{"id":6134,"date":"2026-09-02T20:56:02","date_gmt":"2026-09-02T11:56:02","guid":{"rendered":"https:\/\/eternalsphere.net\/echoes\/?p=6134"},"modified":"2026-09-12T17:17:08","modified_gmt":"2026-09-12T08:17:08","slug":"74ijjg304potkts","status":"publish","type":"post","link":"https:\/\/blog.eternalsphere.net\/index.php\/2026\/09\/02\/74ijjg304potkts\/","title":{"rendered":"Postfix 3.10 After Debian 13: Modernizing TLS, Compatibility Mode, and Relay Logging"},"content":{"rendered":"\n<h2 class=\"wp-block-heading\">Introduction<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">A major Debian upgrade can also introduce a newer Postfix release. Mail delivery may continue to work normally while Postfix begins reporting compatibility and deprecation warnings inherited from an older configuration.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Two common examples are:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>support for parameter \"smtp_use_tls\" will be removed;\ninstead, specify \"smtp_tls_security_level\"\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">and:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Postfix is using backwards-compatible default settings\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Neither message necessarily indicates a broken mail system.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The correct response is not to replace settings mechanically, but to determine the effective SMTP relay behavior first and then modernize the configuration without changing delivery semantics.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">This article uses a fully sanitized example architecture. All domains, addresses, usernames, ports, queue identifiers, and deployment-specific values are placeholders.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">1. Example Architecture<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">A virtualization or backup server may use local Postfix only for outbound system notifications.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">A typical architecture is:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>System notification\n        |\n        v\nLocal Postfix\n        |\n        | authenticated encrypted SMTP\n        v\nExternal Mailcow relay\n        |\n        v\nAdministrator mailbox\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">The local Postfix instance is not intended to operate as a public Internet-facing mail server.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">A generic configuration might resemble:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>inet_interfaces = loopback-only\ninet_protocols = ipv4\nmynetworks = 127.0.0.0\/8\n\nrelayhost = &#091;mail.example.net]:&lt;relay-port&gt;\n\nsmtp_tls_wrappermode = yes\nsmtp_tls_security_level = encrypt\n\nsmtp_sasl_auth_enable = yes\nsmtp_sasl_password_maps = hash:\/etc\/postfix\/sasl_passwd\nsmtp_sasl_security_options = noanonymous\nsmtp_sasl_tls_security_options = noanonymous\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">The placeholder:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>&lt;relay-port&gt;\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">represents an installation-specific SMTP relay port and should be replaced only with the value already configured in the environment being maintained.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">2. Audit Before Changing Anything<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Before modifying Postfix, inspect the effective configuration:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>postconf -n\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Useful individual parameters include:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>postconf \\\n  mail_version \\\n  compatibility_level \\\n  relayhost \\\n  inet_interfaces \\\n  inet_protocols \\\n  mynetworks \\\n  smtp_use_tls \\\n  smtp_tls_wrappermode \\\n  smtp_tls_security_level \\\n  smtp_sasl_auth_enable \\\n  smtp_sasl_password_maps \\\n  smtp_sasl_security_options \\\n  smtp_sasl_tls_security_options\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Also inspect service and queue health:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>systemctl status postfix --no-pager\nsystemctl --failed\npostqueue -p\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">A healthy baseline should normally show:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Postfix active;<\/li>\n\n\n\n<li>no failed mail-related service;<\/li>\n\n\n\n<li>no persistent deferred queue;<\/li>\n\n\n\n<li>relay configuration present;<\/li>\n\n\n\n<li>TLS behavior explicitly defined;<\/li>\n\n\n\n<li>SASL authentication enabled if required by the relay.<\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">3. Understand the <code>smtp_use_tls<\/code> Deprecation<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Older Postfix configurations may contain:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>smtp_use_tls = yes\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Newer Postfix releases warn that this parameter is being retired in favor of:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>smtp_tls_security_level\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">The important question is not simply whether <code>smtp_use_tls<\/code> exists.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The important question is whether modern TLS parameters already define the effective behavior.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">For example:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>smtp_tls_wrappermode = yes\nsmtp_tls_security_level = encrypt\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">already means that TLS is mandatory for the configured relay path.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">In such a configuration:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>smtp_use_tls = yes\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">is redundant.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">4. Why <code>may<\/code> Is Not Always an Equivalent Replacement<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">A common but potentially incorrect migration is:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>smtp_use_tls = yes\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">to:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>smtp_tls_security_level = may\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">These settings do not necessarily preserve the same security behavior.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><code>may<\/code><\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>smtp_tls_security_level = may\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">means Postfix may use TLS when available, but plaintext fallback can be permitted.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><code>encrypt<\/code><\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>smtp_tls_security_level = encrypt\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">means TLS is required.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">If the relay is deliberately configured for encrypted wrapper-mode SMTP:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>smtp_tls_wrappermode = yes\nsmtp_tls_security_level = encrypt\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">then changing the security level to <code>may<\/code> would weaken the existing policy.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The correct modernization is therefore often:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>remove smtp_use_tls\nkeep smtp_tls_wrappermode = yes\nkeep smtp_tls_security_level = encrypt\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">The existing delivery semantics remain unchanged.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">5. Safe Removal of the Deprecated Parameter<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Create a timestamped backup first:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>cp -a \/etc\/postfix\/main.cf \\\n  \/etc\/postfix\/main.cf.$(date +%Y%m%d-%H%M%S)\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Remove only the deprecated parameter:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sed -i \\\n'\/^&#091;&#091;:space:]]*smtp_use_tls&#091;&#091;:space:]]*=\/d' \\\n\/etc\/postfix\/main.cf\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Validate the configuration:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>postfix check\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Inspect the resulting TLS settings:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>postconf -n | grep -E \\\n'^(smtp_use_tls|smtp_tls_wrappermode|smtp_tls_security_level)'\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">A correct result for a mandatory encrypted relay may look like:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>smtp_tls_security_level = encrypt\nsmtp_tls_wrappermode = yes\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">There should be no remaining <code>smtp_use_tls<\/code> entry.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">6. Understanding <code>compatibility_level<\/code><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Another common post-upgrade warning is:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Postfix is using backwards-compatible default settings\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Inspect the current value:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>postconf compatibility_level\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">An installation upgraded repeatedly across Debian releases may still use an older value such as:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>compatibility_level = 2\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">A newer Postfix release may recommend moving to:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>compatibility_level = 3.6\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">This setting controls groups of defaults introduced by newer Postfix releases.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">It should not be changed merely to silence the warning.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The relevant default changes should be reviewed first.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">7. Inspect Compatibility-Sensitive Parameters<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Useful parameters include:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>postconf \\\n  append_dot_mydomain \\\n  smtputf8_enable \\\n  mynetworks_style \\\n  relay_domains \\\n  smtpd_relay_restrictions \\\n  smtpd_relay_before_recipient_restrictions \\\n  respectful_logging \\\n  smtp_tls_fingerprint_digest \\\n  smtpd_tls_fingerprint_digest \\\n  lmtp_tls_fingerprint_digest\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">The output may contain conditional expressions based on <code>compatibility_level<\/code>, for example:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>smtp_tls_fingerprint_digest =\n${{$compatibility_level} &lt;level {3.6} ? {md5} : {sha256}}\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">This does not mean both values are active.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">It means the effective value depends on the configured compatibility level.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">8. Why the Upgrade Is Usually Low Risk for a Relay-Only Host<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">A Postfix instance used only as a local outbound relay client commonly has explicit settings such as:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>inet_interfaces = loopback-only\nmynetworks = 127.0.0.0\/8\n\nrelayhost = &#091;mail.example.net]:&lt;relay-port&gt;\n\nsmtp_tls_security_level = encrypt\nsmtp_tls_wrappermode = yes\nsmtp_sasl_auth_enable = yes\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">In such a design:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>inbound SMTP exposure is minimal;<\/li>\n\n\n\n<li>relay destination is explicit;<\/li>\n\n\n\n<li>TLS policy is explicit;<\/li>\n\n\n\n<li>authentication behavior is explicit;<\/li>\n\n\n\n<li>network scope is explicit.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">This reduces dependence on compatibility-controlled defaults.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The exact environment should still be audited before changing the compatibility level.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">9. Notable Changes at Compatibility Level 3.6<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Moving to compatibility level 3.6 may change several defaults.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">One notable example is TLS fingerprint hashing:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>smtp_tls_fingerprint_digest\nsmtpd_tls_fingerprint_digest\nlmtp_tls_fingerprint_digest\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">The newer default becomes:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sha256\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">instead of the older:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>md5\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Other compatibility-controlled settings include:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>smtpd_relay_before_recipient_restrictions\nrespectful_logging\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">The first affects SMTP server-side restriction evaluation order.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The second affects terminology used in logs.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">On a loopback-only outbound relay client, these changes often have little or no effect on actual message delivery.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">10. Raising the Compatibility Level<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">After confirming that no required legacy behavior depends on the old defaults:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>postconf 'compatibility_level = 3.6'\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Validate before reloading:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>postfix check\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Then reload Postfix:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>systemctl reload postfix\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Verify:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>postconf compatibility_level\nsystemctl status postfix --no-pager\njournalctl -u postfix -n 30 --no-pager\npostqueue -p\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">A clean result should show:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>compatibility_level = 3.6\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">with:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Postfix still active;<\/li>\n\n\n\n<li>no configuration error;<\/li>\n\n\n\n<li>no compatibility warning on the new reload;<\/li>\n\n\n\n<li>no unexpected mail queue buildup.<\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">11. Temporary SMTP Debugging Can Produce Extremely Noisy Logs<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Postfix supports peer-specific debugging.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">An older troubleshooting session may have left settings such as:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>debug_peer_level = 3\ndebug_peer_list = mail.example.net\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">These settings can cause the journal to contain large amounts of low-level SMTP implementation output, including messages such as:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>vstream_buf_get_ready\nrec_get\nvstream_fflush_some\nsmtp_stream_setup\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">These messages are not SMTP failures.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">They are debugging traces.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">If the relay is already stable, peer-specific debugging can be removed:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>postconf -X debug_peer_level\npostconf -X debug_peer_list\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Then validate:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>postfix check\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">and reload:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>systemctl reload postfix\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Historical debug entries remain in the system journal, but future mail transactions should produce much cleaner logs.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">12. Verify SASL Credential File Security Without Exposing Secrets<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">The contents of the SASL password file should never be copied into maintenance reports or public documentation.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Only metadata should be inspected:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>stat -c '%n | owner=%U:%G | mode=%a' \\\n  \/etc\/postfix\/sasl_passwd \\\n  \/etc\/postfix\/sasl_passwd.db\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">A typical secure state is:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>owner=root:root\nmode=600\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">The following data should not appear in documentation:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>SMTP usernames;<\/li>\n\n\n\n<li>passwords;<\/li>\n\n\n\n<li>password hashes;<\/li>\n\n\n\n<li>complete SASL map entries;<\/li>\n\n\n\n<li>private relay credentials.<\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">13. Confirm That Mail Is Actually Being Delivered<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Existing mail logs can confirm end-to-end delivery without generating a test message.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">A successful transaction generally contains:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>dsn=2.0.0\nstatus=sent\n250 2.0.0 Ok\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">A fully sanitized example:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>relay=mail.example.net&#091;192.0.2.25]:&lt;relay-port&gt;\ndsn=2.0.0\nstatus=sent\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">The documentation-only address:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>192.0.2.25\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">belongs to an address range reserved for examples and should not be replaced with a real public IP in published material.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">A successful relay confirms multiple layers:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>DNS resolution;<\/li>\n\n\n\n<li>TCP connectivity;<\/li>\n\n\n\n<li>encrypted SMTP transport;<\/li>\n\n\n\n<li>authentication;<\/li>\n\n\n\n<li>relay acceptance;<\/li>\n\n\n\n<li>local queue processing.<\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">14. Historical Deferred Messages Do Not Necessarily Indicate a Current Fault<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">A mail log may contain:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>status=deferred\nconnection timed out\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">followed later by:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>status=sent\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">This represents a temporary delivery failure that recovered.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Possible causes include:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>temporary relay unavailability;<\/li>\n\n\n\n<li>DNS transition;<\/li>\n\n\n\n<li>network restart;<\/li>\n\n\n\n<li>firewall transition;<\/li>\n\n\n\n<li>remote server restart;<\/li>\n\n\n\n<li>stale cached address information.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">If the message is later accepted successfully and the queue becomes empty, the earlier timeout should be classified as a historical recovered event rather than an active mail failure.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Published examples should avoid real timestamps, queue IDs, IP addresses, and hostnames.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">15. Inspect the Queue<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Use:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>postqueue -p\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">A healthy idle relay often reports:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Mail queue is empty\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">A non-empty queue is not automatically a fault.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Queued messages should be evaluated according to:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>age;<\/li>\n\n\n\n<li>retry reason;<\/li>\n\n\n\n<li>whether the remote relay is reachable;<\/li>\n\n\n\n<li>whether messages are eventually delivered.<\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">16. Confirm Service Health After Changes<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">After modernizing the configuration:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>systemctl status postfix --no-pager\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">should report an active service.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Then inspect only recent logs:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>journalctl -u postfix -n 30 --no-pager -l\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Useful checks include:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>journalctl -u postfix --no-pager | \\\ngrep -Ei \\\n'deprecated|backwards-compatible|fatal|panic|deferred|bounced|SASL.*fail|TLS.*fail'\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Old warnings remain in the journal until log retention removes them.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The presence of an old warning does not mean the current configuration still generates it.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Timestamp comparison is essential.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">17. A Clean Modern Relay Configuration<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">A sanitized relay-only Postfix configuration may conceptually resemble:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>compatibility_level = 3.6\n\ninet_interfaces = loopback-only\ninet_protocols = ipv4\nmynetworks = 127.0.0.0\/8\n\nrelayhost = &#091;mail.example.net]:&lt;relay-port&gt;\n\nsmtp_tls_wrappermode = yes\nsmtp_tls_security_level = encrypt\n\nsmtp_sasl_auth_enable = yes\nsmtp_sasl_password_maps = hash:\/etc\/postfix\/sasl_passwd\nsmtp_sasl_security_options = noanonymous\nsmtp_sasl_tls_security_options = noanonymous\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Deprecated or temporary parameters should be absent:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>smtp_use_tls\ndebug_peer_level\ndebug_peer_list\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">The exact relay hostname, port, credentials, sender identity, and administrator address are deployment-specific and should not appear in public documentation.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">18. What Should Be Sanitized Before Publishing Mail Configuration<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Mail-system documentation deserves stricter sanitization than ordinary Linux configuration examples.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The following should always be replaced:<\/p>\n\n\n\n<figure class=\"wp-block-table\"><table class=\"has-fixed-layout\"><thead><tr><th>Sensitive field<\/th><th>Safe public form<\/th><\/tr><\/thead><tbody><tr><td>Real relay hostname<\/td><td><code>mail.example.net<\/code><\/td><\/tr><tr><td>Real public IP<\/td><td><code>192.0.2.25<\/code><\/td><\/tr><tr><td>Real internal IP<\/td><td><code>192.168.10.10<\/code><\/td><\/tr><tr><td>Real SMTP port<\/td><td><code>&lt;relay-port&gt;<\/code><\/td><\/tr><tr><td>Administrator mailbox<\/td><td><code>admin@example.net<\/code><\/td><\/tr><tr><td>SMTP login<\/td><td><code>&lt;smtp-user&gt;<\/code><\/td><\/tr><tr><td>SMTP password<\/td><td>never publish<\/td><\/tr><tr><td>Queue ID<\/td><td><code>&lt;queue-id&gt;<\/code><\/td><\/tr><tr><td>Certificate fingerprint<\/td><td><code>&lt;fingerprint&gt;<\/code><\/td><\/tr><tr><td>SASL map contents<\/td><td>never publish<\/td><\/tr><tr><td>Real timestamps<\/td><td>generic or omitted<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">This keeps the technical lesson intact without exposing the deployment.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">19. Recommended Maintenance Sequence<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">A safe modernization sequence is:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>1. Inspect effective Postfix configuration\n2. Confirm current relay architecture\n3. Confirm TLS and SASL behavior\n4. Verify successful historical deliveries\n5. Back up main.cf\n6. Remove deprecated smtp_use_tls\n7. Audit compatibility-sensitive defaults\n8. Raise compatibility_level if appropriate\n9. Remove temporary peer debugging\n10. Run postfix check\n11. Reload Postfix\n12. Check service state\n13. Check recent journal entries\n14. Check mail queue\n15. Allow the next normal system notification to provide end-to-end confirmation\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">This sequence minimizes unnecessary changes and preserves existing relay behavior.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">Conclusion<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Postfix warnings after a Debian major-version upgrade are often compatibility warnings rather than service failures.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The correct approach is to modernize the configuration while preserving its original security and relay semantics.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">For an authenticated encrypted relay architecture, this commonly means:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>remove deprecated smtp_use_tls\nretain smtp_tls_security_level = encrypt\nretain smtp_tls_wrappermode = yes\nreview compatibility defaults\nmove compatibility_level to the supported modern value\nremove temporary SMTP debug settings\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">The final objective is not simply to eliminate warning messages.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The objective is a configuration that is:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>explicit;<\/li>\n\n\n\n<li>maintainable;<\/li>\n\n\n\n<li>compatible with current Postfix releases;<\/li>\n\n\n\n<li>no less secure than before;<\/li>\n\n\n\n<li>easy to audit;<\/li>\n\n\n\n<li>free of unnecessary debug noise;<\/li>\n\n\n\n<li>safe to document without exposing infrastructure details.<\/li>\n<\/ul>\n","protected":false},"excerpt":{"rendered":"<p>Introduction A major Debian upgrade can also introduce a newer Postfix release. Mail delivery may continue to work normally while Postfix begins reporting compatibility and deprecation warnings inherited from an older configuration. Two common examples are: and: Neither message necessarily indicates a broken mail system. The correct response is not &hellip;<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[120],"tags":[333,244],"class_list":["post-6134","post","type-post","status-publish","format-standard","hentry","category-1s3b6h7r2zay02x","tag-email","tag-tls"],"_links":{"self":[{"href":"https:\/\/blog.eternalsphere.net\/index.php\/wp-json\/wp\/v2\/posts\/6134","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/blog.eternalsphere.net\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blog.eternalsphere.net\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blog.eternalsphere.net\/index.php\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/blog.eternalsphere.net\/index.php\/wp-json\/wp\/v2\/comments?post=6134"}],"version-history":[{"count":1,"href":"https:\/\/blog.eternalsphere.net\/index.php\/wp-json\/wp\/v2\/posts\/6134\/revisions"}],"predecessor-version":[{"id":6135,"href":"https:\/\/blog.eternalsphere.net\/index.php\/wp-json\/wp\/v2\/posts\/6134\/revisions\/6135"}],"wp:attachment":[{"href":"https:\/\/blog.eternalsphere.net\/index.php\/wp-json\/wp\/v2\/media?parent=6134"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blog.eternalsphere.net\/index.php\/wp-json\/wp\/v2\/categories?post=6134"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blog.eternalsphere.net\/index.php\/wp-json\/wp\/v2\/tags?post=6134"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}