Postfix 3.8 Released — Improved TLS and Performance

Postfix 3.8 is a significant release for mail server administrators, introducing TLS certificate fingerprint verification, improved queue management and better defence against spam.

TLS Fingerprint Verification

New in 3.8: verify remote SMTP servers by certificate fingerprint, not just hostname — stronger protection against MITM attacks.

# main.cf — require specific certificate fingerprint
smtp_tls_fingerprint_digest = sha256
smtp_tls_policy_maps = hash:/etc/postfix/tls_policy

# tls_policy file
mail.recipient.com fingerprint SHA256:AA:BB:CC:...

Improved Postscreen

# main.cf — enhanced postscreen config
postscreen_dnsbl_sites =
    zen.spamhaus.org*3
    bl.spamcop.net*2
    b.barracudacentral.org*2
postscreen_dnsbl_threshold = 3
postscreen_greet_action = enforce
postscreen_dnsbl_action = enforce

Queue Management Improvements

# View queue
postqueue -p

# Flush all queued mail
postqueue -f

# Delete all deferred mail
postsuper -d ALL deferred

# New in 3.8: improved queue file locking
postfix reload

Upgrade on Ubuntu

sudo add-apt-repository ppa:open-dev/postfix
sudo apt update
sudo apt install postfix -y
postconf mail_version

Conclusion

Postfix 3.8 improves security and performance for busy mail servers. Our team configures and manages Postfix mail servers with full DKIM, SPF and DMARC setup.