###--------------------------------------------------------------------------
### Listen for incoming connections.
+SECTION(global, daemon)m4_dnl
+daemon_smtp_ports = CONF_smtp_port : CONF_submission_port
+
SECTION(global, tls)m4_dnl
tls_certificate = CONF_sysconf_dir/server.cert
tls_privatekey = CONF_sysconf_dir/server.key
tls_advertise_hosts = *
-tls_dhparam = CONF_ca_dir/dh-param.pem
+tls_dhparam = CONF_ca_dir/dh-param-2048.pem
tls_require_ciphers = ${if or {{={$received_port}{CONF_submission_port}} \
{match_ip {$sender_host_address}{+trusted}}} \
{CONF_good_ciphers} \
## If this is a message submission then that's handled elsewhere.
accept condition = ${if eq{$acl_c_mode}{submission}}
- ## Make sure that the sender matches the client address.
- require message = Client host invalid for sender domain
- hosts = ${LOOKUP_DOMAIN($sender_address_domain,
+ ## Make sure that the sender matches the client address. I feel like
+ ## I want to reject these, but that will break stuff. For example,
+ ## if I send mail to an externally hosted address which is really a
+ ## distribution list containing some local address, then we'll
+ ## (approximately legitimately) receive mail with an apparently-local
+ ## sender from a remote host.
+ warn !hosts = ${LOOKUP_DOMAIN($sender_address_domain,
{KV(hosts, {$value}{+allnets})},
{${if match_domain {$sender_address_domain} \
{+public} \
{+allnets}{! +allnets}}})}
+ add_header = :after_received:X-Distorted-Warning: \
+ RCLNTLSNDR \
+ Apparently local sender, but received from remote \
+ server.\n\t\
+ sender=$sender_address, \
+ host=$sender_host_address
## OK.
accept