
 
-       qmgr_message_recipient_limit
+       qmgr_message_recipient_limit
               Limit the number of in-memory recipients.
 
               This parameter also limits the size of  the  short-
               term, in-memory destination cache.
 
 Timing controls
-       minimal_backoff_time
+       minimal_backoff_time
               Minimal  time  in seconds between delivery attempts
               of a deferred message.
 
@@ -200,62 +200,66 @@ QMGR(8)                                                   QMGR(8)
               destination  is  kept  in the short-term, in-memory
               destination status cache.
 
-       maximal_backoff_time
+       maximal_backoff_time
               Maximal time in seconds between  delivery  attempts
               of a deferred message.
 
-       maximal_queue_lifetime
-              Maximal  time in days a message is queued before it
-              is sent back as undeliverable.
+       maximal_queue_lifetime
+              Maximal  time  (default: in days) a regular message
+              is queued before it is considered undeliverable.
 
-       queue_run_delay
+       bounce_queue_lifetime
+              Maximal time (default: in days) a bounce message is
+              queued before it is considered undeliverable.
+
+       queue_run_delay
               Time in seconds between deferred queue scans. Queue
               scans do not overlap.
 
-       transport_retry_time
-              Time  in seconds between attempts to contact a bro-
+       transport_retry_time
+              Time in seconds between attempts to contact a  bro-
               ken delivery transport.
 
 Concurrency controls
-       In the text below, transport is the first field in a  mas-
+       In  the text below, transport is the first field in a mas-
        ter.cf entry.
 
-       qmgr_fudge_factor (valid range: 10..100)
-              The  percentage  of  delivery resources that a busy
-              mail system will use up for  delivery  of  a  large
-              mailing  list  message.  With 100%, delivery of one
-              message does not begin before the previous  message
-              has  been  delivered.  This results in good perfor-
-              mance for large mailing lists, but results in  poor
-              response  time for one-to-one mail.  With less than
-              100%, response time for one-to-one  mail  improves,
-              but  large  mailing  list delivery performance suf-
+       qmgr_fudge_factor (valid range: 10..100)
+              The percentage of delivery resources  that  a  busy
+              mail  system  will  use  up for delivery of a large
+              mailing list message.  With 100%, delivery  of  one
+              message  does not begin before the previous message
+              has been delivered. This results  in  good  perfor-
+              mance  for large mailing lists, but results in poor
+              response time for one-to-one mail.  With less  than
+              100%,  response  time for one-to-one mail improves,
+              but large mailing list  delivery  performance  suf-
               fers. In the worst case, recipients near the begin-
-              ning  of  a  large list receive a burst of messages
-              immediately, while recipients near the end of  that
-              list  receive  that  same burst of messages a whole
+              ning of a large list receive a  burst  of  messages
+              immediately,  while recipients near the end of that
+              list receive that same burst of  messages  a  whole
               day later.
 
-       initial_destination_concurrency
-              Initial per-destination concurrency level for  par-
+       initial_destination_concurrency
+              Initial  per-destination concurrency level for par-
               allel delivery to the same destination.
 
-       default_destination_concurrency_limit
-              Default  limit on the number of parallel deliveries
+       default_destination_concurrency_limit
+              Default limit on the number of parallel  deliveries
               to the same destination.
 
-       transport_destination_concurrency_limit
-              Limit on the number of parallel deliveries  to  the
-              same  destination,  for delivery via the named mes-
+       transport_destination_concurrency_limit
+              Limit  on  the number of parallel deliveries to the
+              same destination, for delivery via the  named  mes-
               sage transport.
 
 Recipient controls
-       default_destination_recipient_limit
-              Default limit on the number of recipients per  mes-
+       default_destination_recipient_limit
+              Default  limit on the number of recipients per mes-
               sage transfer.
 
-       transport_destination_recipient_limit
-              Limit  on  the  number  of  recipients  per message
+       transport_destination_recipient_limit
+              Limit on  the  number  of  recipients  per  message
               transfer, for the named message transport.
 
 SEE ALSO
@@ -264,7 +268,7 @@ QMGR(8)                                                   QMGR(8)
        trivial-rewrite(8), address routing
 
 LICENSE
-       The Secure Mailer license must be  distributed  with  this
+       The  Secure  Mailer  license must be distributed with this
        software.
 
 AUTHOR(S)
diff --git a/postfix/html/rate.html b/postfix/html/rate.html
index 70dfde499..e603b703a 100644
--- a/postfix/html/rate.html
+++ b/postfix/html/rate.html
@@ -307,6 +307,13 @@ immediately after the first unsuccessful delivery attempt.
 
 

 
+
 bounce_queue_lifetime (default: 2 days) 
 How
+long a bounce message stays in the queue before it is considered
+undeliverable. Specify 0 for mail that should be returned
+immediately after the first unsuccessful delivery attempt.
+
+

+
 
 minimal_backoff_time (default: 1000 seconds) 
 The
 minimal amount of time a message won't be looked at, and the minimal
 amount of time to stay away from a "dead" destination.
diff --git a/postfix/html/smtpd.8.html b/postfix/html/smtpd.8.html
index ba619f029..275a510e6 100644
--- a/postfix/html/smtpd.8.html
+++ b/postfix/html/smtpd.8.html
@@ -80,61 +80,61 @@ SMTPD(8)                                                 SMTPD(8)
               checking  and  without any state change.  This list
               overrides built-in command definitions.
 
-Content inspection controls
-       Optionally, Postfix can be configured to send new mail  to
-       external content filter software AFTER the mail is queued.
+Content inspection after mail is queued
+       Postfix can be configured to send new mail to an  external
+       content filter AFTER the mail is queued.
 
        content_filter
-              The name of a mail delivery transport that  filters
+              The  name of a mail delivery transport that filters
               mail and that either bounces mail or re-injects the
-              result back into Postfix.  This parameter uses  the
-              same  syntax  as  the  right-hand side of a Postfix
+              result  back into Postfix.  This parameter uses the
+              same syntax as the right-hand  side  of  a  Postfix
               transport table.
 
        receive_override_options
-              The following options  override  main.cf  settings.
-              The  options  are  either  implemented  by the SMTP
-              server or are passed on to the  downstream  cleanup
+              The  following  options  override main.cf settings.
+              The options are  either  implemented  by  the  SMTP
+              server  or  are passed on to the downstream cleanup
               server.
 
               no_unknown_recipient_checks
-                     Do  not  try  to  reject unknown recipients.
-                     This is typically specified  with  the  SMTP
+                     Do not try  to  reject  unknown  recipients.
+                     This  is  typically  specified with the SMTP
                      server after an external content filter.
 
               no_address_mappings
-                     Disable  canonical  address mapping, virtual
-                     alias map expansion,  address  masquerading,
-                     and  automatic BCC recipients. This is typi-
-                     cally specified with the SMTP server  before
+                     Disable canonical address  mapping,  virtual
+                     alias  map  expansion, address masquerading,
+                     and automatic BCC recipients. This is  typi-
+                     cally  specified with the SMTP server before
                      an external content filter.
 
               no_header_body_checks
-                     Disable  header/body_checks.  This  is typi-
-                     cally specified with the SMTP  server  after
+                     Disable header/body_checks.  This  is  typi-
+                     cally  specified  with the SMTP server after
                      an external content filter.
 
-Pass-through proxy
-       Optionally,  the  Postfix SMTP server can be configured to
-       forward all mail to a proxy server, for  example  a  real-
-       time content filter, BEFORE mail is queued.
+Content inspection before mail is queued
+       The Postfix SMTP server can be configured to  forward  all
+       mail  to a real-time SMTP-based content filter BEFORE mail
+       is queued.
 
        smtpd_proxy_filter
-              The host:port of the SMTP proxy server. The host or
-              host: portion is optional.
+              The host:port of the real-time  SMTP-based  content
+              filter.  The host or host: portion is optional.
 
        smtpd_proxy_timeout
               Timeout for connecting to, sending to and receiving
-              from the SMTP proxy server.
+              from the real-time SMTP-based content filter.
 
        smtpd_proxy_ehlo
               The hostname to use when sending an EHLO command to
-              the SMTP proxy server.
+              the real-time SMTP-based content filter.
 
 Authentication controls
        smtpd_sasl_auth_enable
-              Enable per-session authentication as per  RFC  2554
-              (SASL).   This functionality is available only when
+              Enable  per-session  authentication as per RFC 2554
+              (SASL).  This functionality is available only  when
               explicitly  selected  at  program  build  time  and
               explicitly enabled at runtime.
 
@@ -160,15 +160,15 @@ SMTPD(8)                                                 SMTPD(8)
                      Disallow anonymous logins.
 
        smtpd_sender_login_maps
-              Maps  that  specify the SASL login names that own a
-              MAIL   FROM   sender   address.   Used    by    the
+              Maps that specify the SASL login names that  own  a
+              MAIL    FROM    sender   address.   Used   by   the
               reject_sender_login_mismatch  sender  anti-spoofing
-              restriction, as well as by its  component  restric-
+              restriction,  as  well as by its component restric-
               tions    reject_authenticated_sender_login_mismatch
-              (an authenticated client  can't  use  a  MAIL  FROM
-              sender  address  that is owned by someone else) and
+              (an  authenticated  client  can't  use  a MAIL FROM
+              sender address that is owned by someone  else)  and
               reject_unauthenticated_sender_login_mismatch     (a
-              client  must  be  authenticated in order to use the
+              client must be authenticated in order  to  use  the
               MAIL FROM sender address).
 
 Miscellaneous
@@ -178,36 +178,36 @@ SMTPD(8)                                                 SMTPD(8)
 
        smtpd_authorized_xclient_hosts
               Hostnames, domain names and/or addresses of clients
-              that are authorized to  use  the  XCLIENT  command.
-              This   command  overrides  client  information  for
+              that  are  authorized  to  use the XCLIENT command.
+              This  command  overrides  client  information   for
               access  control  and  logging  purposes,  with  the
-              exception   of  the  smtpd_authorized_xclient_hosts
+              exception  of  the   smtpd_authorized_xclient_hosts
               access control itself.
 
        smtpd_authorized_xforward_hosts
               Hostnames, domain names and/or addresses of clients
-              that  are  authorized  to use the XFORWARD command.
+              that are authorized to use  the  XFORWARD  command.
               This command accepts client and message identofying
               information for logging purposes.
 
        debug_peer_level
-              Increment  in  verbose  logging level when a remote
+              Increment in verbose logging level  when  a  remote
               host  matches  a  pattern  in  the  debug_peer_list
               parameter.
 
        debug_peer_list
-              List  of  domain or network patterns. When a remote
-              host matches a pattern, increase the  verbose  log-
-              ging   level   by   the  amount  specified  in  the
+              List of domain or network patterns. When  a  remote
+              host  matches  a pattern, increase the verbose log-
+              ging  level  by  the  amount   specified   in   the
               debug_peer_level parameter.
 
        default_verp_delimiters
               The default VERP delimiter characters that are used
-              when   the   XVERP  command  is  specified  without
+              when  the  XVERP  command  is   specified   without
               explicit delimiters.
 
        error_notice_recipient
-              Recipient   of    protocol/policy/resource/software
+              Recipient    of   protocol/policy/resource/software
               error notices.
 
        hopcount_limit
@@ -216,18 +216,18 @@ SMTPD(8)                                                 SMTPD(8)
        notify_classes
               List of error classes. Of special interest are:
 
-              policy When  a  client  violates any policy, mail a
+              policy When a client violates any  policy,  mail  a
                      transcript of the entire SMTP session to the
                      postmaster.
 
               protocol
-                     When  a client violates the SMTP protocol or
+                     When a client violates the SMTP protocol  or
                      issues  an  unimplemented  command,  mail  a
                      transcript of the entire SMTP session to the
                      postmaster.
 
        smtpd_banner
-              Text that follows the 220 status code in  the  SMTP
+              Text  that  follows the 220 status code in the SMTP
               greeting banner.
 
        smtpd_expansion_filter
@@ -235,57 +235,57 @@ SMTPD(8)                                                 SMTPD(8)
               expansion of rbl template responses and other text.
 
        smtpd_recipient_limit
-              Restrict  the  number  of  recipients that the SMTP
+              Restrict the number of  recipients  that  the  SMTP
               server accepts per message delivery.
 
        smtpd_timeout
-              Limit the time to send a  server  response  and  to
+              Limit  the  time  to  send a server response and to
               receive a client request.
 
        soft_bounce
-              Change  hard (5xx) reject responses into soft (4xx)
-              reject responses.  This can be useful  for  testing
+              Change hard (5xx) reject responses into soft  (4xx)
+              reject  responses.   This can be useful for testing
               purposes.
 
        verp_delimiter_filter
-              The  characters that Postfix accepts as VERP delim-
+              The characters that Postfix accepts as VERP  delim-
               iter characters.
 
 Known versus unknown recipients
        show_user_unknown_table_name
-              Whether or not to reveal  the  table  name  in  the
-              "User  unknown"  responses.  The extra detail makes
-              trouble shooting easier but also  reveals  informa-
+              Whether  or  not  to  reveal  the table name in the
+              "User unknown" responses. The  extra  detail  makes
+              trouble  shooting  easier but also reveals informa-
               tion that is nobody elses business.
 
        unknown_local_recipient_reject_code
               The response code when a client specifies a recipi-
-              ent  whose   domain   matches   $mydestination   or
+              ent   whose   domain   matches   $mydestination  or
               $inet_interfaces,  while  $local_recipient_maps  is
-              non-empty and does not list the  recipient  address
+              non-empty  and  does not list the recipient address
               or address local-part.
 
        unknown_relay_recipient_reject_code
               The response code when a client specifies a recipi-
               ent  whose  domain  matches  $relay_domains,  while
-              $relay_recipient_maps  is  non-empty  and  does not
+              $relay_recipient_maps is  non-empty  and  does  not
               list the recipient address.
 
        unknown_virtual_alias_reject_code
               The response code when a client specifies a recipi-
-              ent  whose  domain  matches $virtual_alias_domains,
-              while  the  recipient  is  not  listed   in   $vir-
+              ent whose  domain  matches  $virtual_alias_domains,
+              while   the   recipient  is  not  listed  in  $vir-
               tual_alias_maps.
 
        unknown_virtual_mailbox_reject_code
               The response code when a client specifies a recipi-
-              ent whose domain matches  $virtual_mailbox_domains,
+              ent  whose domain matches $virtual_mailbox_domains,
               while the recipient is not listed in $virtual_mail-
               box_maps.
 
 Resource controls
        line_length_limit
-              Limit the amount of memory in bytes  used  for  the
+              Limit  the  amount  of memory in bytes used for the
               handling of partial input lines.
 
        message_size_limit
@@ -293,9 +293,9 @@ SMTPD(8)                                                 SMTPD(8)
               ing on-disk storage for envelope information.
 
        queue_minfree
-              Minimal amount of free space in bytes in the  queue
-              file  system for the SMTP server to accept any mail
-              at  all  (default:  twice  the   message_size_limit
+              Minimal  amount of free space in bytes in the queue
+              file system for the SMTP server to accept any  mail
+              at   all  (default:  twice  the  message_size_limit
               value).
 
        smtpd_history_flush_threshold
@@ -305,21 +305,21 @@ SMTPD(8)                                                 SMTPD(8)
 
        smtpd_client_connection_count_limit
               The maximal number of simultaneous connections that
-              any client is allowed  to  make  to  this  service.
-              When  a  client  exceeds the limit, the SMTP server
+              any  client  is  allowed  to  make to this service.
+              When a client exceeds the limit,  the  SMTP  server
               logs a warning with the client name/address and the
               service name as configured in master.cf.
 
        smtpd_client_connection_rate_limit
-              The  maximal  number  of  connections per unit time
+              The maximal number of  connections  per  unit  time
               (specified with connection_rate_time_unit) that any
-              client  is  allowed to make to this service. When a
-              client exceeds the limit, the SMTP  server  logs  a
-              warning  with  the client name/address and the ser-
+              client is allowed to make to this service.  When  a
+              client  exceeds  the  limit, the SMTP server logs a
+              warning with the client name/address and  the  ser-
               vice name as configured in master.cf.
 
        smtpd_client_connection_limit_exceptions
-              Hostnames, .domain  names  and/or  network  address
+              Hostnames,  .domain  names  and/or  network address
               blocks of clients that are excluded from connection
               count or rate limits.
 
@@ -330,17 +330,17 @@ SMTPD(8)                                                 SMTPD(8)
 
        smtpd_soft_error_limit
               When an SMTP client has made this number of errors,
-              wait error_count seconds before responding  to  any
+              wait  error_count  seconds before responding to any
               client request.
 
        smtpd_hard_error_limit
-              Disconnect  after  a client has made this number of
+              Disconnect after a client has made this  number  of
               errors.
 
        smtpd_junk_command_limit
               Limit the number of times a client can issue a junk
-              command  such  as  NOOP,  VRFY, ETRN or RSET in one
-              SMTP session before it  is  penalized  with  tarpit
+              command such as NOOP, VRFY, ETRN  or  RSET  in  one
+              SMTP  session  before  it  is penalized with tarpit
               delays.
 
 Delegated policy
@@ -349,17 +349,17 @@ SMTPD(8)                                                 SMTPD(8)
               receiving from a delegated SMTPD policy server.
 
        smtpd_policy_service_max_idle
-              Time after which an  unused  SMTPD  policy  service
+              Time  after  which  an  unused SMTPD policy service
               connection is closed.
 
        smtpd_policy_service_timeout
-              Time  after  which  an  active SMTPD policy service
+              Time after which an  active  SMTPD  policy  service
               connection is closed.
 
 UCE control restrictions
        parent_domain_matches_subdomains
-              List of Postfix features that use  domain.tld  pat-
-              terns   to  match  sub.domain.tld  (as  opposed  to
+              List  of  Postfix features that use domain.tld pat-
+              terns  to  match  sub.domain.tld  (as  opposed   to
               requiring .domain.tld patterns).
 
        smtpd_client_restrictions
@@ -367,19 +367,19 @@ SMTPD(8)                                                 SMTPD(8)
               tem.
 
        smtpd_helo_required
-              Require  that  clients  introduce themselves at the
+              Require that clients introduce  themselves  at  the
               beginning of an SMTP session.
 
        smtpd_helo_restrictions
-              Restrict what client hostnames are allowed in  HELO
+              Restrict  what client hostnames are allowed in HELO
               and EHLO commands.
 
        smtpd_sender_restrictions
-              Restrict  what sender addresses are allowed in MAIL
+              Restrict what sender addresses are allowed in  MAIL
               FROM commands.
 
        smtpd_recipient_restrictions
-              Restrict what recipient addresses  are  allowed  in
+              Restrict  what  recipient  addresses are allowed in
               RCPT TO commands.
 
        smtpd_etrn_restrictions
@@ -387,96 +387,96 @@ SMTPD(8)                                                 SMTPD(8)
               mands, and what clients may issue ETRN commands.
 
        smtpd_data_restrictions
-              Restrictions on the DATA  command.  Currently,  the
-              only   restriction   that   makes   sense  here  is
+              Restrictions  on  the  DATA command. Currently, the
+              only  restriction  that   makes   sense   here   is
               reject_unauth_pipelining.
 
        allow_untrusted_routing
-              Allow untrusted clients to specify  addresses  with
-              sender-specified  routing.   Enabling this opens up
-              nasty relay loopholes involving trusted  backup  MX
+              Allow  untrusted  clients to specify addresses with
+              sender-specified routing.  Enabling this  opens  up
+              nasty  relay  loopholes involving trusted backup MX
               hosts.
 
        smtpd_restriction_classes
-              Declares  the  name of zero or more parameters that
-              contain a list of UCE restrictions.  The  names  of
-              these  parameters  can  then be used instead of the
+              Declares the name of zero or more  parameters  that
+              contain  a  list  of UCE restrictions. The names of
+              these parameters can then be used  instead  of  the
               restriction lists that they represent.
 
        smtpd_null_access_lookup_key
-              The lookup key to be used in  SMTPD  access  tables
-              instead  of  the null sender address. A null sender
+              The  lookup  key  to be used in SMTPD access tables
+              instead of the null sender address. A  null  sender
               address cannot be looked up.
 
        maps_rbl_domains (deprecated)
-              List of DNS domains that publish the  addresses  of
+              List  of  DNS domains that publish the addresses of
               blacklisted hosts. This is used with the deprecated
               reject_maps_rbl restriction.
 
        permit_mx_backup_networks
-              Only domains  whose  primary  MX  hosts  match  the
-              listed   networks   are   eligible   for  the  per-
+              Only  domains  whose  primary  MX  hosts  match the
+              listed  networks  are   eligible   for   the   per-
               mit_mx_backup feature.
 
        relay_domains
-              Restrict what domains this mail system  will  relay
-              mail  to.  The  domains  are routed to the delivery
+              Restrict  what  domains this mail system will relay
+              mail to. The domains are  routed  to  the  delivery
               agent specified with the relay_transport setting.
 
 Sender/recipient address verification
        Address verification is implemented by sending probe email
-       messages  that  are not actually delivered, and is enabled
-       via   the   reject_unverified_{sender,recipient}    access
-       restriction.   The  status of verification probes is main-
+       messages that are not actually delivered, and  is  enabled
+       via    the   reject_unverified_{sender,recipient}   access
+       restriction.  The status of verification probes  is  main-
        tained by the address verification service.
 
        address_verify_poll_count
-              How many times to query  the  address  verification
-              service  for  completion of an address verification
-              request.  Specify 1 to implement a simple  form  of
-              greylisting,  that is, always defer the request for
+              How  many  times  to query the address verification
+              service for completion of an  address  verification
+              request.   Specify  1 to implement a simple form of
+              greylisting, that is, always defer the request  for
               a new sender or recipient address.
 
        address_verify_poll_delay
-              Time to wait after querying the  address  verifica-
+              Time  to  wait after querying the address verifica-
               tion service for completion of an address verifica-
               tion request.
 
 UCE control responses
        access_map_reject_code
-              Response code when  a  client  violates  an  access
+              Response  code  when  a  client  violates an access
               database restriction.
 
        default_rbl_reply
               Default template reply when a request is RBL black-
-              listed.  This template is used by the  reject_rbl_*
-              and    reject_rhsbl_*   restrictions.   See   also:
+              listed.   This template is used by the reject_rbl_*
+              and   reject_rhsbl_*   restrictions.   See    also:
               rbl_reply_maps and smtpd_expansion_filter.
 
        defer_code
-              Response code when a client request is rejected  by
+              Response  code when a client request is rejected by
               the defer restriction.
 
        invalid_hostname_reject_code
-              Response   code   when   a   client   violates  the
+              Response  code   when   a   client   violates   the
               reject_invalid_hostname restriction.
 
        maps_rbl_reject_code
               Response code when a request is RBL blacklisted.
 
        multi_recipient_bounce_reject_code
-              Response code  when  a  multi-recipient  bounce  is
+              Response  code  when  a  multi-recipient  bounce is
               blocked.
 
        rbl_reply_maps
-              Table  with  template responses for RBL blacklisted
-              requests, indexed by RBL domain  name.  These  tem-
+              Table with template responses for  RBL  blacklisted
+              requests,  indexed  by  RBL domain name. These tem-
               plates   are   used   by   the   reject_rbl_*   and
-              reject_rhsbl_*     restrictions.     See      also:
+              reject_rhsbl_*      restrictions.     See     also:
               default_rbl_reply and smtpd_expansion_filter.
 
        reject_code
-              Response  code  when  the  client  matches a reject
+              Response code when  the  client  matches  a  reject
               restriction.
 
        relay_domains_reject_code
@@ -484,7 +484,7 @@ SMTPD(8)                                                 SMTPD(8)
               mail relay policy.
 
        unknown_address_reject_code
-              Response   code   when   a   client   violates  the
+              Response  code   when   a   client   violates   the
               reject_unknown_address restriction.
 
        unknown_client_reject_code
@@ -493,15 +493,15 @@ SMTPD(8)                                                 SMTPD(8)
               tion.
 
        unknown_hostname_reject_code
-              Response  code   when   a   client   violates   the
+              Response   code   when   a   client   violates  the
               reject_unknown_hostname restriction.
 
        unverified_sender_reject_code
-              Response  code when a sender address is known to be
+              Response code when a sender address is known to  be
               undeliverable.
 
        unverified_recipient_reject_code
-              Response code when a recipient address is known  to
+              Response  code when a recipient address is known to
               be undeliverable.
 
 SEE ALSO
@@ -512,7 +512,7 @@ SMTPD(8)                                                 SMTPD(8)
        verify(8) address verification service
 
 LICENSE
-       The  Secure  Mailer  license must be distributed with this
+       The Secure Mailer license must be  distributed  with  this
        software.
 
 AUTHOR(S)
diff --git a/postfix/man/man1/postsuper.1 b/postfix/man/man1/postsuper.1
index e716f733c..4f27a4c8d 100644
--- a/postfix/man/man1/postsuper.1
+++ b/postfix/man/man1/postsuper.1
@@ -89,8 +89,8 @@ case.
 .sp
 Note: while mail is "on hold" it will not expire when its
 time in the queue exceeds the \fBmaximal_queue_lifetime\fR
-setting. It becomes subject to expiration after it is
-released from "hold".
+or \fBbounce_queue_lifetime\fR setting. It becomes subject to
+expiration after it is released from "hold".
 .IP "\fB-H \fIqueue_id\fR"
 Release mail that was put "on hold".
 Move one message with the named queue ID from the named
diff --git a/postfix/man/man8/nqmgr.8 b/postfix/man/man8/nqmgr.8
index 1f3ffe198..1ab7f6279 100644
--- a/postfix/man/man8/nqmgr.8
+++ b/postfix/man/man8/nqmgr.8
@@ -217,8 +217,11 @@ is kept in the short-term, in-memory destination status cache.
 Maximal time in seconds between delivery attempts
 of a deferred message.
 .IP \fBmaximal_queue_lifetime\fR
-Maximal time in days a message is queued
-before it is sent back as undeliverable.
+Maximal time (default: in days) a regular message is queued
+before it is considered undeliverable.
+.IP \fBbounce_queue_lifetime\fR
+Maximal time (default: in days) a bounce message is queued
+before it is considered undeliverable.
 .IP \fBqueue_run_delay\fR
 Time in seconds between deferred queue scans. Queue scans do
 not overlap.
diff --git a/postfix/man/man8/qmgr.8 b/postfix/man/man8/qmgr.8
index 529fb3989..bf66ff5bd 100644
--- a/postfix/man/man8/qmgr.8
+++ b/postfix/man/man8/qmgr.8
@@ -198,8 +198,11 @@ is kept in the short-term, in-memory destination status cache.
 Maximal time in seconds between delivery attempts
 of a deferred message.
 .IP \fBmaximal_queue_lifetime\fR
-Maximal time in days a message is queued
-before it is sent back as undeliverable.
+Maximal time (default: in days) a regular message is queued
+before it is considered undeliverable.
+.IP \fBbounce_queue_lifetime\fR
+Maximal time (default: in days) a bounce message is queued
+before it is considered undeliverable.
 .IP \fBqueue_run_delay\fR
 Time in seconds between deferred queue scans. Queue scans do
 not overlap.
diff --git a/postfix/man/man8/smtpd.8 b/postfix/man/man8/smtpd.8
index 0aa55253e..7a7bc3326 100644
--- a/postfix/man/man8/smtpd.8
+++ b/postfix/man/man8/smtpd.8
@@ -85,9 +85,11 @@ offered by an SMTP server.
 List of commands that are treated as NOOP (no operation) commands,
 without any parameter syntax checking and without any state change.
 This list overrides built-in command definitions.
-.SH "Content inspection controls"
-Optionally, Postfix can be configured to send new mail to
-external content filter software AFTER the mail is queued.
+.SH "Content inspection after mail is queued"
+.ad
+.fi
+Postfix can be configured to send new mail to an external
+content filter AFTER the mail is queued.
 .IP \fBcontent_filter\fR
 The name of a mail delivery transport that filters mail and that
 either bounces mail or re-injects the result back into Postfix.
@@ -110,22 +112,20 @@ content filter.
 Disable header/body_checks. This is typically specified with the
 SMTP server \fBafter\fR an external content filter.
 .RE
-.SH "Pass-through proxy"
+.SH "Content inspection before mail is queued"
 .ad
 .fi
-.ad
-Optionally, the Postfix SMTP server can be configured to
-forward all mail to a proxy server, for example a real-time
-content filter, BEFORE mail is queued.
+The Postfix SMTP server can be configured to forward all mail
+to a real-time SMTP-based content filter BEFORE mail is queued.
 .IP \fBsmtpd_proxy_filter\fR
-The \fIhost:port\fR of the SMTP proxy server. The \fIhost\fR
-or \fIhost:\fR portion is optional.
+The \fIhost:port\fR of the real-time SMTP-based content filter.
+The \fIhost\fR or \fIhost:\fR portion is optional.
 .IP \fBsmtpd_proxy_timeout\fR
 Timeout for connecting to, sending to and receiving from
-the SMTP proxy server.
+the real-time SMTP-based content filter.
 .IP \fBsmtpd_proxy_ehlo\fR
 The hostname to use when sending an EHLO command to the
-SMTP proxy server.
+real-time SMTP-based content filter.
 .SH "Authentication controls"
 .IP \fBsmtpd_sasl_auth_enable\fR
 Enable per-session authentication as per RFC 2554 (SASL).
diff --git a/postfix/src/global/mail_params.h b/postfix/src/global/mail_params.h
index 7c976429c..4d5ee846d 100644
--- a/postfix/src/global/mail_params.h
+++ b/postfix/src/global/mail_params.h
@@ -548,6 +548,10 @@ extern int var_max_backoff_time;
 #define DEF_MAX_QUEUE_TIME	"5d"
 extern int var_max_queue_time;
 
+#define VAR_DSN_QUEUE_TIME	"bounce_queue_lifetime"
+#define DEF_DSN_QUEUE_TIME	"$" VAR_MAX_QUEUE_TIME
+extern int var_dsn_queue_time;
+
 #define VAR_DELAY_WARN_TIME	"delay_warning_time"
 #define DEF_DELAY_WARN_TIME	"0h"
 extern int var_delay_warn_time;
@@ -1760,7 +1764,7 @@ extern int var_verify_pos_try;
 extern int var_verify_neg_exp;
 
 #define VAR_VERIFY_NEG_TRY		"address_verify_negative_refresh_time"
-#define DEF_VERIFY_NEG_TRY		"2h"
+#define DEF_VERIFY_NEG_TRY		"3h"
 extern int var_verify_neg_try;
 
 #define VAR_VERIFY_NEG_CACHE		"address_verify_negative_cache"
diff --git a/postfix/src/global/mail_version.h b/postfix/src/global/mail_version.h
index 635522778..8b276b0fe 100644
--- a/postfix/src/global/mail_version.h
+++ b/postfix/src/global/mail_version.h
@@ -20,7 +20,7 @@
   * Patches change the patchlevel and the release date. Snapshots change the
   * release date only, unless they include the same bugfix as a patch release.
   */
-#define MAIL_RELEASE_DATE	"20031224"
+#define MAIL_RELEASE_DATE	"20031226"
 
 #define VAR_MAIL_VERSION	"mail_version"
 #define DEF_MAIL_VERSION	"2.0.16-" MAIL_RELEASE_DATE
diff --git a/postfix/src/global/resolve_clnt.c b/postfix/src/global/resolve_clnt.c
index 83df20100..33d134899 100644
--- a/postfix/src/global/resolve_clnt.c
+++ b/postfix/src/global/resolve_clnt.c
@@ -166,15 +166,26 @@ void    resolve_clnt(const char *class, const char *addr, RESOLVE_REPLY *reply)
     /*
      * Peek at the cache.
      */
+#define IFSET(flag, text) ((reply->flags & (flag)) ? (text) : "")
+
     if (*addr && strcmp(addr, STR(last_addr)) == 0) {
 	vstring_strcpy(reply->transport, STR(last_reply.transport));
 	vstring_strcpy(reply->nexthop, STR(last_reply.nexthop));
 	vstring_strcpy(reply->recipient, STR(last_reply.recipient));
 	reply->flags = last_reply.flags;
 	if (msg_verbose)
-	    msg_info("%s: cached: `%s' -> t=`%s' h=`%s' r=`%s'",
+	    msg_info("%s: cached: `%s' -> transp=`%s' host=`%s' rcpt=`%s' flags=%s%s%s%s class=%s%s%s%s%s",
 		     myname, addr, STR(reply->transport),
-		     STR(reply->nexthop), STR(reply->recipient));
+		     STR(reply->nexthop), STR(reply->recipient),
+		     IFSET(RESOLVE_FLAG_FINAL, "final"),
+		     IFSET(RESOLVE_FLAG_ROUTED, "routed"),
+		     IFSET(RESOLVE_FLAG_ERROR, "error"),
+		     IFSET(RESOLVE_FLAG_FAIL, "fail"),
+		     IFSET(RESOLVE_CLASS_LOCAL, "local"),
+		     IFSET(RESOLVE_CLASS_ALIAS, "alias"),
+		     IFSET(RESOLVE_CLASS_VIRTUAL, "virtual"),
+		     IFSET(RESOLVE_CLASS_RELAY, "relay"),
+		     IFSET(RESOLVE_CLASS_DEFAULT, "default"));
 	return;
     }
 
@@ -208,9 +219,18 @@ void    resolve_clnt(const char *class, const char *addr, RESOLVE_REPLY *reply)
 			 var_rewrite_service);
 	} else {
 	    if (msg_verbose)
-		msg_info("%s: `%s' -> t=`%s' h=`%s' r=`%s'",
+		msg_info("%s: `%s' -> transp=`%s' host=`%s' rcpt=`%s' flags=%s%s%s%s class=%s%s%s%s%s",
 			 myname, addr, STR(reply->transport),
-			 STR(reply->nexthop), STR(reply->recipient));
+			 STR(reply->nexthop), STR(reply->recipient),
+			 IFSET(RESOLVE_FLAG_FINAL, "final"),
+			 IFSET(RESOLVE_FLAG_ROUTED, "routed"),
+			 IFSET(RESOLVE_FLAG_ERROR, "error"),
+			 IFSET(RESOLVE_FLAG_FAIL, "fail"),
+			 IFSET(RESOLVE_CLASS_LOCAL, "local"),
+			 IFSET(RESOLVE_CLASS_ALIAS, "alias"),
+			 IFSET(RESOLVE_CLASS_VIRTUAL, "virtual"),
+			 IFSET(RESOLVE_CLASS_RELAY, "relay"),
+			 IFSET(RESOLVE_CLASS_DEFAULT, "default"));
 	    if (STR(reply->transport)[0] == 0)
 		msg_warn("%s: null transport result for: <%s>", myname, addr);
 	    else if (STR(reply->recipient)[0] == 0 && *addr != 0)
diff --git a/postfix/src/master/Makefile.in b/postfix/src/master/Makefile.in
index 3bca0e03d..7a5a4bab4 100644
--- a/postfix/src/master/Makefile.in
+++ b/postfix/src/master/Makefile.in
@@ -1,6 +1,6 @@
 SHELL	= /bin/sh
 SRCS	= master.c master_conf.c master_ent.c master_sig.c master_avail.c \
-	master_spawn.c master_service.c master_status.o master_listen.c \
+	master_spawn.c master_service.c master_status.c master_listen.c \
 	master_proto.c single_server.c multi_server.c master_vars.c \
 	master_wakeup.c master_flow.c mail_flow.c
 OBJS	= master.o master_conf.o master_ent.o master_sig.o master_avail.o \
diff --git a/postfix/src/master/master.h b/postfix/src/master/master.h
index 8cfdb7937..3cc481207 100644
--- a/postfix/src/master/master.h
+++ b/postfix/src/master/master.h
@@ -106,10 +106,6 @@ extern void master_refresh(void);
  /*
   * master_vars.c
   */
-extern char *var_program_dir;
-extern int var_proc_limit;
-extern int var_use_limit;
-extern int var_idle_limit;
 extern void master_vars_init(void);
 
  /*
diff --git a/postfix/src/nqmgr/qmgr.c b/postfix/src/nqmgr/qmgr.c
index 36ebef017..d7bed895c 100644
--- a/postfix/src/nqmgr/qmgr.c
+++ b/postfix/src/nqmgr/qmgr.c
@@ -193,8 +193,11 @@
 /*	Maximal time in seconds between delivery attempts
 /*	of a deferred message.
 /* .IP \fBmaximal_queue_lifetime\fR
-/*	Maximal time in days a message is queued
-/*	before it is sent back as undeliverable.
+/*	Maximal time (default: in days) a regular message is queued
+/*	before it is considered undeliverable.
+/* .IP \fBbounce_queue_lifetime\fR
+/*	Maximal time (default: in days) a bounce message is queued
+/*	before it is considered undeliverable.
 /* .IP \fBqueue_run_delay\fR
 /*	Time in seconds between deferred queue scans. Queue scans do
 /*	not overlap.
@@ -314,6 +317,7 @@ int     var_queue_run_delay;
 int     var_min_backoff_time;
 int     var_max_backoff_time;
 int     var_max_queue_time;
+int     var_dsn_queue_time;
 int     var_qmgr_active_limit;
 int     var_qmgr_rcpt_limit;
 int     var_qmgr_msg_rcpt_limit;
@@ -529,6 +533,7 @@ int     main(int argc, char **argv)
 	VAR_MIN_BACKOFF_TIME, DEF_MIN_BACKOFF_TIME, &var_min_backoff_time, 1, 0,
 	VAR_MAX_BACKOFF_TIME, DEF_MAX_BACKOFF_TIME, &var_max_backoff_time, 1, 0,
 	VAR_MAX_QUEUE_TIME, DEF_MAX_QUEUE_TIME, &var_max_queue_time, 0, 8640000,
+	VAR_DSN_QUEUE_TIME, DEF_DSN_QUEUE_TIME, &var_dsn_queue_time, 0, 8640000,
 	VAR_XPORT_RETRY_TIME, DEF_XPORT_RETRY_TIME, &var_transport_retry_time, 1, 0,
 	VAR_QMGR_CLOG_WARN_TIME, DEF_QMGR_CLOG_WARN_TIME, &var_qmgr_clog_warn_time, 0, 0,
 	0,
diff --git a/postfix/src/nqmgr/qmgr_active.c b/postfix/src/nqmgr/qmgr_active.c
index 198bd4492..3999b4a5f 100644
--- a/postfix/src/nqmgr/qmgr_active.c
+++ b/postfix/src/nqmgr/qmgr_active.c
@@ -378,7 +378,8 @@ static void qmgr_active_done_2_generic(QMGR_MESSAGE *message)
      * daemon waits for the qmgr to accept the "new mail" trigger.
      */
     if (message->flags) {
-	if (event_time() >= message->arrival_time + var_max_queue_time) {
+	if (event_time() >= message->arrival_time +
+	    (*message->sender ? var_max_queue_time : var_dsn_queue_time)) {
 	    msg_info("%s: from=<%s>, status=expired, returned to sender",
 		     message->queue_id, message->sender);
 	    if (message->verp_delims == 0 || var_verp_bounce_off)
diff --git a/postfix/src/postsuper/postsuper.c b/postfix/src/postsuper/postsuper.c
index 3b01c960e..62e273fe2 100644
--- a/postfix/src/postsuper/postsuper.c
+++ b/postfix/src/postsuper/postsuper.c
@@ -83,8 +83,8 @@
 /* .sp
 /*	Note: while mail is "on hold" it will not expire when its
 /*	time in the queue exceeds the \fBmaximal_queue_lifetime\fR
-/*	setting. It becomes subject to expiration after it is
-/*	released from "hold".
+/*	or \fBbounce_queue_lifetime\fR setting. It becomes subject to 
+/*	expiration after it is released from "hold".
 /* .IP "\fB-H \fIqueue_id\fR"
 /*	Release mail that was put "on hold".
 /*	Move one message with the named queue ID from the named
diff --git a/postfix/src/qmgr/qmgr.c b/postfix/src/qmgr/qmgr.c
index 7e899d4c9..978f37a5a 100644
--- a/postfix/src/qmgr/qmgr.c
+++ b/postfix/src/qmgr/qmgr.c
@@ -174,8 +174,11 @@
 /*	Maximal time in seconds between delivery attempts
 /*	of a deferred message.
 /* .IP \fBmaximal_queue_lifetime\fR
-/*	Maximal time in days a message is queued
-/*	before it is sent back as undeliverable.
+/*	Maximal time (default: in days) a regular message is queued
+/*	before it is considered undeliverable.
+/* .IP \fBbounce_queue_lifetime\fR
+/*	Maximal time (default: in days) a bounce message is queued
+/*	before it is considered undeliverable.
 /* .IP \fBqueue_run_delay\fR
 /*	Time in seconds between deferred queue scans. Queue scans do
 /*	not overlap.
@@ -269,6 +272,7 @@ int     var_queue_run_delay;
 int     var_min_backoff_time;
 int     var_max_backoff_time;
 int     var_max_queue_time;
+int     var_dsn_queue_time;
 int     var_qmgr_active_limit;
 int     var_qmgr_rcpt_limit;
 int     var_init_dest_concurrency;
@@ -481,6 +485,7 @@ int     main(int argc, char **argv)
 	VAR_MIN_BACKOFF_TIME, DEF_MIN_BACKOFF_TIME, &var_min_backoff_time, 1, 0,
 	VAR_MAX_BACKOFF_TIME, DEF_MAX_BACKOFF_TIME, &var_max_backoff_time, 1, 0,
 	VAR_MAX_QUEUE_TIME, DEF_MAX_QUEUE_TIME, &var_max_queue_time, 0, 8640000,
+	VAR_DSN_QUEUE_TIME, DEF_DSN_QUEUE_TIME, &var_dsn_queue_time, 0, 8640000,
 	VAR_XPORT_RETRY_TIME, DEF_XPORT_RETRY_TIME, &var_transport_retry_time, 1, 0,
 	VAR_QMGR_CLOG_WARN_TIME, DEF_QMGR_CLOG_WARN_TIME, &var_qmgr_clog_warn_time, 0, 0,
 	0,
diff --git a/postfix/src/qmgr/qmgr_active.c b/postfix/src/qmgr/qmgr_active.c
index 6d4a248c1..bd2c9098f 100644
--- a/postfix/src/qmgr/qmgr_active.c
+++ b/postfix/src/qmgr/qmgr_active.c
@@ -378,7 +378,8 @@ static void qmgr_active_done_2_generic(QMGR_MESSAGE *message)
      * daemon waits for the qmgr to accept the "new mail" trigger.
      */
     if (message->flags) {
-	if (event_time() >= message->arrival_time + var_max_queue_time) {
+	if (event_time() >= message->arrival_time +
+	    (*message->sender ? var_max_queue_time : var_dsn_queue_time)) {
 	    msg_info("%s: from=<%s>, status=expired, returned to sender",
 		     message->queue_id, message->sender);
 	    if (message->verp_delims == 0 || var_verp_bounce_off)
diff --git a/postfix/src/smtp/smtp.c b/postfix/src/smtp/smtp.c
index 0190e3472..a427164f0 100644
--- a/postfix/src/smtp/smtp.c
+++ b/postfix/src/smtp/smtp.c
@@ -419,8 +419,8 @@ static void smtp_service(VSTREAM *client_stream, char *unused_service, char **ar
 static void pre_init(char *unused_name, char **unused_argv)
 {
     static NAME_MASK lookup_masks[] = {
-	SMTP_HOST_LOOKUP_DNS, SMTP_MASK_DNS,
-	SMTP_HOST_LOOKUP_NATIVE, SMTP_MASK_NATIVE,
+	SMTP_HOST_LOOKUP_DNS, SMTP_HOST_FLAG_DNS,
+	SMTP_HOST_LOOKUP_NATIVE, SMTP_HOST_FLAG_NATIVE,
 	0,
     };
 
@@ -433,7 +433,7 @@ static void pre_init(char *unused_name, char **unused_argv)
      * Select hostname lookup mechanisms.
      */
     if (var_disable_dns)
-	smtp_host_lookup_mask = SMTP_MASK_NATIVE;
+	smtp_host_lookup_mask = SMTP_HOST_FLAG_NATIVE;
     else
 	smtp_host_lookup_mask = name_mask(VAR_SMTP_HOST_LOOKUP, lookup_masks,
 					  var_smtp_host_lookup);
diff --git a/postfix/src/smtp/smtp.h b/postfix/src/smtp/smtp.h
index 74850f9b8..813309803 100644
--- a/postfix/src/smtp/smtp.h
+++ b/postfix/src/smtp/smtp.h
@@ -82,20 +82,27 @@ typedef struct SMTP_STATE {
 #define SMTP_FEATURE_XFORWARD_PROTO	(1<<9)
 #define SMTP_FEATURE_XFORWARD_HELO	(1<<10)
 
+ /*
+  * Misc flags.
+  */
+#define SMTP_MISC_FLAG_LOOP_DETECT	(1<<0)
+
+#define SMTP_MISC_FLAG_DEFAULT		SMTP_MISC_FLAG_LOOP_DETECT
+
  /*
   * smtp.c
   */
 extern int smtp_errno;			/* XXX can we get rid of this? */
 
-#define SMTP_NONE	0		/* no error */
-#define SMTP_FAIL	1		/* permanent error */
-#define SMTP_RETRY	2		/* temporary error */
-#define SMTP_LOOP	3		/* MX loop */
+#define SMTP_ERR_NONE	0		/* no error */
+#define SMTP_ERR_FAIL	1		/* permanent error */
+#define SMTP_ERR_RETRY	2		/* temporary error */
+#define SMTP_ERR_LOOP	3		/* mailer loop */
 
 extern int smtp_host_lookup_mask;	/* host lookup methods to use */
 
-#define SMTP_MASK_DNS		(1<<0)
-#define SMTP_MASK_NATIVE	(1<<1)
+#define SMTP_HOST_FLAG_DNS	(1<<0)
+#define SMTP_HOST_FLAG_NATIVE	(1<<1)
 
  /*
   * smtp_session.c
@@ -119,7 +126,7 @@ extern int smtp_connect(SMTP_STATE *);
  /*
   * smtp_proto.c
   */
-extern int smtp_helo(SMTP_STATE *);
+extern int smtp_helo(SMTP_STATE *, int);
 extern int smtp_xfer(SMTP_STATE *);
 extern void smtp_quit(SMTP_STATE *);
 
diff --git a/postfix/src/smtp/smtp_addr.c b/postfix/src/smtp/smtp_addr.c
index adaf01d8f..bd295aacf 100644
--- a/postfix/src/smtp/smtp_addr.c
+++ b/postfix/src/smtp/smtp_addr.c
@@ -6,12 +6,14 @@
 /* SYNOPSIS
 /*	#include "smtp_addr.h"
 /*
-/*	DNS_RR *smtp_domain_addr(name, why)
+/*	DNS_RR *smtp_domain_addr(name, misc_flags, why)
 /*	char	*name;
+/*	int	misc_flags;
 /*	VSTRING	*why;
 /*
-/*	DNS_RR *smtp_host_addr(name, why)
+/*	DNS_RR *smtp_host_addr(name, misc_flags, why)
 /*	char	*name;
+/*	int	misc_flags;
 /*	VSTRING	*why;
 /* DESCRIPTION
 /*	This module implements Internet address lookups. By default,
@@ -173,7 +175,7 @@ static DNS_RR *smtp_addr_one(DNS_RR *addr_list, char *host, unsigned pref, VSTRI
     /*
      * Use DNS lookup, but keep the option open to use native name service.
      */
-    if (smtp_host_lookup_mask & SMTP_MASK_DNS) {
+    if (smtp_host_lookup_mask & SMTP_HOST_FLAG_DNS) {
 	switch (dns_lookup(host, T_A, RES_DEFNAMES, &addr, (VSTRING *) 0, why)) {
 	case DNS_OK:
 	    for (rr = addr; rr; rr = rr->next)
@@ -181,15 +183,15 @@ static DNS_RR *smtp_addr_one(DNS_RR *addr_list, char *host, unsigned pref, VSTRI
 	    addr_list = dns_rr_append(addr_list, addr);
 	    return (addr_list);
 	default:
-	    smtp_errno = SMTP_RETRY;
+	    smtp_errno = SMTP_ERR_RETRY;
 	    return (addr_list);
 	case DNS_FAIL:
-	    if (smtp_errno != SMTP_RETRY)
-		smtp_errno = SMTP_FAIL;
+	    if (smtp_errno != SMTP_ERR_RETRY)
+		smtp_errno = SMTP_ERR_FAIL;
 	    return (addr_list);
 	case DNS_NOTFOUND:
-	    if (smtp_errno != SMTP_RETRY)
-		smtp_errno = SMTP_FAIL;
+	    if (smtp_errno != SMTP_ERR_RETRY)
+		smtp_errno = SMTP_ERR_FAIL;
 	    /* maybe gethostbyname() will succeed */
 	    break;
 	}
@@ -198,18 +200,19 @@ static DNS_RR *smtp_addr_one(DNS_RR *addr_list, char *host, unsigned pref, VSTRI
     /*
      * Use the native name service which also looks in /etc/hosts.
      */
-    if (smtp_host_lookup_mask & SMTP_MASK_NATIVE) {
+    if (smtp_host_lookup_mask & SMTP_HOST_FLAG_NATIVE) {
 	memset((char *) &fixed, 0, sizeof(fixed));
 	if ((hp = gethostbyname(host)) == 0) {
 	    vstring_sprintf(why, "%s: %s", host, HSTRERROR(h_errno));
-	    if (smtp_errno != SMTP_RETRY)
-		smtp_errno = (h_errno == TRY_AGAIN ? SMTP_RETRY : SMTP_FAIL);
+	    if (smtp_errno != SMTP_ERR_RETRY)
+		smtp_errno =
+		    (h_errno == TRY_AGAIN ? SMTP_ERR_RETRY : SMTP_ERR_FAIL);
 	} else if (hp->h_addrtype != AF_INET) {
 	    vstring_sprintf(why, "%s: host not found", host);
 	    msg_warn("%s: unknown address family %d for %s",
 		     myname, hp->h_addrtype, host);
-	    if (smtp_errno != SMTP_RETRY)
-		smtp_errno = SMTP_FAIL;
+	    if (smtp_errno != SMTP_ERR_RETRY)
+		smtp_errno = SMTP_ERR_FAIL;
 	} else {
 	    while (hp->h_addr_list[0]) {
 		addr_list = dns_rr_append(addr_list,
@@ -331,7 +334,7 @@ static int smtp_compare_pref(DNS_RR *a, DNS_RR *b)
 
 /* smtp_domain_addr - mail exchanger address lookup */
 
-DNS_RR *smtp_domain_addr(char *name, VSTRING *why)
+DNS_RR *smtp_domain_addr(char *name, int misc_flags, VSTRING *why)
 {
     DNS_RR *mx_names;
     DNS_RR *addr_list = 0;
@@ -339,7 +342,7 @@ DNS_RR *smtp_domain_addr(char *name, VSTRING *why)
     unsigned best_pref;
     unsigned best_found;
 
-    smtp_errno = SMTP_NONE;			/* Paranoia */
+    smtp_errno = SMTP_ERR_NONE;			/* Paranoia */
 
     /*
      * Preferences from DNS use 0..32767, fall-backs use 32768+.
@@ -396,14 +399,14 @@ DNS_RR *smtp_domain_addr(char *name, VSTRING *why)
      */
     switch (dns_lookup(name, T_MX, 0, &mx_names, (VSTRING *) 0, why)) {
     default:
-	smtp_errno = SMTP_RETRY;
+	smtp_errno = SMTP_ERR_RETRY;
 	if (var_ign_mx_lookup_err)
-	    addr_list = smtp_host_addr(name, why);
+	    addr_list = smtp_host_addr(name, misc_flags, why);
 	break;
     case DNS_FAIL:
-	smtp_errno = SMTP_FAIL;
+	smtp_errno = SMTP_ERR_FAIL;
 	if (var_ign_mx_lookup_err)
-	    addr_list = smtp_host_addr(name, why);
+	    addr_list = smtp_host_addr(name, misc_flags, why);
 	break;
     case DNS_OK:
 	mx_names = dns_rr_sort(mx_names, smtp_compare_pref);
@@ -412,24 +415,25 @@ DNS_RR *smtp_domain_addr(char *name, VSTRING *why)
 	dns_rr_free(mx_names);
 	if (addr_list == 0) {
 	    if (var_smtp_defer_mxaddr)
-		smtp_errno = SMTP_RETRY;
+		smtp_errno = SMTP_ERR_RETRY;
 	    msg_warn("no MX host for %s has a valid A record", name);
 	    break;
 	}
 	best_found = (addr_list ? addr_list->pref : IMPOSSIBLE_PREFERENCE);
 	if (msg_verbose)
 	    smtp_print_addr(name, addr_list);
-	if ((self = smtp_find_self(addr_list)) != 0) {
+	if ((misc_flags & SMTP_MISC_FLAG_LOOP_DETECT)
+	    && (self = smtp_find_self(addr_list)) != 0) {
 	    addr_list = smtp_truncate_self(addr_list, self->pref);
 	    if (addr_list == 0) {
 		if (best_pref != best_found) {
 		    vstring_sprintf(why, "unable to find primary relay for %s",
 				    name);
-		    smtp_errno = SMTP_RETRY;
+		    smtp_errno = SMTP_ERR_RETRY;
 		} else {
 		    vstring_sprintf(why, "mail for %s loops back to myself",
 				    name);
-		    smtp_errno = SMTP_LOOP;
+		    smtp_errno = SMTP_ERR_LOOP;
 		}
 	    }
 	}
@@ -439,7 +443,7 @@ DNS_RR *smtp_domain_addr(char *name, VSTRING *why)
 	}
 	break;
     case DNS_NOTFOUND:
-	addr_list = smtp_host_addr(name, why);
+	addr_list = smtp_host_addr(name, misc_flags, why);
 	break;
     }
 
@@ -451,11 +455,11 @@ DNS_RR *smtp_domain_addr(char *name, VSTRING *why)
 
 /* smtp_host_addr - direct host lookup */
 
-DNS_RR *smtp_host_addr(char *host, VSTRING *why)
+DNS_RR *smtp_host_addr(char *host, int misc_flags, VSTRING *why)
 {
     DNS_RR *addr_list;
 
-    smtp_errno = SMTP_NONE;			/* Paranoia */
+    smtp_errno = SMTP_ERR_NONE;			/* Paranoia */
 
     /*
      * If the host is specified by numerical address, just convert the
@@ -463,14 +467,14 @@ DNS_RR *smtp_host_addr(char *host, VSTRING *why)
      */
 #define PREF0	0
     addr_list = smtp_addr_one((DNS_RR *) 0, host, PREF0, why);
-#if 0
-    if (addr_list && smtp_find_self(addr_list) != 0) {
+    if (addr_list
+	&& (misc_flags & SMTP_MISC_FLAG_LOOP_DETECT)
+	&& smtp_find_self(addr_list) != 0) {
 	dns_rr_free(addr_list);
 	vstring_sprintf(why, "mail for %s loops back to myself", host);
-	smtp_errno = SMTP_LOOP;
+	smtp_errno = SMTP_ERR_LOOP;
 	return (0);
     }
-#endif
     if (addr_list && addr_list->next && var_smtp_rand_addr)
 	addr_list = dns_rr_shuffle(addr_list);
     if (msg_verbose)
diff --git a/postfix/src/smtp/smtp_addr.h b/postfix/src/smtp/smtp_addr.h
index d0dabba49..06706892c 100644
--- a/postfix/src/smtp/smtp_addr.h
+++ b/postfix/src/smtp/smtp_addr.h
@@ -16,8 +16,8 @@
  /*
   * Internal interfaces.
   */
-extern DNS_RR *smtp_host_addr(char *, VSTRING *);
-extern DNS_RR *smtp_domain_addr(char *, VSTRING *);
+extern DNS_RR *smtp_host_addr(char *, int, VSTRING *);
+extern DNS_RR *smtp_domain_addr(char *, int, VSTRING *);
 
 /* LICENSE
 /* .ad
diff --git a/postfix/src/smtp/smtp_connect.c b/postfix/src/smtp/smtp_connect.c
index f628651b2..bea8f0ba9 100644
--- a/postfix/src/smtp/smtp_connect.c
+++ b/postfix/src/smtp/smtp_connect.c
@@ -9,8 +9,8 @@
 /*	int	smtp_connect(state)
 /*	SMTP_STATE *state;
 /* DESCRIPTION
-/*	This module implements SMTP connection management and mail
-/*	delivery.
+/*	This module implements SMTP connection management and controls
+/*	mail delivery.
 /*
 /*	smtp_connect() attempts to establish an SMTP session with a host
 /*	that represents the destination domain, or with an optional fallback
@@ -62,7 +62,7 @@
 #endif
 
 #ifndef INADDR_NONE
-#define INADDR_NONE 0xffffff
+#define INADDR_NONE 0xffffffff
 #endif
 
 /* Utility library. */
@@ -111,14 +111,14 @@ static SMTP_SESSION *smtp_connect_addr(DNS_RR *addr, unsigned port,
     int     ch;
     unsigned long inaddr;
 
-    smtp_errno = SMTP_NONE;			/* Paranoia */
+    smtp_errno = SMTP_ERR_NONE;			/* Paranoia */
 
     /*
      * Sanity checks.
      */
     if (addr->data_len > sizeof(sin.sin_addr)) {
 	msg_warn("%s: skip address with length %d", myname, addr->data_len);
-	smtp_errno = SMTP_RETRY;
+	smtp_errno = SMTP_ERR_RETRY;
 	return (0);
     }
 
@@ -184,7 +184,7 @@ static SMTP_SESSION *smtp_connect_addr(DNS_RR *addr, unsigned port,
     if (conn_stat < 0) {
 	vstring_sprintf(why, "connect to %s[%s]: %m",
 			addr->name, inet_ntoa(sin.sin_addr));
-	smtp_errno = SMTP_RETRY;
+	smtp_errno = SMTP_ERR_RETRY;
 	close(sock);
 	return (0);
     }
@@ -195,7 +195,7 @@ static SMTP_SESSION *smtp_connect_addr(DNS_RR *addr, unsigned port,
     if (read_wait(sock, var_smtp_helo_tmout) < 0) {
 	vstring_sprintf(why, "connect to %s[%s]: read timeout",
 			addr->name, inet_ntoa(sin.sin_addr));
-	smtp_errno = SMTP_RETRY;
+	smtp_errno = SMTP_ERR_RETRY;
 	close(sock);
 	return (0);
     }
@@ -207,7 +207,7 @@ static SMTP_SESSION *smtp_connect_addr(DNS_RR *addr, unsigned port,
     if ((ch = VSTREAM_GETC(stream)) == VSTREAM_EOF) {
 	vstring_sprintf(why, "connect to %s[%s]: server dropped connection without sending the initial SMTP greeting",
 			addr->name, inet_ntoa(sin.sin_addr));
-	smtp_errno = SMTP_RETRY;
+	smtp_errno = SMTP_ERR_RETRY;
 	vstream_fclose(stream);
 	return (0);
     }
@@ -219,7 +219,7 @@ static SMTP_SESSION *smtp_connect_addr(DNS_RR *addr, unsigned port,
     if (ch == '4' && var_smtp_skip_4xx_greeting) {
 	vstring_sprintf(why, "connect to %s[%s]: server refused mail service",
 			addr->name, inet_ntoa(sin.sin_addr));
-	smtp_errno = SMTP_RETRY;
+	smtp_errno = SMTP_ERR_RETRY;
 	vstream_fclose(stream);
 	return (0);
     }
@@ -230,7 +230,7 @@ static SMTP_SESSION *smtp_connect_addr(DNS_RR *addr, unsigned port,
     if (ch == '5' && var_smtp_skip_5xx_greeting) {
 	vstring_sprintf(why, "connect to %s[%s]: server refused mail service",
 			addr->name, inet_ntoa(sin.sin_addr));
-	smtp_errno = SMTP_RETRY;
+	smtp_errno = SMTP_ERR_RETRY;
 	vstream_fclose(stream);
 	return (0);
     }
@@ -290,6 +290,7 @@ int     smtp_connect(SMTP_STATE *state)
     DNS_RR *next;
     int     addr_count;
     int     sess_count;
+    int     misc_flags = SMTP_MISC_FLAG_DEFAULT;
 
     /*
      * First try to deliver to the indicated destination, then try to deliver
@@ -336,10 +337,14 @@ int     smtp_connect(SMTP_STATE *state)
 	 */
 	if (msg_verbose)
 	    msg_info("connecting to %s port %d", host, ntohs(port));
+	if (ntohs(port) != 25)
+	    misc_flags &= ~SMTP_MISC_FLAG_LOOP_DETECT;
+	else
+	    misc_flags |= SMTP_MISC_FLAG_LOOP_DETECT;
 	if (var_disable_dns || *dest == '[') {
-	    addr_list = smtp_host_addr(host, why);
+	    addr_list = smtp_host_addr(host, misc_flags, why);
 	} else {
-	    addr_list = smtp_domain_addr(host, why);
+	    addr_list = smtp_domain_addr(host, misc_flags, why);
 	}
 	myfree(dest_buf);
 
@@ -347,20 +352,18 @@ int     smtp_connect(SMTP_STATE *state)
 	 * Don't try any backup host if mail loops to myself. That would just
 	 * make the problem worse.
 	 */
-	if (addr_list == 0 && smtp_errno == SMTP_LOOP)
+	if (addr_list == 0 && smtp_errno == SMTP_ERR_LOOP)
 	    break;
 
 	/*
-	 * Connect to an SMTP server. XXX Limit the number of addresses that
-	 * we're willing to try for a non-fallback destination.
+	 * Connect to an SMTP server.
 	 * 
 	 * At the start of an SMTP session, all recipients are unmarked. In the
 	 * course of an SMTP session, recipients are marked as KEEP (deliver
-	 * to backup mail server) or DROP (remove from recipient list). The
-	 * marking policy is configurable with the smtp_backup_on_soft_error
-	 * parameter. At the end of an SMTP session, weed out the recipient
-	 * list. Unmark any left-over recipients and try to deliver them to a
-	 * backup mail server.
+	 * to alternate mail server) or DROP (remove from recipient list). At
+	 * the end of an SMTP session, weed out the recipient list. Unmark
+	 * any left-over recipients and try to deliver them to a backup mail
+	 * server.
 	 */
 	sess_count = addr_count = 0;
 	for (addr = addr_list; SMTP_RCPT_LEFT(state) > 0 && addr; addr = next) {
@@ -373,7 +376,7 @@ int     smtp_connect(SMTP_STATE *state)
 		state->final_server = (cpp[1] == 0 && next == 0);
 		state->session->best = (addr->pref == addr_list->pref);
 		debug_peer_check(state->session->host, state->session->addr);
-		if (smtp_helo(state) == 0)
+		if (smtp_helo(state, misc_flags) == 0)
 		    smtp_xfer(state);
 		if (state->history != 0
 		    && (state->error_mask & name_mask(VAR_NOTIFY_CLASSES,
@@ -404,8 +407,8 @@ int     smtp_connect(SMTP_STATE *state)
 	default:
 	    msg_panic("smtp_connect: bad error indication %d", smtp_errno);
 
-	case SMTP_LOOP:
-	case SMTP_FAIL:
+	case SMTP_ERR_LOOP:
+	case SMTP_ERR_FAIL:
 
 	    /*
 	     * The fall-back destination did not resolve as expected, or it
@@ -413,7 +416,7 @@ int     smtp_connect(SMTP_STATE *state)
 	     */
 	    if (sites->argc > 1 && cpp > sites->argv) {
 		msg_warn("%s configuration problem", VAR_FALLBACK_RELAY);
-		smtp_errno = SMTP_RETRY;
+		smtp_errno = SMTP_ERR_RETRY;
 	    }
 
 	    /*
@@ -422,14 +425,14 @@ int     smtp_connect(SMTP_STATE *state)
 	     */
 	    else if (strcmp(sites->argv[0], var_relayhost) == 0) {
 		msg_warn("%s configuration problem", VAR_RELAYHOST);
-		smtp_errno = SMTP_RETRY;
+		smtp_errno = SMTP_ERR_RETRY;
 	    }
 
 	    /*
 	     * Mail for the next-hop destination loops back to myself. Pass
 	     * the mail to the best_mx_transport or bounce it.
 	     */
-	    else if (smtp_errno == SMTP_LOOP && *var_bestmx_transp) {
+	    else if (smtp_errno == SMTP_ERR_LOOP && *var_bestmx_transp) {
 		state->status = deliver_pass_all(MAIL_CLASS_PRIVATE,
 						 var_bestmx_transp,
 						 request);
@@ -438,14 +441,14 @@ int     smtp_connect(SMTP_STATE *state)
 	    }
 	    /* FALLTHROUGH */
 
-	case SMTP_RETRY:
+	case SMTP_ERR_RETRY:
 
 	    /*
 	     * We still need to bounce or defer some left-over recipients:
 	     * either mail loops or some backup mail server was unavailable.
 	     */
 	    state->final_server = 1;		/* XXX */
-	    smtp_site_fail(state, smtp_errno == SMTP_RETRY ? 450 : 550,
+	    smtp_site_fail(state, smtp_errno == SMTP_ERR_RETRY ? 450 : 550,
 			   "%s", vstring_str(why));
 
 	    /*
diff --git a/postfix/src/smtp/smtp_proto.c b/postfix/src/smtp/smtp_proto.c
index 1b391caf8..7a3f99220 100644
--- a/postfix/src/smtp/smtp_proto.c
+++ b/postfix/src/smtp/smtp_proto.c
@@ -167,7 +167,7 @@ char   *xfer_request[SMTP_STATE_LAST] = {
 
 /* smtp_helo - perform initial handshake with SMTP server */
 
-int     smtp_helo(SMTP_STATE *state)
+int     smtp_helo(SMTP_STATE *state, int misc_flags)
 {
     SMTP_SESSION *session = state->session;
     DELIVER_REQUEST *request = state->request;
@@ -218,8 +218,9 @@ int     smtp_helo(SMTP_STATE *state)
     (void) mystrtok(&words, "- \t\n");
     for (n = 0; (word = mystrtok(&words, " \t\n")) != 0; n++) {
 	if (n == 0 && strcasecmp(word, var_myhostname) == 0) {
-	    msg_warn("host %s greeted me with my own hostname %s",
-		     session->namaddr, var_myhostname);
+	    if (misc_flags & SMTP_MISC_FLAG_LOOP_DETECT)
+		msg_warn("host %s greeted me with my own hostname %s",
+			 session->namaddr, var_myhostname);
 	} else if (strcasecmp(word, "ESMTP") == 0)
 	    state->features |= SMTP_FEATURE_ESMTP;
     }
@@ -283,11 +284,13 @@ int     smtp_helo(SMTP_STATE *state)
 		smtp_sasl_helo_auth(state, words);
 #endif
 	    else if (strcasecmp(word, var_myhostname) == 0) {
-		msg_warn("host %s replied to HELO/EHLO with my own hostname %s",
-			 session->namaddr, var_myhostname);
-		return (smtp_site_fail(state, session->best ? 550 : 450,
-				       "mail for %s loops back to myself",
-				       request->nexthop));
+		if (misc_flags & SMTP_MISC_FLAG_LOOP_DETECT) {
+		    msg_warn("host %s replied to HELO/EHLO with my own hostname %s",
+			     session->namaddr, var_myhostname);
+		    return (smtp_site_fail(state, session->best ? 550 : 450,
+					 "mail for %s loops back to myself",
+					   request->nexthop));
+		}
 	    }
 	}
     }
diff --git a/postfix/src/smtp/smtp_rcpt.c b/postfix/src/smtp/smtp_rcpt.c
index 3450e0153..027991896 100644
--- a/postfix/src/smtp/smtp_rcpt.c
+++ b/postfix/src/smtp/smtp_rcpt.c
@@ -36,7 +36,7 @@
 /* .IP \(bu
 /*	In the course of a delivery attempt each recipient is
 /*	marked either as DROP (remove from recipient list) or KEEP
-/*	(deliver to backup mail server). 
+/*	(deliver to alternate mail server). 
 /* .IP \(bu
 /*	After a delivery attempt any recipients marked DROP are deleted 
 /*	from the request, and the left-over recipients are unmarked.
diff --git a/postfix/src/smtpd/smtpd.c b/postfix/src/smtpd/smtpd.c
index ca635b5ae..6d87f1d52 100644
--- a/postfix/src/smtpd/smtpd.c
+++ b/postfix/src/smtpd/smtpd.c
@@ -71,9 +71,11 @@
 /*	List of commands that are treated as NOOP (no operation) commands,
 /*	without any parameter syntax checking and without any state change.
 /*	This list overrides built-in command definitions.
-/* .SH "Content inspection controls"
-/*	Optionally, Postfix can be configured to send new mail to
-/*	external content filter software AFTER the mail is queued.
+/* .SH "Content inspection after mail is queued"
+/* .ad
+/* .fi
+/*	Postfix can be configured to send new mail to an external
+/*	content filter AFTER the mail is queued.
 /* .IP \fBcontent_filter\fR
 /*	The name of a mail delivery transport that filters mail and that
 /*	either bounces mail or re-injects the result back into Postfix.
@@ -96,22 +98,20 @@
 /*	Disable header/body_checks. This is typically specified with the
 /*	SMTP server \fBafter\fR an external content filter.
 /* .RE
-/* .SH "Pass-through proxy"
+/* .SH "Content inspection before mail is queued"
 /* .ad
 /* .fi
-/* .ad
-/*	Optionally, the Postfix SMTP server can be configured to
-/*	forward all mail to a proxy server, for example a real-time
-/*	content filter, BEFORE mail is queued.
+/*	The Postfix SMTP server can be configured to forward all mail
+/*	to a real-time SMTP-based content filter BEFORE mail is queued.
 /* .IP \fBsmtpd_proxy_filter\fR
-/*	The \fIhost:port\fR of the SMTP proxy server. The \fIhost\fR
-/*	or \fIhost:\fR portion is optional.
+/*	The \fIhost:port\fR of the real-time SMTP-based content filter.
+/*	The \fIhost\fR or \fIhost:\fR portion is optional.
 /* .IP \fBsmtpd_proxy_timeout\fR
 /*	Timeout for connecting to, sending to and receiving from
-/*	the SMTP proxy server.
+/*	the real-time SMTP-based content filter.
 /* .IP \fBsmtpd_proxy_ehlo\fR
 /*	The hostname to use when sending an EHLO command to the
-/*	SMTP proxy server.
+/*	real-time SMTP-based content filter.
 /* .SH "Authentication controls"
 /* .IP \fBsmtpd_sasl_auth_enable\fR
 /*	Enable per-session authentication as per RFC 2554 (SASL).
@@ -966,12 +966,14 @@ static char *extract_addr(SMTPD_STATE *state, SMTPD_TOKEN *arg,
      * Report trouble. Log a warning only if we are going to sleep+reject so
      * that attackers can't flood our logfiles.
      */
-    if ((arg->strval[0] == 0 && !allow_empty_addr)
-	|| (strict_rfc821 && arg->strval[0] == '@')) {
-	msg_warn("Illegal address syntax from %s in %s command: %s",
-		 state->namaddr, state->where, STR(arg->vstrval));
-	err = "501 Bad address syntax";
-    }
+    if (err == 0)
+	if ((arg->strval[0] == 0 && !allow_empty_addr)
+	    || (strict_rfc821 && arg->strval[0] == '@')
+	    || smtpd_check_addr(STR(arg->vstrval)) != 0) {
+	    msg_warn("Illegal address syntax from %s in %s command: %s",
+		     state->namaddr, state->where, STR(arg->vstrval));
+	    err = "501 Bad address syntax";
+	}
 
     /*
      * Cleanup.
@@ -1243,6 +1245,12 @@ static int rcpt_cmd(SMTPD_STATE *state, int argc, SMTPD_TOKEN *argv)
     } else if (state->cleanup == 0) {
 	mail_open_stream(state);
     }
+
+    /*
+     * Proxy the recipient. OK, so we lied. If the real-time proxy rejects
+     * the recipient then we can have a proxy connection without having
+     * accepted a recipient.
+     */
     if (state->proxy && smtpd_proxy_cmd(state, SMTPD_PROX_WANT_OK,
 					"%s", STR(state->buffer)) != 0) {
 	smtpd_chat_reply(state, "%s", STR(state->proxy_buffer));
@@ -1343,9 +1351,6 @@ static int data_cmd(SMTPD_STATE *state, int argc, SMTPD_TOKEN *unused_argv)
      * Terminate the message envelope segment. Start the message content
      * segment, and prepend our own Received: header. If there is only one
      * recipient, list the recipient address.
-     * 
-     * Suppress our own Received: header in the unlikely case that we are an
-     * intermediate proxy.
      */
     if (state->cleanup) {
 	if (state->saved_filter)
@@ -1356,6 +1361,11 @@ static int data_cmd(SMTPD_STATE *state, int argc, SMTPD_TOKEN *unused_argv)
 	    rec_fprintf(state->cleanup, REC_TYPE_FLGS, "%d", state->saved_flags);
 	rec_fputs(state->cleanup, REC_TYPE_MESG, "");
     }
+
+    /*
+     * Suppress our own Received: header in the unlikely case that we are an
+     * intermediate proxy.
+     */
     if (!state->proxy || state->xforward.flags == 0) {
 	out_fprintf(out_stream, REC_TYPE_NORM,
 		    "Received: from %s (%s [%s])",
@@ -1389,7 +1399,7 @@ static int data_cmd(SMTPD_STATE *state, int argc, SMTPD_TOKEN *unused_argv)
 
     /*
      * Copy the message content. If the cleanup process has a problem, keep
-     * reading until the remote stops sending, then complain. Read typed
+     * reading until the remote stops sending, then complain. Produce typed
      * records from the SMTP stream so we can handle data that spans buffers.
      * 
      * XXX Force an empty record when the queue file content begins with
diff --git a/postfix/src/smtpd/smtpd.h b/postfix/src/smtpd/smtpd.h
index 6c26b1b1d..9c9bea0a6 100644
--- a/postfix/src/smtpd/smtpd.h
+++ b/postfix/src/smtpd/smtpd.h
@@ -56,35 +56,39 @@ typedef struct {
 } SMTPD_XFORWARD_ATTR;
 
 typedef struct SMTPD_STATE {
-    int     err;
-    VSTREAM *client;
-    VSTRING *buffer;
-    time_t  time;
-    char   *name;
-    char   *addr;
-    char   *namaddr;
+    int     err;			/* cleanup server/queue file errors */
+    VSTREAM *client;			/* SMTP client handle */
+    VSTRING *buffer;			/* SMTP client buffer */
+    time_t  time;			/* start of MAIL FROM transaction */
+    char   *name;			/* client hostname */
+    char   *addr;			/* client host address string */
+    char   *namaddr;			/* combined name and address */
     int     peer_code;			/* 2=ok, 4=soft, 5=hard */
-    int     error_count;
-    int     error_mask;
-    int     notify_mask;
-    char   *helo_name;
-    char   *queue_id;
-    VSTREAM *cleanup;
-    MAIL_STREAM *dest;
-    int     rcpt_count;
-    char   *access_denied;
-    ARGV   *history;
-    char   *reason;
-    char   *sender;
+    int     error_count;		/* reset after DOT */
+    int     error_mask;			/* client errors */
+    int     notify_mask;		/* what to report to postmaster */
+    char   *helo_name;			/* client HELO/EHLO argument */
+    char   *queue_id;			/* from cleanup server/queue file */
+    VSTREAM *cleanup;			/* cleanup server/queue file handle */
+    MAIL_STREAM *dest;			/* another server/file handle */
+    int     rcpt_count;			/* number of accepted recipients */
+    char   *access_denied;		/* fixme */
+    ARGV   *history;			/* protocol transcript */
+    char   *reason;			/* cause of connection loss */
+    char   *sender;			/* sender address */
     char   *encoding;			/* owned by mail_cmd() */
     char   *verp_delims;		/* owned by mail_cmd() */
-    char   *recipient;
-    char   *etrn_name;
-    char   *protocol;
-    char   *where;
-    int     recursion;
-    off_t   msg_size;
-    int     junk_cmds;
+    char   *recipient;			/* recipient address */
+    char   *etrn_name;			/* client ETRN argument */
+    char   *protocol;			/* SMTP or ESMTP */
+    char   *where;			/* protocol stage */
+    int     recursion;			/* Kellerspeicherpegelanzeiger */
+    off_t   msg_size;			/* MAIL FROM message size */
+    int     junk_cmds;			/* counter */
+
+    /*
+     * SASL specific.
+     */
 #ifdef USE_SASL_AUTH
 #if SASL_VERSION_MAJOR >= 2
     const char *sasl_mechanism_list;
@@ -98,6 +102,10 @@ typedef struct SMTPD_STATE {
     VSTRING *sasl_encoded;
     VSTRING *sasl_decoded;
 #endif
+
+    /*
+     * Specific to smtpd access checks.
+     */
     int     rcptmap_checked;
     int     warn_if_reject;		/* force reject into warning */
     SMTPD_DEFER defer_if_reject;	/* force reject into deferral */
@@ -111,13 +119,17 @@ typedef struct SMTPD_STATE {
     int     saved_flags;		/* postponed hold/discard */
     VSTRING *expand_buf;		/* scratch space for $name expansion */
 
-    /* Pass-through proxy client.  */
+    /*
+     * Pass-through proxy client.
+     */
     VSTREAM *proxy;			/* proxy handle */
     VSTRING *proxy_buffer;		/* proxy query/reply buffer */
     char   *proxy_mail;			/* owned by mail_cmd() */
     int     proxy_xforward_features;	/* XFORWARD proxy state */
 
-    /* XFORWARD server state. */
+    /*
+     * XFORWARD server state.
+     */
     SMTPD_XFORWARD_ATTR xforward;	/* up-stream logging info */
 } SMTPD_STATE;
 
@@ -221,9 +233,9 @@ extern void smtpd_peer_reset(SMTPD_STATE *state);
 #define FORWARD_HELO(s)		FORWARD_CLIENT_ATTR((s), helo_name)
 #define FORWARD_IDENT(s)	FORWARD_IDENT_ATTR(s)
 
-extern void smtpd_xforward_init(SMTPD_STATE *state);
-extern void smtpd_xforward_preset(SMTPD_STATE *state);
-extern void smtpd_xforward_reset(SMTPD_STATE *state);
+extern void smtpd_xforward_init(SMTPD_STATE *);
+extern void smtpd_xforward_preset(SMTPD_STATE *);
+extern void smtpd_xforward_reset(SMTPD_STATE *);
 
  /*
   * Transparency: before mail is queued, do we check for unknown recipients,
diff --git a/postfix/src/smtpd/smtpd_check.c b/postfix/src/smtpd/smtpd_check.c
index d962a5096..dda63db50 100644
--- a/postfix/src/smtpd/smtpd_check.c
+++ b/postfix/src/smtpd/smtpd_check.c
@@ -9,6 +9,9 @@
 /*
 /*	void	smtpd_check_init()
 /*
+/*	int	smtpd_check_addr(address)
+/*	const char *address;
+/*
 /*	char	*smtpd_check_client(state)
 /*	SMTPD_STATE *state;
 /*
@@ -39,6 +42,9 @@
 /*	smtpd_check_init() initializes. This function should be called
 /*	once during the process life time.
 /*
+/*	smtpd_check_addr() sanity checks an email address and returns
+/*	non-zero in case of badness.
+/*
 /*	Each of the following routines scrutinizes the argument passed to
 /*	an SMTP command such as HELO, MAIL FROM, RCPT TO, or scrutinizes
 /*	the initial client connection request.  The administrator can
@@ -3404,6 +3410,31 @@ static int generic_checks(SMTPD_STATE *state, ARGV *restrictions,
     return (status);
 }
 
+/* smtpd_check_addr - address sanity check */
+
+int     smtpd_check_addr(const char *addr)
+{
+    const RESOLVE_REPLY *resolve_reply;
+    char   *myname = "smtpd_check_addr";
+    int     status;
+
+    if (msg_verbose)
+	msg_info("%s: addr=%s", myname, addr);
+
+    /*
+     * Catch syntax errors early on if we can, but be prepared to re-compute
+     * the result later when the cache fills up with lots of recipients, at
+     * which time errors can still happen.
+     */
+    if (addr == 0 || *addr == 0)
+	return (0);
+    resolve_reply = (const RESOLVE_REPLY *)
+	ctable_locate(smtpd_resolve_cache, addr);
+    if (resolve_reply->flags & RESOLVE_FLAG_ERROR)
+	return (-1);
+    return (0);
+}
+
 /* smtpd_check_client - validate client name or address */
 
 char   *smtpd_check_client(SMTPD_STATE *state)
diff --git a/postfix/src/smtpd/smtpd_check.h b/postfix/src/smtpd/smtpd_check.h
index 9f2927c92..101673f16 100644
--- a/postfix/src/smtpd/smtpd_check.h
+++ b/postfix/src/smtpd/smtpd_check.h
@@ -13,6 +13,7 @@
   * External interface.
   */
 extern void smtpd_check_init(void);
+extern int smtpd_check_addr(const char *);
 extern char *smtpd_check_client(SMTPD_STATE *);
 extern char *smtpd_check_helo(SMTPD_STATE *, char *);
 extern char *smtpd_check_mail(SMTPD_STATE *, char *);
diff --git a/postfix/src/trivial-rewrite/resolve.c b/postfix/src/trivial-rewrite/resolve.c
index 90c3d7850..cde47cc2c 100644
--- a/postfix/src/trivial-rewrite/resolve.c
+++ b/postfix/src/trivial-rewrite/resolve.c
@@ -357,7 +357,8 @@ static void resolve_addr(RES_CONTEXT *rp, char *addr,
     tok822_internalize(nextrcpt, tree, TOK822_STR_DEFL);
     rcpt_domain = strrchr(STR(nextrcpt), '@') + 1;
     if (*rcpt_domain == '[' ? !valid_hostliteral(rcpt_domain, DONT_GRIPE) :
-	!valid_hostname(rcpt_domain, DONT_GRIPE))
+	(!valid_hostname(rcpt_domain, DONT_GRIPE)
+	 || valid_hostaddr(rcpt_domain, DONT_GRIPE)))
 	*flags |= RESOLVE_FLAG_ERROR;
     tok822_free_tree(tree);
     tree = 0;
@@ -412,7 +413,7 @@ static void resolve_addr(RES_CONTEXT *rp, char *addr,
 #if 0
 		if (strcasecmp(rcpt_domain, var_myorigin) == 0)
 		    msg_warn("do not list $%s (%s) in %s",
-			     VAR_MYORIGIN, var_myorigin, VAR_VIRT_ALIAS_DOMS);
+			   VAR_MYORIGIN, var_myorigin, VAR_VIRT_ALIAS_DOMS);
 #endif
 	    }
 	    vstring_strcpy(channel, MAIL_SERVICE_ERROR);