# See /usr/share/postfix/main.cf.dist for a commented, more complete version

# Server Information
smtpd_banner = $myhostname LIBRARY OF CODE SP-US STAFF SVCS | ESMTP (Debian/GNU)
myhostname = staff.libraryofcode.org
myorigin = /etc/mailname
mydestination = $myhostname, libraryofcode.org
mynetworks = 127.0.0.0/8 [::ffff:127.0.0.0]/104 [::1]/128 63.141.252.130
mail_name = Library of Code sp-us | Staff Services


# Relay Settings
relayhost =
relay_domains = lists.libraryofcode.org, hash:/var/tmp/mailman/data/postfix_domains


# MDA & Delivery 
append_dot_mydomain = no
biff = no
mailbox_transport = lmtp:unix:private/dovecot-lmtp
message_size_limit = 1073741824
transport_maps = hash:/var/tmp/mailman/data/postfix_lmtp
mailbox_size_limit = 0
recipient_delimiter = +


# Authentication
smtpd_sasl_auth_enable = yes
broken_sasl_auth_clients = yes


# TLS parameters
smtpd_tls_cert_file=/etc/postfix/ssl/globalsign.crt
smtpd_tls_key_file=/etc/postfix/ssl/globalsign.key.pem
smtpd_use_tls=yes
smtpd_tls_auth_only = yes
smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache
smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache
smtp_tls_security_level = encrypt
smtpd_tls_security_level = may
smtp_tls_note_starttls_offer = yes
smtpd_tls_CAfile = /etc/postfix/ssl/globalsign.ca.crt
smtpd_tls_loglevel = 1
smtpd_tls_received_header = yes
smtpd_tls_session_cache_timeout = 3600s
smtpd_tls_mandatory_protocols = !SSLv3, !TLSv1, !TLSv1.1
smtpd_tls_protocols = !SSLv3, !TLSv1, !TLSv1.1
smtpd_tls_mandatory_ciphers = medium
tls_random_source = dev:/dev/urandom
tls_medium_cipherlist = ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384
tls_preempt_cipherlist = no


# RESTRICTIONS
smtpd_relay_restrictions = 
  permit_mynetworks, 
  permit_sasl_authenticated, 
  defer_unauth_destination,
smtpd_helo_restrictions = 
  permit_mynetworks,
  reject_non_fqdn_helo_hostname,
  reject_invalid_helo_hostname,
  reject_unknown_helo_hostname,
  permit,
smtpd_sender_restrictions = 
  reject_unknown_sender_domain,
  reject_unknown_reverse_client_hostname,
  reject_unknown_client_hostname,
  reject_sender_login_mismatch,
  permit_mynetworks,
  permit_sasl_authenticated,
  permit,
smtpd_recipient_restrictions = 
  reject_unauth_pipelining,
  reject_non_fqdn_recipient,
  reject_unknown_recipient_domain,
  permit_mynetworks,
  check_policy_service inet:127.0.0.1:10023,
  reject_rbl_client sbl.spamhaus.org,
  reject_rbl_client xbl.spamhaus.org,
  permit,


# Local Aliases
alias_maps = hash:/etc/aliases, hash:/var/lib/mailman/data/aliases
alias_database = hash:/etc/aliases


# Virtual Alises
smtpd_sender_login_maps = hash:/etc/postfix/virtual-mailbox-users
virtual_alias_maps = hash:/etc/postfix/virtual
local_recipient_maps = hash:/var/tmp/mailman/data/postfix_lmtp


# Network Settings & Milters
inet_interfaces = all
inet_protocols = all
milter_default_action = accept
milter_protocol = 6
smtpd_milters = 
  ## OpenDKIM
  inet:localhost:8891,
  ## OpenDMARC
  local:/opendmarc/opendmarc.sock,
  ## ClamAV
  #inet:localhost:8892
non_smtpd_milters = $smtpd_milters


# Misc
readme_directory = no
compatibility_level = 2
unknown_local_recipient_reject_code = 550
mailman_destination_recipient_limit = 1