From a38229c0cb835f4286527ece99abd3a37b0bee05 Mon Sep 17 00:00:00 2001 From: Martin Weinelt Date: Mon, 17 Nov 2025 20:37:04 +0100 Subject: [PATCH] Revert "nixos/postfix-tlspol: make tlsrpt depend on tlsrpt service" This reverts commit 9ccec77537e72c1f7e792e838e99c1f0d7692850. Per the author of postfix-tlspol in https://github.com/NixOS/nixpkgs/pull/456728#issuecomment-3536706358 > QUERYwithTLSRPT should be used when the installed Postfix version is > 3.10 or newer, regardless of the state of the TLSRPT option in the > Postfix configuration. Especially Postfix 3.10.5 and later use the > additional data provided by postfix-tlspol to find the correct MX > domains to connect to MTA-STS-protected mail destinations. > > If you use QUERY with Postfix 3.10.5+, Postfix will use the legacy > way of DNS MX lookup for the domain, which theoretically can differ > from the hosts provided by the MTA-STS policy (but usually should be > the same). > > The user can still disable TLSRPT in the Postfix configuration without > side-effects. --- nixos/modules/services/mail/postfix-tlspol.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/nixos/modules/services/mail/postfix-tlspol.nix b/nixos/modules/services/mail/postfix-tlspol.nix index a42c43fc4a48..b1288d30fb28 100644 --- a/nixos/modules/services/mail/postfix-tlspol.nix +++ b/nixos/modules/services/mail/postfix-tlspol.nix @@ -142,7 +142,7 @@ in else "inet:${cfg.settings.server.address}"; in - [ "socketmap:${address}:${if config.services.tlsrpt.enable then "QUERYwithTLSRPT" else "QUERY"}" ]; + [ "socketmap:${address}:QUERYwithTLSRPT" ]; }; systemd.services.postfix = {