To use postfix instead of sendmail:
- clear sendmail queue and stop the sendmail daemons
Run the following commands to enable postfix during startup:
- sysrc postfix_enable="YES"
- sysrc sendmail_enable="NONE"
If postfix is *not* already activated in /usr/local/etc/mail/mailer.conf
- mv /usr/local/etc/mail/mailer.conf /usr/local/etc/mail/mailer.conf.old
- install -d /usr/local/etc/mail
- install -m 0644 /usr/local/share/postfix/mailer.conf.postfix /usr/local/etc/mail/mailer.conf
Disable sendmail(8) specific tasks,
add the following lines to /etc/periodic.conf(.local):
daily_clean_hoststat_enable="NO"
daily_status_mail_rejects_enable="NO"
daily_status_include_submit_mailq="NO"
daily_submit_queuerun="NO"
If you are using SASL, you need to make sure that postfix has access to read
the sasldb file. This is accomplished by adding postfix to group mail and
making the /usr/local/etc/sasldb* file(s) readable by group mail (this should
be the default for new installs).
Shown after removing
If you remove postfix permanent, adjust / remove the the following file:
- /usr/local/etc/mail/mailer.conf
Note
Size, dependencies, options and messages are those of postfix.
Packages by version and architecture
latest
FreeBSD version
amd64
aarch64
i386
FreeBSD 16
3.11.7_4,1
3.11.7_3,1
–
FreeBSD 15
3.11.7_4,1
3.11.7_3,1
–
FreeBSD 14
3.11.7_4,1
3.11.7_3,1
3.11.7_4,1
quarterly (2026Q4)
FreeBSD version
amd64
aarch64
i386
FreeBSD 15
3.11.7_3,1
3.11.7_3,1
–
FreeBSD 14
3.11.7_3,1
3.11.7_1,1
3.11.7_3,1
version as in the ports tree (latest) or the most common one (quarterly) · different version · ✗ not built · – no packages for this platform. Package sets that have not been rebuilt for 60 days are left out.
Unaddressed and VuXML only (0)
No unaddressed CVE and nothing reported by pkg audit for the packaged version 3.11.7_4,1.
Fixed (2)
Show 2 fixed
VuXML entries whose affected range the packaged version has left.
maintainer-feedback? mail/postfix: lmdb version issue fixed in main but not 2026Q4
New
2026-10-14
Commits (447)
Stefan Eßer (se) · 3.7.2_1,1
Add WWW entries to port Makefiles
It has been common practice to have one or more URLs at the end of the
ports' pkg-descr files, one per line and prefixed with "WWW:". These
URLs should point at a project website or other relevant resources.
Access to these URLs required processing of the pkg-descr files, and
they have often become stale over time. If more than one such URL was
present in a pkg-descr file, only the first one was tarnsfered into
the port INDEX, but for many ports only the last line did contain the
port specific URL to further information.
There have been several proposals to make a project URL available as
a macro in the ports' Makefiles, over time.
This commit implements such a proposal and moves one of the WWW: entries
of each pkg-descr file into the respective port's Makefile. A heuristic
attempts to identify the most relevant URL in case there is more than
one WWW: entry in some pkg-descr file. URLs that are not moved into the
Makefile are prefixed with "See also:" instead of "WWW:" in the pkg-descr
files in order to preserve them.
There are 1256 ports that had no WWW: entries in pkg-descr files. These
ports will not be touched in this commit.
The portlint port has been adjusted to expect a WWW entry in each port
Makefile, and to flag any remaining "WWW:" lines in pkg-descr files as
deprecated.
Approved by: portmgr (tcberner)
*/*: Remove redundant '-[0-9]*' from CONFLICTS_INSTALL
The conflict checks compare the patterns first against the package
names without version (as reported by "pkg query "%n"), then - if
there was no match - agsinst the full package names including the
version (as reported by "pkg query "%n-%v").
Approved by: portmgr (blanket)
net/openldap24-client: bump all dependent port
In the earlier net/openldap24-server commit, only those which depend on
net/openldap24-sasl-client were bumped. Bumping all dependent port that
didn't get a bump to force a rebuild of these packages.
Suggested by: kib
mail/postfix: Check for supported OpenSSL version
- Check if OpenSSL at least 1.1.1a is being used
- LibreSSL is not supported as it dos not (yet) provide the
TLSv1.3 API found in OpenSSL 1.1.1 API.
- update to 3.5.9
========
20210116
Feature: when a Postfix program makes a DNS query that
requests DNSSEC validation (usually for Postfix DANE support)
but the DNS response is not DNSSEC validated, Postfix will
send a DNS query configured with the "dnssec_probe" parameter
to determine if DNSSEC support is available, and logs a
warning if it is not. By default, the probe has type "ns"
and domain name ".". The probe is sent once per process
lifetime. Files: dns/dns.h, dns/dns_lookup.c, dns/dns_sec.c,
test_dns_lookup.c, global/mail_params.[hc], mantools/postlink.
The makedefs script no longer disables DNSSEC when Postfix
is built with libc-musl. Instead Postfix will rely on the
new dnssec_probe feature, and will log a warning when Postfix
requests DNSSEC validation, but the infrastructure does not
validate DNSSEC signatures. File: makedefs.
The default "smtp_tls_dane_insecure_mx_policy = dane" was
causing unnecessary dnssec_probe activity. The default is now
"dane" when smtp_tls_security_level is "dane", otherwise it is
"may". File: global/mail_params.h.
- update to 3.5.6
20200726
Bugfix (introduced: Postfix 3.5.5): part of a memory leak
fix was backported to the wrong place. File: tls/tls_misc.c.
The Postfix 3.5.5 workaround did not explicitly override
the system-wide OpenSSL configuration of allowed TLS protocol
versions, for sessions where the remote SMTP client sends
SNI. It's better to be safe than sorry. File: tls/tls_server.c.
PR: 248271
Reported by: many
- update to 3.5.3
Changelog:
20200530
Bugfix (introduced: Postfix 3.1): "postfix tls deploy-server-cert" did not
handle a missing optional argument.
20200610
Bugfix (introduced: Postfix 3.4): in the Postfix SMTP server, the SNI
callback reported an error when it was called a second time. This happened
after the server-side TLS engine sent a TLSv1.3 HelloRetryRequest (HRR) to
a remote SMTP client.
MFH: 2020Q2
- update to 3.4.10 - adjust PORTSCOUT to include 3.5.x - remove deprecated ports from CONFLICTS_INSTALL - add BLACKLISTD to OPTIONS_DEFAULT - MYSQL_USES s/=/?=/ to allow testbuild without defining XX MYSQL dedicated make.conf's in poudriere
Update Postfix to 3.4.9 (bugfix-only release)
While here, also strip libexec/postfix/postlogd.
Announcement: http://www.postfix.org/announcements/postfix-3.4.9.html
Fixed in all supported stable releases:
Bug (introduced: Postfix 3.1): smtp_dns_resolver_options were broken while adding support for negative DNS response caching in postscreen. Postfix was inadvertently changed to call res_query() instead of res_search(). Reported by Jaroslav Skarvada.
Bug (introduced: Postfix 2.5): Postfix ignored the CONNECT macro overrides from a Milter application. Postfix now evaluates the Milter macros for an SMTP CONNECT event after the Postfix-to-Milter connection is negotiated. Problem reported by David Bürgin.
Bug (introduced: Postfix 3.0): sanitize (remote) server responses before storing them in the verify database, to avoid Postfix warnings about malformed UTF8. Found during code maintenance.
PR: 243879
Submitted by: Juraj Lutter <juraj@lutter.sk>
Approved by: maintainer timeout 15d (ohauer@)
MFH: 2020Q1 (patchlevel upgrade with only bugfixes)
Differential Revision: https://reviews.freebsd.org/D23502