From c09368c544cbd32aa368953fe25b9d33a8e2ffa8 Mon Sep 17 00:00:00 2001 From: Mix Date: Sat, 17 Oct 2026 22:33:34 +0300 Subject: [PATCH] design: help says the upstream's TLS checks no certificate Security audit 2026-10-17, finding M7 (stage 6): the upstream TLS mode "Required" is Postfix's encrypt level, which verifies no certificate, so it protects against a passive observer only. Help's Upstream topic says so for both modes. check.py: 0 violations. Co-Authored-By: Claude Opus 5.5 --- docs/assets/panel-redesign/panel/help.html | 2 +- docs/assets/panel-redesign/panel/src/help.html | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/docs/assets/panel-redesign/panel/help.html b/docs/assets/panel-redesign/panel/help.html index e47dde5..5b4f24b 100644 --- a/docs/assets/panel-redesign/panel/help.html +++ b/docs/assets/panel-redesign/panel/help.html @@ -136,7 +136,7 @@
03

Inbound

Backup-MX and forwarding

An optional backup-MX or forwarder, switched on in the server's .env; the Inbound menu exists only then. Postfix accepts mail on port 25 for the listed domains only and hands each message on to that domain's upstream; there are no mailboxes. For each domain publish the MX record its page shows, and keep a primary MX the domain already has if this is a backup. The MX tag is green when at least one MX of the domain points at this server, and a domain accepts no mail until an upstream is saved on its page. Adding and deleting domains is for the global role.

-

Upstream

The upstream is the server that actually holds the mailboxes. Give its host and port — used exactly as written, with no MX lookup — and choose the TLS for the hop to it: Opportunistic uses TLS when the upstream offers it and otherwise sends in the clear; Required sends only over TLS, and the mail waits in the queue while the upstream does not offer it or the TLS handshake fails - an upstream that answers STARTTLS with a permanent error bounces it; Off never uses TLS. While the upstream does not answer, Postfix keeps the mail and retries as for any other mail.

+

Upstream

The upstream is the server that actually holds the mailboxes. Give its host and port — used exactly as written, with no MX lookup — and choose the TLS for the hop to it: Opportunistic uses TLS when the upstream offers it and otherwise sends in the clear; Required sends only over TLS, and the mail waits in the queue while the upstream does not offer it or the TLS handshake fails - an upstream that answers STARTTLS with a permanent error bounces it. Neither checks the upstream's certificate: TLS here keeps the mail from whoever only listens on the way, not from one who answers in the upstream's place. Off never uses TLS. While the upstream does not answer, Postfix keeps the mail and retries as for any other mail.

Valid recipients

Choose whom this domain accepts. Listed addresses only: the relay accepts exactly the addresses you list, one per line or comma-separated, and refuses any other while the sender is still connected, so it never has to send a bounce for them. Any recipient: everything at the domain is accepted and passed on, and an address the upstream then rejects comes back as a bounce from this server to a sender who is often forged — backscatter. Prefer a list, and keep it in step with the mailboxes upstream.

Spam filter

The spam filter belongs to the server, not to a domain. The server's administrator attaches it in the server's .env, and from then on every inbound domain is screened by it before mail is handed on; the box shows on or off and has nothing to switch. Off means mail goes to the upstream unfiltered. While the filter is down, mail is either accepted unfiltered (the default) or refused with a temporary error, so the sending server tries again later, as the server's setting says; the box states which.

Inbound log

One row per recipient of a message offered on port 25 for an inbound domain, with what was decided: accept — taken for the upstream; reject — refused for good; tempfail — the sender was asked to come back later; quarantine — held by the filter. Why names who decided. rspamd is the spam filter, with its action, the score against the reject threshold and the heaviest symbols; postfix is the relay's own rule — an unknown recipient, a sender domain that does not exist — with its reply; selfpost means nobody judged the message: it was relayed with no filter attached. Upstream says what became of an accepted message: queued — not tried yet; held — held in the queue by the filter, not tried until it is released; sent — the upstream took it; deferred — the upstream put it off or could not be reached, and Postfix tries again; bounced — the upstream refused it, or it waited in the queue too long, and the sender was sent a bounce, if it had a return address. It opens the last reply and the host that gave it. A refused message has no upstream result, and neither has a row logged before 2.10.0.

Accepted mail is recorded as it passes; refused mail is read from mail.log, so its row has no subject, and a message refused after its text was sent is one row however many recipients it had. A refusal to relay for a domain that is not an inbound one is every scanner on the internet and is not recorded. Rows are kept for the number of days set in Settings, and never more than 10 000.

diff --git a/docs/assets/panel-redesign/panel/src/help.html b/docs/assets/panel-redesign/panel/src/help.html index bd45235..9ef664c 100644 --- a/docs/assets/panel-redesign/panel/src/help.html +++ b/docs/assets/panel-redesign/panel/src/help.html @@ -70,7 +70,7 @@
03

Inbound

Backup-MX and forwarding

An optional backup-MX or forwarder, switched on in the server's .env; the Inbound menu exists only then. Postfix accepts mail on port 25 for the listed domains only and hands each message on to that domain's upstream; there are no mailboxes. For each domain publish the MX record its page shows, and keep a primary MX the domain already has if this is a backup. The MX tag is green when at least one MX of the domain points at this server, and a domain accepts no mail until an upstream is saved on its page. Adding and deleting domains is for the global role.

-

Upstream

The upstream is the server that actually holds the mailboxes. Give its host and port — used exactly as written, with no MX lookup — and choose the TLS for the hop to it: Opportunistic uses TLS when the upstream offers it and otherwise sends in the clear; Required sends only over TLS, and the mail waits in the queue while the upstream does not offer it or the TLS handshake fails - an upstream that answers STARTTLS with a permanent error bounces it; Off never uses TLS. While the upstream does not answer, Postfix keeps the mail and retries as for any other mail.

+

Upstream

The upstream is the server that actually holds the mailboxes. Give its host and port — used exactly as written, with no MX lookup — and choose the TLS for the hop to it: Opportunistic uses TLS when the upstream offers it and otherwise sends in the clear; Required sends only over TLS, and the mail waits in the queue while the upstream does not offer it or the TLS handshake fails - an upstream that answers STARTTLS with a permanent error bounces it. Neither checks the upstream's certificate: TLS here keeps the mail from whoever only listens on the way, not from one who answers in the upstream's place. Off never uses TLS. While the upstream does not answer, Postfix keeps the mail and retries as for any other mail.

Valid recipients

Choose whom this domain accepts. Listed addresses only: the relay accepts exactly the addresses you list, one per line or comma-separated, and refuses any other while the sender is still connected, so it never has to send a bounce for them. Any recipient: everything at the domain is accepted and passed on, and an address the upstream then rejects comes back as a bounce from this server to a sender who is often forged — backscatter. Prefer a list, and keep it in step with the mailboxes upstream.

Spam filter

The spam filter belongs to the server, not to a domain. The server's administrator attaches it in the server's .env, and from then on every inbound domain is screened by it before mail is handed on; the box shows on or off and has nothing to switch. Off means mail goes to the upstream unfiltered. While the filter is down, mail is either accepted unfiltered (the default) or refused with a temporary error, so the sending server tries again later, as the server's setting says; the box states which.

Inbound log

One row per recipient of a message offered on port 25 for an inbound domain, with what was decided: accept — taken for the upstream; reject — refused for good; tempfail — the sender was asked to come back later; quarantine — held by the filter. Why names who decided. rspamd is the spam filter, with its action, the score against the reject threshold and the heaviest symbols; postfix is the relay's own rule — an unknown recipient, a sender domain that does not exist — with its reply; selfpost means nobody judged the message: it was relayed with no filter attached. Upstream says what became of an accepted message: queued — not tried yet; held — held in the queue by the filter, not tried until it is released; sent — the upstream took it; deferred — the upstream put it off or could not be reached, and Postfix tries again; bounced — the upstream refused it, or it waited in the queue too long, and the sender was sent a bounce, if it had a return address. It opens the last reply and the host that gave it. A refused message has no upstream result, and neither has a row logged before 2.10.0.

Accepted mail is recorded as it passes; refused mail is read from mail.log, so its row has no subject, and a message refused after its text was sent is one row however many recipients it had. A refusal to relay for a domain that is not an inbound one is every scanner on the internet and is not recorded. Rows are kept for the number of days set in Settings, and never more than 10 000.