Re: Enforced Outbound TLS

2 msg	Duplicate messages with always_bcc
14 msg	[OT] Saving outgoing email Gmail style
3 msg	451 error
10 msg	Postfix 2.5 release candidate (and 2.6 snapshot...
2 msg	postfix errors when sending smtp auth via yahoo
4 msg	Documentation enhancement: Adjusting DB file pe...
11 msg	I don't want Postfix to confirm users via telnet
3 msg	Question on Earthlink and dnsbl.sorbs.net
36 msg	Re: Enforced Outbound TLS (part deux)
6 msg	smtpd_proxy_filter to unix: problem
4 msg	Again troubles with postfix and cyrus-sasl
3 msg	Exclude local host from smtpd_proxy_filter
4 msg	transport nexthop nexthop
3 msg	TLS has been selected, but TLS support is not c...
2 msg	Which documentation to read for this..
4 msg	Exchange 2003 to Postfix maildir migration
7 msg	virtual_mailbox_base & LDAP

Enforced Outbound TLS
\ Dennis Putnam (14 Jan 2008)
. \ Ralf Hildebrandt (14 Jan 2008)
. . \ Jason Ledford (14 Jan 2008)
. . . \ Dennis Putnam (14 Jan 2008)
. . . . \ Victor Duchovni (14 Jan 2008)
. . . . \ Jay Chandler (14 Jan 2008)
. . . . . \ Dennis Putnam (14 Jan 2008)
. . . . . \ Victor Duchovni (14 Jan 2008)
. . . \ Noel Jones (14 Jan 2008)
. . \ Dennis Putnam (14 Jan 2008)
. \ Dennis Putnam (14 Jan 2008)
. . \ (Wietse Venema) (14 Jan 2008)

2 msg	postfix+maildrop error
10 msg	Outgoing IP address

Subject:	Re: Enforced Outbound TLS
Group:	Postfix-users
From:	Victor Duchovni
Date:	14 Jan 2008

On Mon, Jan 14, 2008 at 02:25:29PM -0800, Jay Chandler wrote:

> Dennis Putnam wrote:
> >That is how I understand it as well. However, I have some doubts as to
> >when to use brackets ('[ ]'). I tried both ways with no success but I
> >think something else is wrong in my case. I also think the brackets
> >should be used as there seems to be some cautions about performance if
> >they are not used, although I don't understand what they are.
>
> Correct me if I'm hallucinating, but I thought the brackets were used to
> indicate "bypass MX lookups for this domain?"

The brackets are part of the nexthop syntax for SMTP. Regardless of
their meaning in that context, TLS policy is based on the nexthop,
so if the nexthop has brackets (for whatever reason), so does the TLS
policy lookup key.

TLS policy lookup key is the VERBATIM delivery nexthop. Only when this
nexthop is a domain name (no square brackets, ports, ...) parent domains
with leading "." are also tried.

--
Viktor.

Disclaimer: off-list followups get on-list replies or get ignored.
Please do not ignore the "Reply-To" header.

To unsubscribe from the postfix-users list, visit
http://www.postfix.org/lists.html or click the link below:
<mailto:majordomo?body=unsubscribe%20postfix-users>

If my response solves your problem, the best way to thank me is to not
send an "it worked, thanks" follow-up. If you must respond, please put
"It worked, thanks" in the "Subject" so I can delete these quickly.