On Dec 22, 2016, at 11:09 PM, John Wiegley wrote:

...

If available as a package for your O/S, might as well use 3.1

I'll consider that a second migration, after the dust settles this time around. I'd need to gain experience with 3.x first on my own server, before being comfortable enough to do that. The 2.11-based setup I've been running for a month now on another server.

Wietse maintains a strong commitment to backwards-compatibility. While Postfix 3.0 (could equally have been 2.12) brings in new features for distribution maintainers, with dynamically-loadable table drivers on multiple platforms it remains compatible with 2.x releases for users. Your 2.11 configuration will work with 3.1, you may just need to install additional table driver packages, if your O/S maintainer has just started delivering Postfix as multiple components.

...

...

- [X] Enable postscreen for pre-queue RBL filtering

...

This makes it possible to combine multiple lower-weight RBLs, that individually are not sufficient to reject mail, but you should still use the SpamHaus zen RBL in smtpd(8).

Why is it helpful to run it in smtpd as well? I'm already using:

postscreen_dnsbl_sites = zen.spamhaus.org*2 ...

This is because the TTLs on postscreen whitelists are rather longer than RBL TTLs. If an IP address is added to an RBL, you'll want to refuse access in a timely manner. -- Viktor.