5.27 Postfix配置文件main.cf默认设置

下面红色文字为上一个参数的解释文字

# DO NOT EDIT THIS FILE. EDIT THE MAIN.CF FILE INSTEAD. THE

# TEXT HERE JUST SHOWS DEFAULT SETTINGS BUILT INTO POSTFIX.

#

2bounce_notice_recipient = postmaster

access_map_reject_code = 554

alias_database = hash:/etc/aliases

alias_maps = hash:/etc/aliases, nis:mail.aliases

allow_mail_to_commands = alias,forward

allow_mail_to_files = alias,forward

allow_min_user = no

allow_percent_hack = yes

allow_untrusted_routing = no

alternate_config_directories =

always_bcc =

append_at_myorigin = yes

append_dot_mydomain = yes

authorized_verp_clients = $mynetworks

berkeley_db_create_buffer_size = 16777216

berkeley_db_read_buffer_size = 131072

best_mx_transport =

biff = yes

body_checks =

body_checks_size_limit = 51200

bounce_notice_recipient = postmaster

bounce_service_name = bounce

bounce_size_limit = 50000

这个参数非常重要，用于设定弹回的最大邮件尺寸。缺省为50000 字节。

broken_sasl_auth_clients = no

canonical_maps =

cleanup_service_name = cleanup

command_directory = /usr/sbin

command_expansion_filter = 1234567890!@%-_=+:,./abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ

command_time_limit = 1000s

config_directory = /etc/postfix

content_filter =

daemon_directory = /usr/libexec/postfix

daemon_timeout = 18000s

debug_peer_level = 2

debug_peer_list =

default_database_type = hash

default_delivery_slot_cost = 5

default_delivery_slot_discount = 50

default_delivery_slot_loan = 3

default_destination_concurrency_limit = 20

default_destination_recipient_limit = 50

default_extra_recipient_limit = 1000

default_minimum_delivery_slots = 3

default_privs = nobody

default_process_limit = 100

用于限定SMTP服务的最大同时连接数量。缺省为100。根据服务器配置及操作系统的不同，可以做非常宽限的配置

default_rbl_reply = $rbl_code Service unavailable; $rbl_class [$rbl_what] blocked using $rbl_domain${rbl_reason?; $rbl_reason}

default_recipient_limit = 10000

default_transport = smtp

default_verp_delimiters = +=

defer_code = 450

defer_service_name = defer

defer_transports =

delay_notice_recipient = postmaster

delay_warning_time = 0h

deliver_lock_attempts = 20

deliver_lock_delay = 1s

disable_dns_lookups = no

disable_mime_input_processing = no

disable_mime_output_conversion = no

disable_verp_bounces = no

disable_vrfy_command = no

dont_remove = 0

double_bounce_sender = double-bounce

duplicate_filter_limit = 1000

empty_address_recipient = MAILER-DAEMON

error_notice_recipient = postmaster

error_service_name = error

expand_owner_alias = no

export_environment = TZ MAIL_CONFIG

extract_recipient_limit = 10240

限制扩展的收件人数量限制。这通常用于防止采用"sendmail -t"的方式来进行的攻击行为

fallback_relay =

fallback_transport =

fast_flush_domains = $relay_domains

fast_flush_purge_time = 7d

fast_flush_refresh_time = 12h

fault_injection_code = 0

flush_service_name = flush

fork_attempts = 5

fork_delay = 1s

forward_expansion_filter = 1234567890!@%-_=+:,./abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ

forward_path = $home/.forward${recipient_delimiter}${extension},$home/.forward

hash_queue_depth = 1

hash_queue_names = incoming,active,deferred,bounce,defer,flush,hold

header_address_token_limit = 10240

header_checks =

用于过滤邮件的头部信息

header_size_limit = 102400

设定SMTP所接受的最长邮件头部信息的长度。缺省为102400字节

helpful_warnings = yes

home_mailbox =

hopcount_limit = 50

ignore_mx_lookup_error = no

import_environment = MAIL_CONFIG MAIL_DEBUG MAIL_LOGTAG TZ XAUTHORITY DISPLAY

in_flow_delay = 1s

inet_interfaces = all

initial_destination_concurrency = 5

invalid_hostname_reject_code = 501

ipc_idle = 100s

ipc_timeout = 3600s

line_length_limit = 2048

设定SMTP所接受的最长字符行的长度。缺省为2048字节

lmtp_cache_connection = yes

lmtp_connect_timeout = 0s

lmtp_data_done_timeout = 600s

lmtp_data_init_timeout = 120s

lmtp_data_xfer_timeout = 180s

lmtp_lhlo_timeout = 300s

lmtp_mail_timeout = 300s

lmtp_quit_timeout = 300s

lmtp_rcpt_timeout = 300s

lmtp_rset_timeout = 300s

lmtp_sasl_auth_enable = no

lmtp_sasl_password_maps =

lmtp_sasl_security_options = noplaintext, noanonymous

lmtp_skip_quit_response = no

lmtp_tcp_port = 24

local_command_shell =

local_destination_concurrency_limit = 2

local_destination_recipient_limit = 1

local_recipient_maps = proxy:unix:passwd.byname $alias_maps

local_transport = local:$myhostname

luser_relay =

mail_name = Postfix

mail_owner = postfix

mail_release_date = 20030609

mail_spool_directory = /var/mail

mail_version = 2.0.11

mailbox_command =

mailbox_command_maps =

mailbox_delivery_lock = fcntl, dotlock

mailbox_size_limit = 51200000

mailbox_transport =

mailq_path = /usr/bin/mailq

manpage_directory = /usr/local/man

maps_rbl_domains =

这是一个非常有特色的反垃圾邮件功能。这个参数通常设定为maps_rbl_domains = blackholes.mail-abuse.org如果RBL lookup打开，系统会自动与全球著名的反垃圾邮件组织mail-abuse进行同步。组织来自mail-abuse所列举的不安全的电子邮件服务器。在缺省状态下这个功能是关闭的。

maps_rbl_reject_code = 554

masquerade_classes = envelope_sender, header_sender, header_recipient

masquerade_domains =

masquerade_exceptions =

max_idle = 100s

max_use = 100

maximal_backoff_time = 4000s

用于设定队列处理程序对无法投递的邮件的最长巡回时间。缺省为4000秒

maximal_queue_lifetime = 5d

用于设定队列处理程序对滞留邮件的最长保存期。缺省为5天

message_size_limit = 10240000

这个参数很重要。用于限定系统所接受的最大的单封邮件长度。缺省为10240000 字节

mime_boundary_length_limit = 2048

mime_header_checks = $header_checks

mime_nesting_limit = 100

minimal_backoff_time = 1000s

用于设定队列处理程序对无法投递的邮件的最短巡回时间。缺省为1000秒

mydestination = $myhostname, localhost.$mydomain

用于指定该服务器使用哪个域名来接收邮件。

我们建议，系统安装好后，尽量不要改动这个参数

mynetworks_style = subnet

mynetworks_stype用于设定邮件系统内部子网的限制情况。通常情况下设定为subnet。在单机情况下设置为host

myorigin = $myhostname

myorigin参数用于指定该服务器使用哪个域名来外发邮件。

缺省的情况下myorigin采用本机主机名称（与参数myhostname相同）。

建议：在很小的网络中，采用缺省配置。而在Internet中，我们建议你保持myorigin与mydomain参数相同。也就是说采用该服务器所在的域名称

nested_header_checks = $header_checks

newaliases_path = /usr/bin/newaliases

non_fqdn_reject_code = 504

notify_classes = resource,software

该参数用于告知系统，在哪种情况下用哪种方式通知用户。可以选择的参数类型有：

bounce 邮件原封不动弹回；

2bounce 将双份弹回邮件发送给Postmaster;

delay 将拖延的邮件的头部信息通知Postmaster;

policy 将被系统过滤掉的信息通知Postmaster;

protocol 将协议错误信息通知Postmaster;

resource 将因系统资源短缺而投递失败的信息通知Postmaster;

software 将因软错误而投递失败的信息通知Postmaster.

owner_request_special = yes

parent_domain_matches_subdomains = debug_peer_list,fast_flush_domains,mynetworks,permit_mx_backup_networks,qmqpd_authorized_clients,relay_domains,smtpd_access_maps

permit_mx_backup_networks =

pickup_service_name = pickup

prepend_delivered_header = command, file, forward

process_id_directory = pid

program_directory = /usr/libexec/postfix

propagate_unmatched_extensions = canonical, virtual

proxy_interfaces =

proxy_read_maps = $local_recipient_maps $mydestination $virtual_alias_maps $virtual_alias_domains $virtual_mailbox_maps $virtual_mailbox_domains $relay_recipient_maps $relay_domains $canonical_maps $sender_canonical_maps $recipient_canonical_maps $relocated_maps $transport_maps $mynetworks

qmgr_clog_warn_time = 300s

qmgr_fudge_factor = 100

qmgr_message_active_limit = 20000

qmgr_message_recipient_limit = 20000

qmgr_message_recipient_minimum = 10

qmqpd_authorized_clients =

qmqpd_error_delay = 1s

qmqpd_timeout = 300s

queue_directory = /var/spool/postfix

queue_file_attribute_count_limit = 100

queue_minfree = 0

queue_run_delay = 1000s

用于设定队列处理程序对拖延邮件的扫描周期。缺省为1000秒。

queue_service_name = qmgr

rbl_reply_maps =

readme_directory = no

recipient_canonical_maps =

recipient_delimiter =

reject_code = 554

relay_clientcerts =

relay_domains = $mydestination

relay_domains_reject_code = 554

relay_recipient_maps =

relay_transport = relay

relayhost =

relocated_maps =

require_home_directory = no

resolve_dequoted_address = yes

rewrite_service_name = rewrite

sample_directory = /etc/postfix

sender_canonical_maps =

sendmail_path = /usr/sbin/sendmail

service_throttle_time = 60s

setgid_group = postdrop

show_user_unknown_table_name = yes

showq_service_name = showq

smtp_always_send_ehlo = yes

smtp_bind_address =

smtp_connect_timeout = 30s

smtp_data_done_timeout = 600s

smtp_data_init_timeout = 120s

smtp_data_xfer_timeout = 180s

smtp_destination_concurrency_limit = $default_destination_concurrency_limit

smtp_destination_recipient_limit = $default_destination_recipient_limit

smtp_enforce_tls = no

smtp_helo_name = $myhostname

smtp_helo_timeout = 300s

smtp_line_length_limit = 990

smtp_mail_timeout = 300s

smtp_never_send_ehlo = no

smtp_pix_workaround_delay_time = 10s

smtp_pix_workaround_threshold_time = 500s

smtp_quit_timeout = 300s

smtp_randomize_addresses = yes

smtp_rcpt_timeout = 300s

smtp_sasl_auth_enable = no

smtp_sasl_password_maps =

smtp_sasl_security_options = noplaintext, noanonymous

smtp_skip_4xx_greeting = yes

smtp_skip_5xx_greeting = yes

smtp_skip_quit_response = yes

smtp_starttls_timeout = 300s

smtp_tls_CAfile =

smtp_tls_CApath =

smtp_tls_cert_file =

smtp_tls_cipherlist =

smtp_tls_dcert_file =

smtp_tls_dkey_file = $smtp_tls_dcert_file

smtp_tls_enforce_peername = yes

smtp_tls_key_file = $smtp_tls_cert_file

smtp_tls_loglevel = 0

smtp_tls_note_starttls_offer = no

smtp_tls_per_site =

smtp_tls_session_cache_database =

smtp_tls_session_cache_timeout = 3600s

smtp_use_tls = no

smtpd_banner = $myhostname ESMTP $mail_name

smtpd_client_restrictions =

smtpd_client_restrictions 参数的功能非常强大。它可以对连接到C-Link邮件服务器的各种户端以及其他服务器进行限制。该参数有以下的选项可以灵活配置设定。

reject_unknown_client 拒绝不能IP反向解析的地址；

permit_mynetworks 允许子网中的连接；

check_client_access maptype:mapname 检测在mapname文件中设定的规则；

reject_maps_rbl拒绝符合rbl行为条件的连接。

reject_unauth_pipelining 拒绝为认证的管道连接。

缺省状态下，该参数不做设定。

smtpd_data_restrictions =

smtpd_delay_reject = yes

smtpd_enforce_tls = no

smtpd_error_sleep_time = 1s

当SMTP服务端口接收到非法的命令时，系统将缓冲处理的时间间隔。这个参数对于防止恶意攻击非常有效。

smtpd_etrn_restrictions =

smtpd_expansion_filter = \t\40!"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~

smtpd_hard_error_limit = 20

SMTP服务所允许的硬错误次数。这个参数对于防止恶意攻击非常有效。

缺省20次

smtpd_helo_required = no

设定C-Link邮件系统是否在SMTP连接时必须进行HELO或EHLO握手。

缺省为不需要

smtpd_helo_restrictions =

当HELO握手必须时。该参数用于验证握手信息是否符合要求可以选择的参数有：

reject_invalid_hostname 拒绝错误的hostname。

permit_naked_ip_address 拒绝裸IP地址。

reject_unknown_hostname 拒绝为被DNS A或MX纪录指定的域名。

reject_non_fqdn_hostname 拒绝不符合域名规则的域名。

check_helo_access maptype:mapname 根据mapname中设定的信息限制。

smtpd_history_flush_threshold = 100

smtpd_junk_command_limit = 100

smtpd_noop_commands =

smtpd_null_access_lookup_key = <>

smtpd_recipient_limit = 1000

smtpd_recipient_restrictions = permit_mynetworks, reject_unauth_destination

设定特殊的发信人地址参数限制

可以选择的参数有：

check_relay_domains 检测转发域。

permit_auth_destination 允许经过认证的目的地。

reject_unauth_destination 拒绝为经过认证的目的地。

permit_mx_backup 允许反查询MX主机名称。

check_recipient_access maptype:mapname 根据mapname文件中设定的规则限制。

reject_unknown_recipient_domain 拒绝转发到没有DNS A或MX纪录的域名。

reject_non_fqdn_recipient 拒绝不符合规则的转发目标。

reject_unknown_sender_domain 拒绝没有IP反解析纪录的发件人域名。

ETRN命令限定过滤

系统保留，不开放。

smtpd_restriction_classes =

smtpd_sasl_auth_enable = no

smtpd_sasl_local_domain =

smtpd_sasl_security_options = noanonymous

smtpd_sender_login_maps =

smtpd_sender_restrictions =

设定发信人地址必须符合的规则。确实为任意

可以设定为以下参数：

reject_unknown_sender_domain 拒绝为没有DNS A或MX纪录的发信人域名。

check_sender_access maptype:mapname 根据mapname文件中的规则设定。

reject_non_fqdn_sender 拒绝不符合规则的发信人地址。

smtpd_soft_error_limit = 10

SMTP服务所允许的软错误次数。这个参数对于防止恶意攻击非常有效。缺省10次。

smtpd_timeout = 300s

smtpd_tls_CAfile =

smtpd_tls_CApath =

smtpd_tls_ask_ccert = no

smtpd_tls_auth_only = no

smtpd_tls_ccert_verifydepth = 5

smtpd_tls_cert_file =

smtpd_tls_cipherlist =

smtpd_tls_dcert_file =

smtpd_tls_dh1024_param_file =

smtpd_tls_dh512_param_file =

smtpd_tls_dkey_file = $smtpd_tls_dcert_file

smtpd_tls_key_file = $smtpd_tls_cert_file

smtpd_tls_loglevel = 0

smtpd_tls_received_header = no

smtpd_tls_req_ccert = no

smtpd_tls_session_cache_database =

smtpd_tls_session_cache_timeout = 3600s

smtpd_tls_wrappermode = no

smtpd_use_tls = no

soft_bounce = no

stale_lock_time = 500s

strict_7bit_headers = no

strict_8bitmime = no

strict_8bitmime_body = no

strict_mime_encoding_domain = no

strict_rfc821_envelopes = no

设定C-Link系统是否必须只接受符合RFC821所定义的负荷规则的邮件地址。

sun_mailtool_compatibility = no

swap_bangpath = yes

syslog_facility = mail

syslog_name = postfix

tls_daemon_random_bytes = 32

tls_daemon_random_source =

tls_random_bytes = 32

tls_random_exchange_name = ${config_directory}/prng_exch

tls_random_prng_update_period = 60s

tls_random_reseed_period = 3600s

tls_random_source =

transport_maps =

transport_retry_time = 60s

trigger_timeout = 10s

undisclosed_recipients_header = To: undisclosed-recipients:;

unknown_address_reject_code = 450

unknown_client_reject_code = 450

unknown_hostname_reject_code = 450

unknown_local_recipient_reject_code = 550

unknown_relay_recipient_reject_code = 550

unknown_virtual_alias_reject_code = 550

unknown_virtual_mailbox_reject_code = 550

verp_delimiter_filter = -=+

virtual_alias_domains = $virtual_alias_maps

virtual_alias_maps = $virtual_maps

virtual_gid_maps =

virtual_mailbox_base =

virtual_mailbox_domains = $virtual_mailbox_maps

virtual_mailbox_limit = 51200000

virtual_mailbox_lock = fcntl

virtual_mailbox_maps =

virtual_minimum_uid = 100

virtual_transport = virtual

virtual_uid_maps =