SENDMAIL(1)

📦
version 3.11.7 · 9 versions
, in alpine 3.24, arch rolling, nixos 26.05, nixpkgs unstable, ubuntu stonking

💌 SENDMAIL 💌 (1)

okay bestie, pull up a chair, because this is <rainbow>sendmail</rainbow> from the General Commands Manual, section <cyan>1</cyan>, a.k.a. the Postfix to Sendmail compatibility interface. she's giving legacy-but-make-it-serve. 🫶

✨ NAME ✨

sendmail — Postfix to Sendmail compatibility interface

🦋 SYNOPSIS 🦋

sendmail [option ...] [recipient ...]

mailq
sendmail -bp

newaliases
sendmail -I

🌸 DESCRIPTION 🌸

so the Postfix sendmail(1) command is the Postfix to Sendmail compatibility interface. the whole point, the moment, the vibe. 💅 and for the sake of compatibility with existing applications (the old ones, the ones that refuse to change), some Sendmail command-line options are recognized but silently ignored. not me getting away with that. 💀

by default, Postfix sendmail(1) reads a message from standard input until EOF or until it reads a line with only a . character, and arranges for delivery. Postfix sendmail(1) relies on the postdrop(1) command to create a queue file in the maildrop directory. teamwork makes the dream work, fr fr. ✨

specific command aliases are provided for other common modes of operation, and honestly? iconic little shortcuts:

  • mailq — list the mail queue. 🎀 each entry shows the queue file ID, message size, arrival time, sender, and the recipients that still need to be delivered. if mail could not be delivered upon the last attempt, the reason for failure is shown. the queue ID string is followed by an optional status character:
    • * — the message is in the active queue, i.e. the message is selected for delivery. it's giving chosen. 👑
    • ! — the message is in the hold queue, i.e. no further delivery attempt will be made until the mail is taken off hold. she's on pause, respectfully. 🫶
    • # — the message is forced to expire. see the postsuper(1) options -e or -f. rip bestie 😭
    • this mode of operation is implemented by executing the postqueue(1) command.
  • newaliases — initialize the alias database. 💖 if no input file is specified (with the -oA option, see below), the program processes the file(s) specified with the alias_database configuration parameter. if no alias database type is specified, the program uses the type specified with the default_database_type configuration parameter. this mode of operation is implemented by running the postalias(1) command.
note: it may take a minute or so before an alias database update becomes visible. use the "postfix reload" command to eliminate this delay. (yes queen, refresh the page. 🔄)

these and other features can be selected by specifying the appropriate combination of command-line options. some features are controlled by parameters in the main.cf configuration file. mix and match, it's your world. 🌈

🔧 the options, bestie (recognized) 🔧

the following options are recognized:

  • -Am (ignored) — literally nothing. a ghost. a rumor. 👻
  • -Ac (ignored) — Postfix sendmail uses the same configuration file regardless of whether or not a message is an initial submission. one config to rule them all.
  • -B body_type — the message body MIME type: 7BIT or 8BITMIME.
  • -bd — go into daemon mode. 🧚 this mode of operation is implemented by executing the "postfix start" command.
  • -bh (ignored) — nope, nothing here either.
  • -bH (ignored) — Postfix has no persistent host status database. that's just not a thing she does. 🙈
  • -bi — initialize alias database. see the newaliases command above.
  • -bl — go into daemon mode. to accept only local connections as with Sendmail's -bl option, specify "inet_interfaces = loopback" in the Postfix main.cf configuration file. local only, no strangers. ✨
  • -bm — read mail from standard input and arrange for delivery. this is the default mode of operation. the main character, basically. 👑
  • -bp — list the mail queue. see the mailq command above.
  • -bs — stand-alone SMTP server mode. 🌐 read SMTP commands from standard input, and write responses to standard output. in stand-alone SMTP server mode, mail relaying and other access controls are disabled by default. to enable them, run the process as the mail_owner user.

this mode of operation is implemented by running the smtpd(8) daemon.

  • -bv — do not collect or deliver a message. instead, send an email report after verifying each recipient address. this is useful for testing address rewriting and routing configurations. 🧪🔍

this feature is available in Postfix version 2.1 and later.

  • -C config_file / -C config_dir — the path name of the Postfix main.cf file, or of its parent directory. this information is ignored with Postfix versions before 2.3.

with Postfix version 3.2 and later, a non-default directory must be authorized in the default main.cf file, through the alternate_config_directories or multi_instance_directories parameters.

with all Postfix versions, you can specify a directory pathname with the MAIL_CONFIG environment variable to override the location of configuration files. 🫶

  • -F full_name — set the sender full name. this overrides the NAME environment variable, and is used only with messages that have no From: message header.
  • -f sender — set the envelope sender address. this is the address where delivery problems are sent to. with Postfix versions before 2.1, the Errors-To: message header overrides the error return address. 📬
  • -G — gateway (relay) submission, as opposed to initial user submission. either do not rewrite addresses at all, or update incomplete addresses with the domain information specified with remote_header_rewrite_domain. 🚪

this option is ignored before Postfix version 2.3.

  • -h hop_count (ignored) — hop count limit. use the hopcount_limit configuration parameter instead.
  • -I — initialize alias database. see the newaliases command above.
  • -i — when reading a message from standard input, don't treat a line with only a . character as the end of input. keep going, keep going. 💅
  • -L label (ignored) — the logging label. use the syslog_name configuration parameter instead.
  • -m (ignored) — backwards compatibility. that's it, that's the tweet.
  • -N dsn (default: 'delay, failure') — delivery status notification control. specify either a comma-separated list with one or more of:
    • failure — send notification when delivery fails
    • delay — send notification when delivery is delayed
    • success — send notification when the message is delivered

…or specify never (don't send any notifications at all). your inbox, your rules. 💖

this feature is available in Postfix 2.3 and later.

  • -n (ignored) — backwards compatibility. bestie, she's just here for the heritage. 💀
  • -O requiretls=yes / -O requiretls=no — when delivering a message to an SMTP or LMTP server, the connection must use TLS with a verified server certificate, and that server must support REQUIRETLS. the "requiretls" name and option value are case-insensitive. REQUIRETLS enforcement is controlled with the configuration parameters requiretls_enable, smtp_requiretls_policy, and lmtp_requiretls_policy. 🔐✨

this feature is available in Postfix 3.11 and later.

  • -O smtputf8=yes / -O smtputf8=no — when delivering a message to an SMTP or LMTP server, and an envelope address or message header contains UTF8 text, that server must support SMTPUTF8. the "smtputf8" option name and value are case-insensitive. 🌍

this feature is available in Postfix 3.11 and later.

  • -O option=value (ignored) — set the named option to value. use the equivalent configuration parameter in main.cf instead.
  • -oAalias_database — non-default alias database. specify pathname or type:pathname. see postalias(1) for details.
  • -o7 (ignored) / -o8 (ignored) — to send 8-bit or binary content, use an appropriate MIME encapsulation and specify the appropriate -B command-line option. 🎀
  • -oi — when reading a message from standard input, don't treat a line with only a . character as the end of input.
  • -om (ignored) — the sender is never eliminated from alias etc. expansions.
  • -o x value (ignored) — set option x to value. use the equivalent configuration parameter in main.cf instead.
  • -r sender — set the envelope sender address. this is the address where delivery problems are sent to. with Postfix versions before 2.1, the Errors-To: message header overrides the error return address.
  • -R return — delivery status notification control. specify "hdrs" to return only the header when a message bounces, "full" to return a full copy (the default behavior). 📄

the -R option specifies an upper bound; Postfix will return only the header, when a full copy would exceed the bounce_size_limit setting.

this option is ignored before Postfix version 2.10.

  • -q — attempt to deliver all queued mail. this is implemented by executing the postqueue(1) command.
⚠️ warning: flushing undeliverable mail frequently will result in poor delivery performance of all other mail. do not spam the flush bestie, it's not the move. 😭
  • -qinterval (ignored) — the interval between queue runs. use the queue_run_delay configuration parameter instead.
  • -qIqueueid — schedule immediate delivery of mail with the specified queue ID. this option is implemented by executing the postqueue(1) command, and is available with Postfix version 2.4 and later. ⚡
  • -qRsite — schedule immediate delivery of all mail that is queued for the named site. this option accepts only site names that are eligible for the "fast flush" service, and is implemented by executing the postqueue(1) command. see flush(8) for more information about the "fast flush" service.
  • -qSsite — this command is not implemented. use the slower "sendmail -q" command instead. 🐢
  • -t — extract recipients from message headers. these are added to any recipients specified on the command line.

with Postfix versions prior to 2.1, this option requires that no recipient addresses are specified on the command line.

  • -U (ignored) — initial user submission.
  • -V envid — specify the envelope ID for notification by servers that support DSN. 💖

this feature is available in Postfix 2.3 and later.

  • -XV (Postfix 2.2 and earlier: -V) — Variable Envelope Return Path. given an envelope sender address of the form owner-listname@origin, each recipient user@domain receives mail with a personalized envelope sender address. ✨

by default, the personalized envelope sender address is owner-listname+user=domain@origin. the default + and = characters are configurable with the default_verp_delimiters configuration parameter.

  • -XVxy (Postfix 2.2 and earlier: -Vxy) — it's literally -XV but you get to pick x and y as your VERP delimiter characters yourself, instead of just going with whatever the default_verp_delimiters configuration parameter says. custom delimiters, your rules 💅
  • -v — sends an email report of the first delivery attempt (this is a Postfix 2.1 and later thing). Mail delivery itself always happens in the background, no exceptions. But bestie, listen: when you stack multiple -v options, it turns on verbose logging for debugging purposes. one -v = a lil report, many -v = full on detective mode 🔍
  • -X log_file — (ignored). Like, genuinely ignored, it does nothing now. It used to log mailer traffic. Now you use the debug_peer_list and debug_peer_level configuration parameters instead. rip to a real one 🪦

🔒 SECURITY 🔒

By design, this program is not set-user (or group) id. It's built to handle message content from untrusted users, and possibly remote ones too. so like, it's not walking around with extra powers, ok? 🫶

BUT — and this is the big BUT — like most Postfix programs, it does not enforce a security policy on its command-line arguments. Instead it's relying on the UNIX system to enforce access policies based on the effective user and group IDs of the process. Concretely, this means running Postfix commands as root (from sudo or equivalent) on behalf of a non-root user is likely to create privilege escalation opportunities. not cute. not the vibe. 😭

If an application runs any Postfix programs on behalf of users that don't have normal shell access to Postfix commands, then that application MUST restrict user-specified command-line arguments to avoid privilege escalation. MUST. all caps. I don't make the rules (Wietse does) 👑

  • Filter all command-line arguments, for example arguments that contain a pathname or that specify a database access method. These pathname checks must reject user-controlled symlinks or hardlinks to sensitive files, and must not be vulnerable to TOCTOU race attacks. yes, TOCTOU, look it up, it's giving sneaky 💀
  • Disable command options processing for all command arguments that contain user-specified data. For example, the Postfix sendmail(1) command line MUST be structured as follows:
/path/to/sendmail system-arguments -- user-arguments

Here, the -- disables command option processing for all user-arguments that follow.

Without the --, a malicious user could enable Postfix sendmail(1) command options, by specifying an email address that starts with -. yeah. one lil dash. that's all it takes. protect the -- with your life 💖

🩺 DIAGNOSTICS 🩺

Problems get logged to syslogd(8) or postlogd(8), and to the standard error stream. so if something's wrong, it will tell you, multiple places actually 🌸

🌱 ENVIRONMENT 🌱

  • MAIL_CONFIG — directory with Postfix configuration files.
  • MAIL_VERBOSE (value does not matter) — enable verbose logging for debugging purposes. literally any value, it just needs to exist.
  • MAIL_DEBUG (value does not matter) — enable debugging with an external command, as specified with the debugger_command configuration parameter.
  • NAME — the sender full name. This is used only with messages that have no From: message header. See also the -F option above. yes, the same -F. go look, it's up there 👆

⚙️ CONFIGURATION PARAMETERS ⚙️

The following main.cf parameters are especially relevant to this program. The text below provides only a parameter summary. See postconf(5) for more details including examples. so like, this is the trailer, not the whole movie 🎬

🧩 COMPATIBILITY CONTROLS 🧩

Available with Postfix 2.9 and later:

  • sendmail_fix_line_endings (always) — controls how the Postfix sendmail command converts email message line endings from <CR><LF> into UNIX format (<LF>). Windows line endings, we're fixing you 🛠️

🔧 TROUBLE SHOOTING CONTROLS 🔧

The DEBUG_README file gives examples of how to troubleshoot a Postfix system. read it, it's giving helpful 📖

  • debugger_command (empty) — the external command to execute when a Postfix daemon program is invoked with the -D option.
  • debug_peer_level (2) — the increment in verbose logging level when a nexthop destination, remote client or server name or network address matches a pattern given with the debug_peer_list parameter.
  • debug_peer_list (empty) — optional list of nexthop destination, remote client or server name or network address patterns that, if matched, cause the verbose logging level to increase by the amount specified in $debug_peer_level.

🚪 ACCESS CONTROLS 🚪

Available in Postfix version 2.2 and later:

  • authorized_flush_users (static:anyone) — list of users who are authorized to flush the queue.
  • authorized_mailq_users (static:anyone) — list of users who are authorized to view the queue.
  • authorized_submit_users (static:anyone) — list of users who are authorized to submit mail with the sendmail(1) command (and with the privileged postdrop(1) helper command). note: privileged helper. respect it 😤

📊 RESOURCE AND RATE CONTROLS 📊

  • bounce_size_limit (50000) — the maximal amount of original message text that is sent in a non-delivery notification.
  • fork_attempts (5) — the maximal number of attempts to fork() a child process.
  • fork_delay (1s) — the delay between attempts to fork() a child process.
  • hopcount_limit (50) — the maximal number of Received: message headers that is allowed in the primary message headers.
  • queue_run_delay (300s) — the time between deferred queue scans by the queue manager; prior to Postfix 2.4 the default value was 1000s. glow up moment fr 📈

⚡ FAST FLUSH CONTROLS ⚡

The ETRN_README file describes configuration and operation details for the Postfix "fast flush" service.

  • fast_flush_domains ($relay_domains) — optional list of destinations that are eligible for per-destination logfiles with mail that is queued to those destinations.

🔁 VERP CONTROLS 🔁

The VERP_README file describes configuration and operation details of Postfix support for variable envelope return path addresses. variable envelope return path, say it with your chest 🗣️

  • default_verp_delimiters (+=) — the two default VERP delimiter characters.
  • verp_delimiter_filter (-=+) — the characters Postfix accepts as VERP delimiter characters on the Postfix sendmail(1) command line and in SMTP commands.

🎀 MISCELLANEOUS CONTROLS 🎀

  • alias_database (see postconf -d output) — the alias databases for local(8) delivery that are updated with newaliases or with sendmail -bi.
  • command_directory (see postconf -d output) — the location of all postfix administrative commands.
  • config_directory (see postconf -d output) — the default location of the Postfix main.cf and master.cf configuration files.
  • daemon_directory (see postconf -d output) — the directory with Postfix support programs and daemon programs.
  • default_database_type (see postconf -d output) — the default database type for use in newaliases(1), postalias(1) and postmap(1) commands.
  • delay_warning_time (0h) — the time after which the sender receives a copy of the message headers of mail that is still queued.
  • import_environment (see postconf -d output) — the list of environment variables that a privileged Postfix process will import from a non-Postfix parent process, or name=value environment overrides.
  • mail_owner (postfix) — the UNIX system account that owns the Postfix queue and most Postfix daemon processes.
  • queue_directory (see postconf -d output) — the location of the Postfix top-level queue directory.
  • remote_header_rewrite_domain (empty) — rewrite or add message headers in mail from remote clients if the remote_header_rewrite_domain parameter value is non-empty, updating incomplete addresses with the domain specified in the remote_header_rewrite_domain parameter, and adding missing headers.
  • syslog_facility (mail) — the syslog facility of Postfix logging.
  • syslog_name (see postconf -d output) — a prefix that is prepended to the process name in syslog records, so that, for example, smtpd becomes prefix/smtpd.

Postfix 3.2 and later:

  • alternate_config_directories (empty) — a list of non-default Postfix configuration directories that may be specified with -c config_directory on the command line (in the case of sendmail(1), with the -C option), or via the MAIL_CONFIG environment parameter.
  • multi_instance_directories (empty) — an optional list of non-default Postfix configuration directories; these directories belong to additional Postfix instances that share the Postfix executable files and documentation with the default Postfix instance, and that are started, stopped, etc., together with the default Postfix instance. multiple instances, one icon era 👑

Postfix 3.11 and later:

  • requiretls_enable (yes) — enable support for the ESMTP verb REQUIRETLS in the MAIL FROM command.

📁 FILES 📁

  • /var/spool/postfix, mail queue
  • /etc/postfix, configuration files

👀 SEE ALSO 👀

📚 README_FILES 📚

Use postconf readme_directory or postconf html_directory to locate this information.

  • DEBUG_README, Postfix debugging howto
  • ETRN_README, Postfix ETRN howto
  • VERP_README, Postfix VERP howto

📜 LICENSE 📜

The Secure Mailer license must be distributed with this software. non-negotiable bestie ✨

💖 AUTHOR(S) 💖

Wietse Venema IBM T.J. Watson Research P.O. Box 704 Yorktown Heights, NY 10598, USA

Wietse Venema Google, Inc. 111 8th Avenue New York, NY 10011, USA

and that's a wrap on the SENDMAIL(1) page, bestie 🎀 that lil SENDMAIL(1) footer sitting at the bottom of the page is the source-and-version stamp, so if you ever forget which manpage you're living in, just scroll down and let it remind you. go configure something iconic 💅✨

📦 where this page comes from