xref: /titanic_52/usr/src/cmd/sendmail/cf/README (revision e9af4bc0b1cc30cea75d6ad4aa2fde97d985e9be)
17c478bd9Sstevel@tonic-gate
27c478bd9Sstevel@tonic-gate		SENDMAIL CONFIGURATION FILES
37c478bd9Sstevel@tonic-gate
47c478bd9Sstevel@tonic-gateThis document describes the sendmail configuration files.  It
57c478bd9Sstevel@tonic-gateexplains how to create a sendmail.cf file for use with sendmail.
67c478bd9Sstevel@tonic-gateIt also describes how to set options for sendmail which are explained
77c478bd9Sstevel@tonic-gatein the Sendmail Installation and Operation guide, which can be found
87c478bd9Sstevel@tonic-gateon-line at http://www.sendmail.org/%7Eca/email/doc8.12/op.html .
97c478bd9Sstevel@tonic-gateRecall this URL throughout this document when references to
107c478bd9Sstevel@tonic-gatedoc/op/op.* are made.
117c478bd9Sstevel@tonic-gate
127c478bd9Sstevel@tonic-gateTable of Content:
137c478bd9Sstevel@tonic-gate
147c478bd9Sstevel@tonic-gateINTRODUCTION AND EXAMPLE
157c478bd9Sstevel@tonic-gateA BRIEF INTRODUCTION TO M4
167c478bd9Sstevel@tonic-gateFILE LOCATIONS
177c478bd9Sstevel@tonic-gateOSTYPE
187c478bd9Sstevel@tonic-gateDOMAINS
197c478bd9Sstevel@tonic-gateMAILERS
207c478bd9Sstevel@tonic-gateFEATURES
217c478bd9Sstevel@tonic-gateHACKS
227c478bd9Sstevel@tonic-gateSITE CONFIGURATION
237c478bd9Sstevel@tonic-gateUSING UUCP MAILERS
247c478bd9Sstevel@tonic-gateTWEAKING RULESETS
257c478bd9Sstevel@tonic-gateMASQUERADING AND RELAYING
267c478bd9Sstevel@tonic-gateUSING LDAP FOR ALIASES, MAPS, AND CLASSES
277c478bd9Sstevel@tonic-gateLDAP ROUTING
287c478bd9Sstevel@tonic-gateANTI-SPAM CONFIGURATION CONTROL
297c478bd9Sstevel@tonic-gateCONNECTION CONTROL
307c478bd9Sstevel@tonic-gateSTARTTLS
317c478bd9Sstevel@tonic-gateADDING NEW MAILERS OR RULESETS
327c478bd9Sstevel@tonic-gateADDING NEW MAIL FILTERS
337c478bd9Sstevel@tonic-gateQUEUE GROUP DEFINITIONS
347c478bd9Sstevel@tonic-gateNON-SMTP BASED CONFIGURATIONS
357c478bd9Sstevel@tonic-gateWHO AM I?
367c478bd9Sstevel@tonic-gateACCEPTING MAIL FOR MULTIPLE NAMES
377c478bd9Sstevel@tonic-gateUSING MAILERTABLES
387c478bd9Sstevel@tonic-gateUSING USERDB TO MAP FULL NAMES
397c478bd9Sstevel@tonic-gateMISCELLANEOUS SPECIAL FEATURES
407c478bd9Sstevel@tonic-gateSECURITY NOTES
417c478bd9Sstevel@tonic-gateTWEAKING CONFIGURATION OPTIONS
427c478bd9Sstevel@tonic-gateMESSAGE SUBMISSION PROGRAM
437c478bd9Sstevel@tonic-gateFORMAT OF FILES AND MAPS
447c478bd9Sstevel@tonic-gateDIRECTORY LAYOUT
457c478bd9Sstevel@tonic-gateADMINISTRATIVE DETAILS
467c478bd9Sstevel@tonic-gate
477c478bd9Sstevel@tonic-gate
487c478bd9Sstevel@tonic-gate+--------------------------+
497c478bd9Sstevel@tonic-gate| INTRODUCTION AND EXAMPLE |
507c478bd9Sstevel@tonic-gate+--------------------------+
517c478bd9Sstevel@tonic-gate
527c478bd9Sstevel@tonic-gateConfiguration files are contained in the subdirectory "cf", with a
537c478bd9Sstevel@tonic-gatesuffix ".mc".  They must be run through "m4" to produce a ".cf" file.
547c478bd9Sstevel@tonic-gateYou must pre-load "cf.m4":
557c478bd9Sstevel@tonic-gate
567c478bd9Sstevel@tonic-gate	m4 ${CFDIR}/m4/cf.m4 config.mc > config.cf
577c478bd9Sstevel@tonic-gate
587c478bd9Sstevel@tonic-gateAlternatively, you can simply:
597c478bd9Sstevel@tonic-gate
607c478bd9Sstevel@tonic-gate	cd ${CFDIR}/cf
617c478bd9Sstevel@tonic-gate	/usr/ccs/bin/make config.cf
627c478bd9Sstevel@tonic-gate
637c478bd9Sstevel@tonic-gatewhere ${CFDIR} is the root of the cf directory and config.mc is the
647c478bd9Sstevel@tonic-gatename of your configuration file.  If you are running a version of M4
657c478bd9Sstevel@tonic-gatethat understands the __file__ builtin (versions of GNU m4 >= 0.75 do
667c478bd9Sstevel@tonic-gatethis, but the versions distributed with 4.4BSD and derivatives do not)
677c478bd9Sstevel@tonic-gateor the -I flag (ditto), then ${CFDIR} can be in an arbitrary directory.
687c478bd9Sstevel@tonic-gateFor "traditional" versions, ${CFDIR} ***MUST*** be "..", or you MUST
697c478bd9Sstevel@tonic-gateuse -D_CF_DIR_=/path/to/cf/dir/ -- note the trailing slash!  For example:
707c478bd9Sstevel@tonic-gate
717c478bd9Sstevel@tonic-gate	m4 -D_CF_DIR_=${CFDIR}/ ${CFDIR}/m4/cf.m4 config.mc > config.cf
727c478bd9Sstevel@tonic-gate
737c478bd9Sstevel@tonic-gateLet's examine a typical .mc file:
747c478bd9Sstevel@tonic-gate
757c478bd9Sstevel@tonic-gate	divert(-1)
767c478bd9Sstevel@tonic-gate	#
7749218d4fSjbeck	# Copyright (c) 1998-2005 Sendmail, Inc. and its suppliers.
787c478bd9Sstevel@tonic-gate	#	All rights reserved.
797c478bd9Sstevel@tonic-gate	# Copyright (c) 1983 Eric P. Allman.  All rights reserved.
807c478bd9Sstevel@tonic-gate	# Copyright (c) 1988, 1993
817c478bd9Sstevel@tonic-gate	#	The Regents of the University of California.  All rights reserved.
827c478bd9Sstevel@tonic-gate	#
837c478bd9Sstevel@tonic-gate	# By using this file, you agree to the terms and conditions set
847c478bd9Sstevel@tonic-gate	# forth in the LICENSE file which can be found at the top level of
857c478bd9Sstevel@tonic-gate	# the sendmail distribution.
867c478bd9Sstevel@tonic-gate	#
877c478bd9Sstevel@tonic-gate
887c478bd9Sstevel@tonic-gate	#
897c478bd9Sstevel@tonic-gate	#  This is a Berkeley-specific configuration file for HP-UX 9.x.
907c478bd9Sstevel@tonic-gate	#  It applies only to the Computer Science Division at Berkeley,
917c478bd9Sstevel@tonic-gate	#  and should not be used elsewhere.   It is provided on the sendmail
927c478bd9Sstevel@tonic-gate	#  distribution as a sample only.  To create your own configuration
937c478bd9Sstevel@tonic-gate	#  file, create an appropriate domain file in ../domain, change the
947c478bd9Sstevel@tonic-gate	#  `DOMAIN' macro below to reference that file, and copy the result
957c478bd9Sstevel@tonic-gate	#  to a name of your own choosing.
967c478bd9Sstevel@tonic-gate	#
977c478bd9Sstevel@tonic-gate	divert(0)
987c478bd9Sstevel@tonic-gate
997c478bd9Sstevel@tonic-gateThe divert(-1) will delete the crud in the resulting output file.
1007c478bd9Sstevel@tonic-gateThe copyright notice can be replaced by whatever your lawyers require;
1017c478bd9Sstevel@tonic-gateour lawyers require the one that is included in these files.  A copyleft
1027c478bd9Sstevel@tonic-gateis a copyright by another name.  The divert(0) restores regular output.
1037c478bd9Sstevel@tonic-gate
1047c478bd9Sstevel@tonic-gate	VERSIONID(`<SCCS or RCS version id>')
1057c478bd9Sstevel@tonic-gate
1067c478bd9Sstevel@tonic-gateVERSIONID is a macro that stuffs the version information into the
1077c478bd9Sstevel@tonic-gateresulting file.  You could use SCCS, RCS, CVS, something else, or
1087c478bd9Sstevel@tonic-gateomit it completely.  This is not the same as the version id included
1097c478bd9Sstevel@tonic-gatein SMTP greeting messages -- this is defined in m4/version.m4.
1107c478bd9Sstevel@tonic-gate
1117c478bd9Sstevel@tonic-gate	OSTYPE(`hpux9')dnl
1127c478bd9Sstevel@tonic-gate
1137c478bd9Sstevel@tonic-gateYou must specify an OSTYPE to properly configure things such as the
1147c478bd9Sstevel@tonic-gatepathname of the help and status files, the flags needed for the local
1157c478bd9Sstevel@tonic-gatemailer, and other important things.  If you omit it, you will get an
1167c478bd9Sstevel@tonic-gateerror when you try to build the configuration.  Look at the ostype
1177c478bd9Sstevel@tonic-gatedirectory for the list of known operating system types.
1187c478bd9Sstevel@tonic-gate
1197c478bd9Sstevel@tonic-gate	DOMAIN(`CS.Berkeley.EDU')dnl
1207c478bd9Sstevel@tonic-gate
1217c478bd9Sstevel@tonic-gateThis example is specific to the Computer Science Division at Berkeley.
1227c478bd9Sstevel@tonic-gateYou can use "DOMAIN(`generic')" to get a sufficiently bland definition
1237c478bd9Sstevel@tonic-gatethat may well work for you, or you can create a customized domain
1247c478bd9Sstevel@tonic-gatedefinition appropriate for your environment.
1257c478bd9Sstevel@tonic-gate
1267c478bd9Sstevel@tonic-gate	MAILER(`local')
1277c478bd9Sstevel@tonic-gate	MAILER(`smtp')
1287c478bd9Sstevel@tonic-gate
1297c478bd9Sstevel@tonic-gateThese describe the mailers used at the default CS site.  The local
1307c478bd9Sstevel@tonic-gatemailer is always included automatically.  Beware: MAILER declarations
1317c478bd9Sstevel@tonic-gateshould only be followed by LOCAL_* sections.  The general rules are
1327c478bd9Sstevel@tonic-gatethat the order should be:
1337c478bd9Sstevel@tonic-gate
1347c478bd9Sstevel@tonic-gate	VERSIONID
1357c478bd9Sstevel@tonic-gate	OSTYPE
1367c478bd9Sstevel@tonic-gate	DOMAIN
1377c478bd9Sstevel@tonic-gate	FEATURE
1387c478bd9Sstevel@tonic-gate	local macro definitions
1397c478bd9Sstevel@tonic-gate	MAILER
1407c478bd9Sstevel@tonic-gate	LOCAL_CONFIG
1417c478bd9Sstevel@tonic-gate	LOCAL_RULE_*
1427c478bd9Sstevel@tonic-gate	LOCAL_RULESETS
1437c478bd9Sstevel@tonic-gate
1447c478bd9Sstevel@tonic-gateThere are a few exceptions to this rule.  Local macro definitions which
1457c478bd9Sstevel@tonic-gateinfluence a FEATURE() should be done before that feature.  For example,
1467c478bd9Sstevel@tonic-gatea define(`PROCMAIL_MAILER_PATH', ...) should be done before
1477c478bd9Sstevel@tonic-gateFEATURE(`local_procmail').
1487c478bd9Sstevel@tonic-gate
1497c478bd9Sstevel@tonic-gate
1507c478bd9Sstevel@tonic-gate+----------------------------+
1517c478bd9Sstevel@tonic-gate| A BRIEF INTRODUCTION TO M4 |
1527c478bd9Sstevel@tonic-gate+----------------------------+
1537c478bd9Sstevel@tonic-gate
1547c478bd9Sstevel@tonic-gateSendmail uses the M4 macro processor to ``compile'' the configuration
1557c478bd9Sstevel@tonic-gatefiles.  The most important thing to know is that M4 is stream-based,
1567c478bd9Sstevel@tonic-gatethat is, it doesn't understand about lines.  For this reason, in some
1577c478bd9Sstevel@tonic-gateplaces you may see the word ``dnl'', which stands for ``delete
1587c478bd9Sstevel@tonic-gatethrough newline''; essentially, it deletes all characters starting
1597c478bd9Sstevel@tonic-gateat the ``dnl'' up to and including the next newline character.  In
1607c478bd9Sstevel@tonic-gatemost cases sendmail uses this only to avoid lots of unnecessary
1617c478bd9Sstevel@tonic-gateblank lines in the output.
1627c478bd9Sstevel@tonic-gate
1637c478bd9Sstevel@tonic-gateOther important directives are define(A, B) which defines the macro
1647c478bd9Sstevel@tonic-gate``A'' to have value ``B''.  Macros are expanded as they are read, so
1657c478bd9Sstevel@tonic-gateone normally quotes both values to prevent expansion.  For example,
1667c478bd9Sstevel@tonic-gate
1677c478bd9Sstevel@tonic-gate	define(`SMART_HOST', `smart.foo.com')
1687c478bd9Sstevel@tonic-gate
1697c478bd9Sstevel@tonic-gateOne word of warning:  M4 macros are expanded even in lines that appear
1707c478bd9Sstevel@tonic-gateto be comments.  For example, if you have
1717c478bd9Sstevel@tonic-gate
1727c478bd9Sstevel@tonic-gate	# See FEATURE(`foo') above
1737c478bd9Sstevel@tonic-gate
1747c478bd9Sstevel@tonic-gateit will not do what you expect, because the FEATURE(`foo') will be
1757c478bd9Sstevel@tonic-gateexpanded.  This also applies to
1767c478bd9Sstevel@tonic-gate
1777c478bd9Sstevel@tonic-gate	# And then define the $X macro to be the return address
1787c478bd9Sstevel@tonic-gate
1797c478bd9Sstevel@tonic-gatebecause ``define'' is an M4 keyword.  If you want to use them, surround
1807c478bd9Sstevel@tonic-gatethem with directed quotes, `like this'.
1817c478bd9Sstevel@tonic-gate
1827c478bd9Sstevel@tonic-gateSince m4 uses single quotes (opening "`" and closing "'") to quote
1837c478bd9Sstevel@tonic-gatearguments, those quotes can't be used in arguments.  For example,
1847c478bd9Sstevel@tonic-gateit is not possible to define a rejection message containing a single
1857c478bd9Sstevel@tonic-gatequote. Usually there are simple workarounds by changing those
1867c478bd9Sstevel@tonic-gatemessages; in the worst case it might be ok to change the value
1877c478bd9Sstevel@tonic-gatedirectly in the generated .cf file, which however is not advised.
1887c478bd9Sstevel@tonic-gate
1897c478bd9Sstevel@tonic-gate+----------------+
1907c478bd9Sstevel@tonic-gate| FILE LOCATIONS |
1917c478bd9Sstevel@tonic-gate+----------------+
1927c478bd9Sstevel@tonic-gate
1937c478bd9Sstevel@tonic-gatesendmail 8.9 has introduced a new configuration directory for sendmail
1947c478bd9Sstevel@tonic-gaterelated files, /etc/mail.  The new files available for sendmail 8.9 --
1957c478bd9Sstevel@tonic-gatethe class {R} /etc/mail/relay-domains and the access database
1967c478bd9Sstevel@tonic-gate/etc/mail/access -- take advantage of this new directory.  Beginning with
1977c478bd9Sstevel@tonic-gate8.10, all files will use this directory by default (some options may be
1987c478bd9Sstevel@tonic-gateset by OSTYPE() files).  This new directory should help to restore
1997c478bd9Sstevel@tonic-gateuniformity to sendmail's file locations.
2007c478bd9Sstevel@tonic-gate
2017c478bd9Sstevel@tonic-gateBelow is a table of some of the common changes:
2027c478bd9Sstevel@tonic-gate
2037c478bd9Sstevel@tonic-gateOld filename			New filename
2047c478bd9Sstevel@tonic-gate------------			------------
2057c478bd9Sstevel@tonic-gate/etc/bitdomain			/etc/mail/bitdomain
2067c478bd9Sstevel@tonic-gate/etc/domaintable		/etc/mail/domaintable
2077c478bd9Sstevel@tonic-gate/etc/genericstable		/etc/mail/genericstable
2087c478bd9Sstevel@tonic-gate/etc/uudomain			/etc/mail/uudomain
2097c478bd9Sstevel@tonic-gate/etc/virtusertable		/etc/mail/virtusertable
2107c478bd9Sstevel@tonic-gate/etc/userdb			/etc/mail/userdb
2117c478bd9Sstevel@tonic-gate
2127c478bd9Sstevel@tonic-gate/etc/aliases			/etc/mail/aliases
2137c478bd9Sstevel@tonic-gate/etc/sendmail/aliases		/etc/mail/aliases
2147c478bd9Sstevel@tonic-gate/etc/ucbmail/aliases		/etc/mail/aliases
2157c478bd9Sstevel@tonic-gate/usr/adm/sendmail/aliases	/etc/mail/aliases
2167c478bd9Sstevel@tonic-gate/usr/lib/aliases		/etc/mail/aliases
2177c478bd9Sstevel@tonic-gate/usr/lib/mail/aliases		/etc/mail/aliases
2187c478bd9Sstevel@tonic-gate/usr/ucblib/aliases		/etc/mail/aliases
2197c478bd9Sstevel@tonic-gate
2207c478bd9Sstevel@tonic-gate/etc/sendmail.cw		/etc/mail/local-host-names
2217c478bd9Sstevel@tonic-gate/etc/mail/sendmail.cw		/etc/mail/local-host-names
2227c478bd9Sstevel@tonic-gate/etc/sendmail/sendmail.cw	/etc/mail/local-host-names
2237c478bd9Sstevel@tonic-gate
2247c478bd9Sstevel@tonic-gate/etc/sendmail.ct		/etc/mail/trusted-users
2257c478bd9Sstevel@tonic-gate
2267c478bd9Sstevel@tonic-gate/etc/sendmail.oE		/etc/mail/error-header
2277c478bd9Sstevel@tonic-gate
2287c478bd9Sstevel@tonic-gate/etc/sendmail.hf		/etc/mail/helpfile
2297c478bd9Sstevel@tonic-gate/etc/mail/sendmail.hf		/etc/mail/helpfile
2307c478bd9Sstevel@tonic-gate/usr/ucblib/sendmail.hf		/etc/mail/helpfile
2317c478bd9Sstevel@tonic-gate/etc/ucbmail/sendmail.hf	/etc/mail/helpfile
2327c478bd9Sstevel@tonic-gate/usr/lib/sendmail.hf		/etc/mail/helpfile
2337c478bd9Sstevel@tonic-gate/usr/share/lib/sendmail.hf	/etc/mail/helpfile
2347c478bd9Sstevel@tonic-gate/usr/share/misc/sendmail.hf	/etc/mail/helpfile
2357c478bd9Sstevel@tonic-gate/share/misc/sendmail.hf		/etc/mail/helpfile
2367c478bd9Sstevel@tonic-gate
2377c478bd9Sstevel@tonic-gate/etc/service.switch		/etc/mail/service.switch
2387c478bd9Sstevel@tonic-gate
2397c478bd9Sstevel@tonic-gate/etc/sendmail.st		/etc/mail/statistics
2407c478bd9Sstevel@tonic-gate/etc/mail/sendmail.st		/etc/mail/statistics
2417c478bd9Sstevel@tonic-gate/etc/mailer/sendmail.st		/etc/mail/statistics
2427c478bd9Sstevel@tonic-gate/etc/sendmail/sendmail.st	/etc/mail/statistics
2437c478bd9Sstevel@tonic-gate/usr/lib/sendmail.st		/etc/mail/statistics
2447c478bd9Sstevel@tonic-gate/usr/ucblib/sendmail.st		/etc/mail/statistics
2457c478bd9Sstevel@tonic-gate
2467c478bd9Sstevel@tonic-gateNote that all of these paths actually use a new m4 macro MAIL_SETTINGS_DIR
2477c478bd9Sstevel@tonic-gateto create the pathnames.  The default value of this variable is
2487c478bd9Sstevel@tonic-gate`/etc/mail/'.  If you set this macro to a different value, you MUST include
2497c478bd9Sstevel@tonic-gatea trailing slash.
2507c478bd9Sstevel@tonic-gate
2517c478bd9Sstevel@tonic-gateNotice: all filenames used in a .mc (or .cf) file should be absolute
2527c478bd9Sstevel@tonic-gate(starting at the root, i.e., with '/').  Relative filenames most
2537c478bd9Sstevel@tonic-gatelikely cause surprises during operations (unless otherwise noted).
2547c478bd9Sstevel@tonic-gate
2557c478bd9Sstevel@tonic-gate
2567c478bd9Sstevel@tonic-gate+--------+
2577c478bd9Sstevel@tonic-gate| OSTYPE |
2587c478bd9Sstevel@tonic-gate+--------+
2597c478bd9Sstevel@tonic-gate
2607c478bd9Sstevel@tonic-gateYou MUST define an operating system environment, or the configuration
2617c478bd9Sstevel@tonic-gatefile build will puke.  There are several environments available; look
2627c478bd9Sstevel@tonic-gateat the "ostype" directory for the current list.  This macro changes
2637c478bd9Sstevel@tonic-gatethings like the location of the alias file and queue directory.  Some
2647c478bd9Sstevel@tonic-gateof these files are identical to one another.
2657c478bd9Sstevel@tonic-gate
2667c478bd9Sstevel@tonic-gateIt is IMPERATIVE that the OSTYPE occur before any MAILER definitions.
2677c478bd9Sstevel@tonic-gateIn general, the OSTYPE macro should go immediately after any version
2687c478bd9Sstevel@tonic-gateinformation, and MAILER definitions should always go last.
2697c478bd9Sstevel@tonic-gate
2707c478bd9Sstevel@tonic-gateOperating system definitions are usually easy to write.  They may define
2717c478bd9Sstevel@tonic-gatethe following variables (everything defaults, so an ostype file may be
2727c478bd9Sstevel@tonic-gateempty).  Unfortunately, the list of configuration-supported systems is
2737c478bd9Sstevel@tonic-gatenot as broad as the list of source-supported systems, since many of
2747c478bd9Sstevel@tonic-gatethe source contributors do not include corresponding ostype files.
2757c478bd9Sstevel@tonic-gate
2767c478bd9Sstevel@tonic-gateALIAS_FILE		[/etc/mail/aliases] The location of the text version
2777c478bd9Sstevel@tonic-gate			of the alias file(s).  It can be a comma-separated
2787c478bd9Sstevel@tonic-gate			list of names (but be sure you quote values with
2797c478bd9Sstevel@tonic-gate			commas in them -- for example, use
2807c478bd9Sstevel@tonic-gate				define(`ALIAS_FILE', `a,b')
2817c478bd9Sstevel@tonic-gate			to get "a" and "b" both listed as alias files;
2827c478bd9Sstevel@tonic-gate			otherwise the define() primitive only sees "a").
2837c478bd9Sstevel@tonic-gateHELP_FILE		[/etc/mail/helpfile] The name of the file
2847c478bd9Sstevel@tonic-gate			containing information printed in response to
2857c478bd9Sstevel@tonic-gate			the SMTP HELP command.
2867c478bd9Sstevel@tonic-gateQUEUE_DIR		[/var/spool/mqueue] The directory containing
2877c478bd9Sstevel@tonic-gate			queue files.  To use multiple queues, supply
2887c478bd9Sstevel@tonic-gate			a value ending with an asterisk.  For
2897c478bd9Sstevel@tonic-gate			example, /var/spool/mqueue/qd* will use all of the
2907c478bd9Sstevel@tonic-gate			directories or symbolic links to directories
2917c478bd9Sstevel@tonic-gate			beginning with 'qd' in /var/spool/mqueue as queue
2927c478bd9Sstevel@tonic-gate			directories.  The names 'qf', 'df', and 'xf' are
2937c478bd9Sstevel@tonic-gate			reserved as specific subdirectories for the
2947c478bd9Sstevel@tonic-gate			corresponding queue file types as explained in
2957c478bd9Sstevel@tonic-gate			doc/op/op.me.  See also QUEUE GROUP DEFINITIONS.
2967c478bd9Sstevel@tonic-gateMSP_QUEUE_DIR		[/var/spool/clientmqueue] The directory containing
2977c478bd9Sstevel@tonic-gate			queue files for the MSP (Mail Submission Program).
2987c478bd9Sstevel@tonic-gateSTATUS_FILE		[/etc/mail/statistics] The file containing status
2997c478bd9Sstevel@tonic-gate			information.
3007c478bd9Sstevel@tonic-gateLOCAL_MAILER_PATH	[/bin/mail] The program used to deliver local mail.
3017c478bd9Sstevel@tonic-gateLOCAL_MAILER_FLAGS	[Prmn9] The flags used by the local mailer.  The
3027c478bd9Sstevel@tonic-gate			flags lsDFMAw5:/|@q are always included.
3037c478bd9Sstevel@tonic-gateLOCAL_MAILER_ARGS	[mail -d $u] The arguments passed to deliver local
3047c478bd9Sstevel@tonic-gate			mail.
3057c478bd9Sstevel@tonic-gateLOCAL_MAILER_MAX	[undefined] If defined, the maximum size of local
3067c478bd9Sstevel@tonic-gate			mail that you are willing to accept.
3077c478bd9Sstevel@tonic-gateLOCAL_MAILER_MAXMSGS	[undefined] If defined, the maximum number of
3087c478bd9Sstevel@tonic-gate			messages to deliver in a single connection.  Only
3097c478bd9Sstevel@tonic-gate			useful for LMTP local mailers.
3107c478bd9Sstevel@tonic-gateLOCAL_MAILER_CHARSET	[undefined] If defined, messages containing 8-bit data
3117c478bd9Sstevel@tonic-gate			that ARRIVE from an address that resolves to the
3127c478bd9Sstevel@tonic-gate			local mailer and which are converted to MIME will be
3137c478bd9Sstevel@tonic-gate			labeled with this character set.
3147c478bd9Sstevel@tonic-gateLOCAL_MAILER_EOL	[undefined] If defined, the string to use as the
3157c478bd9Sstevel@tonic-gate			end of line for the local mailer.
3167c478bd9Sstevel@tonic-gateLOCAL_MAILER_DSN_DIAGNOSTIC_CODE
3177c478bd9Sstevel@tonic-gate			[X-Unix] The DSN Diagnostic-Code value for the
3187c478bd9Sstevel@tonic-gate			local mailer.  This should be changed with care.
3197c478bd9Sstevel@tonic-gateLOCAL_SHELL_PATH	[/bin/sh] The shell used to deliver piped email.
3207c478bd9Sstevel@tonic-gateLOCAL_SHELL_FLAGS	[eu9] The flags used by the shell mailer.  The
3217c478bd9Sstevel@tonic-gate			flags lsDFM are always included.
3227c478bd9Sstevel@tonic-gateLOCAL_SHELL_ARGS	[sh -c $u] The arguments passed to deliver "prog"
3237c478bd9Sstevel@tonic-gate			mail.
3247c478bd9Sstevel@tonic-gateLOCAL_SHELL_DIR		[$z:/] The directory search path in which the
3257c478bd9Sstevel@tonic-gate			shell should run.
3267c478bd9Sstevel@tonic-gateLOCAL_MAILER_QGRP	[undefined] The queue group for the local mailer.
3277c478bd9Sstevel@tonic-gateSMTP_MAILER_FLAGS	[undefined] Flags added to SMTP mailer.  Default
3287c478bd9Sstevel@tonic-gate			flags are `mDFMuX' for all SMTP-based mailers; the
3297c478bd9Sstevel@tonic-gate			"esmtp" mailer adds `a'; "smtp8" adds `8'; and
3307c478bd9Sstevel@tonic-gate			"dsmtp" adds `%'.
3317c478bd9Sstevel@tonic-gateRELAY_MAILER_FLAGS	[undefined] Flags added to the relay mailer.  Default
3327c478bd9Sstevel@tonic-gate			flags are `mDFMuX' for all SMTP-based mailers; the
3337c478bd9Sstevel@tonic-gate			relay mailer adds `a8'.  If this is not defined,
3347c478bd9Sstevel@tonic-gate			then SMTP_MAILER_FLAGS is used.
3357c478bd9Sstevel@tonic-gateSMTP_MAILER_MAX		[undefined] The maximum size of messages that will
3367c478bd9Sstevel@tonic-gate			be transported using the smtp, smtp8, esmtp, or dsmtp
3377c478bd9Sstevel@tonic-gate			mailers.
3387c478bd9Sstevel@tonic-gateSMTP_MAILER_MAXMSGS	[undefined] If defined, the maximum number of
3397c478bd9Sstevel@tonic-gate			messages to deliver in a single connection for the
3407c478bd9Sstevel@tonic-gate			smtp, smtp8, esmtp, or dsmtp mailers.
3417c478bd9Sstevel@tonic-gateSMTP_MAILER_MAXRCPTS	[undefined] If defined, the maximum number of
3427c478bd9Sstevel@tonic-gate			recipients to deliver in a single connection for the
3437c478bd9Sstevel@tonic-gate			smtp, smtp8, esmtp, or dsmtp mailers.
3447c478bd9Sstevel@tonic-gateSMTP_MAILER_ARGS	[TCP $h] The arguments passed to the smtp mailer.
3457c478bd9Sstevel@tonic-gate			About the only reason you would want to change this
3467c478bd9Sstevel@tonic-gate			would be to change the default port.
3477c478bd9Sstevel@tonic-gateESMTP_MAILER_ARGS	[TCP $h] The arguments passed to the esmtp mailer.
3487c478bd9Sstevel@tonic-gateSMTP8_MAILER_ARGS	[TCP $h] The arguments passed to the smtp8 mailer.
3497c478bd9Sstevel@tonic-gateDSMTP_MAILER_ARGS	[TCP $h] The arguments passed to the dsmtp mailer.
3507c478bd9Sstevel@tonic-gateRELAY_MAILER_ARGS	[TCP $h] The arguments passed to the relay mailer.
3517c478bd9Sstevel@tonic-gateSMTP_MAILER_QGRP	[undefined] The queue group for the smtp mailer.
3527c478bd9Sstevel@tonic-gateESMTP_MAILER_QGRP	[undefined] The queue group for the esmtp mailer.
3537c478bd9Sstevel@tonic-gateSMTP8_MAILER_QGRP	[undefined] The queue group for the smtp8 mailer.
3547c478bd9Sstevel@tonic-gateDSMTP_MAILER_QGRP	[undefined] The queue group for the dsmtp mailer.
3557c478bd9Sstevel@tonic-gateRELAY_MAILER_QGRP	[undefined] The queue group for the relay mailer.
3567c478bd9Sstevel@tonic-gateRELAY_MAILER_MAXMSGS	[undefined] If defined, the maximum number of
3577c478bd9Sstevel@tonic-gate			messages to deliver in a single connection for the
3587c478bd9Sstevel@tonic-gate			relay mailer.
3597c478bd9Sstevel@tonic-gateSMTP_MAILER_CHARSET	[undefined] If defined, messages containing 8-bit data
3607c478bd9Sstevel@tonic-gate			that ARRIVE from an address that resolves to one of
3617c478bd9Sstevel@tonic-gate			the SMTP mailers and which are converted to MIME will
3627c478bd9Sstevel@tonic-gate			be labeled with this character set.
363058561cbSjbeckSMTP_MAILER_LL		[990] The maximum line length for SMTP mailers
364058561cbSjbeck			(except the relay mailer).
365058561cbSjbeckRELAY_MAILER_LL		[2040] The maximum line length for the relay mailer.
3667c478bd9Sstevel@tonic-gateUUCP_MAILER_PATH	[/usr/bin/uux] The program used to send UUCP mail.
3677c478bd9Sstevel@tonic-gateUUCP_MAILER_FLAGS	[undefined] Flags added to UUCP mailer.  Default
3687c478bd9Sstevel@tonic-gate			flags are `DFMhuU' (and `m' for uucp-new mailer,
3697c478bd9Sstevel@tonic-gate			minus `U' for uucp-dom mailer).
3707c478bd9Sstevel@tonic-gateUUCP_MAILER_ARGS	[uux - -r -z -a$g -gC $h!rmail ($u)] The arguments
3717c478bd9Sstevel@tonic-gate			passed to the UUCP mailer.
3727c478bd9Sstevel@tonic-gateUUCP_MAILER_MAX		[100000] The maximum size message accepted for
3737c478bd9Sstevel@tonic-gate			transmission by the UUCP mailers.
3747c478bd9Sstevel@tonic-gateUUCP_MAILER_CHARSET	[undefined] If defined, messages containing 8-bit data
3757c478bd9Sstevel@tonic-gate			that ARRIVE from an address that resolves to one of
3767c478bd9Sstevel@tonic-gate			the UUCP mailers and which are converted to MIME will
3777c478bd9Sstevel@tonic-gate			be labeled with this character set.
3787c478bd9Sstevel@tonic-gateUUCP_MAILER_QGRP	[undefined] The queue group for the UUCP mailers.
3797c478bd9Sstevel@tonic-gatePROCMAIL_MAILER_PATH	[/usr/local/bin/procmail] The path to the procmail
3807c478bd9Sstevel@tonic-gate			program.  This is also used by
3817c478bd9Sstevel@tonic-gate			FEATURE(`local_procmail').
3827c478bd9Sstevel@tonic-gatePROCMAIL_MAILER_FLAGS	[SPhnu9] Flags added to Procmail mailer.  Flags
3837c478bd9Sstevel@tonic-gate			DFM are always set.  This is NOT used by
3847c478bd9Sstevel@tonic-gate			FEATURE(`local_procmail'); tweak LOCAL_MAILER_FLAGS
3857c478bd9Sstevel@tonic-gate			instead.
3867c478bd9Sstevel@tonic-gatePROCMAIL_MAILER_ARGS	[procmail -Y -m $h $f $u] The arguments passed to
3877c478bd9Sstevel@tonic-gate			the Procmail mailer.  This is NOT used by
3887c478bd9Sstevel@tonic-gate			FEATURE(`local_procmail'); tweak LOCAL_MAILER_ARGS
3897c478bd9Sstevel@tonic-gate			instead.
3907c478bd9Sstevel@tonic-gatePROCMAIL_MAILER_MAX	[undefined] If set, the maximum size message that
3917c478bd9Sstevel@tonic-gate			will be accepted by the procmail mailer.
3927c478bd9Sstevel@tonic-gatePROCMAIL_MAILER_QGRP	[undefined] The queue group for the procmail mailer.
3937c478bd9Sstevel@tonic-gateconfEBINDIR		[/usr/libexec] The directory for executables.
3947c478bd9Sstevel@tonic-gate			Currently used for FEATURE(`local_lmtp') and
3957c478bd9Sstevel@tonic-gate			FEATURE(`smrsh').
3967c478bd9Sstevel@tonic-gateLOCAL_PROG_QGRP		[undefined] The queue group for the prog mailer.
3977c478bd9Sstevel@tonic-gate
3987c478bd9Sstevel@tonic-gateNote: to tweak Name_MAILER_FLAGS use the macro MODIFY_MAILER_FLAGS:
39949218d4fSjbeckMODIFY_MAILER_FLAGS(`Name', `change') where Name is the first part
40049218d4fSjbeckof the macro Name_MAILER_FLAGS (note: that means Name is entirely in
40149218d4fSjbeckupper case) and change can be: flags that should be used directly
40249218d4fSjbeck(thus overriding the default value), or if it starts with `+' (`-')
40349218d4fSjbeckthen those flags are added to (removed from) the default value.
40449218d4fSjbeckExample:
4057c478bd9Sstevel@tonic-gate
4067c478bd9Sstevel@tonic-gate	MODIFY_MAILER_FLAGS(`LOCAL', `+e')
4077c478bd9Sstevel@tonic-gate
4087c478bd9Sstevel@tonic-gatewill add the flag `e' to LOCAL_MAILER_FLAGS.  Notice: there are
4097c478bd9Sstevel@tonic-gateseveral smtp mailers all of which are manipulated individually.
4107c478bd9Sstevel@tonic-gateSee the section MAILERS for the available mailer names.
4117c478bd9Sstevel@tonic-gateWARNING: The FEATUREs local_lmtp and local_procmail set LOCAL_MAILER_FLAGS
4127c478bd9Sstevel@tonic-gateunconditionally, i.e., without respecting any definitions in an
4137c478bd9Sstevel@tonic-gateOSTYPE setting.
4147c478bd9Sstevel@tonic-gate
4157c478bd9Sstevel@tonic-gate
4167c478bd9Sstevel@tonic-gate+---------+
4177c478bd9Sstevel@tonic-gate| DOMAINS |
4187c478bd9Sstevel@tonic-gate+---------+
4197c478bd9Sstevel@tonic-gate
4207c478bd9Sstevel@tonic-gateYou will probably want to collect domain-dependent defines into one
4217c478bd9Sstevel@tonic-gatefile, referenced by the DOMAIN macro.  For example, the Berkeley
4227c478bd9Sstevel@tonic-gatedomain file includes definitions for several internal distinguished
4237c478bd9Sstevel@tonic-gatehosts:
4247c478bd9Sstevel@tonic-gate
4257c478bd9Sstevel@tonic-gateUUCP_RELAY	The host that will accept UUCP-addressed email.
4267c478bd9Sstevel@tonic-gate		If not defined, all UUCP sites must be directly
4277c478bd9Sstevel@tonic-gate		connected.
4287c478bd9Sstevel@tonic-gateBITNET_RELAY	The host that will accept BITNET-addressed email.
4297c478bd9Sstevel@tonic-gate		If not defined, the .BITNET pseudo-domain won't work.
4307c478bd9Sstevel@tonic-gateDECNET_RELAY	The host that will accept DECNET-addressed email.
4317c478bd9Sstevel@tonic-gate		If not defined, the .DECNET pseudo-domain and addresses
4327c478bd9Sstevel@tonic-gate		of the form node::user will not work.
4337c478bd9Sstevel@tonic-gateFAX_RELAY	The host that will accept mail to the .FAX pseudo-domain.
4347c478bd9Sstevel@tonic-gate		The "fax" mailer overrides this value.
4357c478bd9Sstevel@tonic-gateLOCAL_RELAY	The site that will handle unqualified names -- that
4367c478bd9Sstevel@tonic-gate		is, names without an @domain extension.
4377c478bd9Sstevel@tonic-gate		Normally MAIL_HUB is preferred for this function.
4387c478bd9Sstevel@tonic-gate		LOCAL_RELAY is mostly useful in conjunction with
4397c478bd9Sstevel@tonic-gate		FEATURE(`stickyhost') -- see the discussion of
4407c478bd9Sstevel@tonic-gate		stickyhost below.  If not set, they are assumed to
4417c478bd9Sstevel@tonic-gate		belong on this machine.  This allows you to have a
4427c478bd9Sstevel@tonic-gate		central site to store a company- or department-wide
4437c478bd9Sstevel@tonic-gate		alias database.  This only works at small sites,
4447c478bd9Sstevel@tonic-gate		and only with some user agents.
4457c478bd9Sstevel@tonic-gateLUSER_RELAY	The site that will handle lusers -- that is, apparently
4467c478bd9Sstevel@tonic-gate		local names that aren't local accounts or aliases.  To
4477c478bd9Sstevel@tonic-gate		specify a local user instead of a site, set this to
4487c478bd9Sstevel@tonic-gate		``local:username''.
4497c478bd9Sstevel@tonic-gate
4507c478bd9Sstevel@tonic-gateAny of these can be either ``mailer:hostname'' (in which case the
4517c478bd9Sstevel@tonic-gatemailer is the internal mailer name, such as ``uucp-new'' and the hostname
4527c478bd9Sstevel@tonic-gateis the name of the host as appropriate for that mailer) or just a
4537c478bd9Sstevel@tonic-gate``hostname'', in which case a default mailer type (usually ``relay'',
4547c478bd9Sstevel@tonic-gatea variant on SMTP) is used.  WARNING: if you have a wildcard MX
4557c478bd9Sstevel@tonic-gaterecord matching your domain, you probably want to define these to
4567c478bd9Sstevel@tonic-gatehave a trailing dot so that you won't get the mail diverted back
4577c478bd9Sstevel@tonic-gateto yourself.
4587c478bd9Sstevel@tonic-gate
4597c478bd9Sstevel@tonic-gateThe domain file can also be used to define a domain name, if needed
4607c478bd9Sstevel@tonic-gate(using "DD<domain>") and set certain site-wide features.  If all hosts
4617c478bd9Sstevel@tonic-gateat your site masquerade behind one email name, you could also use
4627c478bd9Sstevel@tonic-gateMASQUERADE_AS here.
4637c478bd9Sstevel@tonic-gate
4647c478bd9Sstevel@tonic-gateYou do not have to define a domain -- in particular, if you are a
4657c478bd9Sstevel@tonic-gatesingle machine sitting off somewhere, it is probably more work than
4667c478bd9Sstevel@tonic-gateit's worth.  This is just a mechanism for combining "domain dependent
4677c478bd9Sstevel@tonic-gateknowledge" into one place.
4687c478bd9Sstevel@tonic-gate
4697c478bd9Sstevel@tonic-gate
4707c478bd9Sstevel@tonic-gate+---------+
4717c478bd9Sstevel@tonic-gate| MAILERS |
4727c478bd9Sstevel@tonic-gate+---------+
4737c478bd9Sstevel@tonic-gate
4747c478bd9Sstevel@tonic-gateThere are fewer mailers supported in this version than the previous
4757c478bd9Sstevel@tonic-gateversion, owing mostly to a simpler world.  As a general rule, put the
4767c478bd9Sstevel@tonic-gateMAILER definitions last in your .mc file.
4777c478bd9Sstevel@tonic-gate
4787c478bd9Sstevel@tonic-gatelocal		The local and prog mailers.  You will almost always
4797c478bd9Sstevel@tonic-gate		need these; the only exception is if you relay ALL
4807c478bd9Sstevel@tonic-gate		your mail to another site.  This mailer is included
4817c478bd9Sstevel@tonic-gate		automatically.
4827c478bd9Sstevel@tonic-gate
4837c478bd9Sstevel@tonic-gatesmtp		The Simple Mail Transport Protocol mailer.  This does
4847c478bd9Sstevel@tonic-gate		not hide hosts behind a gateway or another other
4857c478bd9Sstevel@tonic-gate		such hack; it assumes a world where everyone is
4867c478bd9Sstevel@tonic-gate		running the name server.  This file actually defines
4877c478bd9Sstevel@tonic-gate		five mailers: "smtp" for regular (old-style) SMTP to
4887c478bd9Sstevel@tonic-gate		other servers, "esmtp" for extended SMTP to other
4897c478bd9Sstevel@tonic-gate		servers, "smtp8" to do SMTP to other servers without
4907c478bd9Sstevel@tonic-gate		converting 8-bit data to MIME (essentially, this is
4917c478bd9Sstevel@tonic-gate		your statement that you know the other end is 8-bit
4927c478bd9Sstevel@tonic-gate		clean even if it doesn't say so), "dsmtp" to do on
4937c478bd9Sstevel@tonic-gate		demand delivery, and "relay" for transmission to the
4947c478bd9Sstevel@tonic-gate		RELAY_HOST, LUSER_RELAY, or MAIL_HUB.
4957c478bd9Sstevel@tonic-gate
4967c478bd9Sstevel@tonic-gateuucp		The UNIX-to-UNIX Copy Program mailer.  Actually, this
4977c478bd9Sstevel@tonic-gate		defines two mailers, "uucp-old" (a.k.a. "uucp") and
4987c478bd9Sstevel@tonic-gate		"uucp-new" (a.k.a. "suucp").  The latter is for when you
4997c478bd9Sstevel@tonic-gate		know that the UUCP mailer at the other end can handle
5007c478bd9Sstevel@tonic-gate		multiple recipients in one transfer.  If the smtp mailer
5017c478bd9Sstevel@tonic-gate		is included in your configuration, two other mailers
5027c478bd9Sstevel@tonic-gate		("uucp-dom" and "uucp-uudom") are also defined [warning: you
5037c478bd9Sstevel@tonic-gate		MUST specify MAILER(`smtp') before MAILER(`uucp')].  When you
5047c478bd9Sstevel@tonic-gate		include the uucp mailer, sendmail looks for all names in
5057c478bd9Sstevel@tonic-gate		class {U} and sends them to the uucp-old mailer; all
5067c478bd9Sstevel@tonic-gate		names in class {Y} are sent to uucp-new; and all
5077c478bd9Sstevel@tonic-gate		names in class {Z} are sent to uucp-uudom.  Note that
5087c478bd9Sstevel@tonic-gate		this is a function of what version of rmail runs on
5097c478bd9Sstevel@tonic-gate		the receiving end, and hence may be out of your control.
5107c478bd9Sstevel@tonic-gate		See the section below describing UUCP mailers in more
5117c478bd9Sstevel@tonic-gate		detail.
5127c478bd9Sstevel@tonic-gate
5137c478bd9Sstevel@tonic-gateprocmail	An interface to procmail (does not come with sendmail).
5147c478bd9Sstevel@tonic-gate		This is designed to be used in mailertables.  For example,
5157c478bd9Sstevel@tonic-gate		a common question is "how do I forward all mail for a given
5167c478bd9Sstevel@tonic-gate		domain to a single person?".  If you have this mailer
5177c478bd9Sstevel@tonic-gate		defined, you could set up a mailertable reading:
5187c478bd9Sstevel@tonic-gate
5197c478bd9Sstevel@tonic-gate			host.com	procmail:/etc/procmailrcs/host.com
5207c478bd9Sstevel@tonic-gate
5217c478bd9Sstevel@tonic-gate		with the file /etc/procmailrcs/host.com reading:
5227c478bd9Sstevel@tonic-gate
5237c478bd9Sstevel@tonic-gate			:0	# forward mail for host.com
5247c478bd9Sstevel@tonic-gate			! -oi -f $1 person@other.host
5257c478bd9Sstevel@tonic-gate
5267c478bd9Sstevel@tonic-gate		This would arrange for (anything)@host.com to be sent
5277c478bd9Sstevel@tonic-gate		to person@other.host.  In a procmail script, $1 is the
5287c478bd9Sstevel@tonic-gate		name of the sender and $2 is the name of the recipient.
5297c478bd9Sstevel@tonic-gate		If you use this with FEATURE(`local_procmail'), the FEATURE
5307c478bd9Sstevel@tonic-gate		should be listed first.
5317c478bd9Sstevel@tonic-gate
5327c478bd9Sstevel@tonic-gate		Of course there are other ways to solve this particular
5337c478bd9Sstevel@tonic-gate		problem, e.g., a catch-all entry in a virtusertable.
5347c478bd9Sstevel@tonic-gate
5357c478bd9Sstevel@tonic-gateThe local mailer accepts addresses of the form "user+detail", where
5367c478bd9Sstevel@tonic-gatethe "+detail" is not used for mailbox matching but is available
5377c478bd9Sstevel@tonic-gateto certain local mail programs (in particular, see
5387c478bd9Sstevel@tonic-gateFEATURE(`local_procmail')).  For example, "eric", "eric+sendmail", and
5397c478bd9Sstevel@tonic-gate"eric+sww" all indicate the same user, but additional arguments <null>,
5407c478bd9Sstevel@tonic-gate"sendmail", and "sww" may be provided for use in sorting mail.
5417c478bd9Sstevel@tonic-gate
5427c478bd9Sstevel@tonic-gate
5437c478bd9Sstevel@tonic-gate+----------+
5447c478bd9Sstevel@tonic-gate| FEATURES |
5457c478bd9Sstevel@tonic-gate+----------+
5467c478bd9Sstevel@tonic-gate
5477c478bd9Sstevel@tonic-gateSpecial features can be requested using the "FEATURE" macro.  For
5487c478bd9Sstevel@tonic-gateexample, the .mc line:
5497c478bd9Sstevel@tonic-gate
5507c478bd9Sstevel@tonic-gate	FEATURE(`use_cw_file')
5517c478bd9Sstevel@tonic-gate
5527c478bd9Sstevel@tonic-gatetells sendmail that you want to have it read an /etc/mail/local-host-names
5537c478bd9Sstevel@tonic-gatefile to get values for class {w}.  A FEATURE may contain up to 9
5547c478bd9Sstevel@tonic-gateoptional parameters -- for example:
5557c478bd9Sstevel@tonic-gate
5567c478bd9Sstevel@tonic-gate	FEATURE(`mailertable', `dbm /usr/lib/mailertable')
5577c478bd9Sstevel@tonic-gate
5587c478bd9Sstevel@tonic-gateThe default database map type for the table features can be set with
5597c478bd9Sstevel@tonic-gate
5607c478bd9Sstevel@tonic-gate	define(`DATABASE_MAP_TYPE', `dbm')
5617c478bd9Sstevel@tonic-gate
5627c478bd9Sstevel@tonic-gatewhich would set it to use ndbm databases.  The default is the Berkeley DB
5637c478bd9Sstevel@tonic-gatehash database format.  Note that you must still declare a database map type
5647c478bd9Sstevel@tonic-gateif you specify an argument to a FEATURE.  DATABASE_MAP_TYPE is only used
5657c478bd9Sstevel@tonic-gateif no argument is given for the FEATURE.  It must be specified before any
5667c478bd9Sstevel@tonic-gatefeature that uses a map.
5677c478bd9Sstevel@tonic-gate
5687c478bd9Sstevel@tonic-gateAlso, features which can take a map definition as an argument can also take
5697c478bd9Sstevel@tonic-gatethe special keyword `LDAP'.  If that keyword is used, the map will use the
5707c478bd9Sstevel@tonic-gateLDAP definition described in the ``USING LDAP FOR ALIASES, MAPS, AND
5717c478bd9Sstevel@tonic-gateCLASSES'' section below.
5727c478bd9Sstevel@tonic-gate
5737c478bd9Sstevel@tonic-gateAvailable features are:
5747c478bd9Sstevel@tonic-gate
5757c478bd9Sstevel@tonic-gateuse_cw_file	Read the file /etc/mail/local-host-names file to get
5767c478bd9Sstevel@tonic-gate		alternate names for this host.  This might be used if you
5777c478bd9Sstevel@tonic-gate		were on a host that MXed for a dynamic set of other hosts.
5787c478bd9Sstevel@tonic-gate		If the set is static, just including the line "Cw<name1>
5797c478bd9Sstevel@tonic-gate		<name2> ..." (where the names are fully qualified domain
5807c478bd9Sstevel@tonic-gate		names) is probably superior.  The actual filename can be
5817c478bd9Sstevel@tonic-gate		overridden by redefining confCW_FILE.
5827c478bd9Sstevel@tonic-gate
5837c478bd9Sstevel@tonic-gateuse_ct_file	Read the file /etc/mail/trusted-users file to get the
5847c478bd9Sstevel@tonic-gate		names of users that will be ``trusted'', that is, able to
5857c478bd9Sstevel@tonic-gate		set their envelope from address using -f without generating
5867c478bd9Sstevel@tonic-gate		a warning message.  The actual filename can be overridden
5877c478bd9Sstevel@tonic-gate		by redefining confCT_FILE.
5887c478bd9Sstevel@tonic-gate
5897c478bd9Sstevel@tonic-gateredirect	Reject all mail addressed to "address.REDIRECT" with
5907c478bd9Sstevel@tonic-gate		a ``551 User has moved; please try <address>'' message.
5917c478bd9Sstevel@tonic-gate		If this is set, you can alias people who have left
5927c478bd9Sstevel@tonic-gate		to their new address with ".REDIRECT" appended.
5937c478bd9Sstevel@tonic-gate
5947c478bd9Sstevel@tonic-gatenouucp		Don't route UUCP addresses.  This feature takes one
5957c478bd9Sstevel@tonic-gate		parameter:
5967c478bd9Sstevel@tonic-gate		`reject': reject addresses which have "!" in the local
5977c478bd9Sstevel@tonic-gate			part unless it originates from a system
5987c478bd9Sstevel@tonic-gate			that is allowed to relay.
5997c478bd9Sstevel@tonic-gate		`nospecial': don't do anything special with "!".
6007c478bd9Sstevel@tonic-gate		Warnings: 1. See the notice in the anti-spam section.
6017c478bd9Sstevel@tonic-gate		2. don't remove "!" from OperatorChars if `reject' is
6027c478bd9Sstevel@tonic-gate		given as parameter.
6037c478bd9Sstevel@tonic-gate
6047c478bd9Sstevel@tonic-gatenocanonify	Don't pass addresses to $[ ... $] for canonification
6057c478bd9Sstevel@tonic-gate		by default, i.e., host/domain names are considered canonical,
6067c478bd9Sstevel@tonic-gate		except for unqualified names, which must not be used in this
6077c478bd9Sstevel@tonic-gate		mode (violation of the standard).  It can be changed by
6087c478bd9Sstevel@tonic-gate		setting the DaemonPortOptions modifiers (M=).  That is,
6097c478bd9Sstevel@tonic-gate		FEATURE(`nocanonify') will be overridden by setting the
6107c478bd9Sstevel@tonic-gate		'c' flag.  Conversely, if FEATURE(`nocanonify') is not used,
6117c478bd9Sstevel@tonic-gate		it can be emulated by setting the 'C' flag
6127c478bd9Sstevel@tonic-gate		(DaemonPortOptions=Modifiers=C).  This would generally only
6137c478bd9Sstevel@tonic-gate		be used by sites that only act as mail gateways or which have
6147c478bd9Sstevel@tonic-gate		user agents that do full canonification themselves.  You may
6157c478bd9Sstevel@tonic-gate		also want to use
6167c478bd9Sstevel@tonic-gate		"define(`confBIND_OPTS', `-DNSRCH -DEFNAMES')" to turn off
6177c478bd9Sstevel@tonic-gate		the usual resolver options that do a similar thing.
6187c478bd9Sstevel@tonic-gate
6197c478bd9Sstevel@tonic-gate		An exception list for FEATURE(`nocanonify') can be
6207c478bd9Sstevel@tonic-gate		specified with CANONIFY_DOMAIN or CANONIFY_DOMAIN_FILE,
6217c478bd9Sstevel@tonic-gate		i.e., a list of domains which are nevertheless passed to
6227c478bd9Sstevel@tonic-gate		$[ ... $] for canonification.  This is useful to turn on
6237c478bd9Sstevel@tonic-gate		canonification for local domains, e.g., use
6247c478bd9Sstevel@tonic-gate		CANONIFY_DOMAIN(`my.domain my') to canonify addresses
6257c478bd9Sstevel@tonic-gate		which end in "my.domain" or "my".
6267c478bd9Sstevel@tonic-gate		Another way to require canonification in the local
6277c478bd9Sstevel@tonic-gate		domain is CANONIFY_DOMAIN(`$=m').
6287c478bd9Sstevel@tonic-gate
6297c478bd9Sstevel@tonic-gate		A trailing dot is added to addresses with more than
6307c478bd9Sstevel@tonic-gate		one component in it such that other features which
6317c478bd9Sstevel@tonic-gate		expect a trailing dot (e.g., virtusertable) will
6327c478bd9Sstevel@tonic-gate		still work.
6337c478bd9Sstevel@tonic-gate
6347c478bd9Sstevel@tonic-gate		If `canonify_hosts' is specified as parameter, i.e.,
6357c478bd9Sstevel@tonic-gate		FEATURE(`nocanonify', `canonify_hosts'), then
6367c478bd9Sstevel@tonic-gate		addresses which have only a hostname, e.g.,
6377c478bd9Sstevel@tonic-gate		<user@host>, will be canonified (and hopefully fully
6387c478bd9Sstevel@tonic-gate		qualified), too.
6397c478bd9Sstevel@tonic-gate
6407c478bd9Sstevel@tonic-gatestickyhost	This feature is sometimes used with LOCAL_RELAY,
6417c478bd9Sstevel@tonic-gate		although it can be used for a different effect with
6427c478bd9Sstevel@tonic-gate		MAIL_HUB.
6437c478bd9Sstevel@tonic-gate
6447c478bd9Sstevel@tonic-gate		When used without MAIL_HUB, email sent to
6457c478bd9Sstevel@tonic-gate		"user@local.host" are marked as "sticky" -- that
6467c478bd9Sstevel@tonic-gate		is, the local addresses aren't matched against UDB,
6477c478bd9Sstevel@tonic-gate		don't go through ruleset 5, and are not forwarded to
6487c478bd9Sstevel@tonic-gate		the LOCAL_RELAY (if defined).
6497c478bd9Sstevel@tonic-gate
6507c478bd9Sstevel@tonic-gate		With MAIL_HUB, mail addressed to "user@local.host"
6517c478bd9Sstevel@tonic-gate		is forwarded to the mail hub, with the envelope
6527c478bd9Sstevel@tonic-gate		address still remaining "user@local.host".
6537c478bd9Sstevel@tonic-gate		Without stickyhost, the envelope would be changed
6547c478bd9Sstevel@tonic-gate		to "user@mail_hub", in order to protect against
6557c478bd9Sstevel@tonic-gate		mailing loops.
6567c478bd9Sstevel@tonic-gate
6577c478bd9Sstevel@tonic-gatemailertable	Include a "mailer table" which can be used to override
6587c478bd9Sstevel@tonic-gate		routing for particular domains (which are not in class {w},
6597c478bd9Sstevel@tonic-gate		i.e.  local host names).  The argument of the FEATURE may be
6607c478bd9Sstevel@tonic-gate		the key definition.  If none is specified, the definition
6617c478bd9Sstevel@tonic-gate		used is:
6627c478bd9Sstevel@tonic-gate
6637c478bd9Sstevel@tonic-gate			hash /etc/mail/mailertable
6647c478bd9Sstevel@tonic-gate
6657c478bd9Sstevel@tonic-gate		Keys in this database are fully qualified domain names
6667c478bd9Sstevel@tonic-gate		or partial domains preceded by a dot -- for example,
6677c478bd9Sstevel@tonic-gate		"vangogh.CS.Berkeley.EDU" or ".CS.Berkeley.EDU".  As a
6687c478bd9Sstevel@tonic-gate		special case of the latter, "." matches any domain not
6697c478bd9Sstevel@tonic-gate		covered by other keys.  Values must be of the form:
6707c478bd9Sstevel@tonic-gate			mailer:domain
6717c478bd9Sstevel@tonic-gate		where "mailer" is the internal mailer name, and "domain"
6727c478bd9Sstevel@tonic-gate		is where to send the message.  These maps are not
6737c478bd9Sstevel@tonic-gate		reflected into the message header.  As a special case,
6747c478bd9Sstevel@tonic-gate		the forms:
6757c478bd9Sstevel@tonic-gate			local:user
6767c478bd9Sstevel@tonic-gate		will forward to the indicated user using the local mailer,
6777c478bd9Sstevel@tonic-gate			local:
6787c478bd9Sstevel@tonic-gate		will forward to the original user in the e-mail address
6797c478bd9Sstevel@tonic-gate		using the local mailer, and
6807c478bd9Sstevel@tonic-gate			error:code message
6817c478bd9Sstevel@tonic-gate			error:D.S.N:code message
6827c478bd9Sstevel@tonic-gate		will give an error message with the indicated SMTP reply
6837c478bd9Sstevel@tonic-gate		code and message, where D.S.N is an RFC 1893 compliant
6847c478bd9Sstevel@tonic-gate		error code.
6857c478bd9Sstevel@tonic-gate
6867c478bd9Sstevel@tonic-gatedomaintable	Include a "domain table" which can be used to provide
6877c478bd9Sstevel@tonic-gate		domain name mapping.  Use of this should really be
6887c478bd9Sstevel@tonic-gate		limited to your own domains.  It may be useful if you
6897c478bd9Sstevel@tonic-gate		change names (e.g., your company changes names from
6907c478bd9Sstevel@tonic-gate		oldname.com to newname.com).  The argument of the
6917c478bd9Sstevel@tonic-gate		FEATURE may be the key definition.  If none is specified,
6927c478bd9Sstevel@tonic-gate		the definition used is:
6937c478bd9Sstevel@tonic-gate
6947c478bd9Sstevel@tonic-gate			hash /etc/mail/domaintable
6957c478bd9Sstevel@tonic-gate
6967c478bd9Sstevel@tonic-gate		The key in this table is the domain name; the value is
6977c478bd9Sstevel@tonic-gate		the new (fully qualified) domain.  Anything in the
6987c478bd9Sstevel@tonic-gate		domaintable is reflected into headers; that is, this
6997c478bd9Sstevel@tonic-gate		is done in ruleset 3.
7007c478bd9Sstevel@tonic-gate
7017c478bd9Sstevel@tonic-gatebitdomain	Look up bitnet hosts in a table to try to turn them into
7027c478bd9Sstevel@tonic-gate		internet addresses.  The table can be built using the
7037c478bd9Sstevel@tonic-gate		bitdomain program contributed by John Gardiner Myers.
7047c478bd9Sstevel@tonic-gate		The argument of the FEATURE may be the key definition; if
7057c478bd9Sstevel@tonic-gate		none is specified, the definition used is:
7067c478bd9Sstevel@tonic-gate
7077c478bd9Sstevel@tonic-gate			hash /etc/mail/bitdomain
7087c478bd9Sstevel@tonic-gate
7097c478bd9Sstevel@tonic-gate		Keys are the bitnet hostname; values are the corresponding
7107c478bd9Sstevel@tonic-gate		internet hostname.
7117c478bd9Sstevel@tonic-gate
7127c478bd9Sstevel@tonic-gateuucpdomain	Similar feature for UUCP hosts.  The default map definition
7137c478bd9Sstevel@tonic-gate		is:
7147c478bd9Sstevel@tonic-gate
7157c478bd9Sstevel@tonic-gate			hash /etc/mail/uudomain
7167c478bd9Sstevel@tonic-gate
7177c478bd9Sstevel@tonic-gate		At the moment there is no automagic tool to build this
7187c478bd9Sstevel@tonic-gate		database.
7197c478bd9Sstevel@tonic-gate
7207c478bd9Sstevel@tonic-gatealways_add_domain
7217c478bd9Sstevel@tonic-gate		Include the local host domain even on locally delivered
7227c478bd9Sstevel@tonic-gate		mail.  Normally it is not added on unqualified names.
7237c478bd9Sstevel@tonic-gate		However, if you use a shared message store but do not use
7247c478bd9Sstevel@tonic-gate		the same user name space everywhere, you may need the host
7257c478bd9Sstevel@tonic-gate		name on local names.  An optional argument specifies
7267c478bd9Sstevel@tonic-gate		another domain to be added than the local.
7277c478bd9Sstevel@tonic-gate
7287c478bd9Sstevel@tonic-gateallmasquerade	If masquerading is enabled (using MASQUERADE_AS), this
7297c478bd9Sstevel@tonic-gate		feature will cause recipient addresses to also masquerade
7307c478bd9Sstevel@tonic-gate		as being from the masquerade host.  Normally they get
7317c478bd9Sstevel@tonic-gate		the local hostname.  Although this may be right for
7327c478bd9Sstevel@tonic-gate		ordinary users, it can break local aliases.  For example,
7337c478bd9Sstevel@tonic-gate		if you send to "localalias", the originating sendmail will
7347c478bd9Sstevel@tonic-gate		find that alias and send to all members, but send the
7357c478bd9Sstevel@tonic-gate		message with "To: localalias@masqueradehost".  Since that
7367c478bd9Sstevel@tonic-gate		alias likely does not exist, replies will fail.  Use this
7377c478bd9Sstevel@tonic-gate		feature ONLY if you can guarantee that the ENTIRE
7387c478bd9Sstevel@tonic-gate		namespace on your masquerade host supersets all the
7397c478bd9Sstevel@tonic-gate		local entries.
7407c478bd9Sstevel@tonic-gate
7417c478bd9Sstevel@tonic-gatelimited_masquerade
7427c478bd9Sstevel@tonic-gate		Normally, any hosts listed in class {w} are masqueraded.  If
7437c478bd9Sstevel@tonic-gate		this feature is given, only the hosts listed in class {M} (see
7447c478bd9Sstevel@tonic-gate		below:  MASQUERADE_DOMAIN) are masqueraded.  This is useful
7457c478bd9Sstevel@tonic-gate		if you have several domains with disjoint namespaces hosted
7467c478bd9Sstevel@tonic-gate		on the same machine.
7477c478bd9Sstevel@tonic-gate
7487c478bd9Sstevel@tonic-gatemasquerade_entire_domain
7497c478bd9Sstevel@tonic-gate		If masquerading is enabled (using MASQUERADE_AS) and
7507c478bd9Sstevel@tonic-gate		MASQUERADE_DOMAIN (see below) is set, this feature will
7517c478bd9Sstevel@tonic-gate		cause addresses to be rewritten such that the masquerading
7527c478bd9Sstevel@tonic-gate		domains are actually entire domains to be hidden.  All
7537c478bd9Sstevel@tonic-gate		hosts within the masquerading domains will be rewritten
7547c478bd9Sstevel@tonic-gate		to the masquerade name (used in MASQUERADE_AS).  For example,
7557c478bd9Sstevel@tonic-gate		if you have:
7567c478bd9Sstevel@tonic-gate
7577c478bd9Sstevel@tonic-gate			MASQUERADE_AS(`masq.com')
7587c478bd9Sstevel@tonic-gate			MASQUERADE_DOMAIN(`foo.org')
7597c478bd9Sstevel@tonic-gate			MASQUERADE_DOMAIN(`bar.com')
7607c478bd9Sstevel@tonic-gate
7617c478bd9Sstevel@tonic-gate		then *foo.org and *bar.com are converted to masq.com.  Without
7627c478bd9Sstevel@tonic-gate		this feature, only foo.org and bar.com are masqueraded.
7637c478bd9Sstevel@tonic-gate
7647c478bd9Sstevel@tonic-gate		    NOTE: only domains within your jurisdiction and
7657c478bd9Sstevel@tonic-gate		    current hierarchy should be masqueraded using this.
7667c478bd9Sstevel@tonic-gate
7677c478bd9Sstevel@tonic-gatelocal_no_masquerade
7687c478bd9Sstevel@tonic-gate		This feature prevents the local mailer from masquerading even
7697c478bd9Sstevel@tonic-gate		if MASQUERADE_AS is used.  MASQUERADE_AS will only have effect
7707c478bd9Sstevel@tonic-gate		on addresses of mail going outside the local domain.
7717c478bd9Sstevel@tonic-gate
7727c478bd9Sstevel@tonic-gatemasquerade_envelope
7737c478bd9Sstevel@tonic-gate		If masquerading is enabled (using MASQUERADE_AS) or the
7747c478bd9Sstevel@tonic-gate		genericstable is in use, this feature will cause envelope
7757c478bd9Sstevel@tonic-gate		addresses to also masquerade as being from the masquerade
7767c478bd9Sstevel@tonic-gate		host.  Normally only the header addresses are masqueraded.
7777c478bd9Sstevel@tonic-gate
7787c478bd9Sstevel@tonic-gategenericstable	This feature will cause unqualified addresses (i.e., without
7797c478bd9Sstevel@tonic-gate		a domain) and addresses with a domain listed in class {G}
7807c478bd9Sstevel@tonic-gate		to be looked up in a map and turned into another ("generic")
7817c478bd9Sstevel@tonic-gate		form, which can change both the domain name and the user name.
7827c478bd9Sstevel@tonic-gate		Notice: if you use an MSP (as it is default starting with
7837c478bd9Sstevel@tonic-gate		8.12), the MTA will only receive qualified addresses from the
7847c478bd9Sstevel@tonic-gate		MSP (as required by the RFCs).  Hence you need to add your
7857c478bd9Sstevel@tonic-gate		domain to class {G}.  This feature is similar to the userdb
7867c478bd9Sstevel@tonic-gate		functionality.  The same types of addresses as for
7877c478bd9Sstevel@tonic-gate		masquerading are looked up, i.e., only header sender
7887c478bd9Sstevel@tonic-gate		addresses unless the allmasquerade and/or masquerade_envelope
7897c478bd9Sstevel@tonic-gate		features are given.  Qualified addresses must have the domain
7907c478bd9Sstevel@tonic-gate		part in class {G}; entries can be added to this class by the
7917c478bd9Sstevel@tonic-gate		macros GENERICS_DOMAIN or GENERICS_DOMAIN_FILE (analogously
7927c478bd9Sstevel@tonic-gate		to MASQUERADE_DOMAIN and MASQUERADE_DOMAIN_FILE, see below).
7937c478bd9Sstevel@tonic-gate
7947c478bd9Sstevel@tonic-gate		The argument of FEATURE(`genericstable') may be the map
7957c478bd9Sstevel@tonic-gate		definition; the default map definition is:
7967c478bd9Sstevel@tonic-gate
7977c478bd9Sstevel@tonic-gate			hash /etc/mail/genericstable
7987c478bd9Sstevel@tonic-gate
7997c478bd9Sstevel@tonic-gate		The key for this table is either the full address, the domain
8007c478bd9Sstevel@tonic-gate		(with a leading @; the localpart is passed as first argument)
8017c478bd9Sstevel@tonic-gate		or the unqualified username (tried in the order mentioned);
8027c478bd9Sstevel@tonic-gate		the value is the new user address.  If the new user address
8037c478bd9Sstevel@tonic-gate		does not include a domain, it will be qualified in the standard
8047c478bd9Sstevel@tonic-gate		manner, i.e., using $j or the masquerade name.  Note that the
8057c478bd9Sstevel@tonic-gate		address being looked up must be fully qualified.  For local
8067c478bd9Sstevel@tonic-gate		mail, it is necessary to use FEATURE(`always_add_domain')
8077c478bd9Sstevel@tonic-gate		for the addresses to be qualified.
8087c478bd9Sstevel@tonic-gate		The "+detail" of an address is passed as %1, so entries like
8097c478bd9Sstevel@tonic-gate
8107c478bd9Sstevel@tonic-gate			old+*@foo.org	new+%1@example.com
8117c478bd9Sstevel@tonic-gate			gen+*@foo.org	%1@example.com
8127c478bd9Sstevel@tonic-gate
8137c478bd9Sstevel@tonic-gate		and other forms are possible.
8147c478bd9Sstevel@tonic-gate
8157c478bd9Sstevel@tonic-gategenerics_entire_domain
8167c478bd9Sstevel@tonic-gate		If the genericstable is enabled and GENERICS_DOMAIN or
8177c478bd9Sstevel@tonic-gate		GENERICS_DOMAIN_FILE is used, this feature will cause
8187c478bd9Sstevel@tonic-gate		addresses to be searched in the map if their domain
8197c478bd9Sstevel@tonic-gate		parts are subdomains of elements in class {G}.
8207c478bd9Sstevel@tonic-gate
8217c478bd9Sstevel@tonic-gatevirtusertable	A domain-specific form of aliasing, allowing multiple
8227c478bd9Sstevel@tonic-gate		virtual domains to be hosted on one machine.  For example,
82349218d4fSjbeck		if the virtuser table contains:
8247c478bd9Sstevel@tonic-gate
8257c478bd9Sstevel@tonic-gate			info@foo.com	foo-info
8267c478bd9Sstevel@tonic-gate			info@bar.com	bar-info
8277c478bd9Sstevel@tonic-gate			joe@bar.com	error:nouser 550 No such user here
8287c478bd9Sstevel@tonic-gate			jax@bar.com	error:5.7.0:550 Address invalid
8297c478bd9Sstevel@tonic-gate			@baz.org	jane@example.net
8307c478bd9Sstevel@tonic-gate
8317c478bd9Sstevel@tonic-gate		then mail addressed to info@foo.com will be sent to the
8327c478bd9Sstevel@tonic-gate		address foo-info, mail addressed to info@bar.com will be
8337c478bd9Sstevel@tonic-gate		delivered to bar-info, and mail addressed to anyone at baz.org
8347c478bd9Sstevel@tonic-gate		will be sent to jane@example.net, mail to joe@bar.com will
8357c478bd9Sstevel@tonic-gate		be rejected with the specified error message, and mail to
8367c478bd9Sstevel@tonic-gate		jax@bar.com will also have a RFC 1893 compliant error code
8377c478bd9Sstevel@tonic-gate		5.7.0.
8387c478bd9Sstevel@tonic-gate
8397c478bd9Sstevel@tonic-gate		The username from the original address is passed
8407c478bd9Sstevel@tonic-gate		as %1 allowing:
8417c478bd9Sstevel@tonic-gate
8427c478bd9Sstevel@tonic-gate			@foo.org	%1@example.com
8437c478bd9Sstevel@tonic-gate
8447c478bd9Sstevel@tonic-gate		meaning someone@foo.org will be sent to someone@example.com.
8457c478bd9Sstevel@tonic-gate		Additionally, if the local part consists of "user+detail"
8467c478bd9Sstevel@tonic-gate		then "detail" is passed as %2 and "+detail" is passed as %3
8477c478bd9Sstevel@tonic-gate		when a match against user+* is attempted, so entries like
8487c478bd9Sstevel@tonic-gate
8497c478bd9Sstevel@tonic-gate			old+*@foo.org	new+%2@example.com
8507c478bd9Sstevel@tonic-gate			gen+*@foo.org	%2@example.com
8517c478bd9Sstevel@tonic-gate			+*@foo.org	%1%3@example.com
8527c478bd9Sstevel@tonic-gate			X++@foo.org	Z%3@example.com
8537c478bd9Sstevel@tonic-gate			@bar.org	%1%3
8547c478bd9Sstevel@tonic-gate
8557c478bd9Sstevel@tonic-gate		and other forms are possible.  Note: to preserve "+detail"
8567c478bd9Sstevel@tonic-gate		for a default case (@domain) %1%3 must be used as RHS.
8577c478bd9Sstevel@tonic-gate		There are two wildcards after "+": "+" matches only a non-empty
8587c478bd9Sstevel@tonic-gate		detail, "*" matches also empty details, e.g., user+@foo.org
8597c478bd9Sstevel@tonic-gate		matches +*@foo.org but not ++@foo.org.  This can be used
8607c478bd9Sstevel@tonic-gate		to ensure that the parameters %2 and %3 are not empty.
8617c478bd9Sstevel@tonic-gate
8627c478bd9Sstevel@tonic-gate		All the host names on the left hand side (foo.com, bar.com,
8637c478bd9Sstevel@tonic-gate		and baz.org) must be in class {w} or class {VirtHost}.  The
8647c478bd9Sstevel@tonic-gate		latter can be defined by the macros VIRTUSER_DOMAIN or
8657c478bd9Sstevel@tonic-gate		VIRTUSER_DOMAIN_FILE (analogously to MASQUERADE_DOMAIN and
8667c478bd9Sstevel@tonic-gate		MASQUERADE_DOMAIN_FILE, see below).  If VIRTUSER_DOMAIN or
8677c478bd9Sstevel@tonic-gate		VIRTUSER_DOMAIN_FILE is used, then the entries of class
8687c478bd9Sstevel@tonic-gate		{VirtHost} are added to class {R}, i.e., relaying is allowed
869d4660949Sjbeck		to (and from) those domains, which by default includes also
870d4660949Sjbeck		all subdomains (see relay_hosts_only).  The default map
871d4660949Sjbeck		definition is:
8727c478bd9Sstevel@tonic-gate
8737c478bd9Sstevel@tonic-gate			hash /etc/mail/virtusertable
8747c478bd9Sstevel@tonic-gate
8757c478bd9Sstevel@tonic-gate		A new definition can be specified as the second argument of
8767c478bd9Sstevel@tonic-gate		the FEATURE macro, such as
8777c478bd9Sstevel@tonic-gate
8787c478bd9Sstevel@tonic-gate			FEATURE(`virtusertable', `dbm /etc/mail/virtusers')
8797c478bd9Sstevel@tonic-gate
8807c478bd9Sstevel@tonic-gatevirtuser_entire_domain
8817c478bd9Sstevel@tonic-gate		If the virtusertable is enabled and VIRTUSER_DOMAIN or
8827c478bd9Sstevel@tonic-gate		VIRTUSER_DOMAIN_FILE is used, this feature will cause
8837c478bd9Sstevel@tonic-gate		addresses to be searched in the map if their domain
8847c478bd9Sstevel@tonic-gate		parts are subdomains of elements in class {VirtHost}.
8857c478bd9Sstevel@tonic-gate
8867c478bd9Sstevel@tonic-gateldap_routing	Implement LDAP-based e-mail recipient routing according to
8877c478bd9Sstevel@tonic-gate		the Internet Draft draft-lachman-laser-ldap-mail-routing-01.
8887c478bd9Sstevel@tonic-gate		This provides a method to re-route addresses with a
8897c478bd9Sstevel@tonic-gate		domain portion in class {LDAPRoute} to either a
8907c478bd9Sstevel@tonic-gate		different mail host or a different address.  Hosts can
8917c478bd9Sstevel@tonic-gate		be added to this class using LDAPROUTE_DOMAIN and
8927c478bd9Sstevel@tonic-gate		LDAPROUTE_DOMAIN_FILE (analogously to MASQUERADE_DOMAIN and
8937c478bd9Sstevel@tonic-gate		MASQUERADE_DOMAIN_FILE, see below).
8947c478bd9Sstevel@tonic-gate
8957c478bd9Sstevel@tonic-gate		See the LDAP ROUTING section below for more information.
8967c478bd9Sstevel@tonic-gate
8977c478bd9Sstevel@tonic-gatenullclient	This is a special case -- it creates a configuration file
8987c478bd9Sstevel@tonic-gate		containing nothing but support for forwarding all mail to a
8997c478bd9Sstevel@tonic-gate		central hub via a local SMTP-based network.  The argument
9007c478bd9Sstevel@tonic-gate		is the name of that hub.
9017c478bd9Sstevel@tonic-gate
9027c478bd9Sstevel@tonic-gate		The only other feature that should be used in conjunction
9037c478bd9Sstevel@tonic-gate		with this one is FEATURE(`nocanonify').  No mailers
9047c478bd9Sstevel@tonic-gate		should be defined.  No aliasing or forwarding is done.
9057c478bd9Sstevel@tonic-gate
9067c478bd9Sstevel@tonic-gatelocal_lmtp	Use an LMTP capable local mailer.  The argument to this
9077c478bd9Sstevel@tonic-gate		feature is the pathname of an LMTP capable mailer.  By
9087c478bd9Sstevel@tonic-gate		default, mail.local is used.  This is expected to be the
9097c478bd9Sstevel@tonic-gate		mail.local which came with the 8.9 distribution which is
9107c478bd9Sstevel@tonic-gate		LMTP capable.  The path to mail.local is set by the
9117c478bd9Sstevel@tonic-gate		confEBINDIR m4 variable -- making the default
9127c478bd9Sstevel@tonic-gate		LOCAL_MAILER_PATH /usr/libexec/mail.local.
9137c478bd9Sstevel@tonic-gate		If a different LMTP capable mailer is used, its pathname
9147c478bd9Sstevel@tonic-gate		can be specified as second parameter and the arguments
9157c478bd9Sstevel@tonic-gate		passed to it (A=) as third parameter, e.g.,
9167c478bd9Sstevel@tonic-gate
9177c478bd9Sstevel@tonic-gate			FEATURE(`local_lmtp', `/usr/local/bin/lmtp', `lmtp')
9187c478bd9Sstevel@tonic-gate
9197c478bd9Sstevel@tonic-gate		WARNING: This feature sets LOCAL_MAILER_FLAGS unconditionally,
9207c478bd9Sstevel@tonic-gate		i.e., without respecting any definitions in an OSTYPE setting.
9217c478bd9Sstevel@tonic-gate
9227c478bd9Sstevel@tonic-gatelocal_procmail	Use procmail or another delivery agent as the local mailer.
9237c478bd9Sstevel@tonic-gate		The argument to this feature is the pathname of the
9247c478bd9Sstevel@tonic-gate		delivery agent, which defaults to PROCMAIL_MAILER_PATH.
9257c478bd9Sstevel@tonic-gate		Note that this does NOT use PROCMAIL_MAILER_FLAGS or
9267c478bd9Sstevel@tonic-gate		PROCMAIL_MAILER_ARGS for the local mailer; tweak
9277c478bd9Sstevel@tonic-gate		LOCAL_MAILER_FLAGS and LOCAL_MAILER_ARGS instead, or
9287c478bd9Sstevel@tonic-gate		specify the appropriate parameters.  When procmail is used,
9297c478bd9Sstevel@tonic-gate		the local mailer can make use of the
9307c478bd9Sstevel@tonic-gate		"user+indicator@local.host" syntax; normally the +indicator
9317c478bd9Sstevel@tonic-gate		is just tossed, but by default it is passed as the -a
9327c478bd9Sstevel@tonic-gate		argument to procmail.
9337c478bd9Sstevel@tonic-gate
9347c478bd9Sstevel@tonic-gate		This feature can take up to three arguments:
9357c478bd9Sstevel@tonic-gate
9367c478bd9Sstevel@tonic-gate		1. Path to the mailer program
9377c478bd9Sstevel@tonic-gate		   [default: /usr/local/bin/procmail]
9387c478bd9Sstevel@tonic-gate		2. Argument vector including name of the program
9397c478bd9Sstevel@tonic-gate		   [default: procmail -Y -a $h -d $u]
9407c478bd9Sstevel@tonic-gate		3. Flags for the mailer [default: SPfhn9]
9417c478bd9Sstevel@tonic-gate
9427c478bd9Sstevel@tonic-gate		Empty arguments cause the defaults to be taken.
9437c478bd9Sstevel@tonic-gate		Note that if you are on a system with a broken
9447c478bd9Sstevel@tonic-gate		setreuid() call, you may need to add -f $f to the procmail
9457c478bd9Sstevel@tonic-gate		argument vector to pass the proper sender to procmail.
9467c478bd9Sstevel@tonic-gate
9477c478bd9Sstevel@tonic-gate		For example, this allows it to use the maildrop
9487c478bd9Sstevel@tonic-gate		(http://www.flounder.net/~mrsam/maildrop/) mailer instead
9497c478bd9Sstevel@tonic-gate		by specifying:
9507c478bd9Sstevel@tonic-gate
9517c478bd9Sstevel@tonic-gate		FEATURE(`local_procmail', `/usr/local/bin/maildrop',
9527c478bd9Sstevel@tonic-gate		 `maildrop -d $u')
9537c478bd9Sstevel@tonic-gate
9547c478bd9Sstevel@tonic-gate		or scanmails using:
9557c478bd9Sstevel@tonic-gate
9567c478bd9Sstevel@tonic-gate		FEATURE(`local_procmail', `/usr/local/bin/scanmails')
9577c478bd9Sstevel@tonic-gate
9587c478bd9Sstevel@tonic-gate		WARNING: This feature sets LOCAL_MAILER_FLAGS unconditionally,
9597c478bd9Sstevel@tonic-gate		i.e.,  without respecting any definitions in an OSTYPE setting.
9607c478bd9Sstevel@tonic-gate
9617c478bd9Sstevel@tonic-gatebestmx_is_local	Accept mail as though locally addressed for any host that
9627c478bd9Sstevel@tonic-gate		lists us as the best possible MX record.  This generates
9637c478bd9Sstevel@tonic-gate		additional DNS traffic, but should be OK for low to
9647c478bd9Sstevel@tonic-gate		medium traffic hosts.  The argument may be a set of
9657c478bd9Sstevel@tonic-gate		domains, which will limit the feature to only apply to
9667c478bd9Sstevel@tonic-gate		these domains -- this will reduce unnecessary DNS
9677c478bd9Sstevel@tonic-gate		traffic.  THIS FEATURE IS FUNDAMENTALLY INCOMPATIBLE WITH
9687c478bd9Sstevel@tonic-gate		WILDCARD MX RECORDS!!!  If you have a wildcard MX record
9697c478bd9Sstevel@tonic-gate		that matches your domain, you cannot use this feature.
9707c478bd9Sstevel@tonic-gate
9717c478bd9Sstevel@tonic-gatesmrsh		Use the SendMail Restricted SHell (smrsh) provided
9727c478bd9Sstevel@tonic-gate		with the distribution instead of /bin/sh for mailing
9737c478bd9Sstevel@tonic-gate		to programs.  This improves the ability of the local
9747c478bd9Sstevel@tonic-gate		system administrator to control what gets run via
9757c478bd9Sstevel@tonic-gate		e-mail.  If an argument is provided it is used as the
9767c478bd9Sstevel@tonic-gate		pathname to smrsh; otherwise, the path defined by
9777c478bd9Sstevel@tonic-gate		confEBINDIR is used for the smrsh binary -- by default,
9787c478bd9Sstevel@tonic-gate		/usr/libexec/smrsh is assumed.
9797c478bd9Sstevel@tonic-gate
9807c478bd9Sstevel@tonic-gatepromiscuous_relay
9817c478bd9Sstevel@tonic-gate		By default, the sendmail configuration files do not permit
9827c478bd9Sstevel@tonic-gate		mail relaying (that is, accepting mail from outside your
9837c478bd9Sstevel@tonic-gate		local host (class {w}) and sending it to another host than
9847c478bd9Sstevel@tonic-gate		your local host).  This option sets your site to allow
9857c478bd9Sstevel@tonic-gate		mail relaying from any site to any site.  In almost all
9867c478bd9Sstevel@tonic-gate		cases, it is better to control relaying more carefully
9877c478bd9Sstevel@tonic-gate		with the access map, class {R}, or authentication.  Domains
9887c478bd9Sstevel@tonic-gate		can be added to class {R} by the macros RELAY_DOMAIN or
9897c478bd9Sstevel@tonic-gate		RELAY_DOMAIN_FILE (analogously to MASQUERADE_DOMAIN and
9907c478bd9Sstevel@tonic-gate		MASQUERADE_DOMAIN_FILE, see below).
9917c478bd9Sstevel@tonic-gate
9927c478bd9Sstevel@tonic-gaterelay_entire_domain
9937c478bd9Sstevel@tonic-gate		This option allows any host in your domain as defined by
9947c478bd9Sstevel@tonic-gate		class {m} to use your server for relaying.  Notice: make
9957c478bd9Sstevel@tonic-gate		sure that your domain is not just a top level domain,
9967c478bd9Sstevel@tonic-gate		e.g., com.  This can happen if you give your host a name
9977c478bd9Sstevel@tonic-gate		like example.com instead of host.example.com.
9987c478bd9Sstevel@tonic-gate
9997c478bd9Sstevel@tonic-gaterelay_hosts_only
10007c478bd9Sstevel@tonic-gate		By default, names that are listed as RELAY in the access
10017c478bd9Sstevel@tonic-gate		db and class {R} are treated as domain names, not host names.
10027c478bd9Sstevel@tonic-gate		For example, if you specify ``foo.com'', then mail to or
10037c478bd9Sstevel@tonic-gate		from foo.com, abc.foo.com, or a.very.deep.domain.foo.com
10047c478bd9Sstevel@tonic-gate		will all be accepted for relaying.  This feature changes
10057c478bd9Sstevel@tonic-gate		the behaviour to lookup individual host names only.
10067c478bd9Sstevel@tonic-gate
10077c478bd9Sstevel@tonic-gaterelay_based_on_MX
10087c478bd9Sstevel@tonic-gate		Turns on the ability to allow relaying based on the MX
10097c478bd9Sstevel@tonic-gate		records of the host portion of an incoming recipient; that
10107c478bd9Sstevel@tonic-gate		is, if an MX record for host foo.com points to your site,
10117c478bd9Sstevel@tonic-gate		you will accept and relay mail addressed to foo.com.  See
10127c478bd9Sstevel@tonic-gate		description below for more information before using this
10137c478bd9Sstevel@tonic-gate		feature.  Also, see the KNOWNBUGS entry regarding bestmx
10147c478bd9Sstevel@tonic-gate		map lookups.
10157c478bd9Sstevel@tonic-gate
10167c478bd9Sstevel@tonic-gate		FEATURE(`relay_based_on_MX') does not necessarily allow
10177c478bd9Sstevel@tonic-gate		routing of these messages which you expect to be allowed,
10187c478bd9Sstevel@tonic-gate		if route address syntax (or %-hack syntax) is used.  If
10197c478bd9Sstevel@tonic-gate		this is a problem, add entries to the access-table or use
10207c478bd9Sstevel@tonic-gate		FEATURE(`loose_relay_check').
10217c478bd9Sstevel@tonic-gate
10227c478bd9Sstevel@tonic-gaterelay_mail_from
10237c478bd9Sstevel@tonic-gate		Allows relaying if the mail sender is listed as RELAY in
10247c478bd9Sstevel@tonic-gate		the access map.  If an optional argument `domain' (this
10257c478bd9Sstevel@tonic-gate		is the literal word `domain', not a placeholder) is given,
10267c478bd9Sstevel@tonic-gate		relaying can be allowed just based on the domain portion
10277c478bd9Sstevel@tonic-gate		of the sender address.  This feature should only be used if
10287c478bd9Sstevel@tonic-gate		absolutely necessary as the sender address can be easily
10297c478bd9Sstevel@tonic-gate		forged.  Use of this feature requires the "From:" tag to
10307c478bd9Sstevel@tonic-gate		be used for the key in the access map; see the discussion
10317c478bd9Sstevel@tonic-gate		of tags and FEATURE(`relay_mail_from') in the section on
10327c478bd9Sstevel@tonic-gate		anti-spam configuration control.
10337c478bd9Sstevel@tonic-gate
10347c478bd9Sstevel@tonic-gaterelay_local_from
10357c478bd9Sstevel@tonic-gate		Allows relaying if the domain portion of the mail sender
10367c478bd9Sstevel@tonic-gate		is a local host.  This should only be used if absolutely
10377c478bd9Sstevel@tonic-gate		necessary as it opens a window for spammers.  Specifically,
10387c478bd9Sstevel@tonic-gate		they can send mail to your mail server that claims to be
10397c478bd9Sstevel@tonic-gate		from your domain (either directly or via a routed address),
10407c478bd9Sstevel@tonic-gate		and you will go ahead and relay it out to arbitrary hosts
10417c478bd9Sstevel@tonic-gate		on the Internet.
10427c478bd9Sstevel@tonic-gate
10437c478bd9Sstevel@tonic-gateaccept_unqualified_senders
10447c478bd9Sstevel@tonic-gate		Normally, MAIL FROM: commands in the SMTP session will be
10457c478bd9Sstevel@tonic-gate		refused if the connection is a network connection and the
10467c478bd9Sstevel@tonic-gate		sender address does not include a domain name.  If your
10477c478bd9Sstevel@tonic-gate		setup sends local mail unqualified (i.e., MAIL FROM:<joe>),
10487c478bd9Sstevel@tonic-gate		you will need to use this feature to accept unqualified
10497c478bd9Sstevel@tonic-gate		sender addresses.  Setting the DaemonPortOptions modifier
10507c478bd9Sstevel@tonic-gate		'u' overrides the default behavior, i.e., unqualified
10517c478bd9Sstevel@tonic-gate		addresses are accepted even without this FEATURE.
10527c478bd9Sstevel@tonic-gate		If this FEATURE is not used, the DaemonPortOptions modifier
10537c478bd9Sstevel@tonic-gate		'f' can be used to enforce fully qualified addresses.
10547c478bd9Sstevel@tonic-gate
10557c478bd9Sstevel@tonic-gateaccept_unresolvable_domains
10567c478bd9Sstevel@tonic-gate		Normally, MAIL FROM: commands in the SMTP session will be
10577c478bd9Sstevel@tonic-gate		refused if the host part of the argument to MAIL FROM:
10587c478bd9Sstevel@tonic-gate		cannot be located in the host name service (e.g., an A or
10597c478bd9Sstevel@tonic-gate		MX record in DNS).  If you are inside a firewall that has
10607c478bd9Sstevel@tonic-gate		only a limited view of the Internet host name space, this
10617c478bd9Sstevel@tonic-gate		could cause problems.  In this case you probably want to
10627c478bd9Sstevel@tonic-gate		use this feature to accept all domains on input, even if
10637c478bd9Sstevel@tonic-gate		they are unresolvable.
10647c478bd9Sstevel@tonic-gate
10657c478bd9Sstevel@tonic-gateaccess_db	Turns on the access database feature.  The access db gives
10667c478bd9Sstevel@tonic-gate		you the ability to allow or refuse to accept mail from
10677c478bd9Sstevel@tonic-gate		specified domains for administrative reasons.  Moreover,
10687c478bd9Sstevel@tonic-gate		it can control the behavior of sendmail in various situations.
10697c478bd9Sstevel@tonic-gate		By default, the access database specification is:
10707c478bd9Sstevel@tonic-gate
10717c478bd9Sstevel@tonic-gate			hash -T<TMPF> /etc/mail/access
10727c478bd9Sstevel@tonic-gate
10737c478bd9Sstevel@tonic-gate		See the anti-spam configuration control section for further
10747c478bd9Sstevel@tonic-gate		important information about this feature.  Notice:
10757c478bd9Sstevel@tonic-gate		"-T<TMPF>" is meant literal, do not replace it by anything.
10767c478bd9Sstevel@tonic-gate
10777c478bd9Sstevel@tonic-gateblacklist_recipients
10787c478bd9Sstevel@tonic-gate		Turns on the ability to block incoming mail for certain
10797c478bd9Sstevel@tonic-gate		recipient usernames, hostnames, or addresses.  For
10807c478bd9Sstevel@tonic-gate		example, you can block incoming mail to user nobody,
10817c478bd9Sstevel@tonic-gate		host foo.mydomain.com, or guest@bar.mydomain.com.
10827c478bd9Sstevel@tonic-gate		These specifications are put in the access db as
10837c478bd9Sstevel@tonic-gate		described in the anti-spam configuration control section
10847c478bd9Sstevel@tonic-gate		later in this document.
10857c478bd9Sstevel@tonic-gate
10867c478bd9Sstevel@tonic-gatedelay_checks	The rulesets check_mail and check_relay will not be called
10877c478bd9Sstevel@tonic-gate		when a client connects or issues a MAIL command, respectively.
10887c478bd9Sstevel@tonic-gate		Instead, those rulesets will be called by the check_rcpt
10897c478bd9Sstevel@tonic-gate		ruleset; they will be skipped under certain circumstances.
10907c478bd9Sstevel@tonic-gate		See "Delay all checks" in the anti-spam configuration control
10917c478bd9Sstevel@tonic-gate		section.  Note: this feature is incompatible to the versions
10927c478bd9Sstevel@tonic-gate		in 8.10 and 8.11.
10937c478bd9Sstevel@tonic-gate
10947c478bd9Sstevel@tonic-gateuse_client_ptr	If this feature is enabled then check_relay will override
10957c478bd9Sstevel@tonic-gate		its first argument with $&{client_ptr}.  This is useful for
10967c478bd9Sstevel@tonic-gate		rejections based on the unverified hostname of client,
10977c478bd9Sstevel@tonic-gate		which turns on the same behavior as in earlier sendmail
10987c478bd9Sstevel@tonic-gate		versions when delay_checks was not in use.  See doc/op/op.*
10997c478bd9Sstevel@tonic-gate		about check_relay, {client_name}, and {client_ptr}.
11007c478bd9Sstevel@tonic-gate
1101058561cbSjbeckdnsbl		Turns on rejection, discarding, or quarantining of hosts
1102058561cbSjbeck		found in a DNS based list.  The first argument is used as
1103058561cbSjbeck		the domain in which blocked hosts are listed.  A second
1104058561cbSjbeck		argument can be used to change the default error message,
11054aac33d3Sjbeck		or select one of the operations `discard' and `quarantine'.
1106058561cbSjbeck		Without that second argument, the error message will be
1107058561cbSjbeck
11087c478bd9Sstevel@tonic-gate			Rejected: IP-ADDRESS listed at SERVER
1109058561cbSjbeck
11107c478bd9Sstevel@tonic-gate		where IP-ADDRESS and SERVER are replaced by the appropriate
11117c478bd9Sstevel@tonic-gate		information.  By default, temporary lookup failures are
11127c478bd9Sstevel@tonic-gate		ignored.  This behavior can be changed by specifying a
11137c478bd9Sstevel@tonic-gate		third argument, which must be either `t' or a full error
11147c478bd9Sstevel@tonic-gate		message.  See the anti-spam configuration control section for
11157c478bd9Sstevel@tonic-gate		an example.  The dnsbl feature can be included several times
11167c478bd9Sstevel@tonic-gate		to query different DNS based rejection lists.  See also
11177c478bd9Sstevel@tonic-gate		enhdnsbl for an enhanced version.
11187c478bd9Sstevel@tonic-gate
11197c478bd9Sstevel@tonic-gate		Set the DNSBL_MAP mc option to change the default map
11207c478bd9Sstevel@tonic-gate		definition from `host'.  Set the DNSBL_MAP_OPT mc option
11217c478bd9Sstevel@tonic-gate		to add additional options to the map specification used.
11227c478bd9Sstevel@tonic-gate
11237c478bd9Sstevel@tonic-gate		Some DNS based rejection lists cause failures if asked
11247c478bd9Sstevel@tonic-gate		for AAAA records. If your sendmail version is compiled
11257c478bd9Sstevel@tonic-gate		with IPv6 support (NETINET6) and you experience this
11267c478bd9Sstevel@tonic-gate		problem, add
11277c478bd9Sstevel@tonic-gate
11287c478bd9Sstevel@tonic-gate			define(`DNSBL_MAP', `dns -R A')
11297c478bd9Sstevel@tonic-gate
11307c478bd9Sstevel@tonic-gate		before the first use of this feature.  Alternatively you
11317c478bd9Sstevel@tonic-gate		can use enhdnsbl instead (see below).  Moreover, this
11327c478bd9Sstevel@tonic-gate		statement can be used to reduce the number of DNS retries,
11337c478bd9Sstevel@tonic-gate		e.g.,
11347c478bd9Sstevel@tonic-gate
11357c478bd9Sstevel@tonic-gate			define(`DNSBL_MAP', `dns -R A -r2')
11367c478bd9Sstevel@tonic-gate
11377c478bd9Sstevel@tonic-gate		See below (EDNSBL_TO) for an explanation.
11387c478bd9Sstevel@tonic-gate
11397c478bd9Sstevel@tonic-gateenhdnsbl	Enhanced version of dnsbl (see above).  Further arguments
11407c478bd9Sstevel@tonic-gate		(up to 5) can be used to specify specific return values
11417c478bd9Sstevel@tonic-gate		from lookups.  Temporary lookup failures are ignored unless
11427c478bd9Sstevel@tonic-gate		a third argument is given, which must be either `t' or a full
11437c478bd9Sstevel@tonic-gate		error message.  By default, any successful lookup will
11447c478bd9Sstevel@tonic-gate		generate an error.  Otherwise the result of the lookup is
11457c478bd9Sstevel@tonic-gate		compared with the supplied argument(s), and only if a match
11467c478bd9Sstevel@tonic-gate		occurs an error is generated.  For example,
11477c478bd9Sstevel@tonic-gate
11487c478bd9Sstevel@tonic-gate		FEATURE(`enhdnsbl', `dnsbl.example.com', `', `t', `127.0.0.2.')
11497c478bd9Sstevel@tonic-gate
11507c478bd9Sstevel@tonic-gate		will reject the e-mail if the lookup returns the value
11517c478bd9Sstevel@tonic-gate		``127.0.0.2.'', or generate a 451 response if the lookup
11527c478bd9Sstevel@tonic-gate		temporarily failed.  The arguments can contain metasymbols
11537c478bd9Sstevel@tonic-gate		as they are allowed in the LHS of rules.  As the example
11547c478bd9Sstevel@tonic-gate		shows, the default values are also used if an empty argument,
11557c478bd9Sstevel@tonic-gate		i.e., `', is specified.  This feature requires that sendmail
11567c478bd9Sstevel@tonic-gate		has been compiled with the flag DNSMAP (see sendmail/README).
11577c478bd9Sstevel@tonic-gate
11587c478bd9Sstevel@tonic-gate		Set the EDNSBL_TO mc option to change the DNS retry count
11597c478bd9Sstevel@tonic-gate		from the default value of 5, this can be very useful when
11607c478bd9Sstevel@tonic-gate		a DNS server is not responding, which in turn may cause
11617c478bd9Sstevel@tonic-gate		clients to time out (an entry stating
11627c478bd9Sstevel@tonic-gate
11637c478bd9Sstevel@tonic-gate			did not issue MAIL/EXPN/VRFY/ETRN
11647c478bd9Sstevel@tonic-gate
11657c478bd9Sstevel@tonic-gate		will be logged).
11667c478bd9Sstevel@tonic-gate
11677c478bd9Sstevel@tonic-gateratecontrol	Enable simple ruleset to do connection rate control
11687c478bd9Sstevel@tonic-gate		checking.  This requires entries in access_db of the form
11697c478bd9Sstevel@tonic-gate
11707c478bd9Sstevel@tonic-gate			ClientRate:IP.ADD.RE.SS		LIMIT
11717c478bd9Sstevel@tonic-gate
11727c478bd9Sstevel@tonic-gate		The RHS specifies the maximum number of connections
11737c478bd9Sstevel@tonic-gate		(an integer number) over the time interval defined
11747c478bd9Sstevel@tonic-gate		by ConnectionRateWindowSize, where 0 means unlimited.
11757c478bd9Sstevel@tonic-gate
11767c478bd9Sstevel@tonic-gate		Take the following example:
11777c478bd9Sstevel@tonic-gate
11787c478bd9Sstevel@tonic-gate			ClientRate:10.1.2.3		4
11797c478bd9Sstevel@tonic-gate			ClientRate:127.0.0.1		0
11807c478bd9Sstevel@tonic-gate			ClientRate:			10
11817c478bd9Sstevel@tonic-gate
11827c478bd9Sstevel@tonic-gate		10.1.2.3 can only make up to 4 connections, the
11837c478bd9Sstevel@tonic-gate		general limit it 10, and 127.0.0.1 can make an unlimited
11847c478bd9Sstevel@tonic-gate		number of connections per ConnectionRateWindowSize.
11857c478bd9Sstevel@tonic-gate
11867c478bd9Sstevel@tonic-gate		See also CONNECTION CONTROL.
11877c478bd9Sstevel@tonic-gate
11887c478bd9Sstevel@tonic-gateconncontrol	Enable a simple check of the number of incoming SMTP
11897c478bd9Sstevel@tonic-gate		connections.  This requires entries in access_db of the
11907c478bd9Sstevel@tonic-gate		form
11917c478bd9Sstevel@tonic-gate
11927c478bd9Sstevel@tonic-gate			ClientConn:IP.ADD.RE.SS		LIMIT
11937c478bd9Sstevel@tonic-gate
11947c478bd9Sstevel@tonic-gate		The RHS specifies the maximum number of open connections
11957c478bd9Sstevel@tonic-gate		(an integer number).
11967c478bd9Sstevel@tonic-gate
11977c478bd9Sstevel@tonic-gate		Take the following example:
11987c478bd9Sstevel@tonic-gate
11997c478bd9Sstevel@tonic-gate			ClientConn:10.1.2.3		4
12007c478bd9Sstevel@tonic-gate			ClientConn:127.0.0.1		0
12017c478bd9Sstevel@tonic-gate			ClientConn:			10
12027c478bd9Sstevel@tonic-gate
12037c478bd9Sstevel@tonic-gate		10.1.2.3 can only have up to 4 open connections, the
12047c478bd9Sstevel@tonic-gate		general limit it 10, and 127.0.0.1 does not have any
12057c478bd9Sstevel@tonic-gate		explicit limit.
12067c478bd9Sstevel@tonic-gate
12077c478bd9Sstevel@tonic-gate		See also CONNECTION CONTROL.
12087c478bd9Sstevel@tonic-gate
12097c478bd9Sstevel@tonic-gatemtamark		Experimental support for "Marking Mail Transfer Agents in
12107c478bd9Sstevel@tonic-gate		Reverse DNS with TXT RRs" (MTAMark), see
12117c478bd9Sstevel@tonic-gate		draft-stumpf-dns-mtamark-01.  Optional arguments are:
12127c478bd9Sstevel@tonic-gate
12137c478bd9Sstevel@tonic-gate		1. Error message, default:
12147c478bd9Sstevel@tonic-gate
12157c478bd9Sstevel@tonic-gate			550 Rejected: $&{client_addr} not listed as MTA
12167c478bd9Sstevel@tonic-gate
12177c478bd9Sstevel@tonic-gate		2. Temporary lookup failures are ignored unless a second
12187c478bd9Sstevel@tonic-gate		argument is given, which must be either `t' or a full
12197c478bd9Sstevel@tonic-gate		error message.
12207c478bd9Sstevel@tonic-gate
12217c478bd9Sstevel@tonic-gate		3. Lookup prefix, default: _perm._smtp._srv.  This should
12227c478bd9Sstevel@tonic-gate		not be changed unless the draft changes it.
12237c478bd9Sstevel@tonic-gate
12247c478bd9Sstevel@tonic-gate		Example:
12257c478bd9Sstevel@tonic-gate
12267c478bd9Sstevel@tonic-gate			FEATURE(`mtamark', `', `t')
12277c478bd9Sstevel@tonic-gate
12287c478bd9Sstevel@tonic-gatelookupdotdomain	Look up also .domain in the access map.  This allows to
12297c478bd9Sstevel@tonic-gate		match only subdomains.  It does not work well with
12307c478bd9Sstevel@tonic-gate		FEATURE(`relay_hosts_only'), because most lookups for
12317c478bd9Sstevel@tonic-gate		subdomains are suppressed by the latter feature.
12327c478bd9Sstevel@tonic-gate
12337c478bd9Sstevel@tonic-gateloose_relay_check
12347c478bd9Sstevel@tonic-gate		Normally, if % addressing is used for a recipient, e.g.
12357c478bd9Sstevel@tonic-gate		user%site@othersite, and othersite is in class {R}, the
12367c478bd9Sstevel@tonic-gate		check_rcpt ruleset will strip @othersite and recheck
12377c478bd9Sstevel@tonic-gate		user@site for relaying.  This feature changes that
12387c478bd9Sstevel@tonic-gate		behavior.  It should not be needed for most installations.
12397c478bd9Sstevel@tonic-gate
12407c478bd9Sstevel@tonic-gatepreserve_luser_host
12417c478bd9Sstevel@tonic-gate		Preserve the name of the recipient host if LUSER_RELAY is
12427c478bd9Sstevel@tonic-gate		used.  Without this option, the domain part of the
12437c478bd9Sstevel@tonic-gate		recipient address will be replaced by the host specified as
12447c478bd9Sstevel@tonic-gate		LUSER_RELAY.  This feature only works if the hostname is
12457c478bd9Sstevel@tonic-gate		passed to the mailer (see mailer triple in op.me).  Note
12467c478bd9Sstevel@tonic-gate		that in the default configuration the local mailer does not
12477c478bd9Sstevel@tonic-gate		receive the hostname, i.e., the mailer triple has an empty
12487c478bd9Sstevel@tonic-gate		hostname.
12497c478bd9Sstevel@tonic-gate
12507c478bd9Sstevel@tonic-gatepreserve_local_plus_detail
12517c478bd9Sstevel@tonic-gate		Preserve the +detail portion of the address when passing
12527c478bd9Sstevel@tonic-gate		address to local delivery agent.  Disables alias and
12537c478bd9Sstevel@tonic-gate		.forward +detail stripping (e.g., given user+detail, only
12547c478bd9Sstevel@tonic-gate		that address will be looked up in the alias file; user+* and
12557c478bd9Sstevel@tonic-gate		user will not be looked up).  Only use if the local
12567c478bd9Sstevel@tonic-gate		delivery agent in use supports +detail addressing.
12577c478bd9Sstevel@tonic-gate
12587c478bd9Sstevel@tonic-gatecompat_check	Enable ruleset check_compat to look up pairs of addresses
12597c478bd9Sstevel@tonic-gate		with the Compat: tag --	Compat:sender<@>recipient -- in the
12607c478bd9Sstevel@tonic-gate		access map.  Valid values for the RHS include
12617c478bd9Sstevel@tonic-gate			DISCARD	silently discard recipient
12627c478bd9Sstevel@tonic-gate			TEMP:	return a temporary error
12637c478bd9Sstevel@tonic-gate			ERROR:	return a permanent error
12647c478bd9Sstevel@tonic-gate		In the last two cases, a 4xy/5xy SMTP reply code should
12657c478bd9Sstevel@tonic-gate		follow the colon.
12667c478bd9Sstevel@tonic-gate
12677c478bd9Sstevel@tonic-gateno_default_msa	Don't generate the default MSA daemon, i.e.,
12687c478bd9Sstevel@tonic-gate		DAEMON_OPTIONS(`Port=587,Name=MSA,M=E')
12697c478bd9Sstevel@tonic-gate		To define a MSA daemon with other parameters, use this
12707c478bd9Sstevel@tonic-gate		FEATURE and introduce new settings via DAEMON_OPTIONS().
12717c478bd9Sstevel@tonic-gate
12727c478bd9Sstevel@tonic-gatemsp		Defines config file for Message Submission Program.
12737c478bd9Sstevel@tonic-gate		See cf/submit.mc for how
12747c478bd9Sstevel@tonic-gate		to use it.  An optional argument can be used to override
12757c478bd9Sstevel@tonic-gate		the default of `[localhost]' to use as host to send all
12767c478bd9Sstevel@tonic-gate		e-mails to.  Note that MX records will be used if the
12777c478bd9Sstevel@tonic-gate		specified hostname is not in square brackets (e.g.,
12787c478bd9Sstevel@tonic-gate		[hostname]).  If `MSA' is specified as second argument then
12797c478bd9Sstevel@tonic-gate		port 587 is used to contact the server.  Example:
12807c478bd9Sstevel@tonic-gate
12817c478bd9Sstevel@tonic-gate			FEATURE(`msp', `', `MSA')
12827c478bd9Sstevel@tonic-gate
12837c478bd9Sstevel@tonic-gate		Some more hints about possible changes can be found below
12847c478bd9Sstevel@tonic-gate		in the section MESSAGE SUBMISSION PROGRAM.
12857c478bd9Sstevel@tonic-gate
12867c478bd9Sstevel@tonic-gate		Note: Due to many problems, submit.mc uses
12877c478bd9Sstevel@tonic-gate
12887c478bd9Sstevel@tonic-gate			FEATURE(`msp', `[127.0.0.1]')
12897c478bd9Sstevel@tonic-gate
12907c478bd9Sstevel@tonic-gate		by default.  If you have a machine with IPv6 only,
12917c478bd9Sstevel@tonic-gate		change it to
12927c478bd9Sstevel@tonic-gate
12937c478bd9Sstevel@tonic-gate			FEATURE(`msp', `[IPv6:::1]')
12947c478bd9Sstevel@tonic-gate
12957c478bd9Sstevel@tonic-gate		If you want to continue using '[localhost]', (the behavior
12967c478bd9Sstevel@tonic-gate		up to 8.12.6), use
12977c478bd9Sstevel@tonic-gate
12987c478bd9Sstevel@tonic-gate			FEATURE(`msp')
12997c478bd9Sstevel@tonic-gate
13007c478bd9Sstevel@tonic-gatequeuegroup	A simple example how to select a queue group based
13017c478bd9Sstevel@tonic-gate		on the full e-mail address or the domain of the
13027c478bd9Sstevel@tonic-gate		recipient.  Selection is done via entries in the
13037c478bd9Sstevel@tonic-gate		access map using the tag QGRP:, for example:
13047c478bd9Sstevel@tonic-gate
13057c478bd9Sstevel@tonic-gate			QGRP:example.com	main
13067c478bd9Sstevel@tonic-gate			QGRP:friend@some.org	others
13077c478bd9Sstevel@tonic-gate			QGRP:my.domain		local
13087c478bd9Sstevel@tonic-gate
13097c478bd9Sstevel@tonic-gate		where "main", "others", and "local" are names of
13107c478bd9Sstevel@tonic-gate		queue groups.  If an argument is specified, it is used
13117c478bd9Sstevel@tonic-gate		as default queue group.
13127c478bd9Sstevel@tonic-gate
13137c478bd9Sstevel@tonic-gate		Note: please read the warning in doc/op/op.me about
13147c478bd9Sstevel@tonic-gate		queue groups and possible queue manipulations.
13157c478bd9Sstevel@tonic-gate
13167c478bd9Sstevel@tonic-gategreet_pause	Adds the greet_pause ruleset which enables open proxy
13177c478bd9Sstevel@tonic-gate		and SMTP slamming protection.  The feature can take an
13187c478bd9Sstevel@tonic-gate		argument specifying the milliseconds to wait:
13197c478bd9Sstevel@tonic-gate
13207c478bd9Sstevel@tonic-gate			FEATURE(`greet_pause', `5000')  dnl 5 seconds
13217c478bd9Sstevel@tonic-gate
13227c478bd9Sstevel@tonic-gate		If FEATURE(`access_db') is enabled, an access database
13237c478bd9Sstevel@tonic-gate		lookup with the GreetPause tag is done using client
13247c478bd9Sstevel@tonic-gate		hostname, domain, IP address, or subnet to determine the
13257c478bd9Sstevel@tonic-gate		pause time:
13267c478bd9Sstevel@tonic-gate
13277c478bd9Sstevel@tonic-gate			GreetPause:my.domain	0
13287c478bd9Sstevel@tonic-gate			GreetPause:example.com	5000
13297c478bd9Sstevel@tonic-gate			GreetPause:10.1.2	2000
13307c478bd9Sstevel@tonic-gate			GreetPause:127.0.0.1	0
13317c478bd9Sstevel@tonic-gate
13327c478bd9Sstevel@tonic-gate		When using FEATURE(`access_db'), the optional
13337c478bd9Sstevel@tonic-gate		FEATURE(`greet_pause') argument becomes the default if
13347c478bd9Sstevel@tonic-gate		nothing is found in the access database.  A ruleset called
13357c478bd9Sstevel@tonic-gate		Local_greet_pause can be used for local modifications, e.g.,
13367c478bd9Sstevel@tonic-gate
13377c478bd9Sstevel@tonic-gate			LOCAL_RULESETS
13387c478bd9Sstevel@tonic-gate			SLocal_greet_pause
13397c478bd9Sstevel@tonic-gate			R$*		$: $&{daemon_flags}
13407c478bd9Sstevel@tonic-gate			R$* a $*	$# 0
13417c478bd9Sstevel@tonic-gate
1342058561cbSjbeckblock_bad_helo	Reject messages from SMTP clients which provide a HELO/EHLO
1343058561cbSjbeck		argument which is either unqualified, or is one of our own
1344058561cbSjbeck		names (i.e., the server name instead of the client name).
13454aac33d3Sjbeck		This check is performed at RCPT stage and disabled for the
13464aac33d3Sjbeck		following cases:
13474aac33d3Sjbeck		- authenticated sessions,
13484aac33d3Sjbeck		- connections from IP addresses in class $={R}.
13494aac33d3Sjbeck		Currently access_db lookups can not be used to
13504aac33d3Sjbeck		(selectively) disable this test, moreover,
13514aac33d3Sjbeck		FEATURE(`delay_checks')
13524aac33d3Sjbeck		is required.
1353058561cbSjbeck
1354058561cbSjbeckrequire_rdns	Reject mail from connecting SMTP clients without proper
1355058561cbSjbeck		rDNS (reverse DNS), functional gethostbyaddr() resolution.
13564aac33d3Sjbeck		Note: this feature will cause false positives, i.e., there
13574aac33d3Sjbeck		are legitimate MTAs that do not have proper DNS entries.
13584aac33d3Sjbeck		Rejecting mails from those MTAs is a local policy decision.
1359058561cbSjbeck
1360058561cbSjbeck		The basic policy is to reject message with a 5xx error if
1361058561cbSjbeck		the IP address fails to resolve.  However, if this is a
1362058561cbSjbeck		temporary failure, a 4xx temporary failure is returned.
1363058561cbSjbeck		If the look-up succeeds, but returns an apparently forged
1364058561cbSjbeck		value, this is treated as a temporary failure with a 4xx
1365058561cbSjbeck		error code.
1366058561cbSjbeck
1367058561cbSjbeck		EXCEPTIONS:
1368058561cbSjbeck
1369058561cbSjbeck		Exceptions based on access entries are discussed below.
1370058561cbSjbeck		Any IP address matched using $=R (the "relay-domains" file)
1371058561cbSjbeck		is excepted from the rules.  Since we have explicitly
1372058561cbSjbeck		allowed relaying for this host, based on IP address, we
1373058561cbSjbeck		ignore the rDNS failure.
1374058561cbSjbeck
1375058561cbSjbeck		The philosophical assumption here is that most users do
1376058561cbSjbeck		not control their rDNS.  They should be able to send mail
1377058561cbSjbeck		through their ISP, whether or not they have valid rDNS.
1378058561cbSjbeck		The class $=R, roughly speaking, contains those IP addresses
1379058561cbSjbeck		and address ranges for which we are the ISP, or are acting
1380058561cbSjbeck		as if the ISP.
1381058561cbSjbeck
1382058561cbSjbeck		If `delay_checks' is in effect (recommended), then any
1383058561cbSjbeck		sender who has authenticated is also excepted from the
1384058561cbSjbeck		restrictions.  This happens because the rules produced by
1385058561cbSjbeck		this FEATURE() will not be applied to authenticated senders
1386058561cbSjbeck		(assuming `delay_checks').
1387058561cbSjbeck
1388058561cbSjbeck		ACCESS MAP ENTRIES:
1389058561cbSjbeck
1390058561cbSjbeck		Entries such as
1391058561cbSjbeck			Connect:1.2.3.4		OK
1392058561cbSjbeck			Connect:1.2		RELAY
1393058561cbSjbeck		will whitelist IP address 1.2.3.4, so that the rDNS
1394058561cbSjbeck		blocking does apply to that IP address
1395058561cbSjbeck
1396058561cbSjbeck		Entries such as
1397058561cbSjbeck			Connect:1.2.3.4		REJECT
1398058561cbSjbeck		will have the effect of forcing a temporary failure for
1399058561cbSjbeck		that address to be treated as a permanent failure.
1400058561cbSjbeck
1401058561cbSjbeckbadmx		Reject envelope sender addresses (MAIL) whose domain part
1402058561cbSjbeck		resolves to a "bad" MX record.  By default these are
1403058561cbSjbeck		MX records which resolve to A records that match the
1404058561cbSjbeck		regular expression:
1405058561cbSjbeck
1406058561cbSjbeck		^(127\.|10\.|0\.0\.0\.0)
1407058561cbSjbeck
1408058561cbSjbeck		This default regular expression can be overridden by
1409058561cbSjbeck		specifying an argument, e.g.,
1410058561cbSjbeck
1411058561cbSjbeck		FEATURE(`badmx', `^127\.0\.0\.1')
1412058561cbSjbeck
1413058561cbSjbeck		Note: this feature requires that the sendmail binary
1414058561cbSjbeck		has been compiled with the options MAP_REGEX and
1415058561cbSjbeck		DNSMAP.
1416058561cbSjbeck
14177c478bd9Sstevel@tonic-gate+--------------------+
14187c478bd9Sstevel@tonic-gate| USING UUCP MAILERS |
14197c478bd9Sstevel@tonic-gate+--------------------+
14207c478bd9Sstevel@tonic-gate
14217c478bd9Sstevel@tonic-gateIt's hard to get UUCP mailers right because of the extremely ad hoc
14227c478bd9Sstevel@tonic-gatenature of UUCP addressing.  These config files are really designed
14237c478bd9Sstevel@tonic-gatefor domain-based addressing, even for UUCP sites.
14247c478bd9Sstevel@tonic-gate
14257c478bd9Sstevel@tonic-gateThere are four UUCP mailers available.  The choice of which one to
14267c478bd9Sstevel@tonic-gateuse is partly a matter of local preferences and what is running at
14277c478bd9Sstevel@tonic-gatethe other end of your UUCP connection.  Unlike good protocols that
14287c478bd9Sstevel@tonic-gatedefine what will go over the wire, UUCP uses the policy that you
14297c478bd9Sstevel@tonic-gateshould do what is right for the other end; if they change, you have
14307c478bd9Sstevel@tonic-gateto change.  This makes it hard to do the right thing, and discourages
14317c478bd9Sstevel@tonic-gatepeople from updating their software.  In general, if you can avoid
14327c478bd9Sstevel@tonic-gateUUCP, please do.
14337c478bd9Sstevel@tonic-gate
14347c478bd9Sstevel@tonic-gateThe major choice is whether to go for a domainized scheme or a
14357c478bd9Sstevel@tonic-gatenon-domainized scheme.  This depends entirely on what the other
14367c478bd9Sstevel@tonic-gateend will recognize.  If at all possible, you should encourage the
14377c478bd9Sstevel@tonic-gateother end to go to a domain-based system -- non-domainized addresses
14387c478bd9Sstevel@tonic-gatedon't work entirely properly.
14397c478bd9Sstevel@tonic-gate
14407c478bd9Sstevel@tonic-gateThe four mailers are:
14417c478bd9Sstevel@tonic-gate
14427c478bd9Sstevel@tonic-gate    uucp-old (obsolete name: "uucp")
14437c478bd9Sstevel@tonic-gate	This is the oldest, the worst (but the closest to UUCP) way of
14447c478bd9Sstevel@tonic-gate	sending messages across UUCP connections.  It does bangify
14457c478bd9Sstevel@tonic-gate	everything and prepends $U (your UUCP name) to the sender's
14467c478bd9Sstevel@tonic-gate	address (which can already be a bang path itself).  It can
14477c478bd9Sstevel@tonic-gate	only send to one address at a time, so it spends a lot of
14487c478bd9Sstevel@tonic-gate	time copying duplicates of messages.  Avoid this if at all
14497c478bd9Sstevel@tonic-gate	possible.
14507c478bd9Sstevel@tonic-gate
14517c478bd9Sstevel@tonic-gate    uucp-new (obsolete name: "suucp")
14527c478bd9Sstevel@tonic-gate	The same as above, except that it assumes that in one rmail
14537c478bd9Sstevel@tonic-gate	command you can specify several recipients.  It still has a
14547c478bd9Sstevel@tonic-gate	lot of other problems.
14557c478bd9Sstevel@tonic-gate
14567c478bd9Sstevel@tonic-gate    uucp-dom
14577c478bd9Sstevel@tonic-gate	This UUCP mailer keeps everything as domain addresses.
14587c478bd9Sstevel@tonic-gate	Basically, it uses the SMTP mailer rewriting rules.  This mailer
14597c478bd9Sstevel@tonic-gate	is only included if MAILER(`smtp') is specified before
14607c478bd9Sstevel@tonic-gate	MAILER(`uucp').
14617c478bd9Sstevel@tonic-gate
14627c478bd9Sstevel@tonic-gate	Unfortunately, a lot of UUCP mailer transport agents require
14637c478bd9Sstevel@tonic-gate	bangified addresses in the envelope, although you can use
14647c478bd9Sstevel@tonic-gate	domain-based addresses in the message header.  (The envelope
14657c478bd9Sstevel@tonic-gate	shows up as the From_ line on UNIX mail.)  So....
14667c478bd9Sstevel@tonic-gate
14677c478bd9Sstevel@tonic-gate    uucp-uudom
14687c478bd9Sstevel@tonic-gate	This is a cross between uucp-new (for the envelope addresses)
14697c478bd9Sstevel@tonic-gate	and uucp-dom (for the header addresses).  It bangifies the
14707c478bd9Sstevel@tonic-gate	envelope sender (From_ line in messages) without adding the
14717c478bd9Sstevel@tonic-gate	local hostname, unless there is no host name on the address
14727c478bd9Sstevel@tonic-gate	at all (e.g., "wolf") or the host component is a UUCP host name
14737c478bd9Sstevel@tonic-gate	instead of a domain name ("somehost!wolf" instead of
14747c478bd9Sstevel@tonic-gate	"some.dom.ain!wolf").  This is also included only if MAILER(`smtp')
14757c478bd9Sstevel@tonic-gate	is also specified earlier.
14767c478bd9Sstevel@tonic-gate
14777c478bd9Sstevel@tonic-gateExamples:
14787c478bd9Sstevel@tonic-gate
14797c478bd9Sstevel@tonic-gateOn host grasp.insa-lyon.fr (UUCP host name "grasp"), the following
14807c478bd9Sstevel@tonic-gatesummarizes the sender rewriting for various mailers.
14817c478bd9Sstevel@tonic-gate
14827c478bd9Sstevel@tonic-gateMailer		sender		rewriting in the envelope
14837c478bd9Sstevel@tonic-gate------		------		-------------------------
14847c478bd9Sstevel@tonic-gateuucp-{old,new}	wolf		grasp!wolf
14857c478bd9Sstevel@tonic-gateuucp-dom	wolf		wolf@grasp.insa-lyon.fr
14867c478bd9Sstevel@tonic-gateuucp-uudom	wolf		grasp.insa-lyon.fr!wolf
14877c478bd9Sstevel@tonic-gate
14887c478bd9Sstevel@tonic-gateuucp-{old,new}	wolf@fr.net	grasp!fr.net!wolf
14897c478bd9Sstevel@tonic-gateuucp-dom	wolf@fr.net	wolf@fr.net
14907c478bd9Sstevel@tonic-gateuucp-uudom	wolf@fr.net	fr.net!wolf
14917c478bd9Sstevel@tonic-gate
14927c478bd9Sstevel@tonic-gateuucp-{old,new}	somehost!wolf	grasp!somehost!wolf
14937c478bd9Sstevel@tonic-gateuucp-dom	somehost!wolf	somehost!wolf@grasp.insa-lyon.fr
14947c478bd9Sstevel@tonic-gateuucp-uudom	somehost!wolf	grasp.insa-lyon.fr!somehost!wolf
14957c478bd9Sstevel@tonic-gate
14967c478bd9Sstevel@tonic-gateIf you are using one of the domainized UUCP mailers, you really want
14977c478bd9Sstevel@tonic-gateto convert all UUCP addresses to domain format -- otherwise, it will
14987c478bd9Sstevel@tonic-gatedo it for you (and probably not the way you expected).  For example,
14997c478bd9Sstevel@tonic-gateif you have the address foo!bar!baz (and you are not sending to foo),
15007c478bd9Sstevel@tonic-gatethe heuristics will add the @uucp.relay.name or @local.host.name to
15017c478bd9Sstevel@tonic-gatethis address.  However, if you map foo to foo.host.name first, it
15027c478bd9Sstevel@tonic-gatewill not add the local hostname.  You can do this using the uucpdomain
15037c478bd9Sstevel@tonic-gatefeature.
15047c478bd9Sstevel@tonic-gate
15057c478bd9Sstevel@tonic-gate
15067c478bd9Sstevel@tonic-gate+-------------------+
15077c478bd9Sstevel@tonic-gate| TWEAKING RULESETS |
15087c478bd9Sstevel@tonic-gate+-------------------+
15097c478bd9Sstevel@tonic-gate
15107c478bd9Sstevel@tonic-gateFor more complex configurations, you can define special rules.
15117c478bd9Sstevel@tonic-gateThe macro LOCAL_RULE_3 introduces rules that are used in canonicalizing
15127c478bd9Sstevel@tonic-gatethe names.  Any modifications made here are reflected in the header.
15137c478bd9Sstevel@tonic-gate
15147c478bd9Sstevel@tonic-gateA common use is to convert old UUCP addresses to SMTP addresses using
15157c478bd9Sstevel@tonic-gatethe UUCPSMTP macro.  For example:
15167c478bd9Sstevel@tonic-gate
15177c478bd9Sstevel@tonic-gate	LOCAL_RULE_3
15187c478bd9Sstevel@tonic-gate	UUCPSMTP(`decvax',	`decvax.dec.com')
15197c478bd9Sstevel@tonic-gate	UUCPSMTP(`research',	`research.att.com')
15207c478bd9Sstevel@tonic-gate
15217c478bd9Sstevel@tonic-gatewill cause addresses of the form "decvax!user" and "research!user"
15227c478bd9Sstevel@tonic-gateto be converted to "user@decvax.dec.com" and "user@research.att.com"
15237c478bd9Sstevel@tonic-gaterespectively.
15247c478bd9Sstevel@tonic-gate
15257c478bd9Sstevel@tonic-gateThis could also be used to look up hosts in a database map:
15267c478bd9Sstevel@tonic-gate
15277c478bd9Sstevel@tonic-gate	LOCAL_RULE_3
15287c478bd9Sstevel@tonic-gate	R$* < @ $+ > $*		$: $1 < @ $(hostmap $2 $) > $3
15297c478bd9Sstevel@tonic-gate
15307c478bd9Sstevel@tonic-gateThis map would be defined in the LOCAL_CONFIG portion, as shown below.
15317c478bd9Sstevel@tonic-gate
15327c478bd9Sstevel@tonic-gateSimilarly, LOCAL_RULE_0 can be used to introduce new parsing rules.
15337c478bd9Sstevel@tonic-gateFor example, new rules are needed to parse hostnames that you accept
15347c478bd9Sstevel@tonic-gatevia MX records.  For example, you might have:
15357c478bd9Sstevel@tonic-gate
15367c478bd9Sstevel@tonic-gate	LOCAL_RULE_0
15377c478bd9Sstevel@tonic-gate	R$+ <@ host.dom.ain.>	$#uucp $@ cnmat $: $1 < @ host.dom.ain.>
15387c478bd9Sstevel@tonic-gate
15397c478bd9Sstevel@tonic-gateYou would use this if you had installed an MX record for cnmat.Berkeley.EDU
15407c478bd9Sstevel@tonic-gatepointing at this host; this rule catches the message and forwards it on
15417c478bd9Sstevel@tonic-gateusing UUCP.
15427c478bd9Sstevel@tonic-gate
15437c478bd9Sstevel@tonic-gateYou can also tweak rulesets 1 and 2 using LOCAL_RULE_1 and LOCAL_RULE_2.
15447c478bd9Sstevel@tonic-gateThese rulesets are normally empty.
15457c478bd9Sstevel@tonic-gate
15467c478bd9Sstevel@tonic-gateA similar macro is LOCAL_CONFIG.  This introduces lines added after the
15477c478bd9Sstevel@tonic-gateboilerplate option setting but before rulesets.  Do not declare rulesets in
15487c478bd9Sstevel@tonic-gatethe LOCAL_CONFIG section.  It can be used to declare local database maps or
15497c478bd9Sstevel@tonic-gatewhatever.  For example:
15507c478bd9Sstevel@tonic-gate
15517c478bd9Sstevel@tonic-gate	LOCAL_CONFIG
15527c478bd9Sstevel@tonic-gate	Khostmap hash /etc/mail/hostmap
15537c478bd9Sstevel@tonic-gate	Kyplocal nis -m hosts.byname
15547c478bd9Sstevel@tonic-gate
15557c478bd9Sstevel@tonic-gate
15567c478bd9Sstevel@tonic-gate+---------------------------+
15577c478bd9Sstevel@tonic-gate| MASQUERADING AND RELAYING |
15587c478bd9Sstevel@tonic-gate+---------------------------+
15597c478bd9Sstevel@tonic-gate
15607c478bd9Sstevel@tonic-gateYou can have your host masquerade as another using
15617c478bd9Sstevel@tonic-gate
15627c478bd9Sstevel@tonic-gate	MASQUERADE_AS(`host.domain')
15637c478bd9Sstevel@tonic-gate
15647c478bd9Sstevel@tonic-gateThis causes mail being sent to be labeled as coming from the
15657c478bd9Sstevel@tonic-gateindicated host.domain, rather than $j.  One normally masquerades as
15667c478bd9Sstevel@tonic-gateone of one's own subdomains (for example, it's unlikely that
15677c478bd9Sstevel@tonic-gateBerkeley would choose to masquerade as an MIT site).  This
15687c478bd9Sstevel@tonic-gatebehaviour is modified by a plethora of FEATUREs; in particular, see
15697c478bd9Sstevel@tonic-gatemasquerade_envelope, allmasquerade, limited_masquerade, and
15707c478bd9Sstevel@tonic-gatemasquerade_entire_domain.
15717c478bd9Sstevel@tonic-gate
15727c478bd9Sstevel@tonic-gateThe masquerade name is not normally canonified, so it is important
15737c478bd9Sstevel@tonic-gatethat it be your One True Name, that is, fully qualified and not a
15747c478bd9Sstevel@tonic-gateCNAME.  However, if you use a CNAME, the receiving side may canonify
15757c478bd9Sstevel@tonic-gateit for you, so don't think you can cheat CNAME mapping this way.
15767c478bd9Sstevel@tonic-gate
15777c478bd9Sstevel@tonic-gateNormally the only addresses that are masqueraded are those that come
15787c478bd9Sstevel@tonic-gatefrom this host (that is, are either unqualified or in class {w}, the list
15797c478bd9Sstevel@tonic-gateof local domain names).  You can augment this list, which is realized
15807c478bd9Sstevel@tonic-gateby class {M} using
15817c478bd9Sstevel@tonic-gate
15827c478bd9Sstevel@tonic-gate	MASQUERADE_DOMAIN(`otherhost.domain')
15837c478bd9Sstevel@tonic-gate
15847c478bd9Sstevel@tonic-gateThe effect of this is that although mail to user@otherhost.domain
15857c478bd9Sstevel@tonic-gatewill not be delivered locally, any mail including any user@otherhost.domain
15867c478bd9Sstevel@tonic-gatewill, when relayed, be rewritten to have the MASQUERADE_AS address.
15877c478bd9Sstevel@tonic-gateThis can be a space-separated list of names.
15887c478bd9Sstevel@tonic-gate
15897c478bd9Sstevel@tonic-gateIf these names are in a file, you can use
15907c478bd9Sstevel@tonic-gate
15917c478bd9Sstevel@tonic-gate	MASQUERADE_DOMAIN_FILE(`filename')
15927c478bd9Sstevel@tonic-gate
15937c478bd9Sstevel@tonic-gateto read the list of names from the indicated file (i.e., to add
15947c478bd9Sstevel@tonic-gateelements to class {M}).
15957c478bd9Sstevel@tonic-gate
15967c478bd9Sstevel@tonic-gateTo exempt hosts or subdomains from being masqueraded, you can use
15977c478bd9Sstevel@tonic-gate
15987c478bd9Sstevel@tonic-gate	MASQUERADE_EXCEPTION(`host.domain')
15997c478bd9Sstevel@tonic-gate
16007c478bd9Sstevel@tonic-gateThis can come handy if you want to masquerade a whole domain
16017c478bd9Sstevel@tonic-gateexcept for one (or a few) host(s).  If these names are in a file,
16027c478bd9Sstevel@tonic-gateyou can use
16037c478bd9Sstevel@tonic-gate
16047c478bd9Sstevel@tonic-gate	MASQUERADE_EXCEPTION_FILE(`filename')
16057c478bd9Sstevel@tonic-gate
16067c478bd9Sstevel@tonic-gateNormally only header addresses are masqueraded.  If you want to
16077c478bd9Sstevel@tonic-gatemasquerade the envelope as well, use
16087c478bd9Sstevel@tonic-gate
16097c478bd9Sstevel@tonic-gate	FEATURE(`masquerade_envelope')
16107c478bd9Sstevel@tonic-gate
16117c478bd9Sstevel@tonic-gateThere are always users that need to be "exposed" -- that is, their
16127c478bd9Sstevel@tonic-gateinternal site name should be displayed instead of the masquerade name.
16137c478bd9Sstevel@tonic-gateRoot is an example (which has been "exposed" by default prior to 8.10).
16147c478bd9Sstevel@tonic-gateYou can add users to this list using
16157c478bd9Sstevel@tonic-gate
16167c478bd9Sstevel@tonic-gate	EXPOSED_USER(`usernames')
16177c478bd9Sstevel@tonic-gate
16187c478bd9Sstevel@tonic-gateThis adds users to class {E}; you could also use
16197c478bd9Sstevel@tonic-gate
16207c478bd9Sstevel@tonic-gate	EXPOSED_USER_FILE(`filename')
16217c478bd9Sstevel@tonic-gate
16227c478bd9Sstevel@tonic-gateYou can also arrange to relay all unqualified names (that is, names
16237c478bd9Sstevel@tonic-gatewithout @host) to a relay host.  For example, if you have a central
16247c478bd9Sstevel@tonic-gateemail server, you might relay to that host so that users don't have
16257c478bd9Sstevel@tonic-gateto have .forward files or aliases.  You can do this using
16267c478bd9Sstevel@tonic-gate
16277c478bd9Sstevel@tonic-gate	define(`LOCAL_RELAY', `mailer:hostname')
16287c478bd9Sstevel@tonic-gate
16297c478bd9Sstevel@tonic-gateThe ``mailer:'' can be omitted, in which case the mailer defaults to
16307c478bd9Sstevel@tonic-gate"relay".  There are some user names that you don't want relayed, perhaps
16317c478bd9Sstevel@tonic-gatebecause of local aliases.  A common example is root, which may be
16327c478bd9Sstevel@tonic-gatelocally aliased.  You can add entries to this list using
16337c478bd9Sstevel@tonic-gate
16347c478bd9Sstevel@tonic-gate	LOCAL_USER(`usernames')
16357c478bd9Sstevel@tonic-gate
16367c478bd9Sstevel@tonic-gateThis adds users to class {L}; you could also use
16377c478bd9Sstevel@tonic-gate
16387c478bd9Sstevel@tonic-gate	LOCAL_USER_FILE(`filename')
16397c478bd9Sstevel@tonic-gate
16407c478bd9Sstevel@tonic-gateIf you want all incoming mail sent to a centralized hub, as for a
16417c478bd9Sstevel@tonic-gateshared /var/spool/mail scheme, use
16427c478bd9Sstevel@tonic-gate
16437c478bd9Sstevel@tonic-gate	define(`MAIL_HUB', `mailer:hostname')
16447c478bd9Sstevel@tonic-gate
16457c478bd9Sstevel@tonic-gateAgain, ``mailer:'' defaults to "relay".  If you define both LOCAL_RELAY
16467c478bd9Sstevel@tonic-gateand MAIL_HUB _AND_ you have FEATURE(`stickyhost'), unqualified names will
16477c478bd9Sstevel@tonic-gatebe sent to the LOCAL_RELAY and other local names will be sent to MAIL_HUB.
16487c478bd9Sstevel@tonic-gateNote: there is a (long standing) bug which keeps this combination from
16497c478bd9Sstevel@tonic-gateworking for addresses of the form user+detail.
16507c478bd9Sstevel@tonic-gateNames in class {L} will be delivered locally, so you MUST have aliases or
16517c478bd9Sstevel@tonic-gate.forward files for them.
16527c478bd9Sstevel@tonic-gate
16537c478bd9Sstevel@tonic-gateFor example, if you are on machine mastodon.CS.Berkeley.EDU and you have
16547c478bd9Sstevel@tonic-gateFEATURE(`stickyhost'), the following combinations of settings will have the
16557c478bd9Sstevel@tonic-gateindicated effects:
16567c478bd9Sstevel@tonic-gate
16577c478bd9Sstevel@tonic-gateemail sent to....	eric			  eric@mastodon.CS.Berkeley.EDU
16587c478bd9Sstevel@tonic-gate
16597c478bd9Sstevel@tonic-gateLOCAL_RELAY set to	mail.CS.Berkeley.EDU	  (delivered locally)
16607c478bd9Sstevel@tonic-gatemail.CS.Berkeley.EDU	  (no local aliasing)	    (aliasing done)
16617c478bd9Sstevel@tonic-gate
16627c478bd9Sstevel@tonic-gateMAIL_HUB set to		mammoth.CS.Berkeley.EDU	  mammoth.CS.Berkeley.EDU
16637c478bd9Sstevel@tonic-gatemammoth.CS.Berkeley.EDU	  (aliasing done)	    (aliasing done)
16647c478bd9Sstevel@tonic-gate
16657c478bd9Sstevel@tonic-gateBoth LOCAL_RELAY and	mail.CS.Berkeley.EDU	  mammoth.CS.Berkeley.EDU
16667c478bd9Sstevel@tonic-gateMAIL_HUB set as above	  (no local aliasing)	    (aliasing done)
16677c478bd9Sstevel@tonic-gate
16687c478bd9Sstevel@tonic-gateIf you do not have FEATURE(`stickyhost') set, then LOCAL_RELAY and
16697c478bd9Sstevel@tonic-gateMAIL_HUB act identically, with MAIL_HUB taking precedence.
16707c478bd9Sstevel@tonic-gate
16717c478bd9Sstevel@tonic-gateIf you want all outgoing mail to go to a central relay site, define
16727c478bd9Sstevel@tonic-gateSMART_HOST as well.  Briefly:
16737c478bd9Sstevel@tonic-gate
16747c478bd9Sstevel@tonic-gate	LOCAL_RELAY applies to unqualified names (e.g., "eric").
16757c478bd9Sstevel@tonic-gate	MAIL_HUB applies to names qualified with the name of the
16767c478bd9Sstevel@tonic-gate		local host (e.g., "eric@mastodon.CS.Berkeley.EDU").
16777c478bd9Sstevel@tonic-gate	SMART_HOST applies to names qualified with other hosts or
16787c478bd9Sstevel@tonic-gate		bracketed addresses (e.g., "eric@mastodon.CS.Berkeley.EDU"
16797c478bd9Sstevel@tonic-gate		or "eric@[127.0.0.1]").
16807c478bd9Sstevel@tonic-gate
16817c478bd9Sstevel@tonic-gateHowever, beware that other relays (e.g., UUCP_RELAY, BITNET_RELAY,
16827c478bd9Sstevel@tonic-gateDECNET_RELAY, and FAX_RELAY) take precedence over SMART_HOST, so if you
16837c478bd9Sstevel@tonic-gatereally want absolutely everything to go to a single central site you will
16847c478bd9Sstevel@tonic-gateneed to unset all the other relays -- or better yet, find or build a
16857c478bd9Sstevel@tonic-gateminimal config file that does this.
16867c478bd9Sstevel@tonic-gate
16877c478bd9Sstevel@tonic-gateFor duplicate suppression to work properly, the host name is best
16887c478bd9Sstevel@tonic-gatespecified with a terminal dot:
16897c478bd9Sstevel@tonic-gate
16907c478bd9Sstevel@tonic-gate	define(`MAIL_HUB', `host.domain.')
16917c478bd9Sstevel@tonic-gate	      note the trailing dot ---^
16927c478bd9Sstevel@tonic-gate
16937c478bd9Sstevel@tonic-gate
16947c478bd9Sstevel@tonic-gate+-------------------------------------------+
16957c478bd9Sstevel@tonic-gate| USING LDAP FOR ALIASES, MAPS, AND CLASSES |
16967c478bd9Sstevel@tonic-gate+-------------------------------------------+
16977c478bd9Sstevel@tonic-gate
16987c478bd9Sstevel@tonic-gateLDAP can be used for aliases, maps, and classes by either specifying your
16997c478bd9Sstevel@tonic-gateown LDAP map specification or using the built-in default LDAP map
17007c478bd9Sstevel@tonic-gatespecification.  The built-in default specifications all provide lookups
17017c478bd9Sstevel@tonic-gatewhich match against either the machine's fully qualified hostname (${j}) or
17027c478bd9Sstevel@tonic-gatea "cluster".  The cluster allows you to share LDAP entries among a large
17037c478bd9Sstevel@tonic-gatenumber of machines without having to enter each of the machine names into
17047c478bd9Sstevel@tonic-gateeach LDAP entry.  To set the LDAP cluster name to use for a particular
17057c478bd9Sstevel@tonic-gatemachine or set of machines, set the confLDAP_CLUSTER m4 variable to a
17067c478bd9Sstevel@tonic-gateunique name.  For example:
17077c478bd9Sstevel@tonic-gate
17087c478bd9Sstevel@tonic-gate	define(`confLDAP_CLUSTER', `Servers')
17097c478bd9Sstevel@tonic-gate
17107c478bd9Sstevel@tonic-gateHere, the word `Servers' will be the cluster name.  As an example, assume
17117c478bd9Sstevel@tonic-gatethat smtp.sendmail.org, etrn.sendmail.org, and mx.sendmail.org all belong
17127c478bd9Sstevel@tonic-gateto the Servers cluster.
17137c478bd9Sstevel@tonic-gate
17147c478bd9Sstevel@tonic-gateSome of the LDAP LDIF examples below show use of the Servers cluster.
17157c478bd9Sstevel@tonic-gateEvery entry must have either a sendmailMTAHost or sendmailMTACluster
17167c478bd9Sstevel@tonic-gateattribute or it will be ignored.  Be careful as mixing clusters and
17177c478bd9Sstevel@tonic-gateindividual host records can have surprising results (see the CAUTION
17187c478bd9Sstevel@tonic-gatesections below).
17197c478bd9Sstevel@tonic-gate
17207c478bd9Sstevel@tonic-gateSee the file cf/sendmail.schema for the actual LDAP schemas.  Note that
17217c478bd9Sstevel@tonic-gatethis schema (and therefore the lookups and examples below) is experimental
17227c478bd9Sstevel@tonic-gateat this point as it has had little public review.  Therefore, it may change
172349218d4fSjbeckin future versions.  Feedback via sendmail-YYYY@support.sendmail.org is
172449218d4fSjbeckencouraged (replace YYYY with the current year, e.g., 2005).
17257c478bd9Sstevel@tonic-gate
17267c478bd9Sstevel@tonic-gate-------
17277c478bd9Sstevel@tonic-gateAliases
17287c478bd9Sstevel@tonic-gate-------
17297c478bd9Sstevel@tonic-gate
17307c478bd9Sstevel@tonic-gateThe ALIAS_FILE (O AliasFile) option can be set to use LDAP for alias
17317c478bd9Sstevel@tonic-gatelookups.  To use the default schema, simply use:
17327c478bd9Sstevel@tonic-gate
17337c478bd9Sstevel@tonic-gate	define(`ALIAS_FILE', `ldap:')
17347c478bd9Sstevel@tonic-gate
17357c478bd9Sstevel@tonic-gateBy doing so, you will use the default schema which expands to a map
17367c478bd9Sstevel@tonic-gatedeclared as follows:
17377c478bd9Sstevel@tonic-gate
17387c478bd9Sstevel@tonic-gate	ldap -k (&(objectClass=sendmailMTAAliasObject)
17397c478bd9Sstevel@tonic-gate		  (sendmailMTAAliasGrouping=aliases)
17407c478bd9Sstevel@tonic-gate		  (|(sendmailMTACluster=${sendmailMTACluster})
17417c478bd9Sstevel@tonic-gate		    (sendmailMTAHost=$j))
17427c478bd9Sstevel@tonic-gate		  (sendmailMTAKey=%0))
17437c478bd9Sstevel@tonic-gate	     -v sendmailMTAAliasValue,sendmailMTAAliasSearch:FILTER:sendmailMTAAliasObject,sendmailMTAAliasURL:URL:sendmailMTAAliasObject
17447c478bd9Sstevel@tonic-gate
17457c478bd9Sstevel@tonic-gate
17467c478bd9Sstevel@tonic-gateNOTE: The macros shown above ${sendmailMTACluster} and $j are not actually
17477c478bd9Sstevel@tonic-gateused when the binary expands the `ldap:' token as the AliasFile option is
17487c478bd9Sstevel@tonic-gatenot actually macro-expanded when read from the sendmail.cf file.
17497c478bd9Sstevel@tonic-gate
17507c478bd9Sstevel@tonic-gateExample LDAP LDIF entries might be:
17517c478bd9Sstevel@tonic-gate
17527c478bd9Sstevel@tonic-gate	dn: sendmailMTAKey=sendmail-list, dc=sendmail, dc=org
17537c478bd9Sstevel@tonic-gate	objectClass: sendmailMTA
17547c478bd9Sstevel@tonic-gate	objectClass: sendmailMTAAlias
17557c478bd9Sstevel@tonic-gate	objectClass: sendmailMTAAliasObject
17567c478bd9Sstevel@tonic-gate	sendmailMTAAliasGrouping: aliases
17577c478bd9Sstevel@tonic-gate	sendmailMTAHost: etrn.sendmail.org
17587c478bd9Sstevel@tonic-gate	sendmailMTAKey: sendmail-list
17597c478bd9Sstevel@tonic-gate	sendmailMTAAliasValue: ca@example.org
17607c478bd9Sstevel@tonic-gate	sendmailMTAAliasValue: eric
17617c478bd9Sstevel@tonic-gate	sendmailMTAAliasValue: gshapiro@example.com
17627c478bd9Sstevel@tonic-gate
17637c478bd9Sstevel@tonic-gate	dn: sendmailMTAKey=owner-sendmail-list, dc=sendmail, dc=org
17647c478bd9Sstevel@tonic-gate	objectClass: sendmailMTA
17657c478bd9Sstevel@tonic-gate	objectClass: sendmailMTAAlias
17667c478bd9Sstevel@tonic-gate	objectClass: sendmailMTAAliasObject
17677c478bd9Sstevel@tonic-gate	sendmailMTAAliasGrouping: aliases
17687c478bd9Sstevel@tonic-gate	sendmailMTAHost: etrn.sendmail.org
17697c478bd9Sstevel@tonic-gate	sendmailMTAKey: owner-sendmail-list
17707c478bd9Sstevel@tonic-gate	sendmailMTAAliasValue: eric
17717c478bd9Sstevel@tonic-gate
17727c478bd9Sstevel@tonic-gate	dn: sendmailMTAKey=postmaster, dc=sendmail, dc=org
17737c478bd9Sstevel@tonic-gate	objectClass: sendmailMTA
17747c478bd9Sstevel@tonic-gate	objectClass: sendmailMTAAlias
17757c478bd9Sstevel@tonic-gate	objectClass: sendmailMTAAliasObject
17767c478bd9Sstevel@tonic-gate	sendmailMTAAliasGrouping: aliases
17777c478bd9Sstevel@tonic-gate	sendmailMTACluster: Servers
17787c478bd9Sstevel@tonic-gate	sendmailMTAKey: postmaster
17797c478bd9Sstevel@tonic-gate	sendmailMTAAliasValue: eric
17807c478bd9Sstevel@tonic-gate
17817c478bd9Sstevel@tonic-gateHere, the aliases sendmail-list and owner-sendmail-list will be available
17827c478bd9Sstevel@tonic-gateonly on etrn.sendmail.org but the postmaster alias will be available on
17837c478bd9Sstevel@tonic-gateevery machine in the Servers cluster (including etrn.sendmail.org).
17847c478bd9Sstevel@tonic-gate
17857c478bd9Sstevel@tonic-gateCAUTION: aliases are additive so that entries like these:
17867c478bd9Sstevel@tonic-gate
17877c478bd9Sstevel@tonic-gate	dn: sendmailMTAKey=bob, dc=sendmail, dc=org
17887c478bd9Sstevel@tonic-gate	objectClass: sendmailMTA
17897c478bd9Sstevel@tonic-gate	objectClass: sendmailMTAAlias
17907c478bd9Sstevel@tonic-gate	objectClass: sendmailMTAAliasObject
17917c478bd9Sstevel@tonic-gate	sendmailMTAAliasGrouping: aliases
17927c478bd9Sstevel@tonic-gate	sendmailMTACluster: Servers
17937c478bd9Sstevel@tonic-gate	sendmailMTAKey: bob
17947c478bd9Sstevel@tonic-gate	sendmailMTAAliasValue: eric
17957c478bd9Sstevel@tonic-gate
17967c478bd9Sstevel@tonic-gate	dn: sendmailMTAKey=bobetrn, dc=sendmail, dc=org
17977c478bd9Sstevel@tonic-gate	objectClass: sendmailMTA
17987c478bd9Sstevel@tonic-gate	objectClass: sendmailMTAAlias
17997c478bd9Sstevel@tonic-gate	objectClass: sendmailMTAAliasObject
18007c478bd9Sstevel@tonic-gate	sendmailMTAAliasGrouping: aliases
18017c478bd9Sstevel@tonic-gate	sendmailMTAHost: etrn.sendmail.org
18027c478bd9Sstevel@tonic-gate	sendmailMTAKey: bob
18037c478bd9Sstevel@tonic-gate	sendmailMTAAliasValue: gshapiro
18047c478bd9Sstevel@tonic-gate
18057c478bd9Sstevel@tonic-gatewould mean that on all of the hosts in the cluster, mail to bob would go to
18067c478bd9Sstevel@tonic-gateeric EXCEPT on etrn.sendmail.org in which case it would go to BOTH eric and
18077c478bd9Sstevel@tonic-gategshapiro.
18087c478bd9Sstevel@tonic-gate
18097c478bd9Sstevel@tonic-gateIf you prefer not to use the default LDAP schema for your aliases, you can
18107c478bd9Sstevel@tonic-gatespecify the map parameters when setting ALIAS_FILE.  For example:
18117c478bd9Sstevel@tonic-gate
18127c478bd9Sstevel@tonic-gate	define(`ALIAS_FILE', `ldap:-k (&(objectClass=mailGroup)(mail=%0)) -v mgrpRFC822MailMember')
18137c478bd9Sstevel@tonic-gate
18147c478bd9Sstevel@tonic-gate----
18157c478bd9Sstevel@tonic-gateMaps
18167c478bd9Sstevel@tonic-gate----
18177c478bd9Sstevel@tonic-gate
18187c478bd9Sstevel@tonic-gateFEATURE()'s which take an optional map definition argument (e.g., access,
18197c478bd9Sstevel@tonic-gatemailertable, virtusertable, etc.) can instead take the special keyword
18207c478bd9Sstevel@tonic-gate`LDAP', e.g.:
18217c478bd9Sstevel@tonic-gate
18227c478bd9Sstevel@tonic-gate	FEATURE(`access_db', `LDAP')
18237c478bd9Sstevel@tonic-gate	FEATURE(`virtusertable', `LDAP')
18247c478bd9Sstevel@tonic-gate
18257c478bd9Sstevel@tonic-gateWhen this keyword is given, that map will use LDAP lookups consisting of
18267c478bd9Sstevel@tonic-gatethe objectClass sendmailMTAClassObject, the attribute sendmailMTAMapName
18277c478bd9Sstevel@tonic-gatewith the map name, a search attribute of sendmailMTAKey, and the value
18287c478bd9Sstevel@tonic-gateattribute sendmailMTAMapValue.
18297c478bd9Sstevel@tonic-gate
18307c478bd9Sstevel@tonic-gateThe values for sendmailMTAMapName are:
18317c478bd9Sstevel@tonic-gate
18327c478bd9Sstevel@tonic-gate	FEATURE()		sendmailMTAMapName
18337c478bd9Sstevel@tonic-gate	---------		------------------
18347c478bd9Sstevel@tonic-gate	access_db		access
18357c478bd9Sstevel@tonic-gate	authinfo		authinfo
18367c478bd9Sstevel@tonic-gate	bitdomain		bitdomain
18377c478bd9Sstevel@tonic-gate	domaintable		domain
18387c478bd9Sstevel@tonic-gate	genericstable		generics
18397c478bd9Sstevel@tonic-gate	mailertable		mailer
18407c478bd9Sstevel@tonic-gate	uucpdomain		uucpdomain
18417c478bd9Sstevel@tonic-gate	virtusertable		virtuser
18427c478bd9Sstevel@tonic-gate
18437c478bd9Sstevel@tonic-gateFor example, FEATURE(`mailertable', `LDAP') would use the map definition:
18447c478bd9Sstevel@tonic-gate
18457c478bd9Sstevel@tonic-gate	Kmailertable ldap -k (&(objectClass=sendmailMTAMapObject)
18467c478bd9Sstevel@tonic-gate			       (sendmailMTAMapName=mailer)
18477c478bd9Sstevel@tonic-gate			       (|(sendmailMTACluster=${sendmailMTACluster})
18487c478bd9Sstevel@tonic-gate				 (sendmailMTAHost=$j))
18497c478bd9Sstevel@tonic-gate			       (sendmailMTAKey=%0))
18507c478bd9Sstevel@tonic-gate			  -1 -v sendmailMTAMapValue,sendmailMTAMapSearch:FILTER:sendmailMTAMapObject,sendmailMTAMapURL:URL:sendmailMTAMapObject
18517c478bd9Sstevel@tonic-gate
18527c478bd9Sstevel@tonic-gateAn example LDAP LDIF entry using this map might be:
18537c478bd9Sstevel@tonic-gate
18547c478bd9Sstevel@tonic-gate	dn: sendmailMTAMapName=mailer, dc=sendmail, dc=org
18557c478bd9Sstevel@tonic-gate	objectClass: sendmailMTA
18567c478bd9Sstevel@tonic-gate	objectClass: sendmailMTAMap
18577c478bd9Sstevel@tonic-gate	sendmailMTACluster: Servers
18587c478bd9Sstevel@tonic-gate	sendmailMTAMapName: mailer
18597c478bd9Sstevel@tonic-gate
18607c478bd9Sstevel@tonic-gate	dn: sendmailMTAKey=example.com, sendmailMTAMapName=mailer, dc=sendmail, dc=org
18617c478bd9Sstevel@tonic-gate	objectClass: sendmailMTA
18627c478bd9Sstevel@tonic-gate	objectClass: sendmailMTAMap
18637c478bd9Sstevel@tonic-gate	objectClass: sendmailMTAMapObject
18647c478bd9Sstevel@tonic-gate	sendmailMTAMapName: mailer
18657c478bd9Sstevel@tonic-gate	sendmailMTACluster: Servers
18667c478bd9Sstevel@tonic-gate	sendmailMTAKey: example.com
18677c478bd9Sstevel@tonic-gate	sendmailMTAMapValue: relay:[smtp.example.com]
18687c478bd9Sstevel@tonic-gate
18697c478bd9Sstevel@tonic-gateCAUTION: If your LDAP database contains the record above and *ALSO* a host
18707c478bd9Sstevel@tonic-gatespecific record such as:
18717c478bd9Sstevel@tonic-gate
18727c478bd9Sstevel@tonic-gate	dn: sendmailMTAKey=example.com@etrn, sendmailMTAMapName=mailer, dc=sendmail, dc=org
18737c478bd9Sstevel@tonic-gate	objectClass: sendmailMTA
18747c478bd9Sstevel@tonic-gate	objectClass: sendmailMTAMap
18757c478bd9Sstevel@tonic-gate	objectClass: sendmailMTAMapObject
18767c478bd9Sstevel@tonic-gate	sendmailMTAMapName: mailer
18777c478bd9Sstevel@tonic-gate	sendmailMTAHost: etrn.sendmail.org
18787c478bd9Sstevel@tonic-gate	sendmailMTAKey: example.com
18797c478bd9Sstevel@tonic-gate	sendmailMTAMapValue: relay:[mx.example.com]
18807c478bd9Sstevel@tonic-gate
18817c478bd9Sstevel@tonic-gatethen these entries will give unexpected results.  When the lookup is done
18827c478bd9Sstevel@tonic-gateon etrn.sendmail.org, the effect is that there is *NO* match at all as maps
18837c478bd9Sstevel@tonic-gaterequire a single match.  Since the host etrn.sendmail.org is also in the
18847c478bd9Sstevel@tonic-gateServers cluster, LDAP would return two answers for the example.com map key
18857c478bd9Sstevel@tonic-gatein which case sendmail would treat this as no match at all.
18867c478bd9Sstevel@tonic-gate
18877c478bd9Sstevel@tonic-gateIf you prefer not to use the default LDAP schema for your maps, you can
18887c478bd9Sstevel@tonic-gatespecify the map parameters when using the FEATURE().  For example:
18897c478bd9Sstevel@tonic-gate
18907c478bd9Sstevel@tonic-gate	FEATURE(`access_db', `ldap:-1 -k (&(objectClass=mapDatabase)(key=%0)) -v value')
18917c478bd9Sstevel@tonic-gate
18927c478bd9Sstevel@tonic-gate-------
18937c478bd9Sstevel@tonic-gateClasses
18947c478bd9Sstevel@tonic-gate-------
18957c478bd9Sstevel@tonic-gate
18967c478bd9Sstevel@tonic-gateNormally, classes can be filled via files or programs.  As of 8.12, they
18977c478bd9Sstevel@tonic-gatecan also be filled via map lookups using a new syntax:
18987c478bd9Sstevel@tonic-gate
18997c478bd9Sstevel@tonic-gate	F{ClassName}mapkey@mapclass:mapspec
19007c478bd9Sstevel@tonic-gate
19017c478bd9Sstevel@tonic-gatemapkey is optional and if not provided the map key will be empty.  This can
19027c478bd9Sstevel@tonic-gatebe used with LDAP to read classes from LDAP.  Note that the lookup is only
19037c478bd9Sstevel@tonic-gatedone when sendmail is initially started.  Use the special value `@LDAP' to
19047c478bd9Sstevel@tonic-gateuse the default LDAP schema.  For example:
19057c478bd9Sstevel@tonic-gate
19067c478bd9Sstevel@tonic-gate	RELAY_DOMAIN_FILE(`@LDAP')
19077c478bd9Sstevel@tonic-gate
19087c478bd9Sstevel@tonic-gatewould put all of the attribute sendmailMTAClassValue values of LDAP records
19097c478bd9Sstevel@tonic-gatewith objectClass sendmailMTAClass and an attribute sendmailMTAClassName of
19107c478bd9Sstevel@tonic-gate'R' into class $={R}.  In other words, it is equivalent to the LDAP map
19117c478bd9Sstevel@tonic-gatespecification:
19127c478bd9Sstevel@tonic-gate
19137c478bd9Sstevel@tonic-gate	F{R}@ldap:-k (&(objectClass=sendmailMTAClass)
19147c478bd9Sstevel@tonic-gate		       (sendmailMTAClassName=R)
19157c478bd9Sstevel@tonic-gate		       (|(sendmailMTACluster=${sendmailMTACluster})
19167c478bd9Sstevel@tonic-gate			 (sendmailMTAHost=$j)))
19177c478bd9Sstevel@tonic-gate		  -v sendmailMTAClassValue,sendmailMTAClassSearch:FILTER:sendmailMTAClass,sendmailMTAClassURL:URL:sendmailMTAClass
19187c478bd9Sstevel@tonic-gate
19197c478bd9Sstevel@tonic-gateNOTE: The macros shown above ${sendmailMTACluster} and $j are not actually
19207c478bd9Sstevel@tonic-gateused when the binary expands the `@LDAP' token as class declarations are
19217c478bd9Sstevel@tonic-gatenot actually macro-expanded when read from the sendmail.cf file.
19227c478bd9Sstevel@tonic-gate
19237c478bd9Sstevel@tonic-gateThis can be used with class related commands such as RELAY_DOMAIN_FILE(),
19247c478bd9Sstevel@tonic-gateMASQUERADE_DOMAIN_FILE(), etc:
19257c478bd9Sstevel@tonic-gate
19267c478bd9Sstevel@tonic-gate	Command				sendmailMTAClassName
19277c478bd9Sstevel@tonic-gate	-------				--------------------
19287c478bd9Sstevel@tonic-gate	CANONIFY_DOMAIN_FILE()		Canonify
19297c478bd9Sstevel@tonic-gate	EXPOSED_USER_FILE()		E
19307c478bd9Sstevel@tonic-gate	GENERICS_DOMAIN_FILE()		G
19317c478bd9Sstevel@tonic-gate	LDAPROUTE_DOMAIN_FILE()		LDAPRoute
19327c478bd9Sstevel@tonic-gate	LDAPROUTE_EQUIVALENT_FILE()	LDAPRouteEquiv
19337c478bd9Sstevel@tonic-gate	LOCAL_USER_FILE()		L
19347c478bd9Sstevel@tonic-gate	MASQUERADE_DOMAIN_FILE()	M
19357c478bd9Sstevel@tonic-gate	MASQUERADE_EXCEPTION_FILE()	N
19367c478bd9Sstevel@tonic-gate	RELAY_DOMAIN_FILE()		R
19377c478bd9Sstevel@tonic-gate	VIRTUSER_DOMAIN_FILE()		VirtHost
19387c478bd9Sstevel@tonic-gate
19397c478bd9Sstevel@tonic-gateYou can also add your own as any 'F'ile class of the form:
19407c478bd9Sstevel@tonic-gate
19417c478bd9Sstevel@tonic-gate	F{ClassName}@LDAP
19427c478bd9Sstevel@tonic-gate	  ^^^^^^^^^
19437c478bd9Sstevel@tonic-gatewill use "ClassName" for the sendmailMTAClassName.
19447c478bd9Sstevel@tonic-gate
19457c478bd9Sstevel@tonic-gateAn example LDAP LDIF entry would look like:
19467c478bd9Sstevel@tonic-gate
19477c478bd9Sstevel@tonic-gate	dn: sendmailMTAClassName=R, dc=sendmail, dc=org
19487c478bd9Sstevel@tonic-gate	objectClass: sendmailMTA
19497c478bd9Sstevel@tonic-gate	objectClass: sendmailMTAClass
19507c478bd9Sstevel@tonic-gate	sendmailMTACluster: Servers
19517c478bd9Sstevel@tonic-gate	sendmailMTAClassName: R
19527c478bd9Sstevel@tonic-gate	sendmailMTAClassValue: sendmail.org
19537c478bd9Sstevel@tonic-gate	sendmailMTAClassValue: example.com
19547c478bd9Sstevel@tonic-gate	sendmailMTAClassValue: 10.56.23
19557c478bd9Sstevel@tonic-gate
19567c478bd9Sstevel@tonic-gateCAUTION: If your LDAP database contains the record above and *ALSO* a host
19577c478bd9Sstevel@tonic-gatespecific record such as:
19587c478bd9Sstevel@tonic-gate
19597c478bd9Sstevel@tonic-gate	dn: sendmailMTAClassName=R@etrn.sendmail.org, dc=sendmail, dc=org
19607c478bd9Sstevel@tonic-gate	objectClass: sendmailMTA
19617c478bd9Sstevel@tonic-gate	objectClass: sendmailMTAClass
19627c478bd9Sstevel@tonic-gate	sendmailMTAHost: etrn.sendmail.org
19637c478bd9Sstevel@tonic-gate	sendmailMTAClassName: R
19647c478bd9Sstevel@tonic-gate	sendmailMTAClassValue: example.com
19657c478bd9Sstevel@tonic-gate
19667c478bd9Sstevel@tonic-gatethe result will be similar to the aliases caution above.  When the lookup
19677c478bd9Sstevel@tonic-gateis done on etrn.sendmail.org, $={R} would contain all of the entries (from
19687c478bd9Sstevel@tonic-gateboth the cluster match and the host match).  In other words, the effective
19697c478bd9Sstevel@tonic-gateis additive.
19707c478bd9Sstevel@tonic-gate
19717c478bd9Sstevel@tonic-gateIf you prefer not to use the default LDAP schema for your classes, you can
19727c478bd9Sstevel@tonic-gatespecify the map parameters when using the class command.  For example:
19737c478bd9Sstevel@tonic-gate
19747c478bd9Sstevel@tonic-gate	VIRTUSER_DOMAIN_FILE(`@ldap:-k (&(objectClass=virtHosts)(host=*)) -v host')
19757c478bd9Sstevel@tonic-gate
19767c478bd9Sstevel@tonic-gateRemember, macros can not be used in a class declaration as the binary does
19777c478bd9Sstevel@tonic-gatenot expand them.
19787c478bd9Sstevel@tonic-gate
19797c478bd9Sstevel@tonic-gate
19807c478bd9Sstevel@tonic-gate+--------------+
19817c478bd9Sstevel@tonic-gate| LDAP ROUTING |
19827c478bd9Sstevel@tonic-gate+--------------+
19837c478bd9Sstevel@tonic-gate
19847c478bd9Sstevel@tonic-gateFEATURE(`ldap_routing') can be used to implement the IETF Internet Draft
19857c478bd9Sstevel@tonic-gateLDAP Schema for Intranet Mail Routing
19867c478bd9Sstevel@tonic-gate(draft-lachman-laser-ldap-mail-routing-01).  This feature enables
19877c478bd9Sstevel@tonic-gateLDAP-based rerouting of a particular address to either a different host
19887c478bd9Sstevel@tonic-gateor a different address.  The LDAP lookup is first attempted on the full
19897c478bd9Sstevel@tonic-gateaddress (e.g., user@example.com) and then on the domain portion
19907c478bd9Sstevel@tonic-gate(e.g., @example.com).  Be sure to setup your domain for LDAP routing using
19917c478bd9Sstevel@tonic-gateLDAPROUTE_DOMAIN(), e.g.:
19927c478bd9Sstevel@tonic-gate
19937c478bd9Sstevel@tonic-gate	LDAPROUTE_DOMAIN(`example.com')
19947c478bd9Sstevel@tonic-gate
19957c478bd9Sstevel@tonic-gateAdditionally, you can specify equivalent domains for LDAP routing using
19967c478bd9Sstevel@tonic-gateLDAPROUTE_EQUIVALENT() and LDAPROUTE_EQUIVALENT_FILE().  'Equivalent'
19977c478bd9Sstevel@tonic-gatehostnames are mapped to $M (the masqueraded hostname for the server) before
19987c478bd9Sstevel@tonic-gatethe LDAP query.  For example, if the mail is addressed to
19997c478bd9Sstevel@tonic-gateuser@host1.example.com, normally the LDAP lookup would only be done for
20007c478bd9Sstevel@tonic-gate'user@host1.example.com' and '@host1.example.com'.   However, if
20017c478bd9Sstevel@tonic-gateLDAPROUTE_EQUIVALENT(`host1.example.com') is used, the lookups would also be
20027c478bd9Sstevel@tonic-gatedone on 'user@example.com' and '@example.com' after attempting the
20037c478bd9Sstevel@tonic-gatehost1.example.com lookups.
20047c478bd9Sstevel@tonic-gate
20057c478bd9Sstevel@tonic-gateBy default, the feature will use the schemas as specified in the draft
20067c478bd9Sstevel@tonic-gateand will not reject addresses not found by the LDAP lookup.  However,
20077c478bd9Sstevel@tonic-gatethis behavior can be changed by giving additional arguments to the FEATURE()
20087c478bd9Sstevel@tonic-gatecommand:
20097c478bd9Sstevel@tonic-gate
20107c478bd9Sstevel@tonic-gate FEATURE(`ldap_routing', <mailHost>, <mailRoutingAddress>, <bounce>,
20117c478bd9Sstevel@tonic-gate		 <detail>, <nodomain>, <tempfail>)
20127c478bd9Sstevel@tonic-gate
20137c478bd9Sstevel@tonic-gatewhere <mailHost> is a map definition describing how to lookup an alternative
20147c478bd9Sstevel@tonic-gatemail host for a particular address; <mailRoutingAddress> is a map definition
20157c478bd9Sstevel@tonic-gatedescribing how to lookup an alternative address for a particular address;
20167c478bd9Sstevel@tonic-gatethe <bounce> argument, if present and not the word "passthru", dictates
20177c478bd9Sstevel@tonic-gatethat mail should be bounced if neither a mailHost nor mailRoutingAddress
20187c478bd9Sstevel@tonic-gateis found, if set to "sendertoo", the sender will be rejected if not
20197c478bd9Sstevel@tonic-gatefound in LDAP; and <detail> indicates what actions to take if the address
20207c478bd9Sstevel@tonic-gatecontains +detail information -- `strip' tries the lookup with the +detail
20217c478bd9Sstevel@tonic-gateand if no matches are found, strips the +detail and tries the lookup again;
20227c478bd9Sstevel@tonic-gate`preserve', does the same as `strip' but if a mailRoutingAddress match is
20237c478bd9Sstevel@tonic-gatefound, the +detail information is copied to the new address; the <nodomain>
20247c478bd9Sstevel@tonic-gateargument, if present, will prevent the @domain lookup if the full
20257c478bd9Sstevel@tonic-gateaddress is not found in LDAP; the <tempfail> argument, if set to
20267c478bd9Sstevel@tonic-gate"tempfail", instructs the rules to give an SMTP 4XX temporary
20277c478bd9Sstevel@tonic-gateerror if the LDAP server gives the MTA a temporary failure, or if set to
20287c478bd9Sstevel@tonic-gate"queue" (the default), the MTA will locally queue the mail.
20297c478bd9Sstevel@tonic-gate
20307c478bd9Sstevel@tonic-gateThe default <mailHost> map definition is:
20317c478bd9Sstevel@tonic-gate
20327c478bd9Sstevel@tonic-gate	ldap -1 -T<TMPF> -v mailHost -k (&(objectClass=inetLocalMailRecipient)
20337c478bd9Sstevel@tonic-gate				 (mailLocalAddress=%0))
20347c478bd9Sstevel@tonic-gate
20357c478bd9Sstevel@tonic-gateThe default <mailRoutingAddress> map definition is:
20367c478bd9Sstevel@tonic-gate
20377c478bd9Sstevel@tonic-gate	ldap -1 -T<TMPF> -v mailRoutingAddress
20387c478bd9Sstevel@tonic-gate			 -k (&(objectClass=inetLocalMailRecipient)
20397c478bd9Sstevel@tonic-gate			      (mailLocalAddress=%0))
20407c478bd9Sstevel@tonic-gate
20417c478bd9Sstevel@tonic-gateNote that neither includes the LDAP server hostname (-h server) or base DN
20427c478bd9Sstevel@tonic-gate(-b o=org,c=COUNTRY), both necessary for LDAP queries.  It is presumed that
20437c478bd9Sstevel@tonic-gateyour .mc file contains a setting for the confLDAP_DEFAULT_SPEC option with
20447c478bd9Sstevel@tonic-gatethese settings.  If this is not the case, the map definitions should be
20457c478bd9Sstevel@tonic-gatechanged as described above.  The "-T<TMPF>" is required in any user
20467c478bd9Sstevel@tonic-gatespecified map definition to catch temporary errors.
20477c478bd9Sstevel@tonic-gate
20487c478bd9Sstevel@tonic-gateThe following possibilities exist as a result of an LDAP lookup on an
20497c478bd9Sstevel@tonic-gateaddress:
20507c478bd9Sstevel@tonic-gate
20517c478bd9Sstevel@tonic-gate	mailHost is	mailRoutingAddress is	Results in
20527c478bd9Sstevel@tonic-gate	-----------	---------------------	----------
20537c478bd9Sstevel@tonic-gate	set to a	set			mail delivered to
20547c478bd9Sstevel@tonic-gate	"local" host				mailRoutingAddress
20557c478bd9Sstevel@tonic-gate
20567c478bd9Sstevel@tonic-gate	set to a	not set			delivered to
20577c478bd9Sstevel@tonic-gate	"local" host				original address
20587c478bd9Sstevel@tonic-gate
20597c478bd9Sstevel@tonic-gate	set to a	set			mailRoutingAddress
20607c478bd9Sstevel@tonic-gate	remote host				relayed to mailHost
20617c478bd9Sstevel@tonic-gate
20627c478bd9Sstevel@tonic-gate	set to a	not set			original address
20637c478bd9Sstevel@tonic-gate	remote host				relayed to mailHost
20647c478bd9Sstevel@tonic-gate
20657c478bd9Sstevel@tonic-gate	not set		set			mail delivered to
20667c478bd9Sstevel@tonic-gate						mailRoutingAddress
20677c478bd9Sstevel@tonic-gate
20687c478bd9Sstevel@tonic-gate	not set		not set			delivered to
20697c478bd9Sstevel@tonic-gate						original address *OR*
20707c478bd9Sstevel@tonic-gate						bounced as unknown user
20717c478bd9Sstevel@tonic-gate
20727c478bd9Sstevel@tonic-gateThe term "local" host above means the host specified is in class {w}.  If
20737c478bd9Sstevel@tonic-gatethe result would mean sending the mail to a different host, that host is
20747c478bd9Sstevel@tonic-gatelooked up in the mailertable before delivery.
20757c478bd9Sstevel@tonic-gate
20767c478bd9Sstevel@tonic-gateNote that the last case depends on whether the third argument is given
20777c478bd9Sstevel@tonic-gateto the FEATURE() command.  The default is to deliver the message to the
20787c478bd9Sstevel@tonic-gateoriginal address.
20797c478bd9Sstevel@tonic-gate
20807c478bd9Sstevel@tonic-gateThe LDAP entries should be set up with an objectClass of
20817c478bd9Sstevel@tonic-gateinetLocalMailRecipient and the address be listed in a mailLocalAddress
20827c478bd9Sstevel@tonic-gateattribute.  If present, there must be only one mailHost attribute and it
20837c478bd9Sstevel@tonic-gatemust contain a fully qualified host name as its value.  Similarly, if
20847c478bd9Sstevel@tonic-gatepresent, there must be only one mailRoutingAddress attribute and it must
20857c478bd9Sstevel@tonic-gatecontain an RFC 822 compliant address.  Some example LDAP records (in LDIF
20867c478bd9Sstevel@tonic-gateformat):
20877c478bd9Sstevel@tonic-gate
20887c478bd9Sstevel@tonic-gate	dn: uid=tom, o=example.com, c=US
20897c478bd9Sstevel@tonic-gate	objectClass: inetLocalMailRecipient
20907c478bd9Sstevel@tonic-gate	mailLocalAddress: tom@example.com
20917c478bd9Sstevel@tonic-gate	mailRoutingAddress: thomas@mailhost.example.com
20927c478bd9Sstevel@tonic-gate
20937c478bd9Sstevel@tonic-gateThis would deliver mail for tom@example.com to thomas@mailhost.example.com.
20947c478bd9Sstevel@tonic-gate
20957c478bd9Sstevel@tonic-gate	dn: uid=dick, o=example.com, c=US
20967c478bd9Sstevel@tonic-gate	objectClass: inetLocalMailRecipient
20977c478bd9Sstevel@tonic-gate	mailLocalAddress: dick@example.com
20987c478bd9Sstevel@tonic-gate	mailHost: eng.example.com
20997c478bd9Sstevel@tonic-gate
21007c478bd9Sstevel@tonic-gateThis would relay mail for dick@example.com to the same address but redirect
21017c478bd9Sstevel@tonic-gatethe mail to MX records listed for the host eng.example.com (unless the
21027c478bd9Sstevel@tonic-gatemailertable overrides).
21037c478bd9Sstevel@tonic-gate
21047c478bd9Sstevel@tonic-gate	dn: uid=harry, o=example.com, c=US
21057c478bd9Sstevel@tonic-gate	objectClass: inetLocalMailRecipient
21067c478bd9Sstevel@tonic-gate	mailLocalAddress: harry@example.com
21077c478bd9Sstevel@tonic-gate	mailHost: mktmail.example.com
21087c478bd9Sstevel@tonic-gate	mailRoutingAddress: harry@mkt.example.com
21097c478bd9Sstevel@tonic-gate
21107c478bd9Sstevel@tonic-gateThis would relay mail for harry@example.com to the MX records listed for
21117c478bd9Sstevel@tonic-gatethe host mktmail.example.com using the new address harry@mkt.example.com
21127c478bd9Sstevel@tonic-gatewhen talking to that host.
21137c478bd9Sstevel@tonic-gate
21147c478bd9Sstevel@tonic-gate	dn: uid=virtual.example.com, o=example.com, c=US
21157c478bd9Sstevel@tonic-gate	objectClass: inetLocalMailRecipient
21167c478bd9Sstevel@tonic-gate	mailLocalAddress: @virtual.example.com
21177c478bd9Sstevel@tonic-gate	mailHost: server.example.com
21187c478bd9Sstevel@tonic-gate	mailRoutingAddress: virtual@example.com
21197c478bd9Sstevel@tonic-gate
21207c478bd9Sstevel@tonic-gateThis would send all mail destined for any username @virtual.example.com to
21217c478bd9Sstevel@tonic-gatethe machine server.example.com's MX servers and deliver to the address
21227c478bd9Sstevel@tonic-gatevirtual@example.com on that relay machine.
21237c478bd9Sstevel@tonic-gate
21247c478bd9Sstevel@tonic-gate
21257c478bd9Sstevel@tonic-gate+---------------------------------+
21267c478bd9Sstevel@tonic-gate| ANTI-SPAM CONFIGURATION CONTROL |
21277c478bd9Sstevel@tonic-gate+---------------------------------+
21287c478bd9Sstevel@tonic-gate
21297c478bd9Sstevel@tonic-gateThe primary anti-spam features available in sendmail are:
21307c478bd9Sstevel@tonic-gate
21317c478bd9Sstevel@tonic-gate* Relaying is denied by default.
21327c478bd9Sstevel@tonic-gate* Better checking on sender information.
21337c478bd9Sstevel@tonic-gate* Access database.
21347c478bd9Sstevel@tonic-gate* Header checks.
21357c478bd9Sstevel@tonic-gate
21367c478bd9Sstevel@tonic-gateRelaying (transmission of messages from a site outside your host (class
21377c478bd9Sstevel@tonic-gate{w}) to another site except yours) is denied by default.  Note that this
21387c478bd9Sstevel@tonic-gatechanged in sendmail 8.9; previous versions allowed relaying by default.
21397c478bd9Sstevel@tonic-gateIf you really want to revert to the old behaviour, you will need to use
21407c478bd9Sstevel@tonic-gateFEATURE(`promiscuous_relay').  You can allow certain domains to relay
21417c478bd9Sstevel@tonic-gatethrough your server by adding their domain name or IP address to class
21427c478bd9Sstevel@tonic-gate{R} using RELAY_DOMAIN() and RELAY_DOMAIN_FILE() or via the access database
21437c478bd9Sstevel@tonic-gate(described below).  Note that IPv6 addresses must be prefaced with "IPv6:".
21447c478bd9Sstevel@tonic-gateThe file consists (like any other file based class) of entries listed on
21457c478bd9Sstevel@tonic-gateseparate lines, e.g.,
21467c478bd9Sstevel@tonic-gate
21477c478bd9Sstevel@tonic-gate	sendmail.org
21487c478bd9Sstevel@tonic-gate	128.32
21497c478bd9Sstevel@tonic-gate	IPv6:2002:c0a8:02c7
21507c478bd9Sstevel@tonic-gate	IPv6:2002:c0a8:51d2::23f4
21517c478bd9Sstevel@tonic-gate	host.mydomain.com
21527c478bd9Sstevel@tonic-gate	[UNIX:localhost]
21537c478bd9Sstevel@tonic-gate
21547c478bd9Sstevel@tonic-gateNotice: the last entry allows relaying for connections via a UNIX
21557c478bd9Sstevel@tonic-gatesocket to the MTA/MSP.  This might be necessary if your configuration
21567c478bd9Sstevel@tonic-gatedoesn't allow relaying by other means in that case, e.g., by having
21577c478bd9Sstevel@tonic-gatelocalhost.$m in class {R} (make sure $m is not just a top level
21587c478bd9Sstevel@tonic-gatedomain).
21597c478bd9Sstevel@tonic-gate
21607c478bd9Sstevel@tonic-gateIf you use
21617c478bd9Sstevel@tonic-gate
21627c478bd9Sstevel@tonic-gate	FEATURE(`relay_entire_domain')
21637c478bd9Sstevel@tonic-gate
21647c478bd9Sstevel@tonic-gatethen any host in any of your local domains (that is, class {m})
21657c478bd9Sstevel@tonic-gatewill be relayed (that is, you will accept mail either to or from any
21667c478bd9Sstevel@tonic-gatehost in your domain).
21677c478bd9Sstevel@tonic-gate
21687c478bd9Sstevel@tonic-gateYou can also allow relaying based on the MX records of the host
21697c478bd9Sstevel@tonic-gateportion of an incoming recipient address by using
21707c478bd9Sstevel@tonic-gate
21717c478bd9Sstevel@tonic-gate	FEATURE(`relay_based_on_MX')
21727c478bd9Sstevel@tonic-gate
21737c478bd9Sstevel@tonic-gateFor example, if your server receives a recipient of user@domain.com
21747c478bd9Sstevel@tonic-gateand domain.com lists your server in its MX records, the mail will be
21757c478bd9Sstevel@tonic-gateaccepted for relay to domain.com.  This feature may cause problems
21767c478bd9Sstevel@tonic-gateif MX lookups for the recipient domain are slow or time out.  In that
21777c478bd9Sstevel@tonic-gatecase, mail will be temporarily rejected.  It is usually better to
21787c478bd9Sstevel@tonic-gatemaintain a list of hosts/domains for which the server acts as relay.
21797c478bd9Sstevel@tonic-gateNote also that this feature will stop spammers from using your host
21807c478bd9Sstevel@tonic-gateto relay spam but it will not stop outsiders from using your server
21817c478bd9Sstevel@tonic-gateas a relay for their site (that is, they set up an MX record pointing
21827c478bd9Sstevel@tonic-gateto your mail server, and you will relay mail addressed to them
21837c478bd9Sstevel@tonic-gatewithout any prior arrangement).  Along the same lines,
21847c478bd9Sstevel@tonic-gate
21857c478bd9Sstevel@tonic-gate	FEATURE(`relay_local_from')
21867c478bd9Sstevel@tonic-gate
21877c478bd9Sstevel@tonic-gatewill allow relaying if the sender specifies a return path (i.e.
21887c478bd9Sstevel@tonic-gateMAIL FROM:<user@domain>) domain which is a local domain.  This is a
21897c478bd9Sstevel@tonic-gatedangerous feature as it will allow spammers to spam using your mail
21907c478bd9Sstevel@tonic-gateserver by simply specifying a return address of user@your.domain.com.
21917c478bd9Sstevel@tonic-gateIt should not be used unless absolutely necessary.
21927c478bd9Sstevel@tonic-gateA slightly better solution is
21937c478bd9Sstevel@tonic-gate
21947c478bd9Sstevel@tonic-gate	FEATURE(`relay_mail_from')
21957c478bd9Sstevel@tonic-gate
21967c478bd9Sstevel@tonic-gatewhich allows relaying if the mail sender is listed as RELAY in the
21977c478bd9Sstevel@tonic-gateaccess map.  If an optional argument `domain' (this is the literal
21987c478bd9Sstevel@tonic-gateword `domain', not a placeholder) is given, the domain portion of
21997c478bd9Sstevel@tonic-gatethe mail sender is also checked to allowing relaying.  This option
22007c478bd9Sstevel@tonic-gateonly works together with the tag From: for the LHS of the access
22017c478bd9Sstevel@tonic-gatemap entries.  This feature allows spammers to abuse your mail server
22027c478bd9Sstevel@tonic-gateby specifying a return address that you enabled in your access file.
22037c478bd9Sstevel@tonic-gateThis may be harder to figure out for spammers, but it should not
22047c478bd9Sstevel@tonic-gatebe used unless necessary.  Instead use STARTTLS to
22057c478bd9Sstevel@tonic-gateallow relaying for roaming users.
22067c478bd9Sstevel@tonic-gate
22077c478bd9Sstevel@tonic-gate
22087c478bd9Sstevel@tonic-gateIf source routing is used in the recipient address (e.g.,
22097c478bd9Sstevel@tonic-gateRCPT TO:<user%site.com@othersite.com>), sendmail will check
22107c478bd9Sstevel@tonic-gateuser@site.com for relaying if othersite.com is an allowed relay host
22117c478bd9Sstevel@tonic-gatein either class {R}, class {m} if FEATURE(`relay_entire_domain') is used,
22127c478bd9Sstevel@tonic-gateor the access database if FEATURE(`access_db') is used.  To prevent
22137c478bd9Sstevel@tonic-gatethe address from being stripped down, use:
22147c478bd9Sstevel@tonic-gate
22157c478bd9Sstevel@tonic-gate	FEATURE(`loose_relay_check')
22167c478bd9Sstevel@tonic-gate
22177c478bd9Sstevel@tonic-gateIf you think you need to use this feature, you probably do not.  This
22187c478bd9Sstevel@tonic-gateshould only be used for sites which have no control over the addresses
22197c478bd9Sstevel@tonic-gatethat they provide a gateway for.  Use this FEATURE with caution as it
22207c478bd9Sstevel@tonic-gatecan allow spammers to relay through your server if not setup properly.
22217c478bd9Sstevel@tonic-gate
22227c478bd9Sstevel@tonic-gateNOTICE: It is possible to relay mail through a system which the anti-relay
22237c478bd9Sstevel@tonic-gaterules do not prevent: the case of a system that does use FEATURE(`nouucp',
22247c478bd9Sstevel@tonic-gate`nospecial') (system A) and relays local messages to a mail hub (e.g., via
22257c478bd9Sstevel@tonic-gateLOCAL_RELAY or LUSER_RELAY) (system B).  If system B doesn't use
22267c478bd9Sstevel@tonic-gateFEATURE(`nouucp') at all, addresses of the form
22277c478bd9Sstevel@tonic-gate<example.net!user@local.host> would be relayed to <user@example.net>.
22287c478bd9Sstevel@tonic-gateSystem A doesn't recognize `!' as an address separator and therefore
22297c478bd9Sstevel@tonic-gateforwards it to the mail hub which in turns relays it because it came from
22307c478bd9Sstevel@tonic-gatea trusted local host.  So if a mailserver allows UUCP (bang-format)
22317c478bd9Sstevel@tonic-gateaddresses, all systems from which it allows relaying should do the same
22327c478bd9Sstevel@tonic-gateor reject those addresses.
22337c478bd9Sstevel@tonic-gate
22347c478bd9Sstevel@tonic-gateAs of 8.9, sendmail will refuse mail if the MAIL FROM: parameter has
22357c478bd9Sstevel@tonic-gatean unresolvable domain (i.e., one that DNS, your local name service,
22367c478bd9Sstevel@tonic-gateor special case rules in ruleset 3 cannot locate).  This also applies
22377c478bd9Sstevel@tonic-gateto addresses that use domain literals, e.g., <user@[1.2.3.4]>, if the
22387c478bd9Sstevel@tonic-gateIP address can't be mapped to a host name.  If you want to continue
22397c478bd9Sstevel@tonic-gateto accept such domains, e.g., because you are inside a firewall that
22407c478bd9Sstevel@tonic-gatehas only a limited view of the Internet host name space (note that you
22417c478bd9Sstevel@tonic-gatewill not be able to return mail to them unless you have some "smart
22427c478bd9Sstevel@tonic-gatehost" forwarder), use
22437c478bd9Sstevel@tonic-gate
22447c478bd9Sstevel@tonic-gate	FEATURE(`accept_unresolvable_domains')
22457c478bd9Sstevel@tonic-gate
22467c478bd9Sstevel@tonic-gateAlternatively, you can allow specific addresses by adding them to
22477c478bd9Sstevel@tonic-gatethe access map, e.g.,
22487c478bd9Sstevel@tonic-gate
22497c478bd9Sstevel@tonic-gate	From:unresolvable.domain	OK
22507c478bd9Sstevel@tonic-gate	From:[1.2.3.4]			OK
22517c478bd9Sstevel@tonic-gate	From:[1.2.4]			OK
22527c478bd9Sstevel@tonic-gate
22537c478bd9Sstevel@tonic-gateNotice: domains which are temporarily unresolvable are (temporarily)
22547c478bd9Sstevel@tonic-gaterejected with a 451 reply code.  If those domains should be accepted
22557c478bd9Sstevel@tonic-gate(which is discouraged) then you can use
22567c478bd9Sstevel@tonic-gate
22577c478bd9Sstevel@tonic-gate	LOCAL_CONFIG
22587c478bd9Sstevel@tonic-gate	C{ResOk}TEMP
22597c478bd9Sstevel@tonic-gate
22607c478bd9Sstevel@tonic-gatesendmail will also refuse mail if the MAIL FROM: parameter is not
22617c478bd9Sstevel@tonic-gatefully qualified (i.e., contains a domain as well as a user).  If you
22627c478bd9Sstevel@tonic-gatewant to continue to accept such senders, use
22637c478bd9Sstevel@tonic-gate
22647c478bd9Sstevel@tonic-gate	FEATURE(`accept_unqualified_senders')
22657c478bd9Sstevel@tonic-gate
22667c478bd9Sstevel@tonic-gateSetting the DaemonPortOptions modifier 'u' overrides the default behavior,
22677c478bd9Sstevel@tonic-gatei.e., unqualified addresses are accepted even without this FEATURE.  If
22687c478bd9Sstevel@tonic-gatethis FEATURE is not used, the DaemonPortOptions modifier 'f' can be used
22697c478bd9Sstevel@tonic-gateto enforce fully qualified domain names.
22707c478bd9Sstevel@tonic-gate
22717c478bd9Sstevel@tonic-gateAn ``access'' database can be created to accept or reject mail from
22727c478bd9Sstevel@tonic-gateselected domains.  For example, you may choose to reject all mail
22737c478bd9Sstevel@tonic-gateoriginating from known spammers.  To enable such a database, use
22747c478bd9Sstevel@tonic-gate
22757c478bd9Sstevel@tonic-gate	FEATURE(`access_db')
22767c478bd9Sstevel@tonic-gate
22777c478bd9Sstevel@tonic-gateNotice: the access database is applied to the envelope addresses
22787c478bd9Sstevel@tonic-gateand the connection information, not to the header.
22797c478bd9Sstevel@tonic-gate
22807c478bd9Sstevel@tonic-gateThe FEATURE macro can accept as second parameter the key file
22817c478bd9Sstevel@tonic-gatedefinition for the database; for example
22827c478bd9Sstevel@tonic-gate
22837c478bd9Sstevel@tonic-gate	FEATURE(`access_db', `hash -T<TMPF> /etc/mail/access_map')
22847c478bd9Sstevel@tonic-gate
22857c478bd9Sstevel@tonic-gateNotice: If a second argument is specified it must contain the option
2286058561cbSjbeck`-T<TMPF>' as shown above.  The optional parameters may be
2287058561cbSjbeck
2288058561cbSjbeck	`skip'			enables SKIP as value part (see below).
2289058561cbSjbeck	`lookupdotdomain'	another way to enable the feature of the
2290058561cbSjbeck				same name (see above).
2291058561cbSjbeck	`relaytofulladdress'	enable entries of the form
2292058561cbSjbeck				To:user@example.com	RELAY
2293058561cbSjbeck				to allow relaying to just a specific
2294058561cbSjbeck				e-mail address instead of an entire domain.
22957c478bd9Sstevel@tonic-gate
22967c478bd9Sstevel@tonic-gateRemember, since /etc/mail/access is a database, after creating the text
22977c478bd9Sstevel@tonic-gatefile as described below, you must use makemap to create the database
22987c478bd9Sstevel@tonic-gatemap.  For example:
22997c478bd9Sstevel@tonic-gate
23007c478bd9Sstevel@tonic-gate	makemap hash /etc/mail/access < /etc/mail/access
23017c478bd9Sstevel@tonic-gate
23027c478bd9Sstevel@tonic-gateThe table itself uses e-mail addresses, domain names, and network
23037c478bd9Sstevel@tonic-gatenumbers as keys.  Note that IPv6 addresses must be prefaced with "IPv6:".
23047c478bd9Sstevel@tonic-gateFor example,
23057c478bd9Sstevel@tonic-gate
23067c478bd9Sstevel@tonic-gate	From:spammer@aol.com			REJECT
23077c478bd9Sstevel@tonic-gate	From:cyberspammer.com			REJECT
23087c478bd9Sstevel@tonic-gate	Connect:cyberspammer.com		REJECT
23097c478bd9Sstevel@tonic-gate	Connect:TLD				REJECT
23107c478bd9Sstevel@tonic-gate	Connect:192.168.212			REJECT
23117c478bd9Sstevel@tonic-gate	Connect:IPv6:2002:c0a8:02c7		RELAY
23127c478bd9Sstevel@tonic-gate	Connect:IPv6:2002:c0a8:51d2::23f4	REJECT
23137c478bd9Sstevel@tonic-gate
23147c478bd9Sstevel@tonic-gatewould refuse mail from spammer@aol.com, any user from cyberspammer.com
23157c478bd9Sstevel@tonic-gate(or any host within the cyberspammer.com domain), any host in the entire
23167c478bd9Sstevel@tonic-gatetop level domain TLD, 192.168.212.* network, and the IPv6 address
23177c478bd9Sstevel@tonic-gate2002:c0a8:51d2::23f4.  It would allow relay for the IPv6 network
23187c478bd9Sstevel@tonic-gate2002:c0a8:02c7::/48.
23197c478bd9Sstevel@tonic-gate
23207c478bd9Sstevel@tonic-gateEntries in the access map should be tagged according to their type.
23217c478bd9Sstevel@tonic-gateThree tags are available:
23227c478bd9Sstevel@tonic-gate
23237c478bd9Sstevel@tonic-gate	Connect:	connection information (${client_addr}, ${client_name})
23247c478bd9Sstevel@tonic-gate	From:		envelope sender
23257c478bd9Sstevel@tonic-gate	To:		envelope recipient
23267c478bd9Sstevel@tonic-gate
23277c478bd9Sstevel@tonic-gateNotice: untagged entries are deprecated.
23287c478bd9Sstevel@tonic-gate
23297c478bd9Sstevel@tonic-gateIf the required item is looked up in a map, it will be tried first
23307c478bd9Sstevel@tonic-gatewith the corresponding tag in front, then (as fallback to enable
23317c478bd9Sstevel@tonic-gatebackward compatibility) without any tag, unless the specific feature
23327c478bd9Sstevel@tonic-gaterequires a tag.  For example,
23337c478bd9Sstevel@tonic-gate
23347c478bd9Sstevel@tonic-gate	From:spammer@some.dom	REJECT
23357c478bd9Sstevel@tonic-gate	To:friend.domain	RELAY
23367c478bd9Sstevel@tonic-gate	Connect:friend.domain	OK
23377c478bd9Sstevel@tonic-gate	Connect:from.domain	RELAY
23387c478bd9Sstevel@tonic-gate	From:good@another.dom	OK
23397c478bd9Sstevel@tonic-gate	From:another.dom	REJECT
23407c478bd9Sstevel@tonic-gate
23417c478bd9Sstevel@tonic-gateThis would deny mails from spammer@some.dom but you could still
23427c478bd9Sstevel@tonic-gatesend mail to that address even if FEATURE(`blacklist_recipients')
23437c478bd9Sstevel@tonic-gateis enabled.  Your system will allow relaying to friend.domain, but
23447c478bd9Sstevel@tonic-gatenot from it (unless enabled by other means).  Connections from that
23457c478bd9Sstevel@tonic-gatedomain will be allowed even if it ends up in one of the DNS based
23467c478bd9Sstevel@tonic-gaterejection lists.  Relaying is enabled from from.domain but not to
23477c478bd9Sstevel@tonic-gateit (since relaying is based on the connection information for
23487c478bd9Sstevel@tonic-gateoutgoing relaying, the tag Connect: must be used; for incoming
23497c478bd9Sstevel@tonic-gaterelaying, which is based on the recipient address, To: must be
23507c478bd9Sstevel@tonic-gateused).  The last two entries allow mails from good@another.dom but
23517c478bd9Sstevel@tonic-gatereject mail from all other addresses with another.dom as domain
23527c478bd9Sstevel@tonic-gatepart.
23537c478bd9Sstevel@tonic-gate
23547c478bd9Sstevel@tonic-gate
23557c478bd9Sstevel@tonic-gateThe value part of the map can contain:
23567c478bd9Sstevel@tonic-gate
23577c478bd9Sstevel@tonic-gate	OK		Accept mail even if other rules in the running
23587c478bd9Sstevel@tonic-gate			ruleset would reject it, for example, if the domain
23597c478bd9Sstevel@tonic-gate			name is unresolvable.  "Accept" does not mean
23607c478bd9Sstevel@tonic-gate			"relay", but at most acceptance for local
23617c478bd9Sstevel@tonic-gate			recipients.  That is, OK allows less than RELAY.
2362058561cbSjbeck	RELAY		Accept mail addressed to the indicated domain
2363058561cbSjbeck			(or address if `relaytofulladdress' is set) or
23647c478bd9Sstevel@tonic-gate			received from the indicated domain for relaying
23657c478bd9Sstevel@tonic-gate			through your SMTP server.  RELAY also serves as
23667c478bd9Sstevel@tonic-gate			an implicit OK for the other checks.
23677c478bd9Sstevel@tonic-gate	REJECT		Reject the sender or recipient with a general
23687c478bd9Sstevel@tonic-gate			purpose message.
23697c478bd9Sstevel@tonic-gate	DISCARD		Discard the message completely using the
23707c478bd9Sstevel@tonic-gate			$#discard mailer.  If it is used in check_compat,
23717c478bd9Sstevel@tonic-gate			it affects only the designated recipient, not
23727c478bd9Sstevel@tonic-gate			the whole message as it does in all other cases.
23737c478bd9Sstevel@tonic-gate			This should only be used if really necessary.
23747c478bd9Sstevel@tonic-gate	SKIP		This can only be used for host/domain names
23757c478bd9Sstevel@tonic-gate			and IP addresses/nets.  It will abort the current
23767c478bd9Sstevel@tonic-gate			search for this entry without accepting or rejecting
23777c478bd9Sstevel@tonic-gate			it but causing the default action.
23787c478bd9Sstevel@tonic-gate	### any text	where ### is an RFC 821 compliant error code and
23797c478bd9Sstevel@tonic-gate			"any text" is a message to return for the command.
2380445f2479Sjbeck			The entire string should be quoted to avoid
2381445f2479Sjbeck			surprises:
2382445f2479Sjbeck
2383445f2479Sjbeck				"### any text"
2384445f2479Sjbeck
2385445f2479Sjbeck			Otherwise sendmail formats the text as email
2386445f2479Sjbeck			addresses, e.g., it may remove spaces.
23877c478bd9Sstevel@tonic-gate			This type is deprecated, use one of the two
23887c478bd9Sstevel@tonic-gate			ERROR:  entries below instead.
23897c478bd9Sstevel@tonic-gate	ERROR:### any text
23907c478bd9Sstevel@tonic-gate			as above, but useful to mark error messages as such.
2391445f2479Sjbeck			If quotes need to be used to avoid modifications
2392445f2479Sjbeck			(see above), they should be placed like this:
2393445f2479Sjbeck
2394445f2479Sjbeck				ERROR:"### any text"
2395445f2479Sjbeck
23967c478bd9Sstevel@tonic-gate	ERROR:D.S.N:### any text
23977c478bd9Sstevel@tonic-gate			where D.S.N is an RFC 1893 compliant error code
2398445f2479Sjbeck			and the rest as above.  If quotes need to be used
2399445f2479Sjbeck			to avoid modifications, they should be placed
2400445f2479Sjbeck			like this:
2401445f2479Sjbeck
2402445f2479Sjbeck				ERROR:D.S.N:"### any text"
2403445f2479Sjbeck
24047c478bd9Sstevel@tonic-gate	QUARANTINE:any text
24057c478bd9Sstevel@tonic-gate			Quarantine the message using the given text as the
24067c478bd9Sstevel@tonic-gate			quarantining reason.
24077c478bd9Sstevel@tonic-gate
24087c478bd9Sstevel@tonic-gateFor example:
24097c478bd9Sstevel@tonic-gate
24107c478bd9Sstevel@tonic-gate	From:cyberspammer.com	ERROR:"550 We don't accept mail from spammers"
24117c478bd9Sstevel@tonic-gate	From:okay.cyberspammer.com	OK
24127c478bd9Sstevel@tonic-gate	Connect:sendmail.org		RELAY
24137c478bd9Sstevel@tonic-gate	To:sendmail.org			RELAY
24147c478bd9Sstevel@tonic-gate	Connect:128.32			RELAY
24157c478bd9Sstevel@tonic-gate	Connect:128.32.2		SKIP
24167c478bd9Sstevel@tonic-gate	Connect:IPv6:1:2:3:4:5:6:7	RELAY
24177c478bd9Sstevel@tonic-gate	Connect:suspicious.example.com	QUARANTINE:Mail from suspicious host
24187c478bd9Sstevel@tonic-gate	Connect:[127.0.0.3]		OK
24197c478bd9Sstevel@tonic-gate	Connect:[IPv6:1:2:3:4:5:6:7:8]	OK
24207c478bd9Sstevel@tonic-gate
24217c478bd9Sstevel@tonic-gatewould accept mail from okay.cyberspammer.com, but would reject mail
24227c478bd9Sstevel@tonic-gatefrom all other hosts at cyberspammer.com with the indicated message.
24237c478bd9Sstevel@tonic-gateIt would allow relaying mail from and to any hosts in the sendmail.org
24247c478bd9Sstevel@tonic-gatedomain, and allow relaying from the IPv6 1:2:3:4:5:6:7:* network
24257c478bd9Sstevel@tonic-gateand from the 128.32.*.* network except for the 128.32.2.* network,
24267c478bd9Sstevel@tonic-gatewhich shows how SKIP is useful to exempt subnets/subdomains.  The
24277c478bd9Sstevel@tonic-gatelast two entries are for checks against ${client_name} if the IP
24287c478bd9Sstevel@tonic-gateaddress doesn't resolve to a hostname (or is considered as "may be
24297c478bd9Sstevel@tonic-gateforged").  That is, using square brackets means these are host
24307c478bd9Sstevel@tonic-gatenames, not network numbers.
24317c478bd9Sstevel@tonic-gate
24327c478bd9Sstevel@tonic-gateWarning: if you change the RFC 821 compliant error code from the default
24337c478bd9Sstevel@tonic-gatevalue of 550, then you should probably also change the RFC 1893 compliant
24347c478bd9Sstevel@tonic-gateerror code to match it.  For example, if you use
24357c478bd9Sstevel@tonic-gate
24367c478bd9Sstevel@tonic-gate	To:user@example.com	ERROR:450 mailbox full
24377c478bd9Sstevel@tonic-gate
24387c478bd9Sstevel@tonic-gatethe error returned would be "450 5.0.0 mailbox full" which is wrong.
24397c478bd9Sstevel@tonic-gateUse "ERROR:4.2.2:450 mailbox full" instead.
24407c478bd9Sstevel@tonic-gate
24417c478bd9Sstevel@tonic-gateNote, UUCP users may need to add hostname.UUCP to the access database
24427c478bd9Sstevel@tonic-gateor class {R}.
24437c478bd9Sstevel@tonic-gate
24447c478bd9Sstevel@tonic-gateIf you also use:
24457c478bd9Sstevel@tonic-gate
24467c478bd9Sstevel@tonic-gate	FEATURE(`relay_hosts_only')
24477c478bd9Sstevel@tonic-gate
24487c478bd9Sstevel@tonic-gatethen the above example will allow relaying for sendmail.org, but not
24497c478bd9Sstevel@tonic-gatehosts within the sendmail.org domain.  Note that this will also require
24507c478bd9Sstevel@tonic-gatehosts listed in class {R} to be fully qualified host names.
24517c478bd9Sstevel@tonic-gate
24527c478bd9Sstevel@tonic-gateYou can also use the access database to block sender addresses based on
24537c478bd9Sstevel@tonic-gatethe username portion of the address.  For example:
24547c478bd9Sstevel@tonic-gate
24557c478bd9Sstevel@tonic-gate	From:FREE.STEALTH.MAILER@	ERROR:550 Spam not accepted
24567c478bd9Sstevel@tonic-gate
24577c478bd9Sstevel@tonic-gateNote that you must include the @ after the username to signify that
24587c478bd9Sstevel@tonic-gatethis database entry is for checking only the username portion of the
24597c478bd9Sstevel@tonic-gatesender address.
24607c478bd9Sstevel@tonic-gate
24617c478bd9Sstevel@tonic-gateIf you use:
24627c478bd9Sstevel@tonic-gate
24637c478bd9Sstevel@tonic-gate	FEATURE(`blacklist_recipients')
24647c478bd9Sstevel@tonic-gate
24657c478bd9Sstevel@tonic-gatethen you can add entries to the map for local users, hosts in your
24667c478bd9Sstevel@tonic-gatedomains, or addresses in your domain which should not receive mail:
24677c478bd9Sstevel@tonic-gate
24687c478bd9Sstevel@tonic-gate	To:badlocaluser@	ERROR:550 Mailbox disabled for badlocaluser
24697c478bd9Sstevel@tonic-gate	To:host.my.TLD		ERROR:550 That host does not accept mail
24707c478bd9Sstevel@tonic-gate	To:user@other.my.TLD	ERROR:550 Mailbox disabled for this recipient
24717c478bd9Sstevel@tonic-gate
24727c478bd9Sstevel@tonic-gateThis would prevent a recipient of badlocaluser in any of the local
24737c478bd9Sstevel@tonic-gatedomains (class {w}), any user at host.my.TLD, and the single address
24747c478bd9Sstevel@tonic-gateuser@other.my.TLD from receiving mail.  Please note: a local username
24757c478bd9Sstevel@tonic-gatemust be now tagged with an @ (this is consistent with the check of
24767c478bd9Sstevel@tonic-gatethe sender address, and hence it is possible to distinguish between
24777c478bd9Sstevel@tonic-gatehostnames and usernames).  Enabling this feature will keep you from
24787c478bd9Sstevel@tonic-gatesending mails to all addresses that have an error message or REJECT
24797c478bd9Sstevel@tonic-gateas value part in the access map.  Taking the example from above:
24807c478bd9Sstevel@tonic-gate
24817c478bd9Sstevel@tonic-gate	spammer@aol.com		REJECT
24827c478bd9Sstevel@tonic-gate	cyberspammer.com	REJECT
24837c478bd9Sstevel@tonic-gate
24847c478bd9Sstevel@tonic-gateMail can't be sent to spammer@aol.com or anyone at cyberspammer.com.
24857c478bd9Sstevel@tonic-gateThat's why tagged entries should be used.
24867c478bd9Sstevel@tonic-gate
24873ee0e492SjbeckThere are several DNS based blacklists which can be found by
24883ee0e492Sjbeckquerying a search engine.  These are databases of spammers
24897c478bd9Sstevel@tonic-gatemaintained in DNS.  To use such a database, specify
24907c478bd9Sstevel@tonic-gate
24913ee0e492Sjbeck	FEATURE(`dnsbl', `dnsbl.example.com')
24927c478bd9Sstevel@tonic-gate
24933ee0e492SjbeckThis will cause sendmail to reject mail from any site listed in the
2494058561cbSjbeckDNS based blacklist.  You must select a DNS based blacklist domain
24953ee0e492Sjbeckto check by specifying an argument to the FEATURE.  The default
24963ee0e492Sjbeckerror message is
24977c478bd9Sstevel@tonic-gate
24987c478bd9Sstevel@tonic-gate	Rejected: IP-ADDRESS listed at SERVER
24997c478bd9Sstevel@tonic-gate
25007c478bd9Sstevel@tonic-gatewhere IP-ADDRESS and SERVER are replaced by the appropriate
25017c478bd9Sstevel@tonic-gateinformation.  A second argument can be used to specify a different
2502058561cbSjbecktext or action.  For example,
2503058561cbSjbeck
2504058561cbSjbeck	FEATURE(`dnsbl', `dnsbl.example.com', `quarantine')
2505058561cbSjbeck
2506058561cbSjbeckwould quarantine the message if the client IP address is listed
2507058561cbSjbeckat `dnsbl.example.com'.
2508058561cbSjbeck
2509058561cbSjbeckBy default, temporary lookup failures are ignored
2510058561cbSjbeckand hence cause the connection not to be rejected by the DNS based
2511058561cbSjbeckrejection list.  This behavior can be changed by specifying a third
2512058561cbSjbeckargument, which must be either `t' or a full error message.  For
2513058561cbSjbeckexample:
25147c478bd9Sstevel@tonic-gate
25157c478bd9Sstevel@tonic-gate	FEATURE(`dnsbl', `dnsbl.example.com', `',
25167c478bd9Sstevel@tonic-gate	`"451 Temporary lookup failure for " $&{client_addr} " in dnsbl.example.com"')
25177c478bd9Sstevel@tonic-gate
25187c478bd9Sstevel@tonic-gateIf `t' is used, the error message is:
25197c478bd9Sstevel@tonic-gate
25207c478bd9Sstevel@tonic-gate	451 Temporary lookup failure of IP-ADDRESS at SERVER
25217c478bd9Sstevel@tonic-gate
25227c478bd9Sstevel@tonic-gatewhere IP-ADDRESS and SERVER are replaced by the appropriate
25237c478bd9Sstevel@tonic-gateinformation.
25247c478bd9Sstevel@tonic-gate
25257c478bd9Sstevel@tonic-gateThis FEATURE can be included several times to query different
25263ee0e492SjbeckDNS based rejection lists.
25277c478bd9Sstevel@tonic-gate
25287c478bd9Sstevel@tonic-gateNotice: to avoid checking your own local domains against those
25297c478bd9Sstevel@tonic-gateblacklists, use the access_db feature and add:
25307c478bd9Sstevel@tonic-gate
25317c478bd9Sstevel@tonic-gate	Connect:10.1		OK
25327c478bd9Sstevel@tonic-gate	Connect:127.0.0.1	RELAY
25337c478bd9Sstevel@tonic-gate
25347c478bd9Sstevel@tonic-gateto the access map, where 10.1 is your local network.  You may
25357c478bd9Sstevel@tonic-gatewant to use "RELAY" instead of "OK" to allow also relaying
25367c478bd9Sstevel@tonic-gateinstead of just disabling the DNS lookups in the blacklists.
25377c478bd9Sstevel@tonic-gate
25387c478bd9Sstevel@tonic-gate
25397c478bd9Sstevel@tonic-gateThe features described above make use of the check_relay, check_mail,
25407c478bd9Sstevel@tonic-gateand check_rcpt rulesets.  Note that check_relay checks the SMTP
25417c478bd9Sstevel@tonic-gateclient hostname and IP address when the connection is made to your
25427c478bd9Sstevel@tonic-gateserver.  It does not check if a mail message is being relayed to
25437c478bd9Sstevel@tonic-gateanother server.  That check is done in check_rcpt.  If you wish to
25447c478bd9Sstevel@tonic-gateinclude your own checks, you can put your checks in the rulesets
25457c478bd9Sstevel@tonic-gateLocal_check_relay, Local_check_mail, and Local_check_rcpt.  For
25467c478bd9Sstevel@tonic-gateexample if you wanted to block senders with all numeric usernames
25477c478bd9Sstevel@tonic-gate(i.e. 2312343@bigisp.com), you would use Local_check_mail and the
25487c478bd9Sstevel@tonic-gateregex map:
25497c478bd9Sstevel@tonic-gate
25507c478bd9Sstevel@tonic-gate	LOCAL_CONFIG
25517c478bd9Sstevel@tonic-gate	Kallnumbers regex -a@MATCH ^[0-9]+$
25527c478bd9Sstevel@tonic-gate
25537c478bd9Sstevel@tonic-gate	LOCAL_RULESETS
25547c478bd9Sstevel@tonic-gate	SLocal_check_mail
25557c478bd9Sstevel@tonic-gate	# check address against various regex checks
25567c478bd9Sstevel@tonic-gate	R$*				$: $>Parse0 $>3 $1
25577c478bd9Sstevel@tonic-gate	R$+ < @ bigisp.com. > $*	$: $(allnumbers $1 $)
25587c478bd9Sstevel@tonic-gate	R@MATCH				$#error $: 553 Header Error
25597c478bd9Sstevel@tonic-gate
25607c478bd9Sstevel@tonic-gateThese rules are called with the original arguments of the corresponding
25617c478bd9Sstevel@tonic-gatecheck_* ruleset.  If the local ruleset returns $#OK, no further checking
25627c478bd9Sstevel@tonic-gateis done by the features described above and the mail is accepted.  If
25637c478bd9Sstevel@tonic-gatethe local ruleset resolves to a mailer (such as $#error or $#discard),
25647c478bd9Sstevel@tonic-gatethe appropriate action is taken.  Other results starting with $# are
25657c478bd9Sstevel@tonic-gateinterpreted by sendmail and may lead to unspecified behavior.  Note: do
25667c478bd9Sstevel@tonic-gateNOT create a mailer with the name OK.  Return values that do not start
25677c478bd9Sstevel@tonic-gatewith $# are ignored, i.e., normal processing continues.
25687c478bd9Sstevel@tonic-gate
25697c478bd9Sstevel@tonic-gateDelay all checks
25707c478bd9Sstevel@tonic-gate----------------
25717c478bd9Sstevel@tonic-gate
25727c478bd9Sstevel@tonic-gateBy using FEATURE(`delay_checks') the rulesets check_mail and check_relay
25737c478bd9Sstevel@tonic-gatewill not be called when a client connects or issues a MAIL command,
25747c478bd9Sstevel@tonic-gaterespectively.  Instead, those rulesets will be called by the check_rcpt
25757c478bd9Sstevel@tonic-gateruleset; they will be skipped if a sender has been authenticated using
25767c478bd9Sstevel@tonic-gatea "trusted" mechanism, i.e., one that is defined via TRUST_AUTH_MECH().
25777c478bd9Sstevel@tonic-gateIf check_mail returns an error then the RCPT TO command will be rejected
25787c478bd9Sstevel@tonic-gatewith that error.  If it returns some other result starting with $# then
25797c478bd9Sstevel@tonic-gatecheck_relay will be skipped.  If the sender address (or a part of it) is
25807c478bd9Sstevel@tonic-gatelisted in the access map and it has a RHS of OK or RELAY, then check_relay
25817c478bd9Sstevel@tonic-gatewill be skipped.  This has an interesting side effect: if your domain is
25827c478bd9Sstevel@tonic-gatemy.domain and you have
25837c478bd9Sstevel@tonic-gate
25847c478bd9Sstevel@tonic-gate	my.domain	RELAY
25857c478bd9Sstevel@tonic-gate
25867c478bd9Sstevel@tonic-gatein the access map, then any e-mail with a sender address of
25877c478bd9Sstevel@tonic-gate<user@my.domain> will not be rejected by check_relay even though
25887c478bd9Sstevel@tonic-gateit would match the hostname or IP address.  This allows spammers
25897c478bd9Sstevel@tonic-gateto get around DNS based blacklist by faking the sender address.  To
25907c478bd9Sstevel@tonic-gateavoid this problem you have to use tagged entries:
25917c478bd9Sstevel@tonic-gate
25927c478bd9Sstevel@tonic-gate	To:my.domain		RELAY
25937c478bd9Sstevel@tonic-gate	Connect:my.domain	RELAY
25947c478bd9Sstevel@tonic-gate
25957c478bd9Sstevel@tonic-gateif you need those entries at all (class {R} may take care of them).
25967c478bd9Sstevel@tonic-gate
25977c478bd9Sstevel@tonic-gateFEATURE(`delay_checks') can take an optional argument:
25987c478bd9Sstevel@tonic-gate
25997c478bd9Sstevel@tonic-gate	FEATURE(`delay_checks', `friend')
26007c478bd9Sstevel@tonic-gate		 enables spamfriend test
26017c478bd9Sstevel@tonic-gate	FEATURE(`delay_checks', `hater')
26027c478bd9Sstevel@tonic-gate		 enables spamhater test
26037c478bd9Sstevel@tonic-gate
26047c478bd9Sstevel@tonic-gateIf such an argument is given, the recipient will be looked up in the
26057c478bd9Sstevel@tonic-gateaccess map (using the tag Spam:).  If the argument is `friend', then
26067c478bd9Sstevel@tonic-gatethe default behavior is to apply the other rulesets and make a SPAM
26077c478bd9Sstevel@tonic-gatefriend the exception.  The rulesets check_mail and check_relay will be
26087c478bd9Sstevel@tonic-gateskipped only if the recipient address is found and has RHS FRIEND.  If
26097c478bd9Sstevel@tonic-gatethe argument is `hater', then the default behavior is to skip the rulesets
26107c478bd9Sstevel@tonic-gatecheck_mail and check_relay and make a SPAM hater the exception.  The
26117c478bd9Sstevel@tonic-gateother two rulesets will be applied only if the recipient address is
26127c478bd9Sstevel@tonic-gatefound and has RHS HATER.
26137c478bd9Sstevel@tonic-gate
26147c478bd9Sstevel@tonic-gateThis allows for simple exceptions from the tests, e.g., by activating
26157c478bd9Sstevel@tonic-gatethe friend option and having
26167c478bd9Sstevel@tonic-gate
26177c478bd9Sstevel@tonic-gate	Spam:abuse@	FRIEND
26187c478bd9Sstevel@tonic-gate
26197c478bd9Sstevel@tonic-gatein the access map, mail to abuse@localdomain will get through (where
26207c478bd9Sstevel@tonic-gate"localdomain" is any domain in class {w}).  It is also possible to
26217c478bd9Sstevel@tonic-gatespecify a full address or an address with +detail:
26227c478bd9Sstevel@tonic-gate
26237c478bd9Sstevel@tonic-gate	Spam:abuse@my.domain	FRIEND
26247c478bd9Sstevel@tonic-gate	Spam:me+abuse@		FRIEND
26257c478bd9Sstevel@tonic-gate	Spam:spam.domain	FRIEND
26267c478bd9Sstevel@tonic-gate
26277c478bd9Sstevel@tonic-gateNote: The required tag has been changed in 8.12 from To: to Spam:.
26287c478bd9Sstevel@tonic-gateThis change is incompatible to previous versions.  However, you can
26297c478bd9Sstevel@tonic-gate(for now) simply add the new entries to the access map, the old
26307c478bd9Sstevel@tonic-gateones will be ignored.  As soon as you removed the old entries from
26317c478bd9Sstevel@tonic-gatethe access map, specify a third parameter (`n') to this feature and
26327c478bd9Sstevel@tonic-gatethe backward compatibility rules will not be in the generated .cf
26337c478bd9Sstevel@tonic-gatefile.
26347c478bd9Sstevel@tonic-gate
26357c478bd9Sstevel@tonic-gateHeader Checks
26367c478bd9Sstevel@tonic-gate-------------
26377c478bd9Sstevel@tonic-gate
26387c478bd9Sstevel@tonic-gateYou can also reject mail on the basis of the contents of headers.
26397c478bd9Sstevel@tonic-gateThis is done by adding a ruleset call to the 'H' header definition command
26407c478bd9Sstevel@tonic-gatein sendmail.cf.  For example, this can be used to check the validity of
26417c478bd9Sstevel@tonic-gatea Message-ID: header:
26427c478bd9Sstevel@tonic-gate
26437c478bd9Sstevel@tonic-gate	LOCAL_CONFIG
26447c478bd9Sstevel@tonic-gate	HMessage-Id: $>CheckMessageId
26457c478bd9Sstevel@tonic-gate
26467c478bd9Sstevel@tonic-gate	LOCAL_RULESETS
26477c478bd9Sstevel@tonic-gate	SCheckMessageId
26487c478bd9Sstevel@tonic-gate	R< $+ @ $+ >		$@ OK
26497c478bd9Sstevel@tonic-gate	R$*			$#error $: 553 Header Error
26507c478bd9Sstevel@tonic-gate
26517c478bd9Sstevel@tonic-gateThe alternative format:
26527c478bd9Sstevel@tonic-gate
26537c478bd9Sstevel@tonic-gate	HSubject: $>+CheckSubject
26547c478bd9Sstevel@tonic-gate
26557c478bd9Sstevel@tonic-gatethat is, $>+ instead of $>, gives the full Subject: header including
26567c478bd9Sstevel@tonic-gatecomments to the ruleset (comments in parentheses () are stripped
26577c478bd9Sstevel@tonic-gateby default).
26587c478bd9Sstevel@tonic-gate
26597c478bd9Sstevel@tonic-gateA default ruleset for headers which don't have a specific ruleset
26607c478bd9Sstevel@tonic-gatedefined for them can be given by:
26617c478bd9Sstevel@tonic-gate
26627c478bd9Sstevel@tonic-gate	H*: $>CheckHdr
26637c478bd9Sstevel@tonic-gate
26647c478bd9Sstevel@tonic-gateNotice:
26657c478bd9Sstevel@tonic-gate1. All rules act on tokens as explained in doc/op/op.{me,ps,txt}.
26667c478bd9Sstevel@tonic-gateThat may cause problems with simple header checks due to the
26677c478bd9Sstevel@tonic-gatetokenization.  It might be simpler to use a regex map and apply it
26687c478bd9Sstevel@tonic-gateto $&{currHeader}.
26697c478bd9Sstevel@tonic-gate2. There are no default rulesets coming with this distribution of
267049218d4fSjbecksendmail.  You can write your own or search the WWW for examples.
26717c478bd9Sstevel@tonic-gate3. When using a default ruleset for headers, the name of the header
26727c478bd9Sstevel@tonic-gatecurrently being checked can be found in the $&{hdr_name} macro.
26737c478bd9Sstevel@tonic-gate
26747c478bd9Sstevel@tonic-gateAfter all of the headers are read, the check_eoh ruleset will be called for
26757c478bd9Sstevel@tonic-gateany final header-related checks.  The ruleset is called with the number of
26767c478bd9Sstevel@tonic-gateheaders and the size of all of the headers in bytes separated by $|.  One
26777c478bd9Sstevel@tonic-gateexample usage is to reject messages which do not have a Message-Id:
26787c478bd9Sstevel@tonic-gateheader.  However, the Message-Id: header is *NOT* a required header and is
26797c478bd9Sstevel@tonic-gatenot a guaranteed spam indicator.  This ruleset is an example and should
26807c478bd9Sstevel@tonic-gateprobably not be used in production.
26817c478bd9Sstevel@tonic-gate
26827c478bd9Sstevel@tonic-gate	LOCAL_CONFIG
26837c478bd9Sstevel@tonic-gate	Kstorage macro
26847c478bd9Sstevel@tonic-gate	HMessage-Id: $>CheckMessageId
26857c478bd9Sstevel@tonic-gate
26867c478bd9Sstevel@tonic-gate	LOCAL_RULESETS
26877c478bd9Sstevel@tonic-gate	SCheckMessageId
26887c478bd9Sstevel@tonic-gate	# Record the presence of the header
26897c478bd9Sstevel@tonic-gate	R$*			$: $(storage {MessageIdCheck} $@ OK $) $1
26907c478bd9Sstevel@tonic-gate	R< $+ @ $+ >		$@ OK
26917c478bd9Sstevel@tonic-gate	R$*			$#error $: 553 Header Error
26927c478bd9Sstevel@tonic-gate
26937c478bd9Sstevel@tonic-gate	Scheck_eoh
26947c478bd9Sstevel@tonic-gate	# Check the macro
26957c478bd9Sstevel@tonic-gate	R$*			$: < $&{MessageIdCheck} >
26967c478bd9Sstevel@tonic-gate	# Clear the macro for the next message
26977c478bd9Sstevel@tonic-gate	R$*			$: $(storage {MessageIdCheck} $) $1
26987c478bd9Sstevel@tonic-gate	# Has a Message-Id: header
26997c478bd9Sstevel@tonic-gate	R< $+ >			$@ OK
27007c478bd9Sstevel@tonic-gate	# Allow missing Message-Id: from local mail
27017c478bd9Sstevel@tonic-gate	R$*			$: < $&{client_name} >
27027c478bd9Sstevel@tonic-gate	R< >			$@ OK
27037c478bd9Sstevel@tonic-gate	R< $=w >		$@ OK
27047c478bd9Sstevel@tonic-gate	# Otherwise, reject the mail
27057c478bd9Sstevel@tonic-gate	R$*			$#error $: 553 Header Error
27067c478bd9Sstevel@tonic-gate
27077c478bd9Sstevel@tonic-gate
27087c478bd9Sstevel@tonic-gate+--------------------+
27097c478bd9Sstevel@tonic-gate| CONNECTION CONTROL |
27107c478bd9Sstevel@tonic-gate+--------------------+
27117c478bd9Sstevel@tonic-gate
27127c478bd9Sstevel@tonic-gateThe features ratecontrol and conncontrol allow to establish connection
27137c478bd9Sstevel@tonic-gatelimits per client IP address or net.  These features can limit the
27147c478bd9Sstevel@tonic-gaterate of connections (connections per time unit) or the number of
27157c478bd9Sstevel@tonic-gateincoming SMTP connections, respectively.  If enabled, appropriate
27167c478bd9Sstevel@tonic-gaterulesets are called at the end of check_relay, i.e., after DNS
27177c478bd9Sstevel@tonic-gateblacklists and generic access_db operations.  The features require
27187c478bd9Sstevel@tonic-gateFEATURE(`access_db') to be listed earlier in the mc file.
27197c478bd9Sstevel@tonic-gate
27207c478bd9Sstevel@tonic-gateNote: FEATURE(`delay_checks') delays those connection control checks
27217c478bd9Sstevel@tonic-gateafter a recipient address has been received, hence making these
27227c478bd9Sstevel@tonic-gateconnection control features less useful.  To run the checks as early
27237c478bd9Sstevel@tonic-gateas possible, specify the parameter `nodelay', e.g.,
27247c478bd9Sstevel@tonic-gate
27257c478bd9Sstevel@tonic-gate	FEATURE(`ratecontrol', `nodelay')
27267c478bd9Sstevel@tonic-gate
27277c478bd9Sstevel@tonic-gateIn that case, FEATURE(`delay_checks') has no effect on connection
27287c478bd9Sstevel@tonic-gatecontrol (and it must be specified earlier in the mc file).
27297c478bd9Sstevel@tonic-gate
27307c478bd9Sstevel@tonic-gateAn optional second argument `terminate' specifies whether the
27317c478bd9Sstevel@tonic-gaterulesets should return the error code 421 which will cause
27327c478bd9Sstevel@tonic-gatesendmail to terminate the session with that error if it is
27337c478bd9Sstevel@tonic-gatereturned from check_relay, i.e., not delayed as explained in
27347c478bd9Sstevel@tonic-gatethe previous paragraph.  Example:
27357c478bd9Sstevel@tonic-gate
27367c478bd9Sstevel@tonic-gate	FEATURE(`ratecontrol', `nodelay', `terminate')
27377c478bd9Sstevel@tonic-gate
27387c478bd9Sstevel@tonic-gate
27397c478bd9Sstevel@tonic-gate+----------+
27407c478bd9Sstevel@tonic-gate| STARTTLS |
27417c478bd9Sstevel@tonic-gate+----------+
27427c478bd9Sstevel@tonic-gate
27437c478bd9Sstevel@tonic-gateIn this text, cert will be used as an abbreviation for X.509 certificate,
27447c478bd9Sstevel@tonic-gateDN (CN) is the distinguished (common) name of a cert, and CA is a
27457c478bd9Sstevel@tonic-gatecertification authority, which signs (issues) certs.
27467c478bd9Sstevel@tonic-gate
27477c478bd9Sstevel@tonic-gateFor STARTTLS to be offered by sendmail you need to set at least
27487c478bd9Sstevel@tonic-gatethese variables (the file names and paths are just examples):
27497c478bd9Sstevel@tonic-gate
27507c478bd9Sstevel@tonic-gate	define(`confCACERT_PATH', `/etc/mail/certs/')
27517c478bd9Sstevel@tonic-gate	define(`confCACERT', `/etc/mail/certs/CA.cert.pem')
27527c478bd9Sstevel@tonic-gate	define(`confSERVER_CERT', `/etc/mail/certs/my.cert.pem')
27537c478bd9Sstevel@tonic-gate	define(`confSERVER_KEY', `/etc/mail/certs/my.key.pem')
27547c478bd9Sstevel@tonic-gate
27557c478bd9Sstevel@tonic-gateOn systems which do not have the compile flag HASURANDOM set (see
27567c478bd9Sstevel@tonic-gatesendmail/README) you also must set confRAND_FILE.
27577c478bd9Sstevel@tonic-gate
27587c478bd9Sstevel@tonic-gateSee doc/op/op.{me,ps,txt} for more information about these options,
27597c478bd9Sstevel@tonic-gateespecially the sections ``Certificates for STARTTLS'' and ``PRNG for
27607c478bd9Sstevel@tonic-gateSTARTTLS''.
27617c478bd9Sstevel@tonic-gate
27627c478bd9Sstevel@tonic-gateMacros related to STARTTLS are:
27637c478bd9Sstevel@tonic-gate
27647c478bd9Sstevel@tonic-gate${cert_issuer} holds the DN of the CA (the cert issuer).
27657c478bd9Sstevel@tonic-gate${cert_subject} holds the DN of the cert (called the cert subject).
27667c478bd9Sstevel@tonic-gate${cn_issuer} holds the CN of the CA (the cert issuer).
27677c478bd9Sstevel@tonic-gate${cn_subject} holds the CN of the cert (called the cert subject).
27687c478bd9Sstevel@tonic-gate${tls_version} the TLS/SSL version used for the connection, e.g., TLSv1,
27697c478bd9Sstevel@tonic-gate	TLSv1/SSLv3, SSLv3, SSLv2.
27707c478bd9Sstevel@tonic-gate${cipher} the cipher used for the connection, e.g., EDH-DSS-DES-CBC3-SHA,
27717c478bd9Sstevel@tonic-gate	EDH-RSA-DES-CBC-SHA, DES-CBC-MD5, DES-CBC3-SHA.
27727c478bd9Sstevel@tonic-gate${cipher_bits} the keylength (in bits) of the symmetric encryption algorithm
27737c478bd9Sstevel@tonic-gate	used for the connection.
27747c478bd9Sstevel@tonic-gate${verify} holds the result of the verification of the presented cert.
27757c478bd9Sstevel@tonic-gate	Possible values are:
27767c478bd9Sstevel@tonic-gate	OK	 verification succeeded.
27777c478bd9Sstevel@tonic-gate	NO	 no cert presented.
27787c478bd9Sstevel@tonic-gate	NOT	 no cert requested.
27797c478bd9Sstevel@tonic-gate	FAIL	 cert presented but could not be verified,
27807c478bd9Sstevel@tonic-gate		 e.g., the cert of the signing CA is missing.
27817c478bd9Sstevel@tonic-gate	NONE	 STARTTLS has not been performed.
27827c478bd9Sstevel@tonic-gate	TEMP	 temporary error occurred.
27837c478bd9Sstevel@tonic-gate	PROTOCOL protocol error occurred (SMTP level).
27847c478bd9Sstevel@tonic-gate	SOFTWARE STARTTLS handshake failed.
27857c478bd9Sstevel@tonic-gate${server_name} the name of the server of the current outgoing SMTP
27867c478bd9Sstevel@tonic-gate	connection.
27877c478bd9Sstevel@tonic-gate${server_addr} the address of the server of the current outgoing SMTP
27887c478bd9Sstevel@tonic-gate	connection.
27897c478bd9Sstevel@tonic-gate
27907c478bd9Sstevel@tonic-gateRelaying
27917c478bd9Sstevel@tonic-gate--------
27927c478bd9Sstevel@tonic-gate
27937c478bd9Sstevel@tonic-gateSMTP STARTTLS can allow relaying for remote SMTP clients which have
27947c478bd9Sstevel@tonic-gatesuccessfully authenticated themselves.  If the verification of the cert
27957c478bd9Sstevel@tonic-gatefailed (${verify} != OK), relaying is subject to the usual rules.
27967c478bd9Sstevel@tonic-gateOtherwise the DN of the issuer is looked up in the access map using the
27977c478bd9Sstevel@tonic-gatetag CERTISSUER.  If the resulting value is RELAY, relaying is allowed.
27987c478bd9Sstevel@tonic-gateIf it is SUBJECT, the DN of the cert subject is looked up next in the
27997c478bd9Sstevel@tonic-gateaccess map using the tag CERTSUBJECT.  If the value is RELAY, relaying
28007c478bd9Sstevel@tonic-gateis allowed.
28017c478bd9Sstevel@tonic-gate
28027c478bd9Sstevel@tonic-gateTo make things a bit more flexible (or complicated), the values for
28037c478bd9Sstevel@tonic-gate${cert_issuer} and ${cert_subject} can be optionally modified by regular
28047c478bd9Sstevel@tonic-gateexpressions defined in the m4 variables _CERT_REGEX_ISSUER_ and
28057c478bd9Sstevel@tonic-gate_CERT_REGEX_SUBJECT_, respectively.  To avoid problems with those macros in
28067c478bd9Sstevel@tonic-gaterulesets and map lookups, they are modified as follows: each non-printable
28077c478bd9Sstevel@tonic-gatecharacter and the characters '<', '>', '(', ')', '"', '+', ' ' are replaced
28087c478bd9Sstevel@tonic-gateby their HEX value with a leading '+'.  For example:
28097c478bd9Sstevel@tonic-gate
28107c478bd9Sstevel@tonic-gate/C=US/ST=California/O=endmail.org/OU=private/CN=Darth Mail (Cert)/Email=
28117c478bd9Sstevel@tonic-gatedarth+cert@endmail.org
28127c478bd9Sstevel@tonic-gate
28137c478bd9Sstevel@tonic-gateis encoded as:
28147c478bd9Sstevel@tonic-gate
28157c478bd9Sstevel@tonic-gate/C=US/ST=California/O=endmail.org/OU=private/CN=
28167c478bd9Sstevel@tonic-gateDarth+20Mail+20+28Cert+29/Email=darth+2Bcert@endmail.org
28177c478bd9Sstevel@tonic-gate
28187c478bd9Sstevel@tonic-gate(line breaks have been inserted for readability).
28197c478bd9Sstevel@tonic-gate
28207c478bd9Sstevel@tonic-gateThe  macros  which are subject to this encoding are ${cert_subject},
28217c478bd9Sstevel@tonic-gate${cert_issuer},  ${cn_subject},  and ${cn_issuer}.
28227c478bd9Sstevel@tonic-gate
28237c478bd9Sstevel@tonic-gateExamples:
28247c478bd9Sstevel@tonic-gate
28257c478bd9Sstevel@tonic-gateTo allow relaying for everyone who can present a cert signed by
28267c478bd9Sstevel@tonic-gate
28277c478bd9Sstevel@tonic-gate/C=US/ST=California/O=endmail.org/OU=private/CN=
28287c478bd9Sstevel@tonic-gateDarth+20Mail+20+28Cert+29/Email=darth+2Bcert@endmail.org
28297c478bd9Sstevel@tonic-gate
28307c478bd9Sstevel@tonic-gatesimply use:
28317c478bd9Sstevel@tonic-gate
28327c478bd9Sstevel@tonic-gateCertIssuer:/C=US/ST=California/O=endmail.org/OU=private/CN=
28337c478bd9Sstevel@tonic-gateDarth+20Mail+20+28Cert+29/Email=darth+2Bcert@endmail.org	RELAY
28347c478bd9Sstevel@tonic-gate
28357c478bd9Sstevel@tonic-gateTo allow relaying only for a subset of machines that have a cert signed by
28367c478bd9Sstevel@tonic-gate
28377c478bd9Sstevel@tonic-gate/C=US/ST=California/O=endmail.org/OU=private/CN=
28387c478bd9Sstevel@tonic-gateDarth+20Mail+20+28Cert+29/Email=darth+2Bcert@endmail.org
28397c478bd9Sstevel@tonic-gate
28407c478bd9Sstevel@tonic-gateuse:
28417c478bd9Sstevel@tonic-gate
28427c478bd9Sstevel@tonic-gateCertIssuer:/C=US/ST=California/O=endmail.org/OU=private/CN=
28437c478bd9Sstevel@tonic-gateDarth+20Mail+20+28Cert+29/Email=darth+2Bcert@endmail.org	SUBJECT
28447c478bd9Sstevel@tonic-gateCertSubject:/C=US/ST=California/O=endmail.org/OU=private/CN=
28457c478bd9Sstevel@tonic-gateDeathStar/Email=deathstar@endmail.org		RELAY
28467c478bd9Sstevel@tonic-gate
28477c478bd9Sstevel@tonic-gateNotes:
28487c478bd9Sstevel@tonic-gate- line breaks have been inserted after "CN=" for readability,
28497c478bd9Sstevel@tonic-gate  each tagged entry must be one (long) line in the access map.
28507c478bd9Sstevel@tonic-gate- if OpenSSL 0.9.7 or newer is used then the "Email=" part of a DN
28517c478bd9Sstevel@tonic-gate  is replaced by "emailAddress=".
28527c478bd9Sstevel@tonic-gate
28537c478bd9Sstevel@tonic-gateOf course it is also possible to write a simple ruleset that allows
28547c478bd9Sstevel@tonic-gaterelaying for everyone who can present a cert that can be verified, e.g.,
28557c478bd9Sstevel@tonic-gate
28567c478bd9Sstevel@tonic-gateLOCAL_RULESETS
28577c478bd9Sstevel@tonic-gateSLocal_check_rcpt
28587c478bd9Sstevel@tonic-gateR$*	$: $&{verify}
28597c478bd9Sstevel@tonic-gateROK	$# OK
28607c478bd9Sstevel@tonic-gate
28617c478bd9Sstevel@tonic-gateAllowing Connections
28627c478bd9Sstevel@tonic-gate--------------------
28637c478bd9Sstevel@tonic-gate
28647c478bd9Sstevel@tonic-gateThe rulesets tls_server, tls_client, and tls_rcpt are used to decide whether
28657c478bd9Sstevel@tonic-gatean SMTP connection is accepted (or should continue).
28667c478bd9Sstevel@tonic-gate
28677c478bd9Sstevel@tonic-gatetls_server is called when sendmail acts as client after a STARTTLS command
28687c478bd9Sstevel@tonic-gate(should) have been issued.  The parameter is the value of ${verify}.
28697c478bd9Sstevel@tonic-gate
28707c478bd9Sstevel@tonic-gatetls_client is called when sendmail acts as server, after a STARTTLS command
28717c478bd9Sstevel@tonic-gatehas been issued, and from check_mail.  The parameter is the value of
28727c478bd9Sstevel@tonic-gate${verify} and STARTTLS or MAIL, respectively.
28737c478bd9Sstevel@tonic-gate
28747c478bd9Sstevel@tonic-gateBoth rulesets behave the same.  If no access map is in use, the connection
28757c478bd9Sstevel@tonic-gatewill be accepted unless ${verify} is SOFTWARE, in which case the connection
28767c478bd9Sstevel@tonic-gateis always aborted.  For tls_server/tls_client, ${client_name}/${server_name}
28777c478bd9Sstevel@tonic-gateis looked up in the access map using the tag TLS_Srv/TLS_Clt, which is done
28787c478bd9Sstevel@tonic-gatewith the ruleset LookUpDomain.  If no entry is found, ${client_addr}
28797c478bd9Sstevel@tonic-gate(${server_addr}) is looked up in the access map (same tag, ruleset
28807c478bd9Sstevel@tonic-gateLookUpAddr).  If this doesn't result in an entry either, just the tag is
28817c478bd9Sstevel@tonic-gatelooked up in the access map (included the trailing colon).  Notice:
28827c478bd9Sstevel@tonic-gaterequiring that e-mail is sent to a server only encrypted, e.g., via
28837c478bd9Sstevel@tonic-gate
28847c478bd9Sstevel@tonic-gateTLS_Srv:secure.domain	ENCR:112
28857c478bd9Sstevel@tonic-gate
28867c478bd9Sstevel@tonic-gatedoesn't necessarily mean that e-mail sent to that domain is encrypted.
28877c478bd9Sstevel@tonic-gateIf the domain has multiple MX servers, e.g.,
28887c478bd9Sstevel@tonic-gate
28897c478bd9Sstevel@tonic-gatesecure.domain.	IN MX 10	mail.secure.domain.
28907c478bd9Sstevel@tonic-gatesecure.domain.	IN MX 50	mail.other.domain.
28917c478bd9Sstevel@tonic-gate
28927c478bd9Sstevel@tonic-gatethen mail to user@secure.domain may go unencrypted to mail.other.domain.
28937c478bd9Sstevel@tonic-gatetls_rcpt can be used to address this problem.
28947c478bd9Sstevel@tonic-gate
28957c478bd9Sstevel@tonic-gatetls_rcpt is called before a RCPT TO: command is sent.  The parameter is the
28967c478bd9Sstevel@tonic-gatecurrent recipient.  This ruleset is only defined if FEATURE(`access_db')
28977c478bd9Sstevel@tonic-gateis selected.  A recipient address user@domain is looked up in the access
28987c478bd9Sstevel@tonic-gatemap in four formats: TLS_Rcpt:user@domain, TLS_Rcpt:user@, TLS_Rcpt:domain,
28997c478bd9Sstevel@tonic-gateand TLS_Rcpt:; the first match is taken.
29007c478bd9Sstevel@tonic-gate
29017c478bd9Sstevel@tonic-gateThe result of the lookups is then used to call the ruleset TLS_connection,
29027c478bd9Sstevel@tonic-gatewhich checks the requirement specified by the RHS in the access map against
29037c478bd9Sstevel@tonic-gatethe actual parameters of the current TLS connection, esp. ${verify} and
29047c478bd9Sstevel@tonic-gate${cipher_bits}.  Legal RHSs in the access map are:
29057c478bd9Sstevel@tonic-gate
29067c478bd9Sstevel@tonic-gateVERIFY		verification must have succeeded
29077c478bd9Sstevel@tonic-gateVERIFY:bits	verification must have succeeded and ${cipher_bits} must
29087c478bd9Sstevel@tonic-gate		be greater than or equal bits.
29097c478bd9Sstevel@tonic-gateENCR:bits	${cipher_bits} must be greater than or equal bits.
29107c478bd9Sstevel@tonic-gate
29117c478bd9Sstevel@tonic-gateThe RHS can optionally be prefixed by TEMP+ or PERM+ to select a temporary
29127c478bd9Sstevel@tonic-gateor permanent error.  The default is a temporary error code (403 4.7.0)
29137c478bd9Sstevel@tonic-gateunless the macro TLS_PERM_ERR is set during generation of the .cf file.
29147c478bd9Sstevel@tonic-gate
29157c478bd9Sstevel@tonic-gateIf a certain level of encryption is required, then it might also be
29167c478bd9Sstevel@tonic-gatepossible that this level is provided by the security layer from a SASL
29177c478bd9Sstevel@tonic-gatealgorithm, e.g., DIGEST-MD5.
29187c478bd9Sstevel@tonic-gate
29197c478bd9Sstevel@tonic-gateFurthermore, there can be a list of extensions added.  Such a list
29207c478bd9Sstevel@tonic-gatestarts with '+' and the items are separated by '++'.  Allowed
29217c478bd9Sstevel@tonic-gateextensions are:
29227c478bd9Sstevel@tonic-gate
29237c478bd9Sstevel@tonic-gateCN:name		name must match ${cn_subject}
2924*e9af4bc0SJohn BeckCN		${client_name}/${server_name} must match ${cn_subject}
29257c478bd9Sstevel@tonic-gateCS:name		name must match ${cert_subject}
29267c478bd9Sstevel@tonic-gateCI:name		name must match ${cert_issuer}
29277c478bd9Sstevel@tonic-gate
29287c478bd9Sstevel@tonic-gateExample: e-mail sent to secure.example.com should only use an encrypted
29297c478bd9Sstevel@tonic-gateconnection.  E-mail received from hosts within the laptop.example.com domain
29307c478bd9Sstevel@tonic-gateshould only be accepted if they have been authenticated.  The host which
29317c478bd9Sstevel@tonic-gatereceives e-mail for darth@endmail.org must present a cert that uses the
29327c478bd9Sstevel@tonic-gateCN smtp.endmail.org.
29337c478bd9Sstevel@tonic-gate
29347c478bd9Sstevel@tonic-gateTLS_Srv:secure.example.com      ENCR:112
29357c478bd9Sstevel@tonic-gateTLS_Clt:laptop.example.com      PERM+VERIFY:112
29367c478bd9Sstevel@tonic-gateTLS_Rcpt:darth@endmail.org	ENCR:112+CN:smtp.endmail.org
29377c478bd9Sstevel@tonic-gate
29387c478bd9Sstevel@tonic-gate
29397c478bd9Sstevel@tonic-gateDisabling STARTTLS And Setting SMTP Server Features
29407c478bd9Sstevel@tonic-gate---------------------------------------------------
29417c478bd9Sstevel@tonic-gate
29427c478bd9Sstevel@tonic-gateBy default STARTTLS is used whenever possible.  However, there are
29437c478bd9Sstevel@tonic-gatesome broken MTAs that don't properly implement STARTTLS.  To be able
29447c478bd9Sstevel@tonic-gateto send to (or receive from) those MTAs, the ruleset try_tls
29457c478bd9Sstevel@tonic-gate(srv_features) can be used that work together with the access map.
29467c478bd9Sstevel@tonic-gateEntries for the access map must be tagged with Try_TLS (Srv_Features)
29477c478bd9Sstevel@tonic-gateand refer to the hostname or IP address of the connecting system.
29487c478bd9Sstevel@tonic-gateA default case can be specified by using just the tag.  For example,
29497c478bd9Sstevel@tonic-gatethe following entries in the access map:
29507c478bd9Sstevel@tonic-gate
29517c478bd9Sstevel@tonic-gate	Try_TLS:broken.server	NO
29527c478bd9Sstevel@tonic-gate	Srv_Features:my.domain	v
29537c478bd9Sstevel@tonic-gate	Srv_Features:		V
29547c478bd9Sstevel@tonic-gate
29557c478bd9Sstevel@tonic-gatewill turn off STARTTLS when sending to broken.server (or any host
29567c478bd9Sstevel@tonic-gatein that domain), and request a client certificate during the TLS
29577c478bd9Sstevel@tonic-gatehandshake only for hosts in my.domain.  The valid entries on the RHS
29587c478bd9Sstevel@tonic-gatefor Srv_Features are listed in the Sendmail Installation and
29597c478bd9Sstevel@tonic-gateOperations Guide.
29607c478bd9Sstevel@tonic-gate
29617c478bd9Sstevel@tonic-gate
29627c478bd9Sstevel@tonic-gateReceived: Header
29637c478bd9Sstevel@tonic-gate----------------
29647c478bd9Sstevel@tonic-gate
29657c478bd9Sstevel@tonic-gateThe Received: header reveals whether STARTTLS has been used.  It contains an
29667c478bd9Sstevel@tonic-gateextra line:
29677c478bd9Sstevel@tonic-gate
29687c478bd9Sstevel@tonic-gate(version=${tls_version} cipher=${cipher} bits=${cipher_bits} verify=${verify})
29697c478bd9Sstevel@tonic-gate
29707c478bd9Sstevel@tonic-gate
29717c478bd9Sstevel@tonic-gate+--------------------------------+
29727c478bd9Sstevel@tonic-gate| ADDING NEW MAILERS OR RULESETS |
29737c478bd9Sstevel@tonic-gate+--------------------------------+
29747c478bd9Sstevel@tonic-gate
29757c478bd9Sstevel@tonic-gateSometimes you may need to add entirely new mailers or rulesets.  They
29767c478bd9Sstevel@tonic-gateshould be introduced with the constructs MAILER_DEFINITIONS and
29777c478bd9Sstevel@tonic-gateLOCAL_RULESETS respectively.  For example:
29787c478bd9Sstevel@tonic-gate
29797c478bd9Sstevel@tonic-gate	MAILER_DEFINITIONS
29807c478bd9Sstevel@tonic-gate	Mmymailer, ...
29817c478bd9Sstevel@tonic-gate	...
29827c478bd9Sstevel@tonic-gate
29837c478bd9Sstevel@tonic-gate	LOCAL_RULESETS
29847c478bd9Sstevel@tonic-gate	Smyruleset
29857c478bd9Sstevel@tonic-gate	...
29867c478bd9Sstevel@tonic-gate
298749218d4fSjbeckLocal additions for the rulesets srv_features, try_tls, tls_rcpt,
298849218d4fSjbecktls_client, and tls_server can be made using LOCAL_SRV_FEATURES,
298949218d4fSjbeckLOCAL_TRY_TLS, LOCAL_TLS_RCPT, LOCAL_TLS_CLIENT, and LOCAL_TLS_SERVER,
299049218d4fSjbeckrespectively.  For example, to add a local ruleset that decides
299149218d4fSjbeckwhether to try STARTTLS in a sendmail client, use:
299249218d4fSjbeck
299349218d4fSjbeck	LOCAL_TRY_TLS
299449218d4fSjbeck	R...
299549218d4fSjbeck
29967c478bd9Sstevel@tonic-gateNote: you don't need to add a name for the ruleset, it is implicitly
29977c478bd9Sstevel@tonic-gatedefined by using the appropriate macro.
29987c478bd9Sstevel@tonic-gate
29997c478bd9Sstevel@tonic-gate
30007c478bd9Sstevel@tonic-gate+-------------------------+
30017c478bd9Sstevel@tonic-gate| ADDING NEW MAIL FILTERS |
30027c478bd9Sstevel@tonic-gate+-------------------------+
30037c478bd9Sstevel@tonic-gate
30047c478bd9Sstevel@tonic-gateSendmail supports mail filters to filter incoming SMTP messages according
30057c478bd9Sstevel@tonic-gateto the "Sendmail Mail Filter API" documentation.  These filters can be
30067c478bd9Sstevel@tonic-gateconfigured in your mc file using the two commands:
30077c478bd9Sstevel@tonic-gate
30087c478bd9Sstevel@tonic-gate	MAIL_FILTER(`name', `equates')
30097c478bd9Sstevel@tonic-gate	INPUT_MAIL_FILTER(`name', `equates')
30107c478bd9Sstevel@tonic-gate
30117c478bd9Sstevel@tonic-gateThe first command, MAIL_FILTER(), simply defines a filter with the given
30127c478bd9Sstevel@tonic-gatename and equates.  For example:
30137c478bd9Sstevel@tonic-gate
30147c478bd9Sstevel@tonic-gate	MAIL_FILTER(`archive', `S=local:/var/run/archivesock, F=R')
30157c478bd9Sstevel@tonic-gate
30167c478bd9Sstevel@tonic-gateThis creates the equivalent sendmail.cf entry:
30177c478bd9Sstevel@tonic-gate
30187c478bd9Sstevel@tonic-gate	Xarchive, S=local:/var/run/archivesock, F=R
30197c478bd9Sstevel@tonic-gate
30207c478bd9Sstevel@tonic-gateThe INPUT_MAIL_FILTER() command performs the same actions as MAIL_FILTER
30217c478bd9Sstevel@tonic-gatebut also populates the m4 variable `confINPUT_MAIL_FILTERS' with the name
30227c478bd9Sstevel@tonic-gateof the filter such that the filter will actually be called by sendmail.
30237c478bd9Sstevel@tonic-gate
30247c478bd9Sstevel@tonic-gateFor example, the two commands:
30257c478bd9Sstevel@tonic-gate
30267c478bd9Sstevel@tonic-gate	INPUT_MAIL_FILTER(`archive', `S=local:/var/run/archivesock, F=R')
30277c478bd9Sstevel@tonic-gate	INPUT_MAIL_FILTER(`spamcheck', `S=inet:2525@localhost, F=T')
30287c478bd9Sstevel@tonic-gate
30297c478bd9Sstevel@tonic-gateare equivalent to the three commands:
30307c478bd9Sstevel@tonic-gate
30317c478bd9Sstevel@tonic-gate	MAIL_FILTER(`archive', `S=local:/var/run/archivesock, F=R')
30327c478bd9Sstevel@tonic-gate	MAIL_FILTER(`spamcheck', `S=inet:2525@localhost, F=T')
30337c478bd9Sstevel@tonic-gate	define(`confINPUT_MAIL_FILTERS', `archive, spamcheck')
30347c478bd9Sstevel@tonic-gate
30357c478bd9Sstevel@tonic-gateIn general, INPUT_MAIL_FILTER() should be used unless you need to define
30367c478bd9Sstevel@tonic-gatemore filters than you want to use for `confINPUT_MAIL_FILTERS'.
30377c478bd9Sstevel@tonic-gate
30387c478bd9Sstevel@tonic-gateNote that setting `confINPUT_MAIL_FILTERS' after any INPUT_MAIL_FILTER()
30397c478bd9Sstevel@tonic-gatecommands will clear the list created by the prior INPUT_MAIL_FILTER()
30407c478bd9Sstevel@tonic-gatecommands.
30417c478bd9Sstevel@tonic-gate
30427c478bd9Sstevel@tonic-gate
30437c478bd9Sstevel@tonic-gate+-------------------------+
30447c478bd9Sstevel@tonic-gate| QUEUE GROUP DEFINITIONS |
30457c478bd9Sstevel@tonic-gate+-------------------------+
30467c478bd9Sstevel@tonic-gate
30477c478bd9Sstevel@tonic-gateIn addition to the queue directory (which is the default queue group
30487c478bd9Sstevel@tonic-gatecalled "mqueue"), sendmail can deal with multiple queue groups, which
30497c478bd9Sstevel@tonic-gateare collections of queue directories with the same behaviour.  Queue
30507c478bd9Sstevel@tonic-gategroups can be defined using the command:
30517c478bd9Sstevel@tonic-gate
30527c478bd9Sstevel@tonic-gate	QUEUE_GROUP(`name', `equates')
30537c478bd9Sstevel@tonic-gate
30547c478bd9Sstevel@tonic-gateFor details about queue groups, please see doc/op/op.{me,ps,txt}.
30557c478bd9Sstevel@tonic-gate
30567c478bd9Sstevel@tonic-gate+-------------------------------+
30577c478bd9Sstevel@tonic-gate| NON-SMTP BASED CONFIGURATIONS |
30587c478bd9Sstevel@tonic-gate+-------------------------------+
30597c478bd9Sstevel@tonic-gate
30607c478bd9Sstevel@tonic-gateThese configuration files are designed primarily for use by
30617c478bd9Sstevel@tonic-gateSMTP-based sites.  They may not be well tuned for UUCP-only or
30627c478bd9Sstevel@tonic-gateUUCP-primarily nodes (the latter is defined as a small local net
30637c478bd9Sstevel@tonic-gateconnected to the rest of the world via UUCP).  However, there is
30647c478bd9Sstevel@tonic-gateone hook to handle some special cases.
30657c478bd9Sstevel@tonic-gate
30667c478bd9Sstevel@tonic-gateYou can define a ``smart host'' that understands a richer address syntax
30677c478bd9Sstevel@tonic-gateusing:
30687c478bd9Sstevel@tonic-gate
30697c478bd9Sstevel@tonic-gate	define(`SMART_HOST', `mailer:hostname')
30707c478bd9Sstevel@tonic-gate
30717c478bd9Sstevel@tonic-gateIn this case, the ``mailer:'' defaults to "relay".  Any messages that
30727c478bd9Sstevel@tonic-gatecan't be handled using the usual UUCP rules are passed to this host.
30737c478bd9Sstevel@tonic-gate
30747c478bd9Sstevel@tonic-gateIf you are on a local SMTP-based net that connects to the outside
30757c478bd9Sstevel@tonic-gateworld via UUCP, you can use LOCAL_NET_CONFIG to add appropriate rules.
30767c478bd9Sstevel@tonic-gateFor example:
30777c478bd9Sstevel@tonic-gate
30787c478bd9Sstevel@tonic-gate	define(`SMART_HOST', `uucp-new:uunet')
30797c478bd9Sstevel@tonic-gate	LOCAL_NET_CONFIG
30807c478bd9Sstevel@tonic-gate	R$* < @ $* .$m. > $*	$#smtp $@ $2.$m. $: $1 < @ $2.$m. > $3
30817c478bd9Sstevel@tonic-gate
30827c478bd9Sstevel@tonic-gateThis will cause all names that end in your domain name ($m) to be sent
30837c478bd9Sstevel@tonic-gatevia SMTP; anything else will be sent via uucp-new (smart UUCP) to uunet.
30847c478bd9Sstevel@tonic-gateIf you have FEATURE(`nocanonify'), you may need to omit the dots after
30857c478bd9Sstevel@tonic-gatethe $m.  If you are running a local DNS inside your domain which is
30867c478bd9Sstevel@tonic-gatenot otherwise connected to the outside world, you probably want to
30877c478bd9Sstevel@tonic-gateuse:
30887c478bd9Sstevel@tonic-gate
30897c478bd9Sstevel@tonic-gate	define(`SMART_HOST', `smtp:fire.wall.com')
30907c478bd9Sstevel@tonic-gate	LOCAL_NET_CONFIG
30917c478bd9Sstevel@tonic-gate	R$* < @ $* . > $*	$#smtp $@ $2. $: $1 < @ $2. > $3
30927c478bd9Sstevel@tonic-gate
30937c478bd9Sstevel@tonic-gateThat is, send directly only to things you found in your DNS lookup;
30947c478bd9Sstevel@tonic-gateanything else goes through SMART_HOST.
30957c478bd9Sstevel@tonic-gate
30967c478bd9Sstevel@tonic-gateYou may need to turn off the anti-spam rules in order to accept
30977c478bd9Sstevel@tonic-gateUUCP mail with FEATURE(`promiscuous_relay') and
30987c478bd9Sstevel@tonic-gateFEATURE(`accept_unresolvable_domains').
30997c478bd9Sstevel@tonic-gate
31007c478bd9Sstevel@tonic-gate
31017c478bd9Sstevel@tonic-gate+-----------+
31027c478bd9Sstevel@tonic-gate| WHO AM I? |
31037c478bd9Sstevel@tonic-gate+-----------+
31047c478bd9Sstevel@tonic-gate
31057c478bd9Sstevel@tonic-gateNormally, the $j macro is automatically defined to be your fully
31067c478bd9Sstevel@tonic-gatequalified domain name (FQDN).  Sendmail does this by getting your
31077c478bd9Sstevel@tonic-gatehost name using gethostname and then calling gethostbyname on the
31087c478bd9Sstevel@tonic-gateresult.  For example, in some environments gethostname returns
31097c478bd9Sstevel@tonic-gateonly the root of the host name (such as "foo"); gethostbyname is
31107c478bd9Sstevel@tonic-gatesupposed to return the FQDN ("foo.bar.com").  In some (fairly rare)
31117c478bd9Sstevel@tonic-gatecases, gethostbyname may fail to return the FQDN.  In this case
31127c478bd9Sstevel@tonic-gateyou MUST define confDOMAIN_NAME to be your fully qualified domain
31137c478bd9Sstevel@tonic-gatename.  This is usually done using:
31147c478bd9Sstevel@tonic-gate
31157c478bd9Sstevel@tonic-gate	Dmbar.com
31167c478bd9Sstevel@tonic-gate	define(`confDOMAIN_NAME', `$w.$m')dnl
31177c478bd9Sstevel@tonic-gate
31187c478bd9Sstevel@tonic-gate
31197c478bd9Sstevel@tonic-gate+-----------------------------------+
31207c478bd9Sstevel@tonic-gate| ACCEPTING MAIL FOR MULTIPLE NAMES |
31217c478bd9Sstevel@tonic-gate+-----------------------------------+
31227c478bd9Sstevel@tonic-gate
31237c478bd9Sstevel@tonic-gateIf your host is known by several different names, you need to augment
31247c478bd9Sstevel@tonic-gateclass {w}.  This is a list of names by which your host is known, and
31257c478bd9Sstevel@tonic-gateanything sent to an address using a host name in this list will be
31267c478bd9Sstevel@tonic-gatetreated as local mail.  You can do this in two ways:  either create the
31277c478bd9Sstevel@tonic-gatefile /etc/mail/local-host-names containing a list of your aliases (one per
31287c478bd9Sstevel@tonic-gateline), and use ``FEATURE(`use_cw_file')'' in the .mc file, or add
31297c478bd9Sstevel@tonic-gate``LOCAL_DOMAIN(`alias.host.name')''.  Be sure you use the fully-qualified
31307c478bd9Sstevel@tonic-gatename of the host, rather than a short name.
31317c478bd9Sstevel@tonic-gate
31327c478bd9Sstevel@tonic-gateIf you want to have different address in different domains, take
31337c478bd9Sstevel@tonic-gatea look at the virtusertable feature, which is also explained at
31347c478bd9Sstevel@tonic-gatehttp://www.sendmail.org/virtual-hosting.html
31357c478bd9Sstevel@tonic-gate
31367c478bd9Sstevel@tonic-gate
31377c478bd9Sstevel@tonic-gate+--------------------+
31387c478bd9Sstevel@tonic-gate| USING MAILERTABLES |
31397c478bd9Sstevel@tonic-gate+--------------------+
31407c478bd9Sstevel@tonic-gate
31417c478bd9Sstevel@tonic-gateTo use FEATURE(`mailertable'), you will have to create an external
31427c478bd9Sstevel@tonic-gatedatabase containing the routing information for various domains.
31437c478bd9Sstevel@tonic-gateFor example, a mailertable file in text format might be:
31447c478bd9Sstevel@tonic-gate
31457c478bd9Sstevel@tonic-gate	.my.domain		xnet:%1.my.domain
31467c478bd9Sstevel@tonic-gate	uuhost1.my.domain	uucp-new:uuhost1
31477c478bd9Sstevel@tonic-gate	.bitnet			smtp:relay.bit.net
31487c478bd9Sstevel@tonic-gate
31497c478bd9Sstevel@tonic-gateThis should normally be stored in /etc/mail/mailertable.  The actual
31507c478bd9Sstevel@tonic-gatedatabase version of the mailertable is built using:
31517c478bd9Sstevel@tonic-gate
31527c478bd9Sstevel@tonic-gate	makemap hash /etc/mail/mailertable < /etc/mail/mailertable
31537c478bd9Sstevel@tonic-gate
31547c478bd9Sstevel@tonic-gateThe semantics are simple.  Any LHS entry that does not begin with
31557c478bd9Sstevel@tonic-gatea dot matches the full host name indicated.  LHS entries beginning
31567c478bd9Sstevel@tonic-gatewith a dot match anything ending with that domain name (including
31577c478bd9Sstevel@tonic-gatethe leading dot) -- that is, they can be thought of as having a
31587c478bd9Sstevel@tonic-gateleading ".+" regular expression pattern for a non-empty sequence of
31597c478bd9Sstevel@tonic-gatecharacters.  Matching is done in order of most-to-least qualified
31607c478bd9Sstevel@tonic-gate-- for example, even though ".my.domain" is listed first in the
31617c478bd9Sstevel@tonic-gateabove example, an entry of "uuhost1.my.domain" will match the second
31627c478bd9Sstevel@tonic-gateentry since it is more explicit.  Note: e-mail to "user@my.domain"
31637c478bd9Sstevel@tonic-gatedoes not match any entry in the above table.  You need to have
31647c478bd9Sstevel@tonic-gatesomething like:
31657c478bd9Sstevel@tonic-gate
31667c478bd9Sstevel@tonic-gate	my.domain		esmtp:host.my.domain
31677c478bd9Sstevel@tonic-gate
31687c478bd9Sstevel@tonic-gateThe RHS should always be a "mailer:host" pair.  The mailer is the
31697c478bd9Sstevel@tonic-gateconfiguration name of a mailer (that is, an M line in the
31707c478bd9Sstevel@tonic-gatesendmail.cf file).  The "host" will be the hostname passed to
31717c478bd9Sstevel@tonic-gatethat mailer.  In domain-based matches (that is, those with leading
31727c478bd9Sstevel@tonic-gatedots) the "%1" may be used to interpolate the wildcarded part of
31737c478bd9Sstevel@tonic-gatethe host name.  For example, the first line above sends everything
31747c478bd9Sstevel@tonic-gateaddressed to "anything.my.domain" to that same host name, but using
31757c478bd9Sstevel@tonic-gatethe (presumably experimental) xnet mailer.
31767c478bd9Sstevel@tonic-gate
31777c478bd9Sstevel@tonic-gateIn some cases you may want to temporarily turn off MX records,
31787c478bd9Sstevel@tonic-gateparticularly on gateways.  For example, you may want to MX
31797c478bd9Sstevel@tonic-gateeverything in a domain to one machine that then forwards it
31807c478bd9Sstevel@tonic-gatedirectly.  To do this, you might use the DNS configuration:
31817c478bd9Sstevel@tonic-gate
31827c478bd9Sstevel@tonic-gate	*.domain.	IN	MX	0	relay.machine
31837c478bd9Sstevel@tonic-gate
31847c478bd9Sstevel@tonic-gateand on relay.machine use the mailertable:
31857c478bd9Sstevel@tonic-gate
31867c478bd9Sstevel@tonic-gate	.domain		smtp:[gateway.domain]
31877c478bd9Sstevel@tonic-gate
31887c478bd9Sstevel@tonic-gateThe [square brackets] turn off MX records for this host only.
31897c478bd9Sstevel@tonic-gateIf you didn't do this, the mailertable would use the MX record
31907c478bd9Sstevel@tonic-gateagain, which would give you an MX loop.  Note that the use of
31917c478bd9Sstevel@tonic-gatewildcard MX records is almost always a bad idea.  Please avoid
31927c478bd9Sstevel@tonic-gateusing them if possible.
31937c478bd9Sstevel@tonic-gate
31947c478bd9Sstevel@tonic-gate
31957c478bd9Sstevel@tonic-gate+--------------------------------+
31967c478bd9Sstevel@tonic-gate| USING USERDB TO MAP FULL NAMES |
31977c478bd9Sstevel@tonic-gate+--------------------------------+
31987c478bd9Sstevel@tonic-gate
31997c478bd9Sstevel@tonic-gateThe user database was not originally intended for mapping full names
32007c478bd9Sstevel@tonic-gateto login names (e.g., Eric.Allman => eric), but some people are using
32017c478bd9Sstevel@tonic-gateit that way.  (it is recommended that you set up aliases for this
32027c478bd9Sstevel@tonic-gatepurpose instead -- since you can specify multiple alias files, this
32037c478bd9Sstevel@tonic-gateis fairly easy.)  The intent was to locate the default maildrop at
32047c478bd9Sstevel@tonic-gatea site, but allow you to override this by sending to a specific host.
32057c478bd9Sstevel@tonic-gate
32067c478bd9Sstevel@tonic-gateIf you decide to set up the user database in this fashion, it is
32077c478bd9Sstevel@tonic-gateimperative that you not use FEATURE(`stickyhost') -- otherwise,
32087c478bd9Sstevel@tonic-gatee-mail sent to Full.Name@local.host.name will be rejected.
32097c478bd9Sstevel@tonic-gate
32107c478bd9Sstevel@tonic-gateTo build the internal form of the user database, use:
32117c478bd9Sstevel@tonic-gate
32127c478bd9Sstevel@tonic-gate	makemap btree /etc/mail/userdb < /etc/mail/userdb.txt
32137c478bd9Sstevel@tonic-gate
32147c478bd9Sstevel@tonic-gateAs a general rule, it is an extremely bad idea to using full names
32157c478bd9Sstevel@tonic-gateas e-mail addresses, since they are not in any sense unique.  For
32167c478bd9Sstevel@tonic-gateexample, the UNIX software-development community has at least two
32177c478bd9Sstevel@tonic-gatewell-known Peter Deutsches, and at one time Bell Labs had two
32187c478bd9Sstevel@tonic-gateStephen R. Bournes with offices along the same hallway.  Which one
32197c478bd9Sstevel@tonic-gatewill be forced to suffer the indignity of being Stephen_R_Bourne_2?
32207c478bd9Sstevel@tonic-gateThe less famous of the two, or the one that was hired later?
32217c478bd9Sstevel@tonic-gate
32227c478bd9Sstevel@tonic-gateFinger should handle full names (and be fuzzy).  Mail should use
32237c478bd9Sstevel@tonic-gatehandles, and not be fuzzy.
32247c478bd9Sstevel@tonic-gate
32257c478bd9Sstevel@tonic-gate
32267c478bd9Sstevel@tonic-gate+--------------------------------+
32277c478bd9Sstevel@tonic-gate| MISCELLANEOUS SPECIAL FEATURES |
32287c478bd9Sstevel@tonic-gate+--------------------------------+
32297c478bd9Sstevel@tonic-gate
32307c478bd9Sstevel@tonic-gatePlussed users
32317c478bd9Sstevel@tonic-gate	Sometimes it is convenient to merge configuration on a
32327c478bd9Sstevel@tonic-gate	centralized mail machine, for example, to forward all
32337c478bd9Sstevel@tonic-gate	root mail to a mail server.  In this case it might be
32347c478bd9Sstevel@tonic-gate	useful to be able to treat the root addresses as a class
32357c478bd9Sstevel@tonic-gate	of addresses with subtle differences.  You can do this
32367c478bd9Sstevel@tonic-gate	using plussed users.  For example, a client might include
32377c478bd9Sstevel@tonic-gate	the alias:
32387c478bd9Sstevel@tonic-gate
32397c478bd9Sstevel@tonic-gate		root:  root+client1@server
32407c478bd9Sstevel@tonic-gate
32417c478bd9Sstevel@tonic-gate	On the server, this will match an alias for "root+client1".
32427c478bd9Sstevel@tonic-gate	If that is not found, the alias "root+*" will be tried,
32437c478bd9Sstevel@tonic-gate	then "root".
32447c478bd9Sstevel@tonic-gate
32457c478bd9Sstevel@tonic-gate
32467c478bd9Sstevel@tonic-gate+----------------+
32477c478bd9Sstevel@tonic-gate| SECURITY NOTES |
32487c478bd9Sstevel@tonic-gate+----------------+
32497c478bd9Sstevel@tonic-gate
32507c478bd9Sstevel@tonic-gateA lot of sendmail security comes down to you.  Sendmail 8 is much
32517c478bd9Sstevel@tonic-gatemore careful about checking for security problems than previous
32527c478bd9Sstevel@tonic-gateversions, but there are some things that you still need to watch
32537c478bd9Sstevel@tonic-gatefor.  In particular:
32547c478bd9Sstevel@tonic-gate
32557c478bd9Sstevel@tonic-gate* Make sure the aliases file is not writable except by trusted
32567c478bd9Sstevel@tonic-gate  system personnel.  This includes both the text and database
32577c478bd9Sstevel@tonic-gate  version.
32587c478bd9Sstevel@tonic-gate
32597c478bd9Sstevel@tonic-gate* Make sure that other files that sendmail reads, such as the
32607c478bd9Sstevel@tonic-gate  mailertable, are only writable by trusted system personnel.
32617c478bd9Sstevel@tonic-gate
32627c478bd9Sstevel@tonic-gate* The queue directory should not be world writable PARTICULARLY
32637c478bd9Sstevel@tonic-gate  if your system allows "file giveaways" (that is, if a non-root
32647c478bd9Sstevel@tonic-gate  user can chown any file they own to any other user).
32657c478bd9Sstevel@tonic-gate
32667c478bd9Sstevel@tonic-gate* If your system allows file giveaways, DO NOT create a publically
32677c478bd9Sstevel@tonic-gate  writable directory for forward files.  This will allow anyone
32687c478bd9Sstevel@tonic-gate  to steal anyone else's e-mail.  Instead, create a script that
32697c478bd9Sstevel@tonic-gate  copies the .forward file from users' home directories once a
32707c478bd9Sstevel@tonic-gate  night (if you want the non-NFS-mounted forward directory).
32717c478bd9Sstevel@tonic-gate
32727c478bd9Sstevel@tonic-gate* If your system allows file giveaways, you'll find that
32737c478bd9Sstevel@tonic-gate  sendmail is much less trusting of :include: files -- in
32747c478bd9Sstevel@tonic-gate  particular, you'll have to have /SENDMAIL/ANY/SHELL/ in
32757c478bd9Sstevel@tonic-gate  /etc/shells before they will be trusted (that is, before
32767c478bd9Sstevel@tonic-gate  files and programs listed in them will be honored).
32777c478bd9Sstevel@tonic-gate
32787c478bd9Sstevel@tonic-gateIn general, file giveaways are a mistake -- if you can turn them
32797c478bd9Sstevel@tonic-gateoff, do so.
32807c478bd9Sstevel@tonic-gate
32817c478bd9Sstevel@tonic-gate
32827c478bd9Sstevel@tonic-gate+--------------------------------+
32837c478bd9Sstevel@tonic-gate| TWEAKING CONFIGURATION OPTIONS |
32847c478bd9Sstevel@tonic-gate+--------------------------------+
32857c478bd9Sstevel@tonic-gate
32867c478bd9Sstevel@tonic-gateThere are a large number of configuration options that don't normally
32877c478bd9Sstevel@tonic-gateneed to be changed.  However, if you feel you need to tweak them,
32887c478bd9Sstevel@tonic-gateyou can define the following M4 variables. Note that some of these
32897c478bd9Sstevel@tonic-gatevariables require formats that are defined in RFC 2821 or RFC 2822.
32907c478bd9Sstevel@tonic-gateBefore changing them you need to make sure you do not violate those
32917c478bd9Sstevel@tonic-gate(and other relevant) RFCs.
32927c478bd9Sstevel@tonic-gate
32937c478bd9Sstevel@tonic-gateThis list is shown in four columns:  the name you define, the default
32947c478bd9Sstevel@tonic-gatevalue for that definition, the option or macro that is affected
32957c478bd9Sstevel@tonic-gate(either Ox for an option or Dx for a macro), and a brief description.
32967c478bd9Sstevel@tonic-gate
32977c478bd9Sstevel@tonic-gateSome options are likely to be deprecated in future versions -- that is,
32987c478bd9Sstevel@tonic-gatethe option is only included to provide back-compatibility.  These are
32997c478bd9Sstevel@tonic-gatemarked with "*".
33007c478bd9Sstevel@tonic-gate
33017c478bd9Sstevel@tonic-gateRemember that these options are M4 variables, and hence may need to
33027c478bd9Sstevel@tonic-gatebe quoted.  In particular, arguments with commas will usually have to
33037c478bd9Sstevel@tonic-gatebe ``double quoted, like this phrase'' to avoid having the comma
33047c478bd9Sstevel@tonic-gateconfuse things.  This is common for alias file definitions and for
33057c478bd9Sstevel@tonic-gatethe read timeout.
33067c478bd9Sstevel@tonic-gate
33077c478bd9Sstevel@tonic-gateM4 Variable Name	Configuration	[Default] & Description
33087c478bd9Sstevel@tonic-gate================	=============	=======================
33097c478bd9Sstevel@tonic-gateconfMAILER_NAME		$n macro	[MAILER-DAEMON] The sender name used
33107c478bd9Sstevel@tonic-gate					for internally generated outgoing
33117c478bd9Sstevel@tonic-gate					messages.
33127c478bd9Sstevel@tonic-gateconfDOMAIN_NAME		$j macro	If defined, sets $j.  This should
33137c478bd9Sstevel@tonic-gate					only be done if your system cannot
33147c478bd9Sstevel@tonic-gate					determine your local domain name,
33157c478bd9Sstevel@tonic-gate					and then it should be set to
33167c478bd9Sstevel@tonic-gate					$w.Foo.COM, where Foo.COM is your
33177c478bd9Sstevel@tonic-gate					domain name.
33187c478bd9Sstevel@tonic-gateconfCF_VERSION		$Z macro	If defined, this is appended to the
33197c478bd9Sstevel@tonic-gate					configuration version name.
33207c478bd9Sstevel@tonic-gateconfLDAP_CLUSTER	${sendmailMTACluster} macro
33217c478bd9Sstevel@tonic-gate					If defined, this is the LDAP
33227c478bd9Sstevel@tonic-gate					cluster to use for LDAP searches
33237c478bd9Sstevel@tonic-gate					as described above in ``USING LDAP
33247c478bd9Sstevel@tonic-gate					FOR ALIASES, MAPS, AND CLASSES''.
33257c478bd9Sstevel@tonic-gateconfFROM_HEADER		From:		[$?x$x <$g>$|$g$.] The format of an
33267c478bd9Sstevel@tonic-gate					internally generated From: address.
33277c478bd9Sstevel@tonic-gateconfRECEIVED_HEADER	Received:
33287c478bd9Sstevel@tonic-gate		[$?sfrom $s $.$?_($?s$|from $.$_)
33297c478bd9Sstevel@tonic-gate			$.$?{auth_type}(authenticated)
33307c478bd9Sstevel@tonic-gate			$.by $j ($v/$Z)$?r with $r$. id $i$?u
33317c478bd9Sstevel@tonic-gate			for $u; $|;
33327c478bd9Sstevel@tonic-gate			$.$b]
33337c478bd9Sstevel@tonic-gate					The format of the Received: header
33347c478bd9Sstevel@tonic-gate					in messages passed through this host.
33357c478bd9Sstevel@tonic-gate					It is unwise to try to change this.
33367c478bd9Sstevel@tonic-gateconfMESSAGEID_HEADER	Message-Id:	[<$t.$i@$j>] The format of an
33377c478bd9Sstevel@tonic-gate					internally generated Message-Id:
33387c478bd9Sstevel@tonic-gate					header.
33397c478bd9Sstevel@tonic-gateconfCW_FILE		Fw class	[/etc/mail/local-host-names] Name
33407c478bd9Sstevel@tonic-gate					of file used to get the local
33417c478bd9Sstevel@tonic-gate					additions to class {w} (local host
33427c478bd9Sstevel@tonic-gate					names).
33437c478bd9Sstevel@tonic-gateconfCT_FILE		Ft class	[/etc/mail/trusted-users] Name of
33447c478bd9Sstevel@tonic-gate					file used to get the local additions
33457c478bd9Sstevel@tonic-gate					to class {t} (trusted users).
33467c478bd9Sstevel@tonic-gateconfCR_FILE		FR class	[/etc/mail/relay-domains] Name of
33477c478bd9Sstevel@tonic-gate					file used to get the local additions
33487c478bd9Sstevel@tonic-gate					to class {R} (hosts allowed to relay).
33497c478bd9Sstevel@tonic-gateconfTRUSTED_USERS	Ct class	[no default] Names of users to add to
33507c478bd9Sstevel@tonic-gate					the list of trusted users.  This list
33517c478bd9Sstevel@tonic-gate					always includes root, uucp, and daemon.
33527c478bd9Sstevel@tonic-gate					See also FEATURE(`use_ct_file').
33537c478bd9Sstevel@tonic-gateconfTRUSTED_USER	TrustedUser	[no default] Trusted user for file
33547c478bd9Sstevel@tonic-gate					ownership and starting the daemon.
33557c478bd9Sstevel@tonic-gate					Not to be confused with
33567c478bd9Sstevel@tonic-gate					confTRUSTED_USERS (see above).
33577c478bd9Sstevel@tonic-gateconfSMTP_MAILER		-		[esmtp] The mailer name used when
33587c478bd9Sstevel@tonic-gate					SMTP connectivity is required.
33597c478bd9Sstevel@tonic-gate					One of "smtp", "smtp8",
33607c478bd9Sstevel@tonic-gate					"esmtp", or "dsmtp".
33617c478bd9Sstevel@tonic-gateconfUUCP_MAILER		-		[uucp-old] The mailer to be used by
33627c478bd9Sstevel@tonic-gate					default for bang-format recipient
33637c478bd9Sstevel@tonic-gate					addresses.  See also discussion of
33647c478bd9Sstevel@tonic-gate					class {U}, class {Y}, and class {Z}
33657c478bd9Sstevel@tonic-gate					in the MAILER(`uucp') section.
33667c478bd9Sstevel@tonic-gateconfLOCAL_MAILER	-		[local] The mailer name used when
33677c478bd9Sstevel@tonic-gate					local connectivity is required.
33687c478bd9Sstevel@tonic-gate					Almost always "local".
33697c478bd9Sstevel@tonic-gateconfRELAY_MAILER	-		[relay] The default mailer name used
33707c478bd9Sstevel@tonic-gate					for relaying any mail (e.g., to a
33717c478bd9Sstevel@tonic-gate					BITNET_RELAY, a SMART_HOST, or
33727c478bd9Sstevel@tonic-gate					whatever).  This can reasonably be
33737c478bd9Sstevel@tonic-gate					"uucp-new" if you are on a
33747c478bd9Sstevel@tonic-gate					UUCP-connected site.
33757c478bd9Sstevel@tonic-gateconfSEVEN_BIT_INPUT	SevenBitInput	[False] Force input to seven bits?
33767c478bd9Sstevel@tonic-gateconfEIGHT_BIT_HANDLING	EightBitMode	[pass8] 8-bit data handling
33777c478bd9Sstevel@tonic-gateconfALIAS_WAIT		AliasWait	[10m] Time to wait for alias file
33787c478bd9Sstevel@tonic-gate					rebuild until you get bored and
33797c478bd9Sstevel@tonic-gate					decide that the apparently pending
33807c478bd9Sstevel@tonic-gate					rebuild failed.
33817c478bd9Sstevel@tonic-gateconfMIN_FREE_BLOCKS	MinFreeBlocks	[100] Minimum number of free blocks on
33827c478bd9Sstevel@tonic-gate					queue filesystem to accept SMTP mail.
33837c478bd9Sstevel@tonic-gate					(Prior to 8.7 this was minfree/maxsize,
33847c478bd9Sstevel@tonic-gate					where minfree was the number of free
33857c478bd9Sstevel@tonic-gate					blocks and maxsize was the maximum
33867c478bd9Sstevel@tonic-gate					message size.  Use confMAX_MESSAGE_SIZE
33877c478bd9Sstevel@tonic-gate					for the second value now.)
33887c478bd9Sstevel@tonic-gateconfMAX_MESSAGE_SIZE	MaxMessageSize	[infinite] The maximum size of messages
33897c478bd9Sstevel@tonic-gate					that will be accepted (in bytes).
33907c478bd9Sstevel@tonic-gateconfBLANK_SUB		BlankSub	[.] Blank (space) substitution
33917c478bd9Sstevel@tonic-gate					character.
33927c478bd9Sstevel@tonic-gateconfCON_EXPENSIVE	HoldExpensive	[False] Avoid connecting immediately
33937c478bd9Sstevel@tonic-gate					to mailers marked expensive.
33947c478bd9Sstevel@tonic-gateconfCHECKPOINT_INTERVAL	CheckpointInterval
33957c478bd9Sstevel@tonic-gate					[10] Checkpoint queue files every N
33967c478bd9Sstevel@tonic-gate					recipients.
33977c478bd9Sstevel@tonic-gateconfDELIVERY_MODE	DeliveryMode	[background] Default delivery mode.
33987c478bd9Sstevel@tonic-gateconfERROR_MODE		ErrorMode	[print] Error message mode.
33997c478bd9Sstevel@tonic-gateconfERROR_MESSAGE	ErrorHeader	[undefined] Error message header/file.
34007c478bd9Sstevel@tonic-gateconfSAVE_FROM_LINES	SaveFromLine	Save extra leading From_ lines.
34017c478bd9Sstevel@tonic-gateconfTEMP_FILE_MODE	TempFileMode	[0600] Temporary file mode.
34027c478bd9Sstevel@tonic-gateconfMATCH_GECOS		MatchGECOS	[False] Match GECOS field.
34037c478bd9Sstevel@tonic-gateconfMAX_HOP		MaxHopCount	[25] Maximum hop count.
34047c478bd9Sstevel@tonic-gateconfIGNORE_DOTS*	IgnoreDots	[False; always False in -bs or -bd
34057c478bd9Sstevel@tonic-gate					mode] Ignore dot as terminator for
34067c478bd9Sstevel@tonic-gate					incoming messages?
34077c478bd9Sstevel@tonic-gateconfBIND_OPTS		ResolverOptions	[undefined] Default options for DNS
34087c478bd9Sstevel@tonic-gate					resolver.
34097c478bd9Sstevel@tonic-gateconfMIME_FORMAT_ERRORS*	SendMimeErrors	[True] Send error messages as MIME-
34107c478bd9Sstevel@tonic-gate					encapsulated messages per RFC 1344.
34117c478bd9Sstevel@tonic-gateconfFORWARD_PATH	ForwardPath	[$z/.forward.$w:$z/.forward]
34127c478bd9Sstevel@tonic-gate					The colon-separated list of places to
34137c478bd9Sstevel@tonic-gate					search for .forward files.  N.B.: see
34147c478bd9Sstevel@tonic-gate					the Security Notes section.
34157c478bd9Sstevel@tonic-gateconfMCI_CACHE_SIZE	ConnectionCacheSize
34167c478bd9Sstevel@tonic-gate					[2] Size of open connection cache.
34177c478bd9Sstevel@tonic-gateconfMCI_CACHE_TIMEOUT	ConnectionCacheTimeout
34187c478bd9Sstevel@tonic-gate					[5m] Open connection cache timeout.
34197c478bd9Sstevel@tonic-gateconfHOST_STATUS_DIRECTORY HostStatusDirectory
34207c478bd9Sstevel@tonic-gate					[undefined] If set, host status is kept
34217c478bd9Sstevel@tonic-gate					on disk between sendmail runs in the
34227c478bd9Sstevel@tonic-gate					named directory tree.  This need not be
34237c478bd9Sstevel@tonic-gate					a full pathname, in which case it is
34247c478bd9Sstevel@tonic-gate					interpreted relative to the queue
34257c478bd9Sstevel@tonic-gate					directory.
34267c478bd9Sstevel@tonic-gateconfSINGLE_THREAD_DELIVERY  SingleThreadDelivery
34277c478bd9Sstevel@tonic-gate					[False] If this option and the
34287c478bd9Sstevel@tonic-gate					HostStatusDirectory option are both
34297c478bd9Sstevel@tonic-gate					set, single thread deliveries to other
34307c478bd9Sstevel@tonic-gate					hosts.  That is, don't allow any two
34317c478bd9Sstevel@tonic-gate					sendmails on this host to connect
34327c478bd9Sstevel@tonic-gate					simultaneously to any other single
34337c478bd9Sstevel@tonic-gate					host.  This can slow down delivery in
34347c478bd9Sstevel@tonic-gate					some cases, in particular since a
34357c478bd9Sstevel@tonic-gate					cached but otherwise idle connection
34367c478bd9Sstevel@tonic-gate					to a host will prevent other sendmails
34377c478bd9Sstevel@tonic-gate					from connecting to the other host.
34387c478bd9Sstevel@tonic-gateconfUSE_ERRORS_TO*	UseErrorsTo	[False] Use the Errors-To: header to
34397c478bd9Sstevel@tonic-gate					deliver error messages.  This should
34407c478bd9Sstevel@tonic-gate					not be necessary because of general
34417c478bd9Sstevel@tonic-gate					acceptance of the envelope/header
34427c478bd9Sstevel@tonic-gate					distinction.
34437c478bd9Sstevel@tonic-gateconfLOG_LEVEL		LogLevel	[9] Log level.
34447c478bd9Sstevel@tonic-gateconfME_TOO		MeToo		[True] Include sender in group
34457c478bd9Sstevel@tonic-gate					expansions.  This option is
34467c478bd9Sstevel@tonic-gate					deprecated and will be removed from
34477c478bd9Sstevel@tonic-gate					a future version.
34487c478bd9Sstevel@tonic-gateconfCHECK_ALIASES	CheckAliases	[False] Check RHS of aliases when
34497c478bd9Sstevel@tonic-gate					running newaliases.  Since this does
34507c478bd9Sstevel@tonic-gate					DNS lookups on every address, it can
34517c478bd9Sstevel@tonic-gate					slow down the alias rebuild process
34527c478bd9Sstevel@tonic-gate					considerably on large alias files.
34537c478bd9Sstevel@tonic-gateconfOLD_STYLE_HEADERS*	OldStyleHeaders	[True] Assume that headers without
34547c478bd9Sstevel@tonic-gate					special chars are old style.
34557c478bd9Sstevel@tonic-gateconfPRIVACY_FLAGS	PrivacyOptions	[authwarnings] Privacy flags.
34567c478bd9Sstevel@tonic-gateconfCOPY_ERRORS_TO	PostmasterCopy	[undefined] Address for additional
34577c478bd9Sstevel@tonic-gate					copies of all error messages.
34587c478bd9Sstevel@tonic-gateconfQUEUE_FACTOR	QueueFactor	[600000] Slope of queue-only function.
34597c478bd9Sstevel@tonic-gateconfQUEUE_FILE_MODE	QueueFileMode	[undefined] Default permissions for
34607c478bd9Sstevel@tonic-gate					queue files (octal).  If not set,
34617c478bd9Sstevel@tonic-gate					sendmail uses 0600 unless its real
34627c478bd9Sstevel@tonic-gate					and effective uid are different in
34637c478bd9Sstevel@tonic-gate					which case it uses 0644.
34647c478bd9Sstevel@tonic-gateconfDONT_PRUNE_ROUTES	DontPruneRoutes	[False] Don't prune down route-addr
34657c478bd9Sstevel@tonic-gate					syntax addresses to the minimum
34667c478bd9Sstevel@tonic-gate					possible.
34677c478bd9Sstevel@tonic-gateconfSAFE_QUEUE*		SuperSafe	[True] Commit all messages to disk
34687c478bd9Sstevel@tonic-gate					before forking.
34697c478bd9Sstevel@tonic-gateconfTO_INITIAL		Timeout.initial	[5m] The timeout waiting for a response
34707c478bd9Sstevel@tonic-gate					on the initial connect.
34717c478bd9Sstevel@tonic-gateconfTO_CONNECT		Timeout.connect	[0] The timeout waiting for an initial
34727c478bd9Sstevel@tonic-gate					connect() to complete.  This can only
34737c478bd9Sstevel@tonic-gate					shorten connection timeouts; the kernel
34747c478bd9Sstevel@tonic-gate					silently enforces an absolute maximum
34757c478bd9Sstevel@tonic-gate					(which varies depending on the system).
34767c478bd9Sstevel@tonic-gateconfTO_ICONNECT		Timeout.iconnect
34777c478bd9Sstevel@tonic-gate					[undefined] Like Timeout.connect, but
34787c478bd9Sstevel@tonic-gate					applies only to the very first attempt
34797c478bd9Sstevel@tonic-gate					to connect to a host in a message.
34807c478bd9Sstevel@tonic-gate					This allows a single very fast pass
34817c478bd9Sstevel@tonic-gate					followed by more careful delivery
34827c478bd9Sstevel@tonic-gate					attempts in the future.
34837c478bd9Sstevel@tonic-gateconfTO_ACONNECT		Timeout.aconnect
34847c478bd9Sstevel@tonic-gate					[0] The overall timeout waiting for
34857c478bd9Sstevel@tonic-gate					all connection for a single delivery
34867c478bd9Sstevel@tonic-gate					attempt to succeed.  If 0, no overall
34877c478bd9Sstevel@tonic-gate					limit is applied.
34887c478bd9Sstevel@tonic-gateconfTO_HELO		Timeout.helo	[5m] The timeout waiting for a response
34897c478bd9Sstevel@tonic-gate					to a HELO or EHLO command.
34907c478bd9Sstevel@tonic-gateconfTO_MAIL		Timeout.mail	[10m] The timeout waiting for a
34917c478bd9Sstevel@tonic-gate					response to the MAIL command.
34927c478bd9Sstevel@tonic-gateconfTO_RCPT		Timeout.rcpt	[1h] The timeout waiting for a response
34937c478bd9Sstevel@tonic-gate					to the RCPT command.
34947c478bd9Sstevel@tonic-gateconfTO_DATAINIT		Timeout.datainit
34957c478bd9Sstevel@tonic-gate					[5m] The timeout waiting for a 354
34967c478bd9Sstevel@tonic-gate					response from the DATA command.
34977c478bd9Sstevel@tonic-gateconfTO_DATABLOCK	Timeout.datablock
34987c478bd9Sstevel@tonic-gate					[1h] The timeout waiting for a block
34997c478bd9Sstevel@tonic-gate					during DATA phase.
35007c478bd9Sstevel@tonic-gateconfTO_DATAFINAL	Timeout.datafinal
35017c478bd9Sstevel@tonic-gate					[1h] The timeout waiting for a response
35027c478bd9Sstevel@tonic-gate					to the final "." that terminates a
35037c478bd9Sstevel@tonic-gate					message.
35047c478bd9Sstevel@tonic-gateconfTO_RSET		Timeout.rset	[5m] The timeout waiting for a response
35057c478bd9Sstevel@tonic-gate					to the RSET command.
35067c478bd9Sstevel@tonic-gateconfTO_QUIT		Timeout.quit	[2m] The timeout waiting for a response
35077c478bd9Sstevel@tonic-gate					to the QUIT command.
35087c478bd9Sstevel@tonic-gateconfTO_MISC		Timeout.misc	[2m] The timeout waiting for a response
35097c478bd9Sstevel@tonic-gate					to other SMTP commands.
35107c478bd9Sstevel@tonic-gateconfTO_COMMAND		Timeout.command	[1h] In server SMTP, the timeout
35117c478bd9Sstevel@tonic-gate					waiting	for a command to be issued.
35127c478bd9Sstevel@tonic-gateconfTO_IDENT		Timeout.ident	[5s] The timeout waiting for a
35137c478bd9Sstevel@tonic-gate					response to an IDENT query.
35147c478bd9Sstevel@tonic-gateconfTO_FILEOPEN		Timeout.fileopen
35157c478bd9Sstevel@tonic-gate					[60s] The timeout waiting for a file
35167c478bd9Sstevel@tonic-gate					(e.g., :include: file) to be opened.
35177c478bd9Sstevel@tonic-gateconfTO_LHLO		Timeout.lhlo	[2m] The timeout waiting for a response
35187c478bd9Sstevel@tonic-gate					to an LMTP LHLO command.
35197c478bd9Sstevel@tonic-gateconfTO_STARTTLS		Timeout.starttls
35207c478bd9Sstevel@tonic-gate					[1h] The timeout waiting for a
35217c478bd9Sstevel@tonic-gate					response to an SMTP STARTTLS command.
35227c478bd9Sstevel@tonic-gateconfTO_CONTROL		Timeout.control
35237c478bd9Sstevel@tonic-gate					[2m] The timeout for a complete
35247c478bd9Sstevel@tonic-gate					control socket transaction to complete.
35257c478bd9Sstevel@tonic-gateconfTO_QUEUERETURN	Timeout.queuereturn
35267c478bd9Sstevel@tonic-gate					[5d] The timeout before a message is
35277c478bd9Sstevel@tonic-gate					returned as undeliverable.
35287c478bd9Sstevel@tonic-gateconfTO_QUEUERETURN_NORMAL
35297c478bd9Sstevel@tonic-gate			Timeout.queuereturn.normal
35307c478bd9Sstevel@tonic-gate					[undefined] As above, for normal
35317c478bd9Sstevel@tonic-gate					priority messages.
35327c478bd9Sstevel@tonic-gateconfTO_QUEUERETURN_URGENT
35337c478bd9Sstevel@tonic-gate			Timeout.queuereturn.urgent
35347c478bd9Sstevel@tonic-gate					[undefined] As above, for urgent
35357c478bd9Sstevel@tonic-gate					priority messages.
35367c478bd9Sstevel@tonic-gateconfTO_QUEUERETURN_NONURGENT
35377c478bd9Sstevel@tonic-gate			Timeout.queuereturn.non-urgent
35387c478bd9Sstevel@tonic-gate					[undefined] As above, for non-urgent
35397c478bd9Sstevel@tonic-gate					(low) priority messages.
35407c478bd9Sstevel@tonic-gateconfTO_QUEUERETURN_DSN
35417c478bd9Sstevel@tonic-gate			Timeout.queuereturn.dsn
35427c478bd9Sstevel@tonic-gate					[undefined] As above, for delivery
35437c478bd9Sstevel@tonic-gate					status notification messages.
35447c478bd9Sstevel@tonic-gateconfTO_QUEUEWARN	Timeout.queuewarn
35457c478bd9Sstevel@tonic-gate					[4h] The timeout before a warning
35467c478bd9Sstevel@tonic-gate					message is sent to the sender telling
35477c478bd9Sstevel@tonic-gate					them that the message has been
35487c478bd9Sstevel@tonic-gate					deferred.
35497c478bd9Sstevel@tonic-gateconfTO_QUEUEWARN_NORMAL	Timeout.queuewarn.normal
35507c478bd9Sstevel@tonic-gate					[undefined] As above, for normal
35517c478bd9Sstevel@tonic-gate					priority messages.
35527c478bd9Sstevel@tonic-gateconfTO_QUEUEWARN_URGENT	Timeout.queuewarn.urgent
35537c478bd9Sstevel@tonic-gate					[undefined] As above, for urgent
35547c478bd9Sstevel@tonic-gate					priority messages.
35557c478bd9Sstevel@tonic-gateconfTO_QUEUEWARN_NONURGENT
35567c478bd9Sstevel@tonic-gate			Timeout.queuewarn.non-urgent
35577c478bd9Sstevel@tonic-gate					[undefined] As above, for non-urgent
35587c478bd9Sstevel@tonic-gate					(low) priority messages.
35597c478bd9Sstevel@tonic-gateconfTO_QUEUEWARN_DSN
35607c478bd9Sstevel@tonic-gate			Timeout.queuewarn.dsn
35617c478bd9Sstevel@tonic-gate					[undefined] As above, for delivery
35627c478bd9Sstevel@tonic-gate					status notification messages.
35637c478bd9Sstevel@tonic-gateconfTO_HOSTSTATUS	Timeout.hoststatus
35647c478bd9Sstevel@tonic-gate					[30m] How long information about host
35657c478bd9Sstevel@tonic-gate					statuses will be maintained before it
35667c478bd9Sstevel@tonic-gate					is considered stale and the host should
35677c478bd9Sstevel@tonic-gate					be retried.  This applies both within
35687c478bd9Sstevel@tonic-gate					a single queue run and to persistent
35697c478bd9Sstevel@tonic-gate					information (see below).
35707c478bd9Sstevel@tonic-gateconfTO_RESOLVER_RETRANS	Timeout.resolver.retrans
35717c478bd9Sstevel@tonic-gate					[varies] Sets the resolver's
35727c478bd9Sstevel@tonic-gate					retransmission time interval (in
35737c478bd9Sstevel@tonic-gate					seconds).  Sets both
35747c478bd9Sstevel@tonic-gate					Timeout.resolver.retrans.first and
35757c478bd9Sstevel@tonic-gate					Timeout.resolver.retrans.normal.
35767c478bd9Sstevel@tonic-gateconfTO_RESOLVER_RETRANS_FIRST  Timeout.resolver.retrans.first
35777c478bd9Sstevel@tonic-gate					[varies] Sets the resolver's
35787c478bd9Sstevel@tonic-gate					retransmission time interval (in
35797c478bd9Sstevel@tonic-gate					seconds) for the first attempt to
35807c478bd9Sstevel@tonic-gate					deliver a message.
35817c478bd9Sstevel@tonic-gateconfTO_RESOLVER_RETRANS_NORMAL  Timeout.resolver.retrans.normal
35827c478bd9Sstevel@tonic-gate					[varies] Sets the resolver's
35837c478bd9Sstevel@tonic-gate					retransmission time interval (in
35847c478bd9Sstevel@tonic-gate					seconds) for all resolver lookups
35857c478bd9Sstevel@tonic-gate					except the first delivery attempt.
35867c478bd9Sstevel@tonic-gateconfTO_RESOLVER_RETRY	Timeout.resolver.retry
35877c478bd9Sstevel@tonic-gate					[varies] Sets the number of times
35887c478bd9Sstevel@tonic-gate					to retransmit a resolver query.
35897c478bd9Sstevel@tonic-gate					Sets both
35907c478bd9Sstevel@tonic-gate					Timeout.resolver.retry.first and
35917c478bd9Sstevel@tonic-gate					Timeout.resolver.retry.normal.
35927c478bd9Sstevel@tonic-gateconfTO_RESOLVER_RETRY_FIRST  Timeout.resolver.retry.first
35937c478bd9Sstevel@tonic-gate					[varies] Sets the number of times
35947c478bd9Sstevel@tonic-gate					to retransmit a resolver query for
35957c478bd9Sstevel@tonic-gate					the first attempt to deliver a
35967c478bd9Sstevel@tonic-gate					message.
35977c478bd9Sstevel@tonic-gateconfTO_RESOLVER_RETRY_NORMAL  Timeout.resolver.retry.normal
35987c478bd9Sstevel@tonic-gate					[varies] Sets the number of times
35997c478bd9Sstevel@tonic-gate					to retransmit a resolver query for
36007c478bd9Sstevel@tonic-gate					all resolver lookups except the
36017c478bd9Sstevel@tonic-gate					first delivery attempt.
36027c478bd9Sstevel@tonic-gateconfTIME_ZONE		TimeZoneSpec	[USE_SYSTEM] Time zone info -- can be
36037c478bd9Sstevel@tonic-gate					USE_SYSTEM to use the system's idea,
36047c478bd9Sstevel@tonic-gate					USE_TZ to use the user's TZ envariable,
36057c478bd9Sstevel@tonic-gate					or something else to force that value.
36067c478bd9Sstevel@tonic-gateconfDEF_USER_ID		DefaultUser	[1:1] Default user id.
36077c478bd9Sstevel@tonic-gateconfUSERDB_SPEC		UserDatabaseSpec
36087c478bd9Sstevel@tonic-gate					[undefined] User database
36097c478bd9Sstevel@tonic-gate					specification.
36107c478bd9Sstevel@tonic-gateconfFALLBACK_MX		FallbackMXhost	[undefined] Fallback MX host.
36117c478bd9Sstevel@tonic-gateconfFALLBACK_SMARTHOST	FallbackSmartHost
36127c478bd9Sstevel@tonic-gate					[undefined] Fallback smart host.
36137c478bd9Sstevel@tonic-gateconfTRY_NULL_MX_LIST	TryNullMXList	[False] If this host is the best MX
36147c478bd9Sstevel@tonic-gate					for a host and other arrangements
36157c478bd9Sstevel@tonic-gate					haven't been made, try connecting
36167c478bd9Sstevel@tonic-gate					to the host directly; normally this
36177c478bd9Sstevel@tonic-gate					would be a config error.
36187c478bd9Sstevel@tonic-gateconfQUEUE_LA		QueueLA		[varies] Load average at which
36197c478bd9Sstevel@tonic-gate					queue-only function kicks in.
36207c478bd9Sstevel@tonic-gate					Default values is (8 * numproc)
36217c478bd9Sstevel@tonic-gate					where numproc is the number of
36227c478bd9Sstevel@tonic-gate					processors online (if that can be
36237c478bd9Sstevel@tonic-gate					determined).
36247c478bd9Sstevel@tonic-gateconfREFUSE_LA		RefuseLA	[varies] Load average at which
36257c478bd9Sstevel@tonic-gate					incoming SMTP connections are
36267c478bd9Sstevel@tonic-gate					refused.  Default values is (12 *
36277c478bd9Sstevel@tonic-gate					numproc) where numproc is the
36287c478bd9Sstevel@tonic-gate					number of processors online (if
36297c478bd9Sstevel@tonic-gate					that can be determined).
36307c478bd9Sstevel@tonic-gateconfREJECT_LOG_INTERVAL	RejectLogInterval	[3h] Log interval when
36317c478bd9Sstevel@tonic-gate					refusing connections for this long.
36327c478bd9Sstevel@tonic-gateconfDELAY_LA		DelayLA		[0] Load average at which sendmail
36337c478bd9Sstevel@tonic-gate					will sleep for one second on most
36347c478bd9Sstevel@tonic-gate					SMTP commands and before accepting
36357c478bd9Sstevel@tonic-gate					connections.  0 means no limit.
36367c478bd9Sstevel@tonic-gateconfMAX_ALIAS_RECURSION	MaxAliasRecursion
36377c478bd9Sstevel@tonic-gate					[10] Maximum depth of alias recursion.
36387c478bd9Sstevel@tonic-gateconfMAX_DAEMON_CHILDREN	MaxDaemonChildren
36397c478bd9Sstevel@tonic-gate					[undefined] The maximum number of
36407c478bd9Sstevel@tonic-gate					children the daemon will permit.  After
36417c478bd9Sstevel@tonic-gate					this number, connections will be
36427c478bd9Sstevel@tonic-gate					rejected.  If not set or <= 0, there is
36437c478bd9Sstevel@tonic-gate					no limit.
36447c478bd9Sstevel@tonic-gateconfMAX_HEADERS_LENGTH	MaxHeadersLength
36457c478bd9Sstevel@tonic-gate					[32768] Maximum length of the sum
36467c478bd9Sstevel@tonic-gate					of all headers.
36477c478bd9Sstevel@tonic-gateconfMAX_MIME_HEADER_LENGTH  MaxMimeHeaderLength
36487c478bd9Sstevel@tonic-gate					[undefined] Maximum length of
36497c478bd9Sstevel@tonic-gate					certain MIME header field values.
36507c478bd9Sstevel@tonic-gateconfCONNECTION_RATE_THROTTLE ConnectionRateThrottle
36517c478bd9Sstevel@tonic-gate					[undefined] The maximum number of
36527c478bd9Sstevel@tonic-gate					connections permitted per second per
36537c478bd9Sstevel@tonic-gate					daemon.  After this many connections
36547c478bd9Sstevel@tonic-gate					are accepted, further connections
36557c478bd9Sstevel@tonic-gate					will be delayed.  If not set or <= 0,
36567c478bd9Sstevel@tonic-gate					there is no limit.
36577c478bd9Sstevel@tonic-gateconfCONNECTION_RATE_WINDOW_SIZE ConnectionRateWindowSize
36587c478bd9Sstevel@tonic-gate					[60s] Define the length of the
36597c478bd9Sstevel@tonic-gate					interval for which the number of
36607c478bd9Sstevel@tonic-gate					incoming connections is maintained.
36617c478bd9Sstevel@tonic-gateconfWORK_RECIPIENT_FACTOR
36627c478bd9Sstevel@tonic-gate			RecipientFactor	[30000] Cost of each recipient.
36637c478bd9Sstevel@tonic-gateconfSEPARATE_PROC	ForkEachJob	[False] Run all deliveries in a
36647c478bd9Sstevel@tonic-gate					separate process.
36657c478bd9Sstevel@tonic-gateconfWORK_CLASS_FACTOR	ClassFactor	[1800] Priority multiplier for class.
36667c478bd9Sstevel@tonic-gateconfWORK_TIME_FACTOR	RetryFactor	[90000] Cost of each delivery attempt.
36677c478bd9Sstevel@tonic-gateconfQUEUE_SORT_ORDER	QueueSortOrder	[Priority] Queue sort algorithm:
36687c478bd9Sstevel@tonic-gate					Priority, Host, Filename, Random,
36697c478bd9Sstevel@tonic-gate					Modification, or Time.
36707c478bd9Sstevel@tonic-gateconfMIN_QUEUE_AGE	MinQueueAge	[0] The minimum amount of time a job
36717c478bd9Sstevel@tonic-gate					must sit in the queue between queue
36727c478bd9Sstevel@tonic-gate					runs.  This allows you to set the
36737c478bd9Sstevel@tonic-gate					queue run interval low for better
36747c478bd9Sstevel@tonic-gate					responsiveness without trying all
36757c478bd9Sstevel@tonic-gate					jobs in each run.
36767c478bd9Sstevel@tonic-gateconfDEF_CHAR_SET	DefaultCharSet	[unknown-8bit] When converting
36777c478bd9Sstevel@tonic-gate					unlabeled 8 bit input to MIME, the
36787c478bd9Sstevel@tonic-gate					character set to use by default.
36797c478bd9Sstevel@tonic-gateconfSERVICE_SWITCH_FILE	ServiceSwitchFile
36807c478bd9Sstevel@tonic-gate					[/etc/mail/service.switch] The file
36817c478bd9Sstevel@tonic-gate					to use for the service switch on
36827c478bd9Sstevel@tonic-gate					systems that do not have a
36837c478bd9Sstevel@tonic-gate					system-defined switch.
36847c478bd9Sstevel@tonic-gateconfHOSTS_FILE		HostsFile	[/etc/hosts] The file to use when doing
36857c478bd9Sstevel@tonic-gate					"file" type access of hosts names.
36867c478bd9Sstevel@tonic-gateconfDIAL_DELAY		DialDelay	[0s] If a connection fails, wait this
36877c478bd9Sstevel@tonic-gate					long and try again.  Zero means "don't
36887c478bd9Sstevel@tonic-gate					retry".  This is to allow "dial on
36897c478bd9Sstevel@tonic-gate					demand" connections to have enough time
36907c478bd9Sstevel@tonic-gate					to complete a connection.
36917c478bd9Sstevel@tonic-gateconfNO_RCPT_ACTION	NoRecipientAction
36927c478bd9Sstevel@tonic-gate					[none] What to do if there are no legal
36937c478bd9Sstevel@tonic-gate					recipient fields (To:, Cc: or Bcc:)
36947c478bd9Sstevel@tonic-gate					in the message.  Legal values can
36957c478bd9Sstevel@tonic-gate					be "none" to just leave the
36967c478bd9Sstevel@tonic-gate					nonconforming message as is, "add-to"
36977c478bd9Sstevel@tonic-gate					to add a To: header with all the
36987c478bd9Sstevel@tonic-gate					known recipients (which may expose
36997c478bd9Sstevel@tonic-gate					blind recipients), "add-apparently-to"
37007c478bd9Sstevel@tonic-gate					to do the same but use Apparently-To:
37017c478bd9Sstevel@tonic-gate					instead of To: (strongly discouraged
37027c478bd9Sstevel@tonic-gate					in accordance with IETF standards),
37037c478bd9Sstevel@tonic-gate					"add-bcc" to add an empty Bcc:
37047c478bd9Sstevel@tonic-gate					header, or "add-to-undisclosed" to
37057c478bd9Sstevel@tonic-gate					add the header
37067c478bd9Sstevel@tonic-gate					``To: undisclosed-recipients:;''.
37077c478bd9Sstevel@tonic-gateconfSAFE_FILE_ENV	SafeFileEnvironment
37087c478bd9Sstevel@tonic-gate					[undefined] If set, sendmail will do a
37097c478bd9Sstevel@tonic-gate					chroot() into this directory before
37107c478bd9Sstevel@tonic-gate					writing files.
37117c478bd9Sstevel@tonic-gateconfCOLON_OK_IN_ADDR	ColonOkInAddr	[True unless Configuration Level > 6]
37127c478bd9Sstevel@tonic-gate					If set, colons are treated as a regular
37137c478bd9Sstevel@tonic-gate					character in addresses.  If not set,
37147c478bd9Sstevel@tonic-gate					they are treated as the introducer to
37157c478bd9Sstevel@tonic-gate					the RFC 822 "group" syntax.  Colons are
37167c478bd9Sstevel@tonic-gate					handled properly in route-addrs.  This
37177c478bd9Sstevel@tonic-gate					option defaults on for V5 and lower
37187c478bd9Sstevel@tonic-gate					configuration files.
37197c478bd9Sstevel@tonic-gateconfMAX_QUEUE_RUN_SIZE	MaxQueueRunSize	[0] If set, limit the maximum size of
37207c478bd9Sstevel@tonic-gate					any given queue run to this number of
37217c478bd9Sstevel@tonic-gate					entries.  Essentially, this will stop
37227c478bd9Sstevel@tonic-gate					reading each queue directory after this
37237c478bd9Sstevel@tonic-gate					number of entries are reached; it does
37247c478bd9Sstevel@tonic-gate					_not_ pick the highest priority jobs,
37257c478bd9Sstevel@tonic-gate					so this should be as large as your
37267c478bd9Sstevel@tonic-gate					system can tolerate.  If not set, there
37277c478bd9Sstevel@tonic-gate					is no limit.
37287c478bd9Sstevel@tonic-gateconfMAX_QUEUE_CHILDREN	MaxQueueChildren
37297c478bd9Sstevel@tonic-gate					[undefined] Limits the maximum number
37307c478bd9Sstevel@tonic-gate					of concurrent queue runners active.
37317c478bd9Sstevel@tonic-gate					This is to keep system resources used
37327c478bd9Sstevel@tonic-gate					within a reasonable limit.  Relates to
37337c478bd9Sstevel@tonic-gate					Queue Groups and ForkEachJob.
37347c478bd9Sstevel@tonic-gateconfMAX_RUNNERS_PER_QUEUE	MaxRunnersPerQueue
37357c478bd9Sstevel@tonic-gate					[1] Only active when MaxQueueChildren
37367c478bd9Sstevel@tonic-gate					defined.  Controls the maximum number
37377c478bd9Sstevel@tonic-gate					of queue runners (aka queue children)
37387c478bd9Sstevel@tonic-gate					active at the same time in a work
37397c478bd9Sstevel@tonic-gate					group.  See also MaxQueueChildren.
37407c478bd9Sstevel@tonic-gateconfDONT_EXPAND_CNAMES	DontExpandCnames
37417c478bd9Sstevel@tonic-gate					[False] If set, $[ ... $] lookups that
37427c478bd9Sstevel@tonic-gate					do DNS based lookups do not expand
37437c478bd9Sstevel@tonic-gate					CNAME records.  This currently violates
37447c478bd9Sstevel@tonic-gate					the published standards, but the IETF
37457c478bd9Sstevel@tonic-gate					seems to be moving toward legalizing
37467c478bd9Sstevel@tonic-gate					this.  For example, if "FTP.Foo.ORG"
37477c478bd9Sstevel@tonic-gate					is a CNAME for "Cruft.Foo.ORG", then
37487c478bd9Sstevel@tonic-gate					with this option set a lookup of
37497c478bd9Sstevel@tonic-gate					"FTP" will return "FTP.Foo.ORG"; if
37507c478bd9Sstevel@tonic-gate					clear it returns "Cruft.FOO.ORG".  N.B.
37517c478bd9Sstevel@tonic-gate					you may not see any effect until your
37527c478bd9Sstevel@tonic-gate					downstream neighbors stop doing CNAME
37537c478bd9Sstevel@tonic-gate					lookups as well.
37547c478bd9Sstevel@tonic-gateconfFROM_LINE		UnixFromLine	[From $g $d] The From_ line used
37557c478bd9Sstevel@tonic-gate					when sending to files or programs.
37567c478bd9Sstevel@tonic-gateconfSINGLE_LINE_FROM_HEADER  SingleLineFromHeader
37577c478bd9Sstevel@tonic-gate					[False] From: lines that have
37587c478bd9Sstevel@tonic-gate					embedded newlines are unwrapped
37597c478bd9Sstevel@tonic-gate					onto one line.
37607c478bd9Sstevel@tonic-gateconfALLOW_BOGUS_HELO	AllowBogusHELO	[False] Allow HELO SMTP command that
37617c478bd9Sstevel@tonic-gate					does not include a host name.
37627c478bd9Sstevel@tonic-gateconfMUST_QUOTE_CHARS	MustQuoteChars	[.'] Characters to be quoted in a full
37637c478bd9Sstevel@tonic-gate					name phrase (@,;:\()[] are automatic).
37647c478bd9Sstevel@tonic-gateconfOPERATORS		OperatorChars	[.:%@!^/[]+] Address operator
37657c478bd9Sstevel@tonic-gate					characters.
37667c478bd9Sstevel@tonic-gateconfSMTP_LOGIN_MSG	SmtpGreetingMessage
37677c478bd9Sstevel@tonic-gate					[$j Sendmail $v/$Z; $b]
37687c478bd9Sstevel@tonic-gate					The initial (spontaneous) SMTP
37697c478bd9Sstevel@tonic-gate					greeting message.  The word "ESMTP"
37707c478bd9Sstevel@tonic-gate					will be inserted between the first and
37717c478bd9Sstevel@tonic-gate					second words to convince other
37727c478bd9Sstevel@tonic-gate					sendmails to try to speak ESMTP.
37737c478bd9Sstevel@tonic-gateconfDONT_INIT_GROUPS	DontInitGroups	[False] If set, the initgroups(3)
37747c478bd9Sstevel@tonic-gate					routine will never be invoked.  You
37757c478bd9Sstevel@tonic-gate					might want to do this if you are
37767c478bd9Sstevel@tonic-gate					running NIS and you have a large group
37777c478bd9Sstevel@tonic-gate					map, since this call does a sequential
37787c478bd9Sstevel@tonic-gate					scan of the map; in a large site this
37797c478bd9Sstevel@tonic-gate					can cause your ypserv to run
37807c478bd9Sstevel@tonic-gate					essentially full time.  If you set
37817c478bd9Sstevel@tonic-gate					this, agents run on behalf of users
37827c478bd9Sstevel@tonic-gate					will only have their primary
37837c478bd9Sstevel@tonic-gate					(/etc/passwd) group permissions.
37847c478bd9Sstevel@tonic-gateconfUNSAFE_GROUP_WRITES	UnsafeGroupWrites
378549218d4fSjbeck					[True] If set, group-writable
37867c478bd9Sstevel@tonic-gate					:include: and .forward files are
37877c478bd9Sstevel@tonic-gate					considered "unsafe", that is, programs
37887c478bd9Sstevel@tonic-gate					and files cannot be directly referenced
37897c478bd9Sstevel@tonic-gate					from such files.  World-writable files
37907c478bd9Sstevel@tonic-gate					are always considered unsafe.
379149218d4fSjbeck					Notice: this option is deprecated and
379249218d4fSjbeck					will be removed in future versions;
379349218d4fSjbeck					Set GroupWritableForwardFileSafe
379449218d4fSjbeck					and GroupWritableIncludeFileSafe in
379549218d4fSjbeck					DontBlameSendmail if required.
37967c478bd9Sstevel@tonic-gateconfCONNECT_ONLY_TO	ConnectOnlyTo	[undefined] override connection
37977c478bd9Sstevel@tonic-gate					address (for testing).
37987c478bd9Sstevel@tonic-gateconfCONTROL_SOCKET_NAME	ControlSocketName
37997c478bd9Sstevel@tonic-gate					[undefined] Control socket for daemon
38007c478bd9Sstevel@tonic-gate					management.
38017c478bd9Sstevel@tonic-gateconfDOUBLE_BOUNCE_ADDRESS  DoubleBounceAddress
38027c478bd9Sstevel@tonic-gate					[postmaster] If an error occurs when
38037c478bd9Sstevel@tonic-gate					sending an error message, send that
38047c478bd9Sstevel@tonic-gate					"double bounce" error message to this
38057c478bd9Sstevel@tonic-gate					address.  If it expands to an empty
38067c478bd9Sstevel@tonic-gate					string, double bounces are dropped.
38074aac33d3SjbeckconfSOFT_BOUNCE		SoftBounce	[False] If set, issue temporary errors
38084aac33d3Sjbeck					(4xy) instead of permanent errors
38094aac33d3Sjbeck					(5xy).  This can be useful during
38104aac33d3Sjbeck					testing of a new configuration to
38114aac33d3Sjbeck					avoid erroneous bouncing of mails.
38127c478bd9Sstevel@tonic-gateconfDEAD_LETTER_DROP	DeadLetterDrop	[undefined] Filename to save bounce
38137c478bd9Sstevel@tonic-gate					messages which could not be returned
38147c478bd9Sstevel@tonic-gate					to the user or sent to postmaster.
38157c478bd9Sstevel@tonic-gate					If not set, the queue file will
38167c478bd9Sstevel@tonic-gate					be renamed.
38177c478bd9Sstevel@tonic-gateconfRRT_IMPLIES_DSN	RrtImpliesDsn	[False] Return-Receipt-To: header
38187c478bd9Sstevel@tonic-gate					implies DSN request.
38197c478bd9Sstevel@tonic-gateconfRUN_AS_USER		RunAsUser	[undefined] If set, become this user
38207c478bd9Sstevel@tonic-gate					when reading and delivering mail.
38217c478bd9Sstevel@tonic-gate					Causes all file reads (e.g., .forward
38227c478bd9Sstevel@tonic-gate					and :include: files) to be done as
38237c478bd9Sstevel@tonic-gate					this user.  Also, all programs will
38247c478bd9Sstevel@tonic-gate					be run as this user, and all output
38257c478bd9Sstevel@tonic-gate					files will be written as this user.
38267c478bd9Sstevel@tonic-gateconfMAX_RCPTS_PER_MESSAGE  MaxRecipientsPerMessage
38277c478bd9Sstevel@tonic-gate					[infinite] If set, allow no more than
38287c478bd9Sstevel@tonic-gate					the specified number of recipients in
38297c478bd9Sstevel@tonic-gate					an SMTP envelope.  Further recipients
38307c478bd9Sstevel@tonic-gate					receive a 452 error code (i.e., they
38317c478bd9Sstevel@tonic-gate					are deferred for the next delivery
38327c478bd9Sstevel@tonic-gate					attempt).
38337c478bd9Sstevel@tonic-gateconfBAD_RCPT_THROTTLE	BadRcptThrottle	[infinite] If set and the specified
38347c478bd9Sstevel@tonic-gate					number of recipients in a single SMTP
38357c478bd9Sstevel@tonic-gate					transaction have been rejected, sleep
38367c478bd9Sstevel@tonic-gate					for one second after each subsequent
38377c478bd9Sstevel@tonic-gate					RCPT command in that transaction.
38387c478bd9Sstevel@tonic-gateconfDONT_PROBE_INTERFACES  DontProbeInterfaces
38397c478bd9Sstevel@tonic-gate					[False] If set, sendmail will _not_
38407c478bd9Sstevel@tonic-gate					insert the names and addresses of any
38417c478bd9Sstevel@tonic-gate					local interfaces into class {w}
38427c478bd9Sstevel@tonic-gate					(list of known "equivalent" addresses).
38437c478bd9Sstevel@tonic-gate					If you set this, you must also include
38447c478bd9Sstevel@tonic-gate					some support for these addresses (e.g.,
38457c478bd9Sstevel@tonic-gate					in a mailertable entry) -- otherwise,
38467c478bd9Sstevel@tonic-gate					mail to addresses in this list will
38477c478bd9Sstevel@tonic-gate					bounce with a configuration error.
38487c478bd9Sstevel@tonic-gate					If set to "loopback" (without
38497c478bd9Sstevel@tonic-gate					quotes), sendmail will skip
38507c478bd9Sstevel@tonic-gate					loopback interfaces (e.g., "lo0").
38517c478bd9Sstevel@tonic-gateconfPID_FILE		PidFile		[system dependent] Location of pid
38527c478bd9Sstevel@tonic-gate					file.
38537c478bd9Sstevel@tonic-gateconfPROCESS_TITLE_PREFIX  ProcessTitlePrefix
38547c478bd9Sstevel@tonic-gate					[undefined] Prefix string for the
38557c478bd9Sstevel@tonic-gate					process title shown on 'ps' listings.
38567c478bd9Sstevel@tonic-gateconfDONT_BLAME_SENDMAIL	DontBlameSendmail
38577c478bd9Sstevel@tonic-gate					[safe] Override sendmail's file
38587c478bd9Sstevel@tonic-gate					safety checks.  This will definitely
38597c478bd9Sstevel@tonic-gate					compromise system security and should
38607c478bd9Sstevel@tonic-gate					not be used unless absolutely
38617c478bd9Sstevel@tonic-gate					necessary.
38627c478bd9Sstevel@tonic-gateconfREJECT_MSG		-		[550 Access denied] The message
38637c478bd9Sstevel@tonic-gate					given if the access database contains
38647c478bd9Sstevel@tonic-gate					REJECT in the value portion.
38657c478bd9Sstevel@tonic-gateconfRELAY_MSG		-		[550 Relaying denied] The message
38667c478bd9Sstevel@tonic-gate					given if an unauthorized relaying
38677c478bd9Sstevel@tonic-gate					attempt is rejected.
38687c478bd9Sstevel@tonic-gateconfDF_BUFFER_SIZE	DataFileBufferSize
38697c478bd9Sstevel@tonic-gate					[4096] The maximum size of a
38707c478bd9Sstevel@tonic-gate					memory-buffered data (df) file
38717c478bd9Sstevel@tonic-gate					before a disk-based file is used.
38727c478bd9Sstevel@tonic-gateconfXF_BUFFER_SIZE	XScriptFileBufferSize
38737c478bd9Sstevel@tonic-gate					[4096] The maximum size of a
38747c478bd9Sstevel@tonic-gate					memory-buffered transcript (xf)
38757c478bd9Sstevel@tonic-gate					file before a disk-based file is
38767c478bd9Sstevel@tonic-gate					used.
38777c478bd9Sstevel@tonic-gateconfTLS_SRV_OPTIONS	TLSSrvOptions	If this option is 'V' no client
38787c478bd9Sstevel@tonic-gate					verification is performed, i.e.,
38797c478bd9Sstevel@tonic-gate					the server doesn't ask for a
38807c478bd9Sstevel@tonic-gate					certificate.
38817c478bd9Sstevel@tonic-gateconfLDAP_DEFAULT_SPEC	LDAPDefaultSpec	[undefined] Default map
38827c478bd9Sstevel@tonic-gate					specification for LDAP maps.  The
38837c478bd9Sstevel@tonic-gate					value should only contain LDAP
38847c478bd9Sstevel@tonic-gate					specific settings such as "-h host
38857c478bd9Sstevel@tonic-gate					-p port -d bindDN", etc.  The
38867c478bd9Sstevel@tonic-gate					settings will be used for all LDAP
38877c478bd9Sstevel@tonic-gate					maps unless they are specified in
38887c478bd9Sstevel@tonic-gate					the individual map specification
38897c478bd9Sstevel@tonic-gate					('K' command).
38907c478bd9Sstevel@tonic-gateconfCACERT_PATH		CACertPath	[undefined] Path to directory
38917c478bd9Sstevel@tonic-gate					with certs of CAs.
38927c478bd9Sstevel@tonic-gateconfCACERT		CACertFile	[undefined] File containing one CA
38937c478bd9Sstevel@tonic-gate					cert.
38947c478bd9Sstevel@tonic-gateconfSERVER_CERT		ServerCertFile	[undefined] File containing the
38957c478bd9Sstevel@tonic-gate					cert of the server, i.e., this cert
38967c478bd9Sstevel@tonic-gate					is used when sendmail acts as
38977c478bd9Sstevel@tonic-gate					server.
38987c478bd9Sstevel@tonic-gateconfSERVER_KEY		ServerKeyFile	[undefined] File containing the
38997c478bd9Sstevel@tonic-gate					private key belonging to the server
39007c478bd9Sstevel@tonic-gate					cert.
39017c478bd9Sstevel@tonic-gateconfCLIENT_CERT		ClientCertFile	[undefined] File containing the
39027c478bd9Sstevel@tonic-gate					cert of the client, i.e., this cert
39037c478bd9Sstevel@tonic-gate					is used when sendmail acts as
39047c478bd9Sstevel@tonic-gate					client.
39057c478bd9Sstevel@tonic-gateconfCLIENT_KEY		ClientKeyFile	[undefined] File containing the
39067c478bd9Sstevel@tonic-gate					private key belonging to the client
39077c478bd9Sstevel@tonic-gate					cert.
39087c478bd9Sstevel@tonic-gateconfCRL			CRLFile		[undefined] File containing certificate
39097c478bd9Sstevel@tonic-gate					revocation status, useful for X.509v3
39107c478bd9Sstevel@tonic-gate					authentication. Note that CRL requires
39117c478bd9Sstevel@tonic-gate					at least OpenSSL version 0.9.7.
39127c478bd9Sstevel@tonic-gateconfDH_PARAMETERS	DHParameters	[undefined] File containing the
39137c478bd9Sstevel@tonic-gate					DH parameters.
39147c478bd9Sstevel@tonic-gateconfRAND_FILE		RandFile	[undefined] File containing random
39157c478bd9Sstevel@tonic-gate					data (use prefix file:) or the
39167c478bd9Sstevel@tonic-gate					name of the UNIX socket if EGD is
39177c478bd9Sstevel@tonic-gate					used (use prefix egd:).  STARTTLS
39187c478bd9Sstevel@tonic-gate					requires this option if the compile
39197c478bd9Sstevel@tonic-gate					flag HASURANDOM is not set (see
39207c478bd9Sstevel@tonic-gate					sendmail/README).
39217c478bd9Sstevel@tonic-gateconfNICE_QUEUE_RUN	NiceQueueRun	[undefined]  If set, the priority of
39227c478bd9Sstevel@tonic-gate					queue runners is set the given value
39237c478bd9Sstevel@tonic-gate					(nice(3)).
39247c478bd9Sstevel@tonic-gateconfDIRECT_SUBMISSION_MODIFIERS	DirectSubmissionModifiers
39257c478bd9Sstevel@tonic-gate					[undefined] Defines {daemon_flags}
39267c478bd9Sstevel@tonic-gate					for direct submissions.
392749218d4fSjbeckconfUSE_MSP		UseMSP		[undefined] Use as mail submission
39287c478bd9Sstevel@tonic-gate					program.
39297c478bd9Sstevel@tonic-gateconfDELIVER_BY_MIN	DeliverByMin	[0] Minimum time for Deliver By
39307c478bd9Sstevel@tonic-gate					SMTP Service Extension (RFC 2852).
39317c478bd9Sstevel@tonic-gateconfREQUIRES_DIR_FSYNC	RequiresDirfsync	[true] RequiresDirfsync can
39327c478bd9Sstevel@tonic-gate					be used to turn off the compile time
39337c478bd9Sstevel@tonic-gate					flag REQUIRES_DIR_FSYNC at runtime.
39347c478bd9Sstevel@tonic-gate					See sendmail/README for details.
39357c478bd9Sstevel@tonic-gateconfSHARED_MEMORY_KEY	SharedMemoryKey [0] Key for shared memory.
3936058561cbSjbeckconfSHARED_MEMORY_KEY_FILE
3937058561cbSjbeck			SharedMemoryKeyFile
3938058561cbSjbeck					[undefined] File where the
3939058561cbSjbeck					automatically selected key for
3940058561cbSjbeck					shared memory is stored.
39417c478bd9Sstevel@tonic-gateconfFAST_SPLIT		FastSplit	[1] If set to a value greater than
39427c478bd9Sstevel@tonic-gate					zero, the initial MX lookups on
39437c478bd9Sstevel@tonic-gate					addresses is suppressed when they
39447c478bd9Sstevel@tonic-gate					are sorted which may result in
39457c478bd9Sstevel@tonic-gate					faster envelope splitting.  If the
39467c478bd9Sstevel@tonic-gate					mail is submitted directly from the
39477c478bd9Sstevel@tonic-gate					command line, then the value also
39487c478bd9Sstevel@tonic-gate					limits the number of processes to
39497c478bd9Sstevel@tonic-gate					deliver the envelopes.
39507c478bd9Sstevel@tonic-gateconfMAILBOX_DATABASE	MailboxDatabase	[pw] Type of lookup to find
39517c478bd9Sstevel@tonic-gate					information about local mailboxes.
39527c478bd9Sstevel@tonic-gateconfDEQUOTE_OPTS	-		[empty] Additional options for the
39537c478bd9Sstevel@tonic-gate					dequote map.
3954058561cbSjbeckconfMAX_NOOP_COMMANDS	MaxNOOPCommands	[20] Maximum number of "useless"
3955058561cbSjbeck					commands before the SMTP server
3956058561cbSjbeck					will slow down responding.
3957058561cbSjbeckconfHELO_NAME		HeloName	If defined, use as name for EHLO/HELO
3958058561cbSjbeck					command (instead of $j).
39597c478bd9Sstevel@tonic-gateconfINPUT_MAIL_FILTERS	InputMailFilters
39607c478bd9Sstevel@tonic-gate					A comma separated list of filters
39617c478bd9Sstevel@tonic-gate					which determines which filters and
39627c478bd9Sstevel@tonic-gate					the invocation sequence are
39637c478bd9Sstevel@tonic-gate					contacted for incoming SMTP
39647c478bd9Sstevel@tonic-gate					messages.  If none are set, no
39657c478bd9Sstevel@tonic-gate					filters will be contacted.
39667c478bd9Sstevel@tonic-gateconfMILTER_LOG_LEVEL	Milter.LogLevel	[9] Log level for input mail filter
39677c478bd9Sstevel@tonic-gate					actions, defaults to LogLevel.
39687c478bd9Sstevel@tonic-gateconfMILTER_MACROS_CONNECT	Milter.macros.connect
39697c478bd9Sstevel@tonic-gate					[j, _, {daemon_name}, {if_name},
39707c478bd9Sstevel@tonic-gate					{if_addr}] Macros to transmit to
39717c478bd9Sstevel@tonic-gate					milters when a session connection
39727c478bd9Sstevel@tonic-gate					starts.
39737c478bd9Sstevel@tonic-gateconfMILTER_MACROS_HELO	Milter.macros.helo
39747c478bd9Sstevel@tonic-gate					[{tls_version}, {cipher},
39757c478bd9Sstevel@tonic-gate					{cipher_bits}, {cert_subject},
39767c478bd9Sstevel@tonic-gate					{cert_issuer}] Macros to transmit to
39777c478bd9Sstevel@tonic-gate					milters after HELO/EHLO command.
39787c478bd9Sstevel@tonic-gateconfMILTER_MACROS_ENVFROM	Milter.macros.envfrom
39797c478bd9Sstevel@tonic-gate					[i, {auth_type}, {auth_authen},
39807c478bd9Sstevel@tonic-gate					{auth_ssf}, {auth_author},
39817c478bd9Sstevel@tonic-gate					{mail_mailer}, {mail_host},
39827c478bd9Sstevel@tonic-gate					{mail_addr}] Macros to transmit to
39837c478bd9Sstevel@tonic-gate					milters after MAIL FROM command.
39847c478bd9Sstevel@tonic-gateconfMILTER_MACROS_ENVRCPT	Milter.macros.envrcpt
39857c478bd9Sstevel@tonic-gate					[{rcpt_mailer}, {rcpt_host},
39867c478bd9Sstevel@tonic-gate					{rcpt_addr}] Macros to transmit to
39877c478bd9Sstevel@tonic-gate					milters after RCPT TO command.
39887c478bd9Sstevel@tonic-gateconfMILTER_MACROS_EOM		Milter.macros.eom
39897c478bd9Sstevel@tonic-gate					[{msg_id}] Macros to transmit to
39904aac33d3Sjbeck					milters after the terminating
39914aac33d3Sjbeck					DATA '.' is received.
39924aac33d3SjbeckconfMILTER_MACROS_EOH		Milter.macros.eoh
39934aac33d3Sjbeck					Macros to transmit to milters
39944aac33d3Sjbeck					after the end of headers.
39954aac33d3SjbeckconfMILTER_MACROS_DATA		Milter.macros.data
39964aac33d3Sjbeck					Macros to transmit to milters
39974aac33d3Sjbeck					after DATA command is received.
39987c478bd9Sstevel@tonic-gate
39997c478bd9Sstevel@tonic-gate
40007c478bd9Sstevel@tonic-gateSee also the description of OSTYPE for some parameters that can be
40017c478bd9Sstevel@tonic-gatetweaked (generally pathnames to mailers).
40027c478bd9Sstevel@tonic-gate
40037c478bd9Sstevel@tonic-gateClientPortOptions and DaemonPortOptions are special cases since multiple
40047c478bd9Sstevel@tonic-gateclients/daemons can be defined.  This can be done via
40057c478bd9Sstevel@tonic-gate
40067c478bd9Sstevel@tonic-gate	CLIENT_OPTIONS(`field1=value1,field2=value2,...')
40077c478bd9Sstevel@tonic-gate	DAEMON_OPTIONS(`field1=value1,field2=value2,...')
40087c478bd9Sstevel@tonic-gate
40097c478bd9Sstevel@tonic-gateNote that multiple CLIENT_OPTIONS() commands (and therefore multiple
40107c478bd9Sstevel@tonic-gateClientPortOptions settings) are allowed in order to give settings for each
40117c478bd9Sstevel@tonic-gateprotocol family (e.g., one for Family=inet and one for Family=inet6).  A
40127c478bd9Sstevel@tonic-gaterestriction placed on one family only affects outgoing connections on that
40137c478bd9Sstevel@tonic-gateparticular family.
40147c478bd9Sstevel@tonic-gate
40157c478bd9Sstevel@tonic-gateIf DAEMON_OPTIONS is not used, then the default is
40167c478bd9Sstevel@tonic-gate
40177c478bd9Sstevel@tonic-gate	DAEMON_OPTIONS(`Port=smtp, Name=MTA')
40187c478bd9Sstevel@tonic-gate	DAEMON_OPTIONS(`Port=587, Name=MSA, M=E')
40197c478bd9Sstevel@tonic-gate
40207c478bd9Sstevel@tonic-gateIf you use one DAEMON_OPTIONS macro, it will alter the parameters
40217c478bd9Sstevel@tonic-gateof the first of these.  The second will still be defaulted; it
40227c478bd9Sstevel@tonic-gaterepresents a "Message Submission Agent" (MSA) as defined by RFC
40237c478bd9Sstevel@tonic-gate2476 (see below).  To turn off the default definition for the MSA,
40247c478bd9Sstevel@tonic-gateuse FEATURE(`no_default_msa') (see also FEATURES).  If you use
40257c478bd9Sstevel@tonic-gateadditional DAEMON_OPTIONS macros, they will add additional daemons.
40267c478bd9Sstevel@tonic-gate
40277c478bd9Sstevel@tonic-gateExample 1:  To change the port for the SMTP listener, while
40287c478bd9Sstevel@tonic-gatestill using the MSA default, use
40297c478bd9Sstevel@tonic-gate	DAEMON_OPTIONS(`Port=925, Name=MTA')
40307c478bd9Sstevel@tonic-gate
40317c478bd9Sstevel@tonic-gateExample 2:  To change the port for the MSA daemon, while still
40327c478bd9Sstevel@tonic-gateusing the default SMTP port, use
40337c478bd9Sstevel@tonic-gate	FEATURE(`no_default_msa')
40347c478bd9Sstevel@tonic-gate	DAEMON_OPTIONS(`Name=MTA')
40357c478bd9Sstevel@tonic-gate	DAEMON_OPTIONS(`Port=987, Name=MSA, M=E')
40367c478bd9Sstevel@tonic-gate
40377c478bd9Sstevel@tonic-gateNote that if the first of those DAEMON_OPTIONS lines were omitted, then
40387c478bd9Sstevel@tonic-gatethere would be no listener on the standard SMTP port.
40397c478bd9Sstevel@tonic-gate
40407c478bd9Sstevel@tonic-gateExample 3: To listen on both IPv4 and IPv6 interfaces, use
40417c478bd9Sstevel@tonic-gate
40427c478bd9Sstevel@tonic-gate	DAEMON_OPTIONS(`Name=MTA-v4, Family=inet')
40437c478bd9Sstevel@tonic-gate	DAEMON_OPTIONS(`Name=MTA-v6, Family=inet6')
40447c478bd9Sstevel@tonic-gate
40457c478bd9Sstevel@tonic-gateA "Message Submission Agent" still uses all of the same rulesets for
40467c478bd9Sstevel@tonic-gateprocessing the message (and therefore still allows message rejection via
40477c478bd9Sstevel@tonic-gatethe check_* rulesets).  In accordance with the RFC, the MSA will ensure
40487c478bd9Sstevel@tonic-gatethat all domains in envelope addresses are fully qualified if the message
40497c478bd9Sstevel@tonic-gateis relayed to another MTA.  It will also enforce the normal address syntax
40507c478bd9Sstevel@tonic-gaterules and log error messages.  Additionally, by using the M=a modifier you
40517c478bd9Sstevel@tonic-gatecan require authentication before messages are accepted by the MSA.
40527c478bd9Sstevel@tonic-gateNotice: Do NOT use the 'a' modifier on a public accessible MTA!  Finally,
40537c478bd9Sstevel@tonic-gatethe M=E modifier shown above disables ETRN as required by RFC 2476.
40547c478bd9Sstevel@tonic-gate
40557c478bd9Sstevel@tonic-gateMail filters can be defined using the INPUT_MAIL_FILTER() and MAIL_FILTER()
40567c478bd9Sstevel@tonic-gatecommands:
40577c478bd9Sstevel@tonic-gate
40587c478bd9Sstevel@tonic-gate	INPUT_MAIL_FILTER(`sample', `S=local:/var/run/f1.sock')
40597c478bd9Sstevel@tonic-gate	MAIL_FILTER(`myfilter', `S=inet:3333@localhost')
40607c478bd9Sstevel@tonic-gate
40617c478bd9Sstevel@tonic-gateThe INPUT_MAIL_FILTER() command causes the filter(s) to be called in the
40627c478bd9Sstevel@tonic-gatesame order they were specified by also setting confINPUT_MAIL_FILTERS.  A
40637c478bd9Sstevel@tonic-gatefilter can be defined without adding it to the input filter list by using
40647c478bd9Sstevel@tonic-gateMAIL_FILTER() instead of INPUT_MAIL_FILTER() in your .mc file.
40657c478bd9Sstevel@tonic-gateAlternatively, you can reset the list of filters and their order by setting
40667c478bd9Sstevel@tonic-gateconfINPUT_MAIL_FILTERS option after all INPUT_MAIL_FILTER() commands in
40677c478bd9Sstevel@tonic-gateyour .mc file.
40687c478bd9Sstevel@tonic-gate
40697c478bd9Sstevel@tonic-gate
40707c478bd9Sstevel@tonic-gate+----------------------------+
40717c478bd9Sstevel@tonic-gate| MESSAGE SUBMISSION PROGRAM |
40727c478bd9Sstevel@tonic-gate+----------------------------+
40737c478bd9Sstevel@tonic-gate
40747c478bd9Sstevel@tonic-gateThis section contains a list of caveats and
40757c478bd9Sstevel@tonic-gatea few hints how for those who want to tweak the default configuration
40767c478bd9Sstevel@tonic-gatefor it (which is installed as submit.cf).
40777c478bd9Sstevel@tonic-gate
40787c478bd9Sstevel@tonic-gateNotice: do not add options/features to submit.mc unless you are
40797c478bd9Sstevel@tonic-gateabsolutely sure you need them.  Options you may want to change
40807c478bd9Sstevel@tonic-gateinclude:
40817c478bd9Sstevel@tonic-gate
40827c478bd9Sstevel@tonic-gate- confTRUSTED_USERS, FEATURE(`use_ct_file'), and confCT_FILE for
40837c478bd9Sstevel@tonic-gate  avoiding X-Authentication warnings.
40847c478bd9Sstevel@tonic-gate- confTIME_ZONE to change it from the default `USE_TZ'.
40857c478bd9Sstevel@tonic-gate- confDELIVERY_MODE is set to interactive in msp.m4 instead
40867c478bd9Sstevel@tonic-gate  of the default background mode.
40877c478bd9Sstevel@tonic-gate- FEATURE(stickyhost) and LOCAL_RELAY to send unqualified addresses
40887c478bd9Sstevel@tonic-gate  to the LOCAL_RELAY instead of the default relay.
40897c478bd9Sstevel@tonic-gate
40907c478bd9Sstevel@tonic-gateThe MSP performs hostname canonicalization by default.  Mail may end
40917c478bd9Sstevel@tonic-gateup for various DNS related reasons in the MSP queue.  This problem
40927c478bd9Sstevel@tonic-gatecan be minimized by using
40937c478bd9Sstevel@tonic-gate
40947c478bd9Sstevel@tonic-gate	FEATURE(`nocanonify', `canonify_hosts')
40957c478bd9Sstevel@tonic-gate	define(`confDIRECT_SUBMISSION_MODIFIERS', `C')
40967c478bd9Sstevel@tonic-gate
40977c478bd9Sstevel@tonic-gateSee the discussion about nocanonify for possible side effects.
40987c478bd9Sstevel@tonic-gate
40997c478bd9Sstevel@tonic-gateSome things are not intended to work with the MSP.  These include
41007c478bd9Sstevel@tonic-gatefeatures that influence the delivery process (e.g., mailertable,
41017c478bd9Sstevel@tonic-gatealiases), or those that are only important for a SMTP server (e.g.,
41027c478bd9Sstevel@tonic-gatevirtusertable, DaemonPortOptions, multiple queues).  Moreover,
41037c478bd9Sstevel@tonic-gaterelaxing certain restrictions (RestrictQueueRun, permissions on
41047c478bd9Sstevel@tonic-gatequeue directory) or adding features (e.g., enabling prog/file mailer)
41057c478bd9Sstevel@tonic-gatecan cause security problems.
41067c478bd9Sstevel@tonic-gate
41077c478bd9Sstevel@tonic-gateOther things don't work well with the MSP and require tweaking or
41087c478bd9Sstevel@tonic-gateworkarounds.
41097c478bd9Sstevel@tonic-gate
41107c478bd9Sstevel@tonic-gateThe file and the map created by makemap should be owned by smmsp,
41117c478bd9Sstevel@tonic-gateits group should be smmsp, and it should have mode 640.
41127c478bd9Sstevel@tonic-gate
41137c478bd9Sstevel@tonic-gatefeature/msp.m4 defines almost all settings for the MSP.  Most of
41147c478bd9Sstevel@tonic-gatethose should not be changed at all.  Some of the features and options
41157c478bd9Sstevel@tonic-gatecan be overridden if really necessary.  It is a bit tricky to do
41167c478bd9Sstevel@tonic-gatethis, because it depends on the actual way the option is defined
41177c478bd9Sstevel@tonic-gatein feature/msp.m4.  If it is directly defined (i.e., define()) then
41187c478bd9Sstevel@tonic-gatethe modified value must be defined after
41197c478bd9Sstevel@tonic-gate
41207c478bd9Sstevel@tonic-gate	FEATURE(`msp')
41217c478bd9Sstevel@tonic-gate
41227c478bd9Sstevel@tonic-gateIf it is conditionally defined (i.e., ifdef()) then the desired
41237c478bd9Sstevel@tonic-gatevalue must be defined before the FEATURE line in the .mc file.
41247c478bd9Sstevel@tonic-gateTo see how the options are defined read feature/msp.m4.
41257c478bd9Sstevel@tonic-gate
41267c478bd9Sstevel@tonic-gate
41277c478bd9Sstevel@tonic-gate+--------------------------+
41287c478bd9Sstevel@tonic-gate| FORMAT OF FILES AND MAPS |
41297c478bd9Sstevel@tonic-gate+--------------------------+
41307c478bd9Sstevel@tonic-gate
41317c478bd9Sstevel@tonic-gateFiles that define classes, i.e., F{classname}, consist of lines
41327c478bd9Sstevel@tonic-gateeach of which contains a single element of the class.  For example,
41337c478bd9Sstevel@tonic-gate/etc/mail/local-host-names may have the following content:
41347c478bd9Sstevel@tonic-gate
41357c478bd9Sstevel@tonic-gatemy.domain
41367c478bd9Sstevel@tonic-gateanother.domain
41377c478bd9Sstevel@tonic-gate
41387c478bd9Sstevel@tonic-gateMaps must be created using makemap(8) , e.g.,
41397c478bd9Sstevel@tonic-gate
41407c478bd9Sstevel@tonic-gate	makemap hash MAP < MAP
41417c478bd9Sstevel@tonic-gate
41427c478bd9Sstevel@tonic-gateIn general, a text file from which a map is created contains lines
41437c478bd9Sstevel@tonic-gateof the form
41447c478bd9Sstevel@tonic-gate
41457c478bd9Sstevel@tonic-gatekey	value
41467c478bd9Sstevel@tonic-gate
41477c478bd9Sstevel@tonic-gatewhere 'key' and 'value' are also called LHS and RHS, respectively.
41487c478bd9Sstevel@tonic-gateBy default, the delimiter between LHS and RHS is a non-empty sequence
41497c478bd9Sstevel@tonic-gateof white space characters.
41507c478bd9Sstevel@tonic-gate
41517c478bd9Sstevel@tonic-gate
41527c478bd9Sstevel@tonic-gate+------------------+
41537c478bd9Sstevel@tonic-gate| DIRECTORY LAYOUT |
41547c478bd9Sstevel@tonic-gate+------------------+
41557c478bd9Sstevel@tonic-gate
41567c478bd9Sstevel@tonic-gateWithin this directory are several subdirectories, to wit:
41577c478bd9Sstevel@tonic-gate
41587c478bd9Sstevel@tonic-gatem4		General support routines.  These are typically
41597c478bd9Sstevel@tonic-gate		very important and should not be changed without
41607c478bd9Sstevel@tonic-gate		very careful consideration.
41617c478bd9Sstevel@tonic-gate
41627c478bd9Sstevel@tonic-gatecf		The configuration files themselves.  They have
41637c478bd9Sstevel@tonic-gate		".mc" suffixes, and must be run through m4 to
41647c478bd9Sstevel@tonic-gate		become complete.  The resulting output should
41657c478bd9Sstevel@tonic-gate		have a ".cf" suffix.
41667c478bd9Sstevel@tonic-gate
41677c478bd9Sstevel@tonic-gateostype		Definitions describing a particular operating
41687c478bd9Sstevel@tonic-gate		system type.  These should always be referenced
41697c478bd9Sstevel@tonic-gate		using the OSTYPE macro in the .mc file.  Examples
41707c478bd9Sstevel@tonic-gate		include "bsd4.3", "bsd4.4", "sunos3.5", and
41717c478bd9Sstevel@tonic-gate		"sunos4.1".
41727c478bd9Sstevel@tonic-gate
41737c478bd9Sstevel@tonic-gatedomain		Definitions describing a particular domain, referenced
41747c478bd9Sstevel@tonic-gate		using the DOMAIN macro in the .mc file.  These are
41757c478bd9Sstevel@tonic-gate		site dependent; for example, "CS.Berkeley.EDU.m4"
41767c478bd9Sstevel@tonic-gate		describes hosts in the CS.Berkeley.EDU subdomain.
41777c478bd9Sstevel@tonic-gate
41787c478bd9Sstevel@tonic-gatemailer		Descriptions of mailers.  These are referenced using
41797c478bd9Sstevel@tonic-gate		the MAILER macro in the .mc file.
41807c478bd9Sstevel@tonic-gate
41817c478bd9Sstevel@tonic-gatesh		Shell files used when building the .cf file from the
41827c478bd9Sstevel@tonic-gate		.mc file in the cf subdirectory.
41837c478bd9Sstevel@tonic-gate
41847c478bd9Sstevel@tonic-gatefeature		These hold special orthogonal features that you might
41857c478bd9Sstevel@tonic-gate		want to include.  They should be referenced using
41867c478bd9Sstevel@tonic-gate		the FEATURE macro.
41877c478bd9Sstevel@tonic-gate
41887c478bd9Sstevel@tonic-gatehack		Local hacks.  These can be referenced using the HACK
41897c478bd9Sstevel@tonic-gate		macro.  They shouldn't be of more than voyeuristic
41907c478bd9Sstevel@tonic-gate		interest outside the .Berkeley.EDU domain, but who knows?
41917c478bd9Sstevel@tonic-gate
41927c478bd9Sstevel@tonic-gatesiteconfig	Site configuration -- e.g., tables of locally connected
41937c478bd9Sstevel@tonic-gate		UUCP sites.
41947c478bd9Sstevel@tonic-gate
41957c478bd9Sstevel@tonic-gate
41967c478bd9Sstevel@tonic-gate+------------------------+
41977c478bd9Sstevel@tonic-gate| ADMINISTRATIVE DETAILS |
41987c478bd9Sstevel@tonic-gate+------------------------+
41997c478bd9Sstevel@tonic-gate
42007c478bd9Sstevel@tonic-gateThe following sections detail usage of certain internal parts of the
42017c478bd9Sstevel@tonic-gatesendmail.cf file.  Read them carefully if you are trying to modify
42027c478bd9Sstevel@tonic-gatethe current model.  If you find the above descriptions adequate, these
42037c478bd9Sstevel@tonic-gateshould be {boring, confusing, tedious, ridiculous} (pick one or more).
42047c478bd9Sstevel@tonic-gate
42057c478bd9Sstevel@tonic-gateRULESETS (* means built in to sendmail)
42067c478bd9Sstevel@tonic-gate
42077c478bd9Sstevel@tonic-gate   0 *	Parsing
42087c478bd9Sstevel@tonic-gate   1 *	Sender rewriting
42097c478bd9Sstevel@tonic-gate   2 *	Recipient rewriting
42107c478bd9Sstevel@tonic-gate   3 *	Canonicalization
42117c478bd9Sstevel@tonic-gate   4 *	Post cleanup
42127c478bd9Sstevel@tonic-gate   5 *	Local address rewrite (after aliasing)
42137c478bd9Sstevel@tonic-gate  1x	mailer rules (sender qualification)
42147c478bd9Sstevel@tonic-gate  2x	mailer rules (recipient qualification)
42157c478bd9Sstevel@tonic-gate  3x	mailer rules (sender header qualification)
42167c478bd9Sstevel@tonic-gate  4x	mailer rules (recipient header qualification)
42177c478bd9Sstevel@tonic-gate  5x	mailer subroutines (general)
42187c478bd9Sstevel@tonic-gate  6x	mailer subroutines (general)
42197c478bd9Sstevel@tonic-gate  7x	mailer subroutines (general)
42207c478bd9Sstevel@tonic-gate  8x	reserved
42217c478bd9Sstevel@tonic-gate  90	Mailertable host stripping
42227c478bd9Sstevel@tonic-gate  96	Bottom half of Ruleset 3 (ruleset 6 in old sendmail)
42237c478bd9Sstevel@tonic-gate  97	Hook for recursive ruleset 0 call (ruleset 7 in old sendmail)
42247c478bd9Sstevel@tonic-gate  98	Local part of ruleset 0 (ruleset 8 in old sendmail)
42257c478bd9Sstevel@tonic-gate
42267c478bd9Sstevel@tonic-gate
42277c478bd9Sstevel@tonic-gateMAILERS
42287c478bd9Sstevel@tonic-gate
42297c478bd9Sstevel@tonic-gate   0	local, prog	local and program mailers
42307c478bd9Sstevel@tonic-gate   1	[e]smtp, relay	SMTP channel
42317c478bd9Sstevel@tonic-gate   2	uucp-*		UNIX-to-UNIX Copy Program
42327c478bd9Sstevel@tonic-gate   3	netnews		Network News delivery
42337c478bd9Sstevel@tonic-gate   4	fax		Sam Leffler's HylaFAX software
42347c478bd9Sstevel@tonic-gate   5	mail11		DECnet mailer
42357c478bd9Sstevel@tonic-gate
42367c478bd9Sstevel@tonic-gate
42377c478bd9Sstevel@tonic-gateMACROS
42387c478bd9Sstevel@tonic-gate
42397c478bd9Sstevel@tonic-gate   A
42407c478bd9Sstevel@tonic-gate   B	Bitnet Relay
42417c478bd9Sstevel@tonic-gate   C	DECnet Relay
42427c478bd9Sstevel@tonic-gate   D	The local domain -- usually not needed
42437c478bd9Sstevel@tonic-gate   E	reserved for X.400 Relay
42447c478bd9Sstevel@tonic-gate   F	FAX Relay
42457c478bd9Sstevel@tonic-gate   G
42467c478bd9Sstevel@tonic-gate   H	mail Hub (for mail clusters)
42477c478bd9Sstevel@tonic-gate   I
42487c478bd9Sstevel@tonic-gate   J
42497c478bd9Sstevel@tonic-gate   K
42507c478bd9Sstevel@tonic-gate   L	Luser Relay
42517c478bd9Sstevel@tonic-gate   M	Masquerade (who you claim to be)
42527c478bd9Sstevel@tonic-gate   N
42537c478bd9Sstevel@tonic-gate   O
42547c478bd9Sstevel@tonic-gate   P
42557c478bd9Sstevel@tonic-gate   Q
42567c478bd9Sstevel@tonic-gate   R	Relay (for unqualified names)
42577c478bd9Sstevel@tonic-gate   S	Smart Host
42587c478bd9Sstevel@tonic-gate   T
42597c478bd9Sstevel@tonic-gate   U	my UUCP name (if you have a UUCP connection)
42607c478bd9Sstevel@tonic-gate   V	UUCP Relay (class {V} hosts)
42617c478bd9Sstevel@tonic-gate   W	UUCP Relay (class {W} hosts)
42627c478bd9Sstevel@tonic-gate   X	UUCP Relay (class {X} hosts)
42637c478bd9Sstevel@tonic-gate   Y	UUCP Relay (all other hosts)
42647c478bd9Sstevel@tonic-gate   Z	Version number
42657c478bd9Sstevel@tonic-gate
42667c478bd9Sstevel@tonic-gate
42677c478bd9Sstevel@tonic-gateCLASSES
42687c478bd9Sstevel@tonic-gate
42697c478bd9Sstevel@tonic-gate   A
42707c478bd9Sstevel@tonic-gate   B	domains that are candidates for bestmx lookup
42717c478bd9Sstevel@tonic-gate   C
42727c478bd9Sstevel@tonic-gate   D
42737c478bd9Sstevel@tonic-gate   E	addresses that should not seem to come from $M
42747c478bd9Sstevel@tonic-gate   F	hosts this system forward for
42757c478bd9Sstevel@tonic-gate   G	domains that should be looked up in genericstable
42767c478bd9Sstevel@tonic-gate   H
42777c478bd9Sstevel@tonic-gate   I
42787c478bd9Sstevel@tonic-gate   J
42797c478bd9Sstevel@tonic-gate   K
42807c478bd9Sstevel@tonic-gate   L	addresses that should not be forwarded to $R
42817c478bd9Sstevel@tonic-gate   M	domains that should be mapped to $M
42827c478bd9Sstevel@tonic-gate   N	host/domains that should not be mapped to $M
42837c478bd9Sstevel@tonic-gate   O	operators that indicate network operations (cannot be in local names)
42847c478bd9Sstevel@tonic-gate   P	top level pseudo-domains: BITNET, DECNET, FAX, UUCP, etc.
42857c478bd9Sstevel@tonic-gate   Q
42867c478bd9Sstevel@tonic-gate   R	domains this system is willing to relay (pass anti-spam filters)
42877c478bd9Sstevel@tonic-gate   S
42887c478bd9Sstevel@tonic-gate   T
42897c478bd9Sstevel@tonic-gate   U	locally connected UUCP hosts
42907c478bd9Sstevel@tonic-gate   V	UUCP hosts connected to relay $V
42917c478bd9Sstevel@tonic-gate   W	UUCP hosts connected to relay $W
42927c478bd9Sstevel@tonic-gate   X	UUCP hosts connected to relay $X
42937c478bd9Sstevel@tonic-gate   Y	locally connected smart UUCP hosts
42947c478bd9Sstevel@tonic-gate   Z	locally connected domain-ized UUCP hosts
42957c478bd9Sstevel@tonic-gate   .	the class containing only a dot
42967c478bd9Sstevel@tonic-gate   [	the class containing only a left bracket
42977c478bd9Sstevel@tonic-gate
42987c478bd9Sstevel@tonic-gate
42997c478bd9Sstevel@tonic-gateM4 DIVERSIONS
43007c478bd9Sstevel@tonic-gate
43017c478bd9Sstevel@tonic-gate   1	Local host detection and resolution
43027c478bd9Sstevel@tonic-gate   2	Local Ruleset 3 additions
43037c478bd9Sstevel@tonic-gate   3	Local Ruleset 0 additions
43047c478bd9Sstevel@tonic-gate   4	UUCP Ruleset 0 additions
43057c478bd9Sstevel@tonic-gate   5	locally interpreted names (overrides $R)
43067c478bd9Sstevel@tonic-gate   6	local configuration (at top of file)
43077c478bd9Sstevel@tonic-gate   7	mailer definitions
43087c478bd9Sstevel@tonic-gate   8	DNS based blacklists
43097c478bd9Sstevel@tonic-gate   9	special local rulesets (1 and 2)
43107c478bd9Sstevel@tonic-gate
4311*e9af4bc0SJohn Beck$Revision: 8.727 $, Last updated $Date: 2009/05/07 23:46:17 $
4312