smtpd_banner = $myhostname ESMTP __SERVER_NAME__
biff = no
append_dot_mydomain = no
readme_directory = no
myhostname = __HOSTNAME__
mydestination = localhost, localhost.localdomain
mynetworks = 127.0.0.0/8 [::1]/128
mailbox_size_limit = 0
message_size_limit = __MESSAGE_SIZE_LIMIT__
recipient_delimiter = +
compatibility_level = 3.6
disable_vrfy_command = yes
strict_rfc821_envelopes = yes
smtpd_helo_required = yes
smtpd_delay_reject = yes
smtpd_discard_ehlo_keywords = silent-discard, dsn
maximal_queue_lifetime = 5d
bounce_queue_lifetime = 5d
maximal_backoff_time = 4000s
minimal_backoff_time = 300s
queue_run_delay = 300s

virtual_transport = lmtp:unix:private/dovecot-lmtp
virtual_mailbox_domains = mysql:/etc/postfix/mysql-virtual-domains-maps.cf
virtual_mailbox_maps = mysql:/etc/postfix/mysql-virtual-mailbox-maps.cf
virtual_alias_maps = mysql:/etc/postfix/mysql-virtual-alias-maps.cf, mysql:/etc/postfix/mysql-virtual-redirect-maps.cf
virtual_mailbox_base = __MAIL_HOME__
virtual_uid_maps = static:__VMAIL_UID__
virtual_gid_maps = static:__VMAIL_GID__
virtual_minimum_uid = __VMAIL_UID__
anvil_rate_time_unit = __POSTFIX_RATE_TIME_UNIT__
smtpd_client_connection_rate_limit = __POSTFIX_CLIENT_CONNECTION_RATE_LIMIT__
smtpd_client_message_rate_limit = __POSTFIX_CLIENT_MESSAGE_RATE_LIMIT__
smtpd_client_connection_count_limit = __SMTP_CLIENT_CONNECTION_COUNT_LIMIT__
smtpd_recipient_limit = __SMTP_RECIPIENT_LIMIT__

smtpd_relay_restrictions = permit_mynetworks, permit_sasl_authenticated, reject_unauth_destination
# DNSBL/RBL checks are handled primarily by Rspamd (with local Redis caching).
# Avoid hard-coding public DNSBL zones here: shared resolvers often poison results.
smtpd_client_restrictions = permit_mynetworks, permit_sasl_authenticated, permit
smtpd_data_restrictions = reject_unauth_pipelining, reject_multi_recipient_bounce
smtpd_helo_restrictions = permit_mynetworks, reject_invalid_helo_hostname, reject_non_fqdn_helo_hostname
smtpd_sender_restrictions = reject_non_fqdn_sender, reject_unknown_sender_domain
smtpd_recipient_restrictions = reject_non_fqdn_recipient, reject_unknown_recipient_domain, reject_unauth_destination
smtpd_sender_login_maps = mysql:/etc/postfix/mysql-virtual-sender-login-maps.cf
smtpd_sasl_type = dovecot
smtpd_sasl_path = private/auth
smtpd_sasl_auth_enable = yes
smtpd_sasl_security_options = noanonymous
smtpd_sasl_local_domain =
smtpd_tls_security_level = may
smtp_tls_security_level = may
smtp_tls_CApath = /etc/ssl/certs
smtpd_tls_auth_only = yes
smtpd_tls_cert_file = __TLS_CERT__
smtpd_tls_key_file = __TLS_KEY__
smtpd_tls_protocols = !SSLv2,!SSLv3,!TLSv1,!TLSv1.1
smtp_tls_protocols = !SSLv2,!SSLv3,!TLSv1,!TLSv1.1
smtpd_tls_mandatory_protocols = !SSLv2,!SSLv3,!TLSv1,!TLSv1.1
smtp_tls_mandatory_protocols = !SSLv2,!SSLv3,!TLSv1,!TLSv1.1
smtpd_tls_mandatory_ciphers = high
smtp_tls_mandatory_ciphers = high
tls_preempt_cipherlist = yes
smtpd_tls_loglevel = 1
smtp_tls_loglevel = 1
tls_random_source = dev:/dev/urandom