{ "content": [ { "type": "text", "text": "# posttls-finger (man)\n\n## NAME\n\nposttls-finger - Probe the TLS properties of an ESMTP or LMTP server.\n\n## SYNOPSIS\n\nposttls-finger [options] [inet:]domain[:port] [match ...]\nposttls-finger -S [options] unix:pathname [match ...]\n\n## DESCRIPTION\n\nposttls-finger(1) connects to the specified destination and reports TLS-related information\nabout the server. With SMTP, the destination is a domainname; with LMTP it is either a do‐\nmainname prefixed with inet: or a pathname prefixed with unix:. If Postfix is built without\nTLS support, the resulting posttls-finger program has very limited functionality, and only\nthe -a, -c, -h, -o, -S, -t, -T and -v options are available.\n\n## Sections\n\n- **NAME**\n- **SYNOPSIS**\n- **DESCRIPTION** (28 subsections)\n- **ENVIRONMENT**\n- **SEE ALSO**\n- **README FILES**\n- **LICENSE**\n\nUse structuredContent.sections for detailed options, examples, and full documentation.\n" } ], "structuredContent": { "command": "posttls-finger", "section": "", "mode": "man", "summary": "posttls-finger - Probe the TLS properties of an ESMTP or LMTP server.", "synopsis": "posttls-finger [options] [inet:]domain[:port] [match ...]\nposttls-finger -S [options] unix:pathname [match ...]", "tldr_summary": null, "tldr_examples": [], "tldr_source": null, "flags": [ { "flag": "-a", "long": null, "arg": null, "description": "Address family preference: ipv4, ipv6 or any. When using any, posttls-finger will randomly select one of the two as the more preferred, and exhaust all MX preferences for the first address family before trying any addresses for the other." }, { "flag": "-A", "long": null, "arg": null, "description": "A list of PEM trust-anchor files that overrides CAfile and CApath trust chain verifi‐ cation. Specify the option multiple times to specify multiple files. See the main.cf documentation for smtptlstrustanchorfile for details." }, { "flag": "-c", "long": null, "arg": null, "description": "" }, { "flag": "-C", "long": null, "arg": null, "description": "subject DN, certificate and public key fingerprints (see -d mdalg option below) are printed above each PEM certificate block. If you specify -F CAfile or -P CApath, the OpenSSL library may augment the chain with missing issuer certificates. To see the actual chain sent by the remote SMTP server leave CAfile and CApath unset." }, { "flag": "-d", "long": null, "arg": null, "description": "The message digest algorithm to use for reporting remote SMTP server fingerprints and matching against user provided certificate fingerprints (with DANE TLSA records the algorithm is specified in the DNS). In Postfix versions prior to 3.6, the default value was \"sha1\"." }, { "flag": "-f", "long": null, "arg": null, "description": "dress records lie in an unsigned zone. See smtptlsforceinsecurehosttlsalookup for details." }, { "flag": "-F", "long": null, "arg": null, "description": "The PEM formatted CAfile for remote SMTP server certificate verification. By default no CAfile is used and no public CAs are trusted." }, { "flag": "-g", "long": null, "arg": null, "description": "The minimum TLS cipher grade used by posttls-finger. See smtptlsmandatoryciphers for details." }, { "flag": "-h", "long": null, "arg": null, "description": "The hostname lookup methods used for the connection. See the documentation of smtphostlookup for syntax and semantics." }, { "flag": "-H", "long": null, "arg": null, "description": "List of files with a sequence PEM-encoded TLS client certificate chains. The list can be built-up incrementally, by specifying the option multiple times, or all at once via a comma or whitespace separated list of filenames. Each chain starts with a private key, which is followed immediately by the corresponding certificate, and optionally by additional issuer certificates. Each new key begins a new chain for the corresponding algorithm. This option is mutually exclusive with the below -k and -K options." }, { "flag": "-k", "long": null, "arg": null, "description": "File with PEM-encoded TLS client certificate chain. This defaults to keyfile if one is specified." }, { "flag": "-K", "long": null, "arg": null, "description": "File with PEM-encoded TLS client private key. This defaults to certfile if one is specified." }, { "flag": "-l", "long": null, "arg": null, "description": "The security level for the connection, default dane or secure depending on whether DNSSEC is available. For syntax and semantics, see the documentation of smtptlsse‐ curitylevel. When dane or dane-only is supported and selected, if no TLSA records are found, or all the records found are unusable, the secure level will be used in‐ stead. The fingerprint security level allows you to test certificate or public-key fingerprint matches before you deploy them in the policy table. Note, since posttls-finger does not actually deliver any email, the none, may and en‐‐ crypt security levels are not very useful. Since may and encrypt don't require peer certificates, they will often negotiate anonymous TLS ciphersuites, so you won't learn much about the remote SMTP server's certificates at these levels if it also supports anonymous TLS (though you may learn that the server supports anonymous TLS)." }, { "flag": "-L", "long": null, "arg": null, "description": "Fine-grained TLS logging options. To tune the TLS features logged during the TLS hand‐ shake, specify one or more of: 0, none These yield no TLS logging; you'll generally want more, but this is handy if you just want the trust chain: $ posttls-finger -cC -L none destination 1, routine, summary These synonymous values yield a normal one-line summary of the TLS connection. 2, debug These synonymous values combine routine, ssl-debug, cache and verbose. 3, ssl-expert These synonymous values combine debug with ssl-handshake-packet-dump. For ex‐ perts only. 4, ssl-developer These synonymous values combine ssl-expert with ssl-session-packet-dump. For experts only, and in most cases, use wireshark instead. ssl-debug Turn on OpenSSL logging of the progress of the SSL handshake. ssl-handshake-packet-dump Log hexadecimal packet dumps of the SSL handshake; for experts only. ssl-session-packet-dump Log hexadecimal packet dumps of the entire SSL session; only useful to those who can debug SSL protocol problems from hex dumps. untrusted Logs trust chain verification problems. This is turned on automatically at se‐ curity levels that use peer names signed by Certification Authorities to vali‐ date certificates. So while this setting is recognized, you should never need to set it explicitly. peercert This logs a one line summary of the remote SMTP server certificate subject, is‐ suer, and fingerprints. certmatch This logs remote SMTP server certificate matching, showing the CN and each sub‐ jectAltName and which name matched. With DANE, logs matching of TLSA record trust-anchor and end-entity certificates. cache This logs session cache operations, showing whether session caching is effec‐ tive with the remote SMTP server. Automatically used when reconnecting with the -r option; rarely needs to be set explicitly. verbose Enables verbose logging in the Postfix TLS driver; includes all of peercert..cache and more. The default is routine,certmatch. After a reconnect, peercert, certmatch and verbose are automatically disabled while cache and summary are enabled." }, { "flag": "-m", "long": null, "arg": null, "description": "When the -r delay option is specified, the -m option determines the maximum number of reconnect attempts to use with a server behind a load balancer, to see whether connec‐ tion caching is likely to be effective for this destination. Some MTAs don't expose the underlying server identity in their EHLO response; with these servers there will never be more than 1 reconnection attempt." }, { "flag": "-M", "long": null, "arg": null, "description": "The TLS policy for MX hosts with \"secure\" TLSA records when the nexthop destination security level is dane, but the MX record was found via an \"insecure\" MX lookup. See the main.cf documentation for smtptlsinsecuremxpolicy for details." }, { "flag": "-o", "long": null, "arg": null, "description": "Specify zero or more times to override the value of the main.cf parameter name with value. Possible use-cases include overriding the values of TLS library parameters, or \"myhostname\" to configure the SMTP EHLO name sent to the remote server." }, { "flag": "-p", "long": null, "arg": null, "description": "TLS protocols that posttls-finger will exclude or include. See smtptlsmanda‐ toryprotocols for details." }, { "flag": "-P", "long": null, "arg": null, "description": "The OpenSSL CApath/ directory (indexed via crehash(1)) for remote SMTP server cer‐ tificate verification. By default no CApath is used and no public CAs are trusted." }, { "flag": "-r", "long": null, "arg": null, "description": "With a cacheable TLS session, disconnect and reconnect after delay seconds. Report whether the session is re-used. Retry if a new server is encountered, up to 5 times or as specified with the -m option. By default reconnection is disabled, specify a posi‐ tive delay to enable this behavior." }, { "flag": "-s", "long": null, "arg": null, "description": "The server name to send with the TLS Server Name Indication (SNI) extension. When the server has DANE TLSA records, this parameter is ignored and the TLSA base domain is used instead. Otherwise, SNI is not used by default, but can be enabled by specifying the desired value with this option." }, { "flag": "-S", "long": null, "arg": null, "description": "is 24. Alternative ports can specified by appending \":servicename\" or \":portnumber\" to the destination argument." }, { "flag": "-t", "long": null, "arg": null, "description": "The TCP connection timeout to use. This is also the timeout for reading the remote server's 220 banner." }, { "flag": "-T", "long": null, "arg": null, "description": "The SMTP/LMTP command timeout for EHLO/LHLO, STARTTLS and QUIT." }, { "flag": "-v", "long": null, "arg": null, "description": "bose logging." }, { "flag": "-w", "long": null, "arg": null, "description": "port 465 by servers that are compatible with the ad-hoc SMTP in SSL protocol, rather than the standard STARTTLS protocol. The destination domain:port should of course provide such a service." }, { "flag": "-X", "long": null, "arg": null, "description": "[inet:]domain[:port] Connect via TCP to domain domain, port port. The default port is smtp (or 24 with LMTP). With SMTP an MX lookup is performed to resolve the domain to a host, unless the domain is enclosed in []. If you want to connect to a specific MX host, for in‐ stance mx1.example.com, specify [mx1.example.com] as the destination and example.com as a match argument. When using DNS, the destination domain is assumed fully quali‐ fied and no default domain or search suffixes are applied; you must use fully-quali‐ fied names or also enable native host lookups (these don't support dane or dane-only as no DNSSEC validation information is available via native lookups). unix:pathname Connect to the UNIX-domain socket at pathname. LMTP only." } ], "examples": [], "see_also": [ { "name": "smtp-source", "section": "1", "url": "https://www.chedong.com/phpMan.php/man/smtp-source/1/json" }, { "name": "smtp-sink", "section": "1", "url": "https://www.chedong.com/phpMan.php/man/smtp-sink/1/json" } ], "section_outline": [ { "name": "NAME", "lines": 2, "subsections": [] }, { "name": "SYNOPSIS", "lines": 3, "subsections": [] }, { "name": "DESCRIPTION", "lines": 56, "subsections": [ { "name": "-a", "lines": 4, "flag": "-a" }, { "name": "-A", "lines": 4, "flag": "-A" }, { "name": "-c", "lines": 1, "flag": "-c" }, { "name": "-C", "lines": 5, "flag": "-C" }, { "name": "-d", "lines": 5, "flag": "-d" }, { "name": "-f", "lines": 3, "flag": "-f" }, { "name": "-F", "lines": 3, "flag": "-F" }, { "name": "-g", "lines": 3, "flag": "-g" }, { "name": "-h", "lines": 3, "flag": "-h" }, { "name": "-H", "lines": 7, "flag": "-H" }, { "name": "-k", "lines": 3, "flag": "-k" }, { "name": "-K", "lines": 3, "flag": "-K" }, { "name": "-l", "lines": 13, "flag": "-l" }, { "name": "-L", "lines": 58, "flag": "-L" }, { "name": "-m", "lines": 6, "flag": "-m" }, { "name": "-M", "lines": 4, "flag": "-M" }, { "name": "-o", "lines": 4, "flag": "-o" }, { "name": "-p", "lines": 3, "flag": "-p" }, { "name": "-P", "lines": 3, "flag": "-P" }, { "name": "-r", "lines": 5, "flag": "-r" }, { "name": "-s", "lines": 5, "flag": "-s" }, { "name": "-S", "lines": 3, "flag": "-S" }, { "name": "-t", "lines": 3, "flag": "-t" }, { "name": "-T", "lines": 2, "flag": "-T" }, { "name": "-v", "lines": 2, "flag": "-v" }, { "name": "-w", "lines": 4, "flag": "-w" }, { "name": "-X", "lines": 13, "flag": "-X" }, { "name": "match ...", "lines": 7 } ] }, { "name": "ENVIRONMENT", "lines": 6, "subsections": [] }, { "name": "SEE ALSO", "lines": 4, "subsections": [] }, { "name": "README FILES", "lines": 3, "subsections": [] }, { "name": "LICENSE", "lines": 18, "subsections": [] } ], "sections": { "NAME": { "content": "posttls-finger - Probe the TLS properties of an ESMTP or LMTP server.\n", "subsections": [] }, "SYNOPSIS": { "content": "posttls-finger [options] [inet:]domain[:port] [match ...]\nposttls-finger -S [options] unix:pathname [match ...]\n", "subsections": [] }, "DESCRIPTION": { "content": "posttls-finger(1) connects to the specified destination and reports TLS-related information\nabout the server. With SMTP, the destination is a domainname; with LMTP it is either a do‐\nmainname prefixed with inet: or a pathname prefixed with unix:. If Postfix is built without\nTLS support, the resulting posttls-finger program has very limited functionality, and only\nthe -a, -c, -h, -o, -S, -t, -T and -v options are available.\n\nNote: this is an unsupported test program. No attempt is made to maintain compatibility be‐\ntween successive versions.\n\nFor SMTP servers that don't support ESMTP, only the greeting banner and the negative EHLO re‐\nsponse are reported. Otherwise, the reported EHLO response details further server capabili‐\nties.\n\nIf TLS support is enabled when posttls-finger(1) is compiled, and the server supports START‐‐\nTLS, a TLS handshake is attempted.\n\nIf DNSSEC support is available, the connection TLS security level (-l option) defaults to\ndane; see TLSREADME for details. Otherwise, it defaults to secure. This setting determines\nthe certificate matching policy.\n\nIf TLS negotiation succeeds, the TLS protocol and cipher details are reported. The server\ncertificate is then verified in accordance with the policy at the chosen (or default) secu‐\nrity level. With public CA-based trust, when the -L option includes certmatch, (true by de‐\nfault) name matching is performed even if the certificate chain is not trusted. This logs\nthe names found in the remote SMTP server certificate and which if any would match, were the\ncertificate chain trusted.\n\nNote: posttls-finger(1) does not perform any table lookups, so the TLS policy table and obso‐\nlete per-site tables are not consulted. It does not communicate with the tlsmgr(8) daemon\n(or any other Postfix daemons); its TLS session cache is held in private memory, and disap‐\npears when the process exits.\n\nWith the -r delay option, if the server assigns a TLS session id, the TLS session is cached.\nThe connection is then closed and re-opened after the specified delay, and posttls-finger(1)\nthen reports whether the cached TLS session was re-used.\n\nWhen the destination is a load balancer, it may be distributing load between multiple server\ncaches. Typically, each server returns its unique name in its EHLO response. If, upon recon‐\nnecting with -r, a new server name is detected, another session is cached for the new server,\nand the reconnect is repeated up to a maximum number of times (default 5) that can be speci‐\nfied via the -m option.\n\nThe choice of SMTP or LMTP (-S option) determines the syntax of the destination argument.\nWith SMTP, one can specify a service on a non-default port as host:service, and disable MX\n(mail exchanger) DNS lookups with [host] or [host]:port. The [] form is required when you\nspecify an IP address instead of a hostname. An IPv6 address takes the form [ipv6:address].\nThe default port for SMTP is taken from the smtp/tcp entry in /etc/services, defaulting to 25\nif the entry is not found.\n\nWith LMTP, specify unix:pathname to connect to a local server listening on a unix-domain\nsocket bound to the specified pathname; otherwise, specify an optional inet: prefix followed\nby a domain and an optional port, with the same syntax as for SMTP. The default TCP port for\nLMTP is 24.\n\nArguments:\n", "subsections": [ { "name": "-a", "content": "Address family preference: ipv4, ipv6 or any. When using any, posttls-finger will\nrandomly select one of the two as the more preferred, and exhaust all MX preferences\nfor the first address family before trying any addresses for the other.\n", "flag": "-a" }, { "name": "-A", "content": "A list of PEM trust-anchor files that overrides CAfile and CApath trust chain verifi‐\ncation. Specify the option multiple times to specify multiple files. See the main.cf\ndocumentation for smtptlstrustanchorfile for details.\n", "flag": "-A" }, { "name": "-c", "content": "", "flag": "-c" }, { "name": "-C", "content": "subject DN, certificate and public key fingerprints (see -d mdalg option below) are\nprinted above each PEM certificate block. If you specify -F CAfile or -P CApath, the\nOpenSSL library may augment the chain with missing issuer certificates. To see the\nactual chain sent by the remote SMTP server leave CAfile and CApath unset.\n", "flag": "-C" }, { "name": "-d", "content": "The message digest algorithm to use for reporting remote SMTP server fingerprints and\nmatching against user provided certificate fingerprints (with DANE TLSA records the\nalgorithm is specified in the DNS). In Postfix versions prior to 3.6, the default\nvalue was \"sha1\".\n", "flag": "-d" }, { "name": "-f", "content": "dress records lie in an unsigned zone. See smtptlsforceinsecurehosttlsalookup\nfor details.\n", "flag": "-f" }, { "name": "-F", "content": "The PEM formatted CAfile for remote SMTP server certificate verification. By default\nno CAfile is used and no public CAs are trusted.\n", "flag": "-F" }, { "name": "-g", "content": "The minimum TLS cipher grade used by posttls-finger. See smtptlsmandatoryciphers\nfor details.\n", "flag": "-g" }, { "name": "-h", "content": "The hostname lookup methods used for the connection. See the documentation of\nsmtphostlookup for syntax and semantics.\n", "flag": "-h" }, { "name": "-H", "content": "List of files with a sequence PEM-encoded TLS client certificate chains. The list can\nbe built-up incrementally, by specifying the option multiple times, or all at once via\na comma or whitespace separated list of filenames. Each chain starts with a private\nkey, which is followed immediately by the corresponding certificate, and optionally by\nadditional issuer certificates. Each new key begins a new chain for the corresponding\nalgorithm. This option is mutually exclusive with the below -k and -K options.\n", "flag": "-H" }, { "name": "-k", "content": "File with PEM-encoded TLS client certificate chain. This defaults to keyfile if one is\nspecified.\n", "flag": "-k" }, { "name": "-K", "content": "File with PEM-encoded TLS client private key. This defaults to certfile if one is\nspecified.\n", "flag": "-K" }, { "name": "-l", "content": "The security level for the connection, default dane or secure depending on whether\nDNSSEC is available. For syntax and semantics, see the documentation of smtptlsse‐\ncuritylevel. When dane or dane-only is supported and selected, if no TLSA records\nare found, or all the records found are unusable, the secure level will be used in‐\nstead. The fingerprint security level allows you to test certificate or public-key\nfingerprint matches before you deploy them in the policy table.\n\nNote, since posttls-finger does not actually deliver any email, the none, may and en‐‐\ncrypt security levels are not very useful. Since may and encrypt don't require peer\ncertificates, they will often negotiate anonymous TLS ciphersuites, so you won't learn\nmuch about the remote SMTP server's certificates at these levels if it also supports\nanonymous TLS (though you may learn that the server supports anonymous TLS).\n", "flag": "-l" }, { "name": "-L", "content": "Fine-grained TLS logging options. To tune the TLS features logged during the TLS hand‐\nshake, specify one or more of:\n\n0, none\nThese yield no TLS logging; you'll generally want more, but this is handy if\nyou just want the trust chain:\n$ posttls-finger -cC -L none destination\n\n1, routine, summary\nThese synonymous values yield a normal one-line summary of the TLS connection.\n\n2, debug\nThese synonymous values combine routine, ssl-debug, cache and verbose.\n\n3, ssl-expert\nThese synonymous values combine debug with ssl-handshake-packet-dump. For ex‐\nperts only.\n\n4, ssl-developer\nThese synonymous values combine ssl-expert with ssl-session-packet-dump. For\nexperts only, and in most cases, use wireshark instead.\n\nssl-debug\nTurn on OpenSSL logging of the progress of the SSL handshake.\n\nssl-handshake-packet-dump\nLog hexadecimal packet dumps of the SSL handshake; for experts only.\n\nssl-session-packet-dump\nLog hexadecimal packet dumps of the entire SSL session; only useful to those\nwho can debug SSL protocol problems from hex dumps.\n\nuntrusted\nLogs trust chain verification problems. This is turned on automatically at se‐\ncurity levels that use peer names signed by Certification Authorities to vali‐\ndate certificates. So while this setting is recognized, you should never need\nto set it explicitly.\n\npeercert\nThis logs a one line summary of the remote SMTP server certificate subject, is‐\nsuer, and fingerprints.\n\ncertmatch\nThis logs remote SMTP server certificate matching, showing the CN and each sub‐\njectAltName and which name matched. With DANE, logs matching of TLSA record\ntrust-anchor and end-entity certificates.\n\ncache This logs session cache operations, showing whether session caching is effec‐\ntive with the remote SMTP server. Automatically used when reconnecting with\nthe -r option; rarely needs to be set explicitly.\n\nverbose\nEnables verbose logging in the Postfix TLS driver; includes all of\npeercert..cache and more.\n\nThe default is routine,certmatch. After a reconnect, peercert, certmatch and verbose\nare automatically disabled while cache and summary are enabled.\n", "flag": "-L" }, { "name": "-m", "content": "When the -r delay option is specified, the -m option determines the maximum number of\nreconnect attempts to use with a server behind a load balancer, to see whether connec‐\ntion caching is likely to be effective for this destination. Some MTAs don't expose\nthe underlying server identity in their EHLO response; with these servers there will\nnever be more than 1 reconnection attempt.\n", "flag": "-m" }, { "name": "-M", "content": "The TLS policy for MX hosts with \"secure\" TLSA records when the nexthop destination\nsecurity level is dane, but the MX record was found via an \"insecure\" MX lookup. See\nthe main.cf documentation for smtptlsinsecuremxpolicy for details.\n", "flag": "-M" }, { "name": "-o", "content": "Specify zero or more times to override the value of the main.cf parameter name with\nvalue. Possible use-cases include overriding the values of TLS library parameters, or\n\"myhostname\" to configure the SMTP EHLO name sent to the remote server.\n", "flag": "-o" }, { "name": "-p", "content": "TLS protocols that posttls-finger will exclude or include. See smtptlsmanda‐\ntoryprotocols for details.\n", "flag": "-p" }, { "name": "-P", "content": "The OpenSSL CApath/ directory (indexed via crehash(1)) for remote SMTP server cer‐\ntificate verification. By default no CApath is used and no public CAs are trusted.\n", "flag": "-P" }, { "name": "-r", "content": "With a cacheable TLS session, disconnect and reconnect after delay seconds. Report\nwhether the session is re-used. Retry if a new server is encountered, up to 5 times or\nas specified with the -m option. By default reconnection is disabled, specify a posi‐\ntive delay to enable this behavior.\n", "flag": "-r" }, { "name": "-s", "content": "The server name to send with the TLS Server Name Indication (SNI) extension. When the\nserver has DANE TLSA records, this parameter is ignored and the TLSA base domain is\nused instead. Otherwise, SNI is not used by default, but can be enabled by specifying\nthe desired value with this option.\n", "flag": "-s" }, { "name": "-S", "content": "is 24. Alternative ports can specified by appending \":servicename\" or \":portnumber\"\nto the destination argument.\n", "flag": "-S" }, { "name": "-t", "content": "The TCP connection timeout to use. This is also the timeout for reading the remote\nserver's 220 banner.\n", "flag": "-t" }, { "name": "-T", "content": "The SMTP/LMTP command timeout for EHLO/LHLO, STARTTLS and QUIT.\n", "flag": "-T" }, { "name": "-v", "content": "bose logging.\n", "flag": "-v" }, { "name": "-w", "content": "port 465 by servers that are compatible with the ad-hoc SMTP in SSL protocol, rather\nthan the standard STARTTLS protocol. The destination domain:port should of course\nprovide such a service.\n", "flag": "-w" }, { "name": "-X", "content": "[inet:]domain[:port]\nConnect via TCP to domain domain, port port. The default port is smtp (or 24 with\nLMTP). With SMTP an MX lookup is performed to resolve the domain to a host, unless\nthe domain is enclosed in []. If you want to connect to a specific MX host, for in‐\nstance mx1.example.com, specify [mx1.example.com] as the destination and example.com\nas a match argument. When using DNS, the destination domain is assumed fully quali‐\nfied and no default domain or search suffixes are applied; you must use fully-quali‐\nfied names or also enable native host lookups (these don't support dane or dane-only\nas no DNSSEC validation information is available via native lookups).\n\nunix:pathname\nConnect to the UNIX-domain socket at pathname. LMTP only.\n", "flag": "-X" }, { "name": "match ...", "content": "With no match arguments specified, certificate peername matching uses the compiled-in\ndefault strategies for each security level. If you specify one or more arguments,\nthese will be used as the list of certificate or public-key digests to match for the\nfingerprint level, or as the list of DNS names to match in the certificate at the ver‐‐\nify and secure levels. If the security level is dane, or dane-only the match names\nare ignored, and hostname, nexthop strategies are used.\n" } ] }, "ENVIRONMENT": { "content": "MAILCONFIG\nRead configuration parameters from a non-default location.\n\nMAILVERBOSE\nSame as -v option.\n", "subsections": [] }, "SEE ALSO": { "content": "smtp-source(1), SMTP/LMTP message source\nsmtp-sink(1), SMTP/LMTP message dump\n\n", "subsections": [] }, "README FILES": { "content": "Use \"postconf readmedirectory\" or \"postconf htmldirectory\" to locate this information.\nTLSREADME, Postfix STARTTLS howto\n", "subsections": [] }, "LICENSE": { "content": "The Secure Mailer license must be distributed with this software.\n\nAUTHOR(S)\nWietse Venema\nIBM T.J. Watson Research\nP.O. Box 704\nYorktown Heights, NY 10598, USA\n\nWietse Venema\nGoogle, Inc.\n111 8th Avenue\nNew York, NY 10011, USA\n\nViktor Dukhovni\n\n\n\nPOSTTLS-FINGER(1)", "subsections": [] } } } }