<CHAPTER ID="ZADM-SMTPSERVER-CONFIG"><?dbhtml filename="zadm-smtpserver.html">
<TITLE><COMMAND>Smtpserver</> Configuration</TITLE>

<PARA>
The <COMMAND>smtpserver</> is ZMailer's component to receive incoming
email via SMTP protocol.  Be it thru TCP channel, or thru Batch-SMTP.
</PARA>

<PARA>
The <COMMAND>smtpserver</> program actually has several operational modes.
It can operate as a stand-alone internet service socket listener, which
forks off childs that do the actual SMTP-protocol service.
</PARA>

<PARA>
It can be started from under the control of the <COMMAND>inetd</>(8) server,
and it can there fulfill most of the the same roles as it does in
the stand-alone mode.
</PARA>

<PARA>
It can even be used to accept Batch-SMTP from incoming files (UUCP,
and BITNET uses, for example).
</PARA>

<PARA>
The runtime command-line options are as follows:
</PARA>

<PARA>
<CMDSYNOPSIS>
 <COMMAND>smtpserver</>
 <ARG>-46aignvBV</>
 <ARG>-p <REPLACEABLE>port</></>
 <ARG>-l <REPLACEABLE>logfile</></>
 <ARG><OPTION>-s <CONSTANT>'strict'</></></>
 <ARG>-s <REPLACEABLE>[ftveR]</></>
  <SBR>
 <ARG>-L <REPLACEABLE>maxloadaver</></>
 <ARG>-M <REPLACEABLE>SMTPmaxsize</></>
 <ARG>-P <REPLACEABLE>postoffice</></>
 <ARG>-R <REPLACEABLE>router</></>
  <SBR>
 <ARG>-C <REPLACEABLE>cfgfile</></>
 <ARG>-T <REPLACEABLE>IPv4/IPv6-address-literal</></>
</CMDSYNOPSIS>
</PARA>

<PARA>
The most commonly used command line options are:
<CMDSYNOPSIS>
 <COMMAND>smtpserver</>
 <ARG>-aBivn</>
 <ARG>-s <REPLACEABLE>ehlo-styles</></>
 <ARG>-l <REPLACEABLE>logfile</></>
 <ARG>-C <REPLACEABLE>cfgpath</></>
</CMDSYNOPSIS>
</PARA>

<PARA>
Without any arguments the  <COMMAND>smtpserver</>  will start as a daemon
listening on TCP port 25 (SMTP).
</PARA>

<PARA>
Most important of the options are:
<VARIABLELIST>

<VARLISTENTRY><TERM><OPTION>-a</></><LISTITEM><PARA>
Query IDENT information about the incoming connection.
This information (if available at all) may, or may not tell who is forming
a connection.
</PARA></LISTITEM></VARLISTENTRY>

<VARLISTENTRY><TERM><OPTION>-B</></><LISTITEM><PARA>
The session is Batch-SMTP a.k.a. BSMTP type of session. Use of "-i" option is needed, when feeding the input batch file.
</PARA></LISTITEM></VARLISTENTRY>

<VARLISTENTRY><TERM><OPTION>-i</></><LISTITEM><PARA>
This is interactive session.  I/O is done thru
 <EMPHASIS ROLE=STRONG>stdin/stdout</>.
</PARA></LISTITEM></VARLISTENTRY>

<VARLISTENTRY><TERM><OPTION>-v</></><LISTITEM><PARA>
Verbose trace written to stdout for use in conjunktion with "-i", and "-B".
</PARA></LISTITEM></VARLISTENTRY>

<VARLISTENTRY><TERM><OPTION>-n</></><LISTITEM><PARA>
This tells that the <COMMAND>smtpserver</> is running under
<COMMAND>inetd</>(8), and that the stdin/stdout file handles
are actually network sockets on which we can do peer identity
lookups, for example.
</PARA></LISTITEM></VARLISTENTRY>

<VARLISTENTRY><TERM><OPTION>-s <REPLACEABLE>ehlo-style</></></><LISTITEM><PARA>
Default value for various checks done at SMTP protocol MAIL FROM, RCPT TO,
VRFY, and EXPN commands. These are overridden with the value from
EHLO-patterns, if they are available (more below)
</PARA></LISTITEM></VARLISTENTRY>

<VARLISTENTRY><TERM><OPTION>-s 'strict'</></><LISTITEM><PARA>
Special value directing the system to be extremely picky about the incoming
SMTP protocol &mdash; mainly for protocol compliance testing, usually way too
picky for average (sloppy) applications out there...
</PARA></LISTITEM></VARLISTENTRY>

<VARLISTENTRY><TERM><OPTION>-l <REPLACEABLE>logfilepath</></></><LISTITEM><PARA>
Filename for the <COMMAND>smtpserver</> input protocol log.
This logs about everything, except actual message data...
</PARA></LISTITEM></VARLISTENTRY>

<VARLISTENTRY><TERM><OPTION>-l 'SYSLOG'</></><LISTITEM><PARA>
This tells <COMMAND>smtpserver</> that it shall send all incoming smtp
protocol transactions via <FUNCTION>syslog</> facility to elsewere.
Used syslog parameters are: FACILITY=mail, LEVEL=debug.
</PARA><PARA>
This option may be used in addition to the preceding file logging variant.
Double-use of file referring variant uses the last defined file, but this
doesn't affect files at all.
</PARA></LISTITEM></VARLISTENTRY>

<VARLISTENTRY><TERM><OPTION>-C <REPLACEABLE>configfilepath</></></>
<LISTITEM><PARA>
Full path for the <COMMAND>smtpserver</> configuration in case
the default location can not be used for some reason.
</PARA></LISTITEM></VARLISTENTRY>

<VARLISTENTRY><TERM><OPTION>-M <REPLACEABLE>SMTPmaxsize</></></><LISTITEM><PARA>
<EMPHASIS>SMTPmaxsize</> defines the absolute maximum size we accept
for incoming email. (Default: infinite) (This is a local policy issue.)
</PARA></LISTITEM></VARLISTENTRY>

<VARLISTENTRY><TERM><OPTION>-T <REPLACEABLE>[IPv4-or-IPv6-address-literal]</></></><LISTITEM><PARA>
An <EMPHASIS>address literal</> is used in interactive test mode to check
how the rules work with given inputs when the source address of the connection
is what is given in headers.
</PARA></LISTITEM></VARLISTENTRY>

</VARIABLELIST>
</PARA>

<SECT1 ID=zadm-smtpserver-conf>
<TITLE><FILENAME>smtpserver.conf</></>
<INDEXTERM ID=zadm-smtps-smtpserver.conf-file><PRIMARY><FILENAME>smtpserver.conf</></><SECONDARY>PARAM entries, admin</></>

<PARA>
If the system has file <FILENAME>$<VARNAME>MAILSHARE</>/smtpserver.conf</>
(by default), that file is read for various parameters, which can override
most of those possibly issued at the command line.
</PARA>

<PARA>
Example configuration is is in figure <XREF LINKEND="fig.sample-smtpserver-cfg">.
</PARA>

<FIGURE ID="fig.sample-smtpserver-cfg" PGWIDE="0" FLOAT="1">
<TITLE>Sample <FILENAME>smtpserver.conf</> file</TITLE>
<SCREEN>
#PARAM maxsize          10000000    # Same as -M -option
#PARAM max-error-recipients    3    # More than this is propably SPAM!
#PARAM MaxSameIpSource        10    # Max simultaneous connections from
#                                   # any IP source address
#PARAM ListenQueueSize        10    # listen(2) parameter
#
PARAM help -------------------------------------------------------------
PARAM help  This mail-server is at Yoyodyne Propulsion Inc.
PARAM help  Our telephone number is: +1-234-567-8900, and
....
PARAM help -------------------------------------------------------------

# The policy database:  (NOTE: See  'makedb'  for its default suffixes!)
PARAM  policydb  $DBTYPE  $MAILVAR/db/smtp-policy

#
# HELO/EHLO-pattern     style-flags
#               [max loadavg]
#
localhost           999 ftveR
some.host.domain    999 !NO EMAIL ACCEPTED FROM YOUR MACHINE

# If the host presents itself as:  HELO [1.2.3.4], be lenient to it..
# The syntax below is due to these patterns being SH-GLOB patterns,
# where brackets are special characters.

\[*\]               999 ve

# Per default demant strict syntactic adherence, including fully
# qualified addresses for  MAIL FROM, and RCPT TO.  To be lenient
# on that detail, remove the "R" from "veR" string below:

*                   999 veR
</SCREEN>
</FIGURE>

<SECT2 ID=zadm-smtpserver-conf-param-keywords>
<TITLE><FILENAME>smtpserver.conf</>; PARAM keywords</TITLE>

<PARA>
The PARAM keywords and values are:
<VARIABLELIST>
<VARLISTENTRY>
<TERM><OPTION>maxsize</> <REPLACEABLE>nn</></TERM>
<LISTITEM><PARA>
Maximum size in the number of bytes of the entire spool message
containing both the transport envelope, and the actual message.
That is, if the max-size is too low, and there are a lot of
addresses, the message may entirely become undeliverable..
</PARA></LISTITEM></VARLISTENTRY>

<VARLISTENTRY>
<TERM><OPTION>max-error-recipients</> <REPLACEABLE>nn</></TERM>
<LISTITEM><PARA>
In case the message envelope is an error envelope (MAIL FROM:&lt;&gt;),
the don't accept more than this many separate recipient addresses
for it. The default value is 3, which should be enough for most cases.
(Some SPAMs claim to be error messages, and then provide a huge
number of recipient addresses...)
</PARA></LISTITEM></VARLISTENTRY>

<VARLISTENTRY>
<TERM><OPTION>MaxSameIpSource</> <REPLACEABLE>nn</></TERM>
<LISTITEM><PARA>
(Effective only on daemon-mode server &mdash; not on "-i", nor "-n" modes.)
Sometimes some systems set up multiple parallel connections to same
host  (qmail ones especially, not that ZMailer has entirely clean
papers on this - at least up to 2.99.X series), we won't accept
more than this many connections from the same IP source address
open in parallel.  The default value for this limit is 10.
</PARA></LISTITEM></VARLISTENTRY>

<VARLISTENTRY>
<TERM><OPTION>ListenQueueSize</> <REPLACEABLE>nn</></TERM>
<LISTITEM><PARA>
This relates to newer systems where the <FUNCTION>listen</>(2)
system call can define higher limits, than the traditional/original 5.
This limit tells how many nascent TCP streams we can have in
SYN_RCVD state before we stop answering to incoming SYN packets
requesting opening of a connection.
</PARA><PARA>
There are entirely deliberate denial-of-service attacks based on
flooding to some server many SYNS on which it can't send replies
back (because the target machines don't have network connectivity,
for example), and thus filling the back-queue of nascent sockets.
This can also happen accidentally, as the connectivity in between
the client host, and the server host may have a black hole into
which the SYN-ACK packets disappear, and the client thus will not
be able to get the TCP startup three-way handshake completed.
</PARA><PARA>
Most modern systems can have this value upped to thousands to
improve systems resiliency against malicious attacks, and most
likely to provide complete immunity against the accidental
"attack" by the failing network routing.
</PARA></LISTITEM></VARLISTENTRY>

<VARLISTENTRY>
<TERM><OPTION>help</> <REPLACEABLE>'string'</></TERM>
<LISTITEM><PARA>
This one adds yet another string (no quotes are used) into those
that are presented to the client when it asks for "HELP" in the
SMTP session.
</PARA></LISTITEM></VARLISTENTRY>

<VARLISTENTRY>
<TERM><OPTION>PolicyDB</> <REPLACEABLE>dbtype dbpath</></TERM>
<LISTITEM><PARA>
This defines the database type, and file path prefix to the binary
database containing policy processing information.  More of this
below.  Actual binary database file names are formed by appending
type specific suffixes to the path prefix.  For example NDBM
database appends ".pag" and ".dir", while BSD-Btree appends only
".db".  (And the latter has only one file, while the first has two.)
</PARA><PARA>
For an operative overview, see <XREF LINKEND=zadm-smtpserver-policy-filtering>,
and for deeper details, see <XREF LINKEND=zref-smtpserver-policy-filtering>.
</PARA></LISTITEM></VARLISTENTRY>
</VARIABLELIST>
</PARA>

</SECT2>

<SECT2 ID="zadm-smtpserver-conf-ehlostyle">
<TITLE><FILENAME>smtpserver.conf</>; ``EHLO-style options''</TITLE>
<INDEXTERM ID=zadm-smtps-smtpserver.conf-ehlostyle><PRIMARY><FILENAME>smtpserver.conf</></><SECONDARY>EHLO-style options, admin</></>

<PARA>
All lines that are not comments, nor start with uppercase keyword
``POLICY'' are ``EHLO-style patterns''.
This is the oldest form of configuring the <COMMAND>smtpserver</>, and
as such, it can be seen...
</PARA>

<PARA>
Behaviour is based on glob patterns matching the
<EMPHASIS ROLE="BOLD">HELO/EHLO</> name given by a remote client.
Lines beginning with a ``#'', or whitespace are ignored in the file,
and all other lines must consist of two tokens: a shell-style (glob) 
pattern starting at the beginning of the line, whitespace, and a 
sequence of style flags. The first matching line is used. As a 
special case, the flags section may start with a ! character in 
which case the remainder of the line is a failure comment message 
to print at the client. This configuration capability is intended 
as a way to control misbehaving client software or mailers.
</PARA>

<PARA>
The meanings of the style flag characters are as follow:
<VARIABLELIST>

<VARLISTENTRY><TERM><OPTION>f</></><LISTITEM><PARA>
Check ``<EMPHASIS ROLE=STRONG>MAIL FROM</>'' addresses through online
processing at the attached <COMMAND>router</> process
</PARA></LISTITEM></VARLISTENTRY>

<VARLISTENTRY><TERM><OPTION>t</></><LISTITEM><PARA>
Check <EMPHASIS ROLE=STRONG>RCPT TO</> addresses through online processing
at the attached <COMMAND>router</> process
</PARA></LISTITEM></VARLISTENTRY>

<VARLISTENTRY><TERM><OPTION>v</></><LISTITEM><PARA>
Allow execution of <EMPHASIS ROLE=STRONG>VRFY</> command online at the attached
<COMMAND>router</> process
</PARA></LISTITEM></VARLISTENTRY>

<VARLISTENTRY><TERM><OPTION>e</></><LISTITEM><PARA>
Allow execution <EMPHASIS ROLE=STRONG>EXPN</> command online at the attached
<COMMAND>router</> process
</PARA></LISTITEM></VARLISTENTRY>

<VARLISTENTRY><TERM><OPTION>R</></><LISTITEM><PARA>
Require addresses to be in fully qualified (domained) form:
``<EMPHASIS ROLE=STRONG>local@remote</>'' (strict 821)
</PARA></LISTITEM></VARLISTENTRY>
<VARLISTENTRY><TERM><OPTION>S</></><LISTITEM><PARA>
Allow Sloppy input for systems incapable to respect RFC 821
properly; WinCE1.0 does: ``<EMPHASIS ROLE=STRONG>MAIL FROM:user@domain</>'' :-(
</PARA></LISTITEM></VARLISTENTRY>
</VARIABLELIST>
</PARA>

</SECT2>
</SECT1>


<SECT1 ID="zadm-smtpserver-policy-filtering">
<TITLE>Policy Based Filtering</TITLE>
<INDEXTERM ID=zadm-smtps-policy-filtering1><PRIMARY><FILENAME>smtpserver.conf</></><SECONDARY>input policy filters</></>
<INDEXTERM ID=zadm-smtps-policy-filtering2><PRIMARY>SMTP input</><SECONDARY>policy filtering, admin</></>

<PARA>
The policy database that <COMMAND>smtpserver</> uses is built with
<COMMAND>policy-builder.sh</> script, which bundles together a set
of policy source files:
<INFORMALTABLE FRAME=NONE PGWIDE=0>
<TGROUP COLS=2 ALIGN=LEFT COLSEP=0 ROWSEP=0>
<THEAD>
<ROW ROWSEP=1>
 <ENTRY>File</>
 <ENTRY>What</>
</ROW>
</THEAD>
<TBODY>
<ROW>
 <ENTRY><FILENAME>DB/smtp-policy.src</></>
 <ENTRY><EMPHASIS>The boilerplate</></>
</ROW>
<ROW>
 <ENTRY><FILENAME>DB/localnames</></>
 <ENTRY>(``= _localnames'')</>
</ROW>
<ROW>
 <ENTRY><FILENAME>DB/smtp-policy.relay.manual</></>
 <ENTRY>(``= _full_rights'')</>
</ROW>
<ROW>
 <ENTRY><FILENAME>DB/smtp-policy.relay</></>
 <ENTRY>(``= _full_rights'')</>
</ROW>
<ROW>
 <ENTRY><FILENAME>DB/smtp-policy.mx.manual</></>
 <ENTRY>(``= _relaytarget'')</>
</ROW>
<ROW>
 <ENTRY><FILENAME>DB/smtp-policy.mx</></>
 <ENTRY>(``= _relaytarget'')</>
</ROW>
<ROW>
 <ENTRY><FILENAME>DB/smtp-policy.spam.manual</></>
 <ENTRY>(``= _bulk_mail'')</>
</ROW>
<ROW>
 <ENTRY><FILENAME>DB/smtp-policy.spam</></>
 <ENTRY>(``= _bulk_mail'')</>
</ROW>
</TBODY>
</TGROUP>
</INFORMALTABLE>
</PARA>

<PARA>
 <EMPHASIS>If you want, you can modify your <FILENAME>smtp-policy.src</>
 boilerplate file as well as your installed <COMMAND>policy-builder.sh</>
 script.</>
</PARA>

<PARA>
Basically these various source files (if they exist) are used to
combine knowledge of valid users around us:
</PARA>

<VARIABLELIST>
<VARLISTENTRY><TERM><FILENAME>smtp-policy.src</></><LISTITEM><PARA>
The controlling boilerplate, <EMPHASIS>which you should modify!</>
</PARA></LISTITEM></VARLISTENTRY>

<VARLISTENTRY><TERM><FILENAME>localnames</></><LISTITEM><PARA>
Who we are &mdash; ok domains for receiving.
</PARA></LISTITEM></VARLISTENTRY>

<VARLISTENTRY><TERM><FILENAME>smtp-policy.relay</></><LISTITEM><PARA>
Who can use us as outbound relay.
</PARA>

<PARA>
Use  <CONSTANT>[/ip.number]/maskwidth</>  here for listing those senders
(networks) we want to trust.  You may also use domains, or domain suffixes
so that the IP-reversed hostnames are accepted (but that is a it risky thing
due to ease of fakeing the reversed domain names):

<SCREEN>
  [11.22.33.00]/24
  ip-reversed.host.name
  .domain.suffix
</SCREEN>
</PARA>

<PARA>
Server sets its internal ``always_accept'' flag at the source IP tests
before it decides on what to tell to the contacting client.
The flag is not modified afterwards during the session.
</PARA>

<PARA>
Usage of domain names here is discouraged as there is no way to tell
that domain ``foo.bar'' here has different meaning than same domain
elsewere &mdash; at ``<FILENAME>smtp-policy.mx</>'', for example.
</PARA></LISTITEM></VARLISTENTRY>

<VARLISTENTRY>
 <TERM><FILENAME>smtp-policy.mx.manual</></>
 <TERM><FILENAME>smtp-policy.mx</></>
<LISTITEM><PARA>
Who really are our MX clients.
Use this when you really know them, and don't want just to trust
that if recipient has MX to you, it would be ok&hellip;
</PARA>

<PARA>
You can substitute this knowledge with a fuzzy feeling by using
``acceptifmx -'' attribute at the generic boilerplate.
List here domain names. 
<SCREEN>
  mx-target.dom
  .mx-target.dom
</SCREEN>
</PARA>

<PARA>
You CAN also list here all POSTMASTER addresses you accept email routed to: 
<SCREEN>
  postmaster@local.domain
  postmaster@client.domain
</SCREEN>
these are magic addresses that email is accepted to, even when everything
else is blocked. 
</PARA></LISTITEM></VARLISTENTRY>

<VARLISTENTRY>
 <TERM><FILENAME>smtp-policy.spam.manual</></>
 <TERM><FILENAME>smtp-policy.spam</></>
<LISTITEM><PARA>
Those users, and domains that are absolutely no-no for senders,
or recipients no matter what earlier analysis has shown.
(Except for those senders that we absolutely trust..)
<SCREEN>
  user@domain
  user@
  domain
</SCREEN>
</PARA>

</LISTITEM></VARLISTENTRY>
</VARIABLELIST>

<PARA>
At the ``<FILENAME>smtp-policy.src</>'' boiler-plate file there is one
particular section containing default setting statements.
See figure <XREF LINKEND="fig.adm.smtp-policy-boiler"> for the salient
details concerning this.
</PARA>

<FIGURE ID="fig.adm.smtp-policy-boiler" PGWIDE="0" FLOAT="1">
<TITLE>The <FILENAME>smtp-policy.src</> file default settings fragment</TITLE>
<SCREEN>
...
#| ===========================
#|
#| Default handling boilerplates:
#|
#|   "We are not relaying between off-site hosts, except when ..."
#|
#| You MUST uncomment one of these default-defining pairs, or the blocking
#| of relay hijack will not work at all !
#|
#| == 1st alternate: No MX target usage, no DNS existence verify
#|    Will accept for reception only those domains explicitely listed
#|    in ``smtp-policy.mx'' and  ``localnames''  files.  Will not do
#|    verifications on validity/invalidity of source domains:&lt;foo@bar&gt;
#
# .             relaycustomer - relaytarget -
# [0.0.0.0]/0   relaycustomer - relaytarget -
#
#| == 2nd alternate: No MX target usage, DNS existence verify
#|    Like the 1st alternate, except will verify the sender
#|    (MAIL FROM:&lt;..&gt;) address for existence of the DNS MX and/or
#|    A/AAAA data -- e.g. validity.
#|    If RBL parameters are set below, will use them.
#
# .             relaycustomer - relaytarget - senderokwithdns + = _rbl1
# [0.0.0.0]/0   relaycustomer - relaytarget - senderokwithdns + = _rbl0
#
#| == 3rd alternate: MX relay trust, DNS existence verify
#|    For the people who are in deep s*...  That is, those who for some
#|    reason have given open permissions for people to use their server
#|    as MX backup for their clients, but don't know all domains valid
#|    to go thru...  Substitutes accurate data to user's whimsical DNS
#|    maintenance activities.  Vulnerable to inbound MX resource abuse.
#|    If RBL parameters are set below, will use them.

.               relaycustomer - acceptifmx - senderokwithdns + = _rbl1
[0.0.0.0]/0     relaycustomer - acceptifmx - senderokwithdns + = _rbl0

#| == 4th alternate: Sender & recipient DNS existence verify
#|    This is more of an example for the symmetry's sake, verifies that
#|    the source and destination domains are DNS resolvable, but does not
#|    block relaying
#
# .             senderokwithdns - acceptifdns -
# [0.0.0.0]/0   senderokwithdns - acceptifdns -
#
#|
#|  You may also add  ``test-dns-rbl +''  attribute pair to [0.0.0.0]/0
#|  of your choice to use Paul Vixie's  http://maps.vix.com/  MAPS RBL
#|  system.
#|
#| These rules mean that locally accepted hostnames MUST be listed in
#| the database with ``relaytarget +'' attribute.
#|
#| ===========================
#|
#| RBL type test rules:

#| First RBL variant: NONE OF THE RBL TESTS
_rbl0 # Nothing at early phase
_rbl1 # Nothing at late phase

#| Second RBL variant: Early block with RBL+DUL+RSS
#_rbl0 test-dns-rbl      +:dul.maps.vix.com:relays.mail-abuse.org
#_rbl1 # Nothing at late phase

#| Third RBL variant: Late block with RBL+DUL+RSS
#_rbl0 rcpt-dns-rbl      +:dul.maps.vix.com:relays.mail-abuse.org
#_rbl1 test-rcpt-dns-rbl +

#|  (The "+" at the DNS zone defines is treated as shorthand to
#|   "rbl.maps.vix.com")
#|
#|  The Third RBL variant means that all target domains can all by themselves
#|  choose if they use RBL to do source filtering.  The ``= _RBL1'' test
#|  *must* be added to all domain instances where the check is wanted.
#|  (Including the last-resort domain default of ".")
#|  (Or inverting: If some recipient domain is *not* wanting RBL-type tests,
#|   that domain shall have  ``test-rcpt-dns-rbl -'' attribute pair given for
#|   it at the input datasets -- consider  smtp-policy.mx  file!)
#|
#| These rules mean that locally accepted hostnames MUST be listed in
#| the database with  'relaytarget +' attribute.  ("acceptifmx *" allows
#| reception if the local system is amonst the MXes.)
#|
#| ===========================
#|
#| If your system has ``whoson'' server (see contrib/whoson-*.tgz),
#| you can activate it by adding  'trust-whoson +' attribute pair to
#| the wild-card IP address test:  [0.0.0.0]/0  of your choise.
#|
#| ===========================
#|
#| For outbound relaying control for fixed IP address networks, see
#| comments in file:  smtp-policy.relay
#|
#| ===========================
...
</SCREEN>
</FIGURE>
</SECT1>
</CHAPTER>
