This assumes that your organization has set up multiple internal MX hosts for the local domain.
If your intranet does not use MX records internally, you have to specify the gateway host itself:
This assumes that your organization has set up multiple internal MX hosts for the local domain.
If your intranet does not use MX records internally, you have to specify the gateway host itself:
Specify dbm:/etc/postfix/transport if your system uses dbm files instead of db.
How to set up Postfix on the firewall machine so that it relays mail for my.domain to a gateway machine on the inside, and so that it refuses mail for *.my.domain? The problem is that the standard relay_domains mail relaying restriction allows mail to *.my.domain when you specify my.domain.
Specify dbm:/etc/postfix/virtual if your system uses dbm files instead of db.
Unfortunately, the solution cannot use the transport table, because that table is ignored for destinations that match $mydestination. That's an implementation error, and it will be removed.
If your machine is disconnected most of the time, there isn't a lot of opportunity for Postfix to deliver mail to hard-to-reach corners of the Internet. It's better to drop the mail to a machine that is connected all the time.
Normally, Postfix attempts to deliver outbound mail at its convenience. If your machine uses on-demand dialup IP, this causes your system to place a telephone call whenever you submit new mail, and whenever Postfix retries to deliver delayed mail. To prevent such telephone calls from being placed, disable spontaneous SMTP mail deliveries.
Some people use Postfix to deliver mail across a LAN that is disconnected most of the time. Under such conditions, mail delivery can suffer from delays while the Postfix SMTP client performs sender and recipient domain DNS lookups in order to be standards-compliant. To prevent these delays, disable all SMTP client DNS lookups.
When you disable DNS lookups, you must specify the relayhost as either a numeric IP address, or as a hostname that resolves to one or more IP addresses (with DNS lookup disabled, Postfix does no MX lookup).
Put the following command into your PPP or SLIP dialup scripts:
The exact location of the sendmail command is system-specific. With some UNIX versions, use /usr/lib/sendmail. If you have disabled spontaneous SMTP mail delivery, you also need to run the above command every now and then while the dialup link is up, so that newly-posted mail is flushed from the queue.
Address masquerading is intended for use only on mail gateways.
Note that the gateway should have append_dot_domain and append_myorigin turned on (which is the default setting) so that all addresses are fully qualified before they are subjected to address masquerading.
In some cases, you may wish to have certain users or hosts exempted from masquerading.
Note that the order above is crucial: exemptions such as somehost.my.domain must precede $mydomain in the statement.
It should go without saying that if a particular host you wish to exempt this way is originating mail as user@my.domain in the first place, you can hardly exempt it.
Currently, Postfix has no hooks to let other programs inspect every message, so the scanning has to be done before mail enters Postfix or while mail leaves Postfix, for example at mailbox delivery time.
Postfix supports the maildir mailbox format. Edit main.cf and specify a line with: home_mailbox = Maildir/ (any relative pathname that ends in / will do).
The maildir format is also supported for delivery from aliases or .forward files. Specify /file/name/ as destination. The trailing / turns on maildir delivery.
If you can, avoid using any shell meta characters or built-ins such as $ or " or IFS or &&, because they force Postfix to run an expensive shell process.
With a distributed mail system such as Postfix, this is difficult to implement. Postfix does not run any mail delivery process under control by a user. Instead, mail delivery is done by daemon processes that have no parental relationship with user processes. This eliminates a large variety of potential security exploits with environment variables, signal handlers, and with other process attributes that UNIX passes on from parent to child.
In addition, Postfix uses multiple processes in order to insulate subsystems from each other. Making the delivery agents talk directly to user processes would defeat a lot of the effort that went into making Postfix more secure than ordinary mailers.
Solutions, ranging from fighting symptoms to turning off the Delivered-To: header:
POSIX regular expression support (regexp) is enabled by default on modern UNIX systems. Perl-compatible regular expression support (pcre) is optional; see the PCRE_README file in the top-level Postfix source directory.
See also the FAQ item for problems with the majordomo approve command.
Currently, the workaround is to edit the approve script to strip any header lines that match:
Yes, this assumes that the moderator knows what she is doing.
This causes all mail for the some.domain (and subdomains thereof) to be sent via UUCP to the host uucp-host.
uucp unix - n n - - pipe flags=F user=uucp argv=uux -r -n -z -a$sender - $nexthop!rmail ($recipient)
This runs the uux command, and substitutes the next-hop hostname (uucp-host) and the recipients before executing the command. The uux command is executed without assistance from the shell, so there are no problems with shell meta characters.
Specify dbm instead of hash if your system has no db support.
uucp unix - n n - - pipe flags=F user=uucp argv=uux -r -n -z -a$sender - $nexthop!rmail ($recipient)This runs the uux command, and substitutes the next-hop hostname (uucp-gateway, or whatever you specified) and the recipients before executing the command. The uux command is executed without assistance from the shell, so there are no problems with shell meta characters.
Over here we are using the scheme
In master.cf:
In the transports map:
Note: be sure to not advertise fax.your.domain in the DNS...
However, when you see mail deliveries fail consistently, you may
have a different problem: broken path MTU discovery.
A little background is in order. With the SMTP protocol, the HELO,
MAIL FROM and RCPT TO commands and responses are relatively short.
When you're talking to sendmail, every command and every response
is sent as a separate packet, because sendmail cannot implement
ESMTP command pipelining.
The message content, however, is sent as a few datagrams, each
datagram typically a kbyte large or even bigger, depending on your
local network MTU.
When mail fails consistently due to a timeout, I suspect that the
sending machine runs a modern UNIX which implements path MTU
discovery. That causes the machine to send packets as large as it
would send over the LAN, with the IP DONT'T FRAGMENT bit set,
preventing intermediate routers from fragmenting the packets that
are too big for their networks.
Depending on what network path a message follows, some router on
the way responds with an ICMP MUST FRAGMENT message saying the
packet is too big. Normally, the sending machine will re-send the
data after chopping it up into smaller pieces.
However, things break when some router closer to the sending system
is dropping such ICMP feedback messages, in a mistaken attempt to
protect systems against certain attacks. In that case, the ICMP
feedback message never reaches the sending machine, and the connection
times out.
This is the same configuration problem that causes trouble with
web servers behind a misconfigured packet filter: small images/files
are sent intact, large images/files time out because the server
does not see the MUST FRAGMENT ICMP feedback messages.
Workaround: disable path MTU discovery at the sending machine. Mail
will get out, but of course everyone else will still suffer. How
to disable path MTU discovery? It depends. Solaris has an ndd
command; other systems use different means such as sysctl
to control kernel parameters on a running system.
Fix: find the router that drops the ICMP MUST FRAGMENT messages,
and convince the person responsible for it to fix the configuration.
Answer: you're mixing BIND version 8 include files with a
different version of the resolver library.
Fix: use the right include files. For example:
In order to build Postfix with db support on UNIX systems
that do not have db support out of the box, you need the
db-1.85 release, or the current
version which has a db-1.85 compatible interface.
Use the following commands in the Postfix top-level directory.
The LD_LIBRARY_PATH unset commands may be required to avoid linking
in the wrong libraries.
Of course you will have to specify the actual location of the
include directory and of the object library.
One problem: older DB versions install a file /usr/include/ndbm.h
that is incompatible with the one in /usr/include. Be sure
to get rid of the bogus file, or the linker will fail to find
dbm_dirfno.
fax unix - n n - - pipe
flags= user=fax argv=/usr/bin/faxmail -d -n ${user}
fax.your.domain fax:localhost
Mail fails with timeout or lost connection
Occasionally, mail fails with "timed out while sending end of data
-- message may be sent more than once", or with: "lost connection after DATA".
Network outages happen, systems crash. There isn't much you can
do about it.
Undefined symbols: ___dn_expand, ___res_init etc.
Question: When I build Postfix I get the following errors:
ld: Undefined symbol
___dn_expand
___res_init
___res_search
*** Error code 1
make makefiles CCARGS="-I/usr/include".
Using DB libraries on Solaris etc.
The old dbm UNIX database has severe limitations when you
try to store lots of information. It breaks when the number of hash
collisions becomes so large that the entries no longer fit together
in a single disk block. The more modern db database does
not suffer these limitations. It is standard on 4.4BSD and Linux
systems.
Up one level | Postfix FAQ