Prereq: "3.8.7"
diff -ur --new-file /var/tmp/postfix-3.8.7/src/global/mail_version.h ./src/global/mail_version.h
--- /var/tmp/postfix-3.8.7/src/global/mail_version.h	2024-12-04 14:42:52.000000000 -0500
+++ ./src/global/mail_version.h	2025-02-16 17:59:17.000000000 -0500
@@ -20,8 +20,8 @@
   * Patches change both the patchlevel and the release date. Snapshots have no
   * patchlevel; they change the release date only.
   */
-#define MAIL_RELEASE_DATE	"20241204"
-#define MAIL_VERSION_NUMBER	"3.8.7"
+#define MAIL_RELEASE_DATE	"20250216"
+#define MAIL_VERSION_NUMBER	"3.8.8"
 
 #ifdef SNAPSHOT
 #define MAIL_VERSION_DATE	"-" MAIL_RELEASE_DATE
diff -ur --new-file /var/tmp/postfix-3.8.7/HISTORY ./HISTORY
--- /var/tmp/postfix-3.8.7/HISTORY	2024-12-04 14:42:26.000000000 -0500
+++ ./HISTORY	2025-02-15 16:54:03.000000000 -0500
@@ -27369,3 +27369,78 @@
 	by Postfix (for example, a From: header with UTF8 full name
 	information from the password file). Reported by Michael
 	Tokarev. File: src/cleanup/cleanup_message.c.
+
+20241205
+
+	Portability: include <sys_socket.h> for a SUNOS5 workaround.
+	Gary R. Schmidt. File: util/peekfd.c.
+
+20241230
+
+	Bugfix (defect introduced: Postfix 3.3, date 20180107) small
+	memory leak in the cleanup daemon when generating a "From:
+	full-name <addr-spec>" message header. The impact is limited
+	because the number of requests is bounded by the "max_use"
+	configuration parameter. Found during code maintenance.
+	File: cleanup/cleanup_message.c.
+
+20250111
+
+	Forward compatibility: ignore new queue file flag bits that may
+	be used with Postfix 3.10 and later. This is a safety in case
+	a Postfix 3.10 upgrade needs to be rolled back, after the new
+	TLS-Required feature has been used. Files: global/smtputf8.h,
+	*qmgr/qmgr_message.c.
+ 
+20250115
+
+	Bugfix (defect introduced: Postfix 3.0): the bounce daemon
+	mangled a non-ASCII address localpart in the "X-Postfix-Sender:"
+	field of a delivery status notification. It backslash-escaped
+	each byte in a multi-byte character. This behavior was
+	implemented in Postfix 2.1 (no support for UTF8 local-parts),
+	but it became incorrect after SMTPUTF8 support was implemented
+	in Postfix 3.0. File: bounce/bounce_notify_util.c.
+
+20250207
+
+	Performance: when a mysql: or pgsql: configuration specifies
+	a single host, assume that it is a load balancer and reconnect
+	immediately after a single failure, instead of failing all
+	requests for 60s. Files: global/dict_pgsql.c, global/dict_mysql.c.
+
+20250210
+
+	Bugfix (defect introduced: Postfix 3.6): Reverted the default
+	smtp_tls_dane_insecure_mx_policy setting to "dane" as of Postfix
+	3.6.17, 3.7.13, 3.8.8, 3.9.2, and 3.10.0. By mistake the default
+	was dependent on the smtp_tls_security_level setting. Files:
+	global/mail_params.h, proto/postconf.proto, smtp/smtp.c.
+
+20250212
+
+	Support for OpenSSL 3.5 post-quantum cryptography. To manage
+	algorithm selection, OpenSSL introduces new TLS group syntax
+	that Postfix will not attempt to imitate. Instead, Postfix
+	now allows the tls_eecdh_auto_curves and tls_ffdhe_auto_groups
+	parameter values to have an empty value. When both are set
+	empty, the algorithm selection can be managed through OpenSSL
+	configuration. Viktor Dukhovni. Files: tls/tls_dh.c,
+	tls/tls_misc.c.
+
+	Bugfix (defect introduced: Postfix 3.4, date 20181113): a
+	server with multiple TLS certificates could report, for a
+	resumed TLS session, the wrong server-signature and
+	server-digest names in logging and Received: message headers.
+	Viktor Dukhovni. File: tls/tls_misc.c.
+
+20250213
+
+	Documentation: updated postconf(5) that the parameters
+	smtpd_tls_eecdh_grade, tls_eecdh_strong_curve,
+	tls_eecdh_ultra_curve, and tlsproxy_tls_eecdh_grade, are
+	not used since Postfix 3.6; updated the tls_eecdh_auto_curves
+	and tls_ffdhe_auto_groups description with post-quantum
+	configuration; added a post-quantum example to the
+	tls_config_file description. File: proto/postconf.proto.
+	The unused parameters will be deleted in Postfix 3.11.
diff -ur --new-file /var/tmp/postfix-3.8.7/html/lmtp.8.html ./html/lmtp.8.html
--- /var/tmp/postfix-3.8.7/html/lmtp.8.html	2023-06-04 17:19:50.000000000 -0400
+++ ./html/lmtp.8.html	2025-02-16 17:55:36.000000000 -0500
@@ -678,7 +678,7 @@
 
        Available in Postfix version 3.1 and later:
 
-       <b><a href="postconf.5.html#smtp_tls_dane_insecure_mx_policy">smtp_tls_dane_insecure_mx_policy</a> (see 'postconf -d' output)</b>
+       <b><a href="postconf.5.html#smtp_tls_dane_insecure_mx_policy">smtp_tls_dane_insecure_mx_policy</a> (dane)</b>
               The TLS policy for MX hosts with "secure" TLSA records when  the
               nexthop  destination  security  level is <b>dane</b>, but the MX record
               was found via an "insecure" MX lookup.
diff -ur --new-file /var/tmp/postfix-3.8.7/html/postconf.5.html ./html/postconf.5.html
--- /var/tmp/postfix-3.8.7/html/postconf.5.html	2024-01-21 17:25:57.000000000 -0500
+++ ./html/postconf.5.html	2025-02-16 15:03:39.000000000 -0500
@@ -12909,7 +12909,7 @@
 </DD>
 
 <DT><b><a name="smtp_tls_dane_insecure_mx_policy">smtp_tls_dane_insecure_mx_policy</a>
-(default: see "postconf -d" output)</b></DT><DD>
+(default: dane)</b></DT><DD>
 
 <p> The TLS policy for MX hosts with "secure" TLSA records when the
 nexthop destination security level is <b>dane</b>, but the MX
@@ -12933,10 +12933,9 @@
 "Verified", because the MX host name could have been forged.  </dd>
 </dl>
 
-<p> The default setting for Postfix &ge; 3.6 is "dane" with
-"<a href="postconf.5.html#smtp_tls_security_level">smtp_tls_security_level</a> = dane", otherwise "may". This behavior
-was backported to Postfix versions 3.5.9, 3.4.19, 3.3.16. 3.2.21.
-With earlier Postfix versions the default setting was always "dane".
+<p> The default setting is "dane" as of Postfix versions 3.6.17,
+3.7.13, 3.8.8, 3.9.2, and 3.10.0. With earlier versions the default
+was mistakenly dependent on the <a href="postconf.5.html#smtp_tls_security_level">smtp_tls_security_level</a> setting.
 </p>
 
 <p> Though with "insecure" MX records an active attacker can
@@ -18275,6 +18274,8 @@
 <b>auto</b> value (described below) was chosen.
 </p>
 
+<p> This feature is not used as of Postfix 3.6. Do not specify. </p>
+
 <p> The available choices are: </p>
 
 <dl>
@@ -19422,6 +19423,45 @@
 </pre>
 </blockquote>
 
+<p> Example: Custom OpenSSL group settings. </p>
+
+<pre>
+<a href="postconf.5.html">main.cf</a>:
+    <a href="postconf.5.html#tls_config_file">tls_config_file</a> = ${<a href="postconf.5.html#config_directory">config_directory</a>}/openssl.cnf
+    <a href="postconf.5.html#tls_config_name">tls_config_name</a> = postfix
+</pre>
+
+<pre>
+openssl.cnf:
+    postfix = postfix_settings
+</pre>
+
+<pre>
+    [postfix_settings]
+    ssl_conf = postfix_ssl_settings
+</pre>
+
+<pre>
+    [postfix_ssl_settings]
+    system_default = baseline_postfix_settings
+</pre>
+
+<pre>
+    [baseline_postfix_settings]
+    # New OpenSSL 3.5 syntax, for older releases consider
+    # the Postfix default:
+    #
+    # Groups = X25519:X448:prime256v1:secp384r1:secp521r1:ffdhe2048:ffdhe3072
+    #
+    Groups = *X25519MLKEM768 / *X25519:X448 / P-256:P-384
+</pre>
+
+<p> Caution: It is typically best to just use the default OpenSSL
+group settings, by setting "<a href="postconf.5.html#tls_config_file">tls_config_file</a> = none". Overly strict
+system-wide TLS settings will conflict with Postfix's opportunistic
+TLS, where being less restrictive is better than downgrading to
+cleartext SMTP. </p>
+
 <p> This feature is available in Postfix &ge; 3.9, 3.8.1, 3.7.6,
 3.6.10, and 3.5.20. </p>
 
@@ -19614,8 +19654,7 @@
 (default: see "postconf -d" output)</b></DT><DD>
 
 <p> The prioritized list of elliptic curves supported by the Postfix
-SMTP client and server.  These curves are used by the Postfix SMTP
-server when "<a href="postconf.5.html#smtpd_tls_eecdh_grade">smtpd_tls_eecdh_grade</a> = auto".  The selected curves must be
+SMTP client and server. The selected curves must be
 implemented by OpenSSL and be standardized for use in TLS (<a href="https://tools.ietf.org/html/rfc8422">RFC 8422</a>).
 It is unwise to list only "bleeding-edge" curves supported by a small
 subset of clients.  The default list is suitable for most users. </p>
@@ -19634,6 +19673,14 @@
 is introduced with Postfix 3.8, when built against OpenSSL 3.0 or later.
 </p>
 
+<p> Post-quantum cryptography support: OpenSSL 3.5 introduces new
+configuration syntax that Postfix will not attempt to imitate.
+Instead, with Postfix 3.6.17, 3.7.13, 3.8.8, 3.9.2, and later, set
+both <a href="postconf.5.html#tls_eecdh_auto_curves">tls_eecdh_auto_curves</a> and if available <a href="postconf.5.html#tls_ffdhe_auto_groups">tls_ffdhe_auto_groups</a>
+to the empty value, to enable algorithm selection through OpenSSL
+configuration. See <a href="postconf.5.html#tls_config_file">tls_config_file</a> for a configuration example.
+</p>
+
 <p> This feature is available in Postfix 3.2 and later, when it is
 compiled and linked with OpenSSL 1.0.2 or later on platforms where
 EC algorithms have not been disabled by the vendor. </p>
@@ -19657,6 +19704,8 @@
 is unwise to choose only "bleeding-edge" curves supported by only a
 small subset of clients.  </p>
 
+<p> This feature is not used as of Postfix 3.6. Do not specify. </p>
+
 <p> The default "strong" curve is rated in NSA <a
 href="https://web.archive.org/web/20160330034144/https://www.nsa.gov/ia/programs/suiteb_cryptography/">Suite
 B</a> for information classified up to SECRET.  </p>
@@ -19701,6 +19750,8 @@
 to take place.  It is unwise to choose only "bleeding-edge" curves
 supported by only a small subset of clients. </p>
 
+<p> This feature is not used as of Postfix 3.6. Do not specify. </p>
+
 <p> This default "ultra" curve is rated in NSA <a
 href="https://web.archive.org/web/20160330034144/https://www.nsa.gov/ia/programs/suiteb_cryptography/">Suite
 B</a> for information classified up to TOP SECRET. </p>
@@ -19777,10 +19828,15 @@
 </p>
 
 <p> Conversely, setting "<a href="postconf.5.html#tls_eecdh_auto_curves">tls_eecdh_auto_curves</a>" empty disables TLS 1.3
-EC key agreement in OpenSSL 3.0 and later.  Note that at least one of
-"<a href="postconf.5.html#tls_eecdh_auto_curves">tls_eecdh_auto_curves</a>" and "<a href="postconf.5.html#tls_ffdhe_auto_groups">tls_ffdhe_auto_groups</a>" must be non-empty,
-this is required by OpenSSL 3.0.  If both are inadvertently set empty,
-Postfix will fall back to the compiled-in defaults. </p>
+EC key agreement in OpenSSL 3.0 and later. If both are set empty,
+Postfix will fall back to OpenSSL preferences as described next. </p>
+
+<p> Post-quantum cryptography support: OpenSSL 3.5 introduces new
+configuration syntax that Postfix will not attempt to imitate.
+Instead, with Postfix 3.6.17, 3.7.13, 3.8.8, 3.9.2, and later, set
+both <a href="postconf.5.html#tls_eecdh_auto_curves">tls_eecdh_auto_curves</a> and <a href="postconf.5.html#tls_ffdhe_auto_groups">tls_ffdhe_auto_groups</a> to the empty
+value, to enable algorithm selection through OpenSSL configuration.
+See <a href="postconf.5.html#tls_config_file">tls_config_file</a> for a configuration example. </p>
 
 <p> All the default groups and EC curves should sufficiently strong
 to make "pruning" the defaults unwise.  At a minimum, "X25519" and
@@ -20704,6 +20760,8 @@
 elliptic-curve Diffie-Hellman (EECDH) key exchange. See
 <a href="postconf.5.html#smtpd_tls_eecdh_grade">smtpd_tls_eecdh_grade</a> for further details. </p>
 
+<p> This feature is not used as of Postfix 3.6. Do not specify. </p>
+
 <p> This feature is available in Postfix 2.8 and later. </p>
 
 
diff -ur --new-file /var/tmp/postfix-3.8.7/html/smtp.8.html ./html/smtp.8.html
--- /var/tmp/postfix-3.8.7/html/smtp.8.html	2023-06-04 17:19:50.000000000 -0400
+++ ./html/smtp.8.html	2025-02-16 17:55:36.000000000 -0500
@@ -678,7 +678,7 @@
 
        Available in Postfix version 3.1 and later:
 
-       <b><a href="postconf.5.html#smtp_tls_dane_insecure_mx_policy">smtp_tls_dane_insecure_mx_policy</a> (see 'postconf -d' output)</b>
+       <b><a href="postconf.5.html#smtp_tls_dane_insecure_mx_policy">smtp_tls_dane_insecure_mx_policy</a> (dane)</b>
               The TLS policy for MX hosts with "secure" TLSA records when  the
               nexthop  destination  security  level is <b>dane</b>, but the MX record
               was found via an "insecure" MX lookup.
diff -ur --new-file /var/tmp/postfix-3.8.7/man/man5/postconf.5 ./man/man5/postconf.5
--- /var/tmp/postfix-3.8.7/man/man5/postconf.5	2024-01-21 17:25:57.000000000 -0500
+++ ./man/man5/postconf.5	2025-02-16 15:03:39.000000000 -0500
@@ -8409,7 +8409,7 @@
 TLS connection reuse" for background details.
 .PP
 This feature is available in Postfix 3.4 and later.
-.SH smtp_tls_dane_insecure_mx_policy (default: see "postconf \-d" output)
+.SH smtp_tls_dane_insecure_mx_policy (default: dane)
 The TLS policy for MX hosts with "secure" TLSA records when the
 nexthop destination security level is \fBdane\fR, but the MX
 record was found via an "insecure" MX lookup.  The choices are:
@@ -8430,10 +8430,9 @@
 "Verified", because the MX host name could have been forged.
 .br
 .br
-The default setting for Postfix >= 3.6 is "dane" with
-"smtp_tls_security_level = dane", otherwise "may". This behavior
-was backported to Postfix versions 3.5.9, 3.4.19, 3.3.16. 3.2.21.
-With earlier Postfix versions the default setting was always "dane".
+The default setting is "dane" as of Postfix versions 3.6.17,
+3.7.13, 3.8.8, 3.9.2, and 3.10.0. With earlier versions the default
+was mistakenly dependent on the smtp_tls_security_level setting.
 .PP
 Though with "insecure" MX records an active attacker can
 compromise SMTP transport security by returning forged MX records,
@@ -12867,6 +12866,8 @@
 this parameter is always ignored, and Postfix behaves as though the
 \fBauto\fR value (described below) was chosen.
 .PP
+This feature is not used as of Postfix 3.6. Do not specify.
+.PP
 The available choices are:
 .IP "\fBauto\fR"
 Use the most preferred curve that is
@@ -13812,6 +13813,65 @@
 .ft R
 .in -4
 .PP
+Example: Custom OpenSSL group settings.
+.PP
+.nf
+.na
+.ft C
+main.cf:
+    tls_config_file = ${config_directory}/openssl.cnf
+    tls_config_name = postfix
+.fi
+.ad
+.ft R
+.PP
+.nf
+.na
+.ft C
+openssl.cnf:
+    postfix = postfix_settings
+.fi
+.ad
+.ft R
+.PP
+.nf
+.na
+.ft C
+    [postfix_settings]
+    ssl_conf = postfix_ssl_settings
+.fi
+.ad
+.ft R
+.PP
+.nf
+.na
+.ft C
+    [postfix_ssl_settings]
+    system_default = baseline_postfix_settings
+.fi
+.ad
+.ft R
+.PP
+.nf
+.na
+.ft C
+    [baseline_postfix_settings]
+    # New OpenSSL 3.5 syntax, for older releases consider
+    # the Postfix default:
+    #
+    # Groups = X25519:X448:prime256v1:secp384r1:secp521r1:ffdhe2048:ffdhe3072
+    #
+    Groups = *X25519MLKEM768 / *X25519:X448 / P\-256:P\-384
+.fi
+.ad
+.ft R
+.PP
+Caution: It is typically best to just use the default OpenSSL
+group settings, by setting "tls_config_file = none". Overly strict
+system\-wide TLS settings will conflict with Postfix's opportunistic
+TLS, where being less restrictive is better than downgrading to
+cleartext SMTP.
+.PP
 This feature is available in Postfix >= 3.9, 3.8.1, 3.7.6,
 3.6.10, and 3.5.20.
 .SH tls_config_name (default: empty)
@@ -13973,8 +14033,7 @@
 This feature is available in Postfix 2.8 and later.
 .SH tls_eecdh_auto_curves (default: see "postconf \-d" output)
 The prioritized list of elliptic curves supported by the Postfix
-SMTP client and server.  These curves are used by the Postfix SMTP
-server when "smtpd_tls_eecdh_grade = auto".  The selected curves must be
+SMTP client and server. The selected curves must be
 implemented by OpenSSL and be standardized for use in TLS (RFC 8422).
 It is unwise to list only "bleeding\-edge" curves supported by a small
 subset of clients.  The default list is suitable for most users.
@@ -13992,6 +14051,13 @@
 customizing the list of FFDHE groups enabled with TLS 1.3.  That setting
 is introduced with Postfix 3.8, when built against OpenSSL 3.0 or later.
 .PP
+Post\-quantum cryptography support: OpenSSL 3.5 introduces new
+configuration syntax that Postfix will not attempt to imitate.
+Instead, with Postfix 3.6.17, 3.7.13, 3.8.8, 3.9.2, and later, set
+both tls_eecdh_auto_curves and if available tls_ffdhe_auto_groups
+to the empty value, to enable algorithm selection through OpenSSL
+configuration. See tls_config_file for a configuration example.
+.PP
 This feature is available in Postfix 3.2 and later, when it is
 compiled and linked with OpenSSL 1.0.2 or later on platforms where
 EC algorithms have not been disabled by the vendor.
@@ -14009,6 +14075,8 @@
 is unwise to choose only "bleeding\-edge" curves supported by only a
 small subset of clients.
 .PP
+This feature is not used as of Postfix 3.6. Do not specify.
+.PP
 The default "strong" curve is rated in NSA Suite
 B for information classified up to SECRET.
 .PP
@@ -14044,6 +14112,8 @@
 to take place.  It is unwise to choose only "bleeding\-edge" curves
 supported by only a small subset of clients.
 .PP
+This feature is not used as of Postfix 3.6. Do not specify.
+.PP
 This default "ultra" curve is rated in NSA Suite
 B for information classified up to TOP SECRET.
 .PP
@@ -14098,10 +14168,15 @@
 on whether any of the "kDHE" ciphers are included in the cipherlist.
 .PP
 Conversely, setting "tls_eecdh_auto_curves" empty disables TLS 1.3
-EC key agreement in OpenSSL 3.0 and later.  Note that at least one of
-"tls_eecdh_auto_curves" and "tls_ffdhe_auto_groups" must be non\-empty,
-this is required by OpenSSL 3.0.  If both are inadvertently set empty,
-Postfix will fall back to the compiled\-in defaults.
+EC key agreement in OpenSSL 3.0 and later. If both are set empty,
+Postfix will fall back to OpenSSL preferences as described next.
+.PP
+Post\-quantum cryptography support: OpenSSL 3.5 introduces new
+configuration syntax that Postfix will not attempt to imitate.
+Instead, with Postfix 3.6.17, 3.7.13, 3.8.8, 3.9.2, and later, set
+both tls_eecdh_auto_curves and tls_ffdhe_auto_groups to the empty
+value, to enable algorithm selection through OpenSSL configuration.
+See tls_config_file for a configuration example.
 .PP
 All the default groups and EC curves should sufficiently strong
 to make "pruning" the defaults unwise.  At a minimum, "X25519" and
@@ -14720,6 +14795,8 @@
 elliptic\-curve Diffie\-Hellman (EECDH) key exchange. See
 smtpd_tls_eecdh_grade for further details.
 .PP
+This feature is not used as of Postfix 3.6. Do not specify.
+.PP
 This feature is available in Postfix 2.8 and later.
 .SH tlsproxy_tls_exclude_ciphers (default: $smtpd_tls_exclude_ciphers)
 List of ciphers or cipher types to exclude from the \fBtlsproxy\fR(8)
diff -ur --new-file /var/tmp/postfix-3.8.7/man/man8/smtp.8 ./man/man8/smtp.8
--- /var/tmp/postfix-3.8.7/man/man8/smtp.8	2023-06-04 17:12:22.000000000 -0400
+++ ./man/man8/smtp.8	2025-02-10 19:50:30.000000000 -0500
@@ -610,7 +610,7 @@
 SUBMISSIONS/SMTPS protocol instead of using the STARTTLS command.
 .PP
 Available in Postfix version 3.1 and later:
-.IP "\fBsmtp_tls_dane_insecure_mx_policy (see 'postconf -d' output)\fR"
+.IP "\fBsmtp_tls_dane_insecure_mx_policy (dane)\fR"
 The TLS policy for MX hosts with "secure" TLSA records when the
 nexthop destination security level is \fBdane\fR, but the MX
 record was found via an "insecure" MX lookup.
diff -ur --new-file /var/tmp/postfix-3.8.7/proto/postconf.proto ./proto/postconf.proto
--- /var/tmp/postfix-3.8.7/proto/postconf.proto	2024-01-21 16:20:04.000000000 -0500
+++ ./proto/postconf.proto	2025-02-16 15:03:09.000000000 -0500
@@ -13100,8 +13100,7 @@
 %PARAM tls_eecdh_auto_curves see "postconf -d" output
 
 <p> The prioritized list of elliptic curves supported by the Postfix
-SMTP client and server.  These curves are used by the Postfix SMTP
-server when "smtpd_tls_eecdh_grade = auto".  The selected curves must be
+SMTP client and server. The selected curves must be
 implemented by OpenSSL and be standardized for use in TLS (RFC 8422).
 It is unwise to list only "bleeding-edge" curves supported by a small
 subset of clients.  The default list is suitable for most users. </p>
@@ -13120,6 +13119,14 @@
 is introduced with Postfix 3.8, when built against OpenSSL 3.0 or later.
 </p>
 
+<p> Post-quantum cryptography support: OpenSSL 3.5 introduces new
+configuration syntax that Postfix will not attempt to imitate.
+Instead, with Postfix 3.6.17, 3.7.13, 3.8.8, 3.9.2, and later, set
+both tls_eecdh_auto_curves and if available tls_ffdhe_auto_groups
+to the empty value, to enable algorithm selection through OpenSSL
+configuration. See tls_config_file for a configuration example.
+</p>
+
 <p> This feature is available in Postfix 3.2 and later, when it is
 compiled and linked with OpenSSL 1.0.2 or later on platforms where
 EC algorithms have not been disabled by the vendor. </p>
@@ -13150,10 +13157,15 @@
 </p>
 
 <p> Conversely, setting "tls_eecdh_auto_curves" empty disables TLS 1.3
-EC key agreement in OpenSSL 3.0 and later.  Note that at least one of
-"tls_eecdh_auto_curves" and "tls_ffdhe_auto_groups" must be non-empty,
-this is required by OpenSSL 3.0.  If both are inadvertently set empty,
-Postfix will fall back to the compiled-in defaults. </p>
+EC key agreement in OpenSSL 3.0 and later. If both are set empty,
+Postfix will fall back to OpenSSL preferences as described next. </p>
+
+<p> Post-quantum cryptography support: OpenSSL 3.5 introduces new
+configuration syntax that Postfix will not attempt to imitate.
+Instead, with Postfix 3.6.17, 3.7.13, 3.8.8, 3.9.2, and later, set
+both tls_eecdh_auto_curves and tls_ffdhe_auto_groups to the empty
+value, to enable algorithm selection through OpenSSL configuration.
+See tls_config_file for a configuration example. </p>
 
 <p> All the default groups and EC curves should sufficiently strong
 to make "pruning" the defaults unwise.  At a minimum, "X25519" and
@@ -13178,6 +13190,8 @@
 is unwise to choose only "bleeding-edge" curves supported by only a
 small subset of clients.  </p>
 
+<p> This feature is not used as of Postfix 3.6. Do not specify. </p>
+
 <p> The default "strong" curve is rated in NSA <a
 href="https://web.archive.org/web/20160330034144/https://www.nsa.gov/ia/programs/suiteb_cryptography/">Suite
 B</a> for information classified up to SECRET.  </p>
@@ -13218,6 +13232,8 @@
 to take place.  It is unwise to choose only "bleeding-edge" curves
 supported by only a small subset of clients. </p>
 
+<p> This feature is not used as of Postfix 3.6. Do not specify. </p>
+
 <p> This default "ultra" curve is rated in NSA <a
 href="https://web.archive.org/web/20160330034144/https://www.nsa.gov/ia/programs/suiteb_cryptography/">Suite
 B</a> for information classified up to TOP SECRET. </p>
@@ -13244,6 +13260,8 @@
 <b>auto</b> value (described below) was chosen.
 </p>
 
+<p> This feature is not used as of Postfix 3.6. Do not specify. </p>
+
 <p> The available choices are: </p>
 
 <dl>
@@ -15668,6 +15686,8 @@
 elliptic-curve Diffie-Hellman (EECDH) key exchange. See
 smtpd_tls_eecdh_grade for further details. </p>
 
+<p> This feature is not used as of Postfix 3.6. Do not specify. </p>
+
 <p> This feature is available in Postfix 2.8 and later. </p>
 
 %PARAM tlsproxy_tls_exclude_ciphers $smtpd_tls_exclude_ciphers
@@ -17272,7 +17292,7 @@
 This feature is available in Postfix 3.1 and later.
 </p>
 
-%PARAM smtp_tls_dane_insecure_mx_policy see "postconf -d" output
+%PARAM smtp_tls_dane_insecure_mx_policy dane
 
 <p> The TLS policy for MX hosts with "secure" TLSA records when the
 nexthop destination security level is <b>dane</b>, but the MX
@@ -17296,10 +17316,9 @@
 "Verified", because the MX host name could have been forged.  </dd>
 </dl>
 
-<p> The default setting for Postfix &ge; 3.6 is "dane" with
-"smtp_tls_security_level = dane", otherwise "may". This behavior
-was backported to Postfix versions 3.5.9, 3.4.19, 3.3.16. 3.2.21.
-With earlier Postfix versions the default setting was always "dane".
+<p> The default setting is "dane" as of Postfix versions 3.6.17,
+3.7.13, 3.8.8, 3.9.2, and 3.10.0. With earlier versions the default
+was mistakenly dependent on the smtp_tls_security_level setting.
 </p>
 
 <p> Though with "insecure" MX records an active attacker can
@@ -18716,6 +18735,45 @@
 </pre>
 </blockquote>
 
+<p> Example: Custom OpenSSL group settings. </p>
+
+<pre>
+main.cf:
+    tls_config_file = ${config_directory}/openssl.cnf
+    tls_config_name = postfix
+</pre>
+
+<pre>
+openssl.cnf:
+    postfix = postfix_settings
+</pre>
+
+<pre>
+    [postfix_settings]
+    ssl_conf = postfix_ssl_settings
+</pre>
+
+<pre>
+    [postfix_ssl_settings]
+    system_default = baseline_postfix_settings
+</pre>
+
+<pre>
+    [baseline_postfix_settings]
+    # New OpenSSL 3.5 syntax, for older releases consider
+    # the Postfix default:
+    #
+    # Groups = X25519:X448:prime256v1:secp384r1:secp521r1:ffdhe2048:ffdhe3072
+    #
+    Groups = *X25519MLKEM768 / *X25519:X448 / P-256:P-384
+</pre>
+
+<p> Caution: It is typically best to just use the default OpenSSL
+group settings, by setting "tls_config_file = none". Overly strict
+system-wide TLS settings will conflict with Postfix's opportunistic
+TLS, where being less restrictive is better than downgrading to
+cleartext SMTP. </p>
+
 <p> This feature is available in Postfix &ge; 3.9, 3.8.1, 3.7.6,
 3.6.10, and 3.5.20. </p>
 
diff -ur --new-file /var/tmp/postfix-3.8.7/src/bounce/bounce_notify_util.c ./src/bounce/bounce_notify_util.c
--- /var/tmp/postfix-3.8.7/src/bounce/bounce_notify_util.c	2021-12-19 10:03:55.000000000 -0500
+++ ./src/bounce/bounce_notify_util.c	2025-02-07 17:07:04.000000000 -0500
@@ -356,7 +356,8 @@
 		quote_822_local_flags(bounce_info->sender,
 				      VSTRING_LEN(bounce_info->buf) ?
 				      STR(bounce_info->buf) :
-				      mail_addr_mail_daemon(), 0);
+				      mail_addr_mail_daemon(),
+				      QUOTE_FLAG_8BITCLEAN);
 	    }
 
 	    /*
diff -ur --new-file /var/tmp/postfix-3.8.7/src/cleanup/cleanup_message.c ./src/cleanup/cleanup_message.c
--- /var/tmp/postfix-3.8.7/src/cleanup/cleanup_message.c	2024-12-04 14:40:13.000000000 -0500
+++ ./src/cleanup/cleanup_message.c	2025-02-07 17:07:04.000000000 -0500
@@ -779,7 +779,7 @@
 		}
 		if (token) {
 		    tok822_externalize(state->temp2, token, TOK822_STR_NONE);
-		    tok822_free(token);
+		    tok822_free_tree(token);
 		    vstring_strcat(state->temp2, " ");
 		}
 		vstring_sprintf_append(state->temp2, "<%s>",
diff -ur --new-file /var/tmp/postfix-3.8.7/src/global/dict_mysql.c ./src/global/dict_mysql.c
--- /var/tmp/postfix-3.8.7/src/global/dict_mysql.c	2023-04-18 18:47:13.000000000 -0400
+++ ./src/global/dict_mysql.c	2025-02-07 17:07:04.000000000 -0500
@@ -709,6 +709,9 @@
 	    msg_info("%s: %s: no hostnames specified, defaulting to '%s'",
 		     myname, mysqlcf, dict_mysql->hosts->argv[0]);
     }
+    /* Don't blacklist the load balancer! */
+    if (dict_mysql->hosts->argc == 1)
+        argv_add(dict_mysql->hosts, dict_mysql->hosts->argv[0], (char *) 0);
     myfree(hosts);
 }
 
diff -ur --new-file /var/tmp/postfix-3.8.7/src/global/dict_pgsql.c ./src/global/dict_pgsql.c
--- /var/tmp/postfix-3.8.7/src/global/dict_pgsql.c	2023-04-16 17:17:01.000000000 -0400
+++ ./src/global/dict_pgsql.c	2025-02-07 17:07:04.000000000 -0500
@@ -690,6 +690,9 @@
 	    msg_info("%s: %s: no hostnames specified, defaulting to '%s'",
 		     myname, pgsqlcf, dict_pgsql->hosts->argv[0]);
     }
+    /* Don't blacklist the load balancer! */
+    if (dict_pgsql->hosts->argc == 1)
+	argv_add(dict_pgsql->hosts, dict_pgsql->hosts->argv[0], (char *) 0);
     myfree(hosts);
 }
 
diff -ur --new-file /var/tmp/postfix-3.8.7/src/global/mail_params.h ./src/global/mail_params.h
--- /var/tmp/postfix-3.8.7/src/global/mail_params.h	2024-01-18 18:39:04.000000000 -0500
+++ ./src/global/mail_params.h	2025-02-10 19:41:56.000000000 -0500
@@ -1650,7 +1650,7 @@
 
  /* SMTP only */
 #define VAR_SMTP_TLS_INSECURE_MX_POLICY "smtp_tls_dane_insecure_mx_policy"
-#define DEF_SMTP_TLS_INSECURE_MX_POLICY "${{$smtp_tls_security_level} == {dane} ? {dane} : {may}}"
+#define DEF_SMTP_TLS_INSECURE_MX_POLICY "dane"
 extern char *var_smtp_tls_insecure_mx_policy;
 
  /*
diff -ur --new-file /var/tmp/postfix-3.8.7/src/global/smtputf8.h ./src/global/smtputf8.h
--- /var/tmp/postfix-3.8.7/src/global/smtputf8.h	2017-02-18 20:58:20.000000000 -0500
+++ ./src/global/smtputf8.h	2025-02-10 19:41:56.000000000 -0500
@@ -99,6 +99,11 @@
 #define SMTPUTF8_FLAG_SENDER	(1<<2)	/* queue file/delivery/bounce request */
 #define SMTPUTF8_FLAG_RECIPIENT	(1<<3)	/* delivery request only */
 
+#define SMTPUTF8_FLAG_ALL	(SMTPUTF8_FLAG_REQUESTED \
+				| SMTPUTF8_FLAG_HEADER \
+				| SMTPUTF8_FLAG_SENDER \
+				| SMTPUTF8_FLAG_RECIPIENT)
+
 /* LICENSE
 /* .ad
 /* .fi
diff -ur --new-file /var/tmp/postfix-3.8.7/src/oqmgr/Makefile.in ./src/oqmgr/Makefile.in
--- /var/tmp/postfix-3.8.7/src/oqmgr/Makefile.in	2023-04-12 10:11:07.000000000 -0400
+++ ./src/oqmgr/Makefile.in	2025-02-12 19:47:59.000000000 -0500
@@ -285,6 +285,7 @@
 qmgr_message.o: ../../include/rewrite_clnt.h
 qmgr_message.o: ../../include/scan_dir.h
 qmgr_message.o: ../../include/sent.h
+qmgr_message.o: ../../include/smtputf8.h
 qmgr_message.o: ../../include/split_addr.h
 qmgr_message.o: ../../include/split_at.h
 qmgr_message.o: ../../include/stringops.h
diff -ur --new-file /var/tmp/postfix-3.8.7/src/oqmgr/qmgr_message.c ./src/oqmgr/qmgr_message.c
--- /var/tmp/postfix-3.8.7/src/oqmgr/qmgr_message.c	2022-10-06 18:29:44.000000000 -0400
+++ ./src/oqmgr/qmgr_message.c	2025-02-12 19:46:32.000000000 -0500
@@ -137,6 +137,7 @@
 #include <split_addr.h>
 #include <dsn_mask.h>
 #include <rec_attr_map.h>
+#include <smtputf8.h>
 
 /* Client stubs. */
 
@@ -562,6 +563,8 @@
 			rec_type = REC_TYPE_ERROR;
 			break;
 		    }
+		    /* Forward compatibility. */
+		    message->smtputf8 &= SMTPUTF8_FLAG_ALL;
 		} else if (count == 1) {
 		    /* Postfix < 1.0 (a.k.a. 20010228). */
 		    qmgr_message_oldstyle_scan(message);
diff -ur --new-file /var/tmp/postfix-3.8.7/src/qmgr/Makefile.in ./src/qmgr/Makefile.in
--- /var/tmp/postfix-3.8.7/src/qmgr/Makefile.in	2023-04-12 10:11:07.000000000 -0400
+++ ./src/qmgr/Makefile.in	2025-02-12 19:47:52.000000000 -0500
@@ -301,6 +301,7 @@
 qmgr_message.o: ../../include/sane_time.h
 qmgr_message.o: ../../include/scan_dir.h
 qmgr_message.o: ../../include/sent.h
+qmgr_message.o: ../../include/smtputf8.h
 qmgr_message.o: ../../include/split_addr.h
 qmgr_message.o: ../../include/split_at.h
 qmgr_message.o: ../../include/stringops.h
diff -ur --new-file /var/tmp/postfix-3.8.7/src/qmgr/qmgr_message.c ./src/qmgr/qmgr_message.c
--- /var/tmp/postfix-3.8.7/src/qmgr/qmgr_message.c	2022-10-06 18:28:33.000000000 -0400
+++ ./src/qmgr/qmgr_message.c	2025-02-12 19:46:42.000000000 -0500
@@ -146,6 +146,7 @@
 #include <split_addr.h>
 #include <dsn_mask.h>
 #include <rec_attr_map.h>
+#include <smtputf8.h>
 
 /* Client stubs. */
 
@@ -603,6 +604,8 @@
 			rec_type = REC_TYPE_ERROR;
 			break;
 		    }
+		    /* Forward compatibility. */
+		    message->smtputf8 &= SMTPUTF8_FLAG_ALL;
 		} else if (count == 1) {
 		    /* Postfix < 1.0 (a.k.a. 20010228). */
 		    qmgr_message_oldstyle_scan(message);
diff -ur --new-file /var/tmp/postfix-3.8.7/src/smtp/smtp.c ./src/smtp/smtp.c
--- /var/tmp/postfix-3.8.7/src/smtp/smtp.c	2023-06-04 16:58:32.000000000 -0400
+++ ./src/smtp/smtp.c	2025-02-10 19:41:56.000000000 -0500
@@ -576,7 +576,7 @@
 /*	SUBMISSIONS/SMTPS protocol instead of using the STARTTLS command.
 /* .PP
 /*	Available in Postfix version 3.1 and later:
-/* .IP "\fBsmtp_tls_dane_insecure_mx_policy (see 'postconf -d' output)\fR"
+/* .IP "\fBsmtp_tls_dane_insecure_mx_policy (dane)\fR"
 /*	The TLS policy for MX hosts with "secure" TLSA records when the
 /*	nexthop destination security level is \fBdane\fR, but the MX
 /*	record was found via an "insecure" MX lookup.
diff -ur --new-file /var/tmp/postfix-3.8.7/src/tls/tls_dh.c ./src/tls/tls_dh.c
--- /var/tmp/postfix-3.8.7/src/tls/tls_dh.c	2023-01-08 17:37:29.000000000 -0500
+++ ./src/tls/tls_dh.c	2025-02-11 18:40:07.000000000 -0500
@@ -385,7 +385,6 @@
 
 void    tls_auto_groups(SSL_CTX *ctx, const char *eecdh, const char *ffdhe)
 {
-#ifndef OPENSSL_NO_ECDH
     char   *def_eecdh = DEF_TLS_EECDH_AUTO;
 
 #if OPENSSL_VERSION_PREREQ(3, 0)
@@ -399,6 +398,10 @@
 #endif
     const char *origin;
 
+    /* Use OpenSSL defaults */
+    if (!*eecdh && !*ffdhe)
+        return;
+
     /*
      * Try the user-specified list first. If that fails (empty list or no
      * known group name), try again with the Postfix defaults. We assume that
@@ -424,7 +427,6 @@
 	    return;
 	}
     }
-#endif
 }
 
 #ifdef TEST
diff -ur --new-file /var/tmp/postfix-3.8.7/src/tls/tls_misc.c ./src/tls/tls_misc.c
--- /var/tmp/postfix-3.8.7/src/tls/tls_misc.c	2023-06-04 17:02:41.000000000 -0400
+++ ./src/tls/tls_misc.c	2025-02-11 18:40:24.000000000 -0500
@@ -660,8 +660,8 @@
 	VAR_TLS_EXPORT_CLIST, DEF_TLS_EXPORT_CLIST, &var_tls_export_ignored, 0, 0,
 	VAR_TLS_NULL_CLIST, DEF_TLS_NULL_CLIST, &var_tls_null_clist, 1, 0,
 	VAR_TLS_EECDH_AUTO, DEF_TLS_EECDH_AUTO, &var_tls_eecdh_auto, 0, 0,
-	VAR_TLS_EECDH_STRONG, DEF_TLS_EECDH_STRONG, &var_tls_eecdh_strong, 1, 0,
-	VAR_TLS_EECDH_ULTRA, DEF_TLS_EECDH_ULTRA, &var_tls_eecdh_ultra, 1, 0,
+	VAR_TLS_EECDH_STRONG, DEF_TLS_EECDH_STRONG, &var_tls_eecdh_strong, 0, 0,
+	VAR_TLS_EECDH_ULTRA, DEF_TLS_EECDH_ULTRA, &var_tls_eecdh_ultra, 0, 0,
 	VAR_TLS_FFDHE_AUTO, DEF_TLS_FFDHE_AUTO, &var_tls_ffdhe_auto, 0, 0,
 	VAR_TLS_BUG_TWEAKS, DEF_TLS_BUG_TWEAKS, &var_tls_bug_tweaks, 0, 0,
 	VAR_TLS_SSL_OPTIONS, DEF_TLS_SSL_OPTIONS, &var_tls_ssl_options, 0, 0,
@@ -1044,6 +1044,12 @@
 	    kex_name = OBJ_nid2sn(EVP_PKEY_type(nid));
 	    break;
 
+#if defined(EVP_PKEY_KEYMGMT)
+	case EVP_PKEY_KEYMGMT:
+	    kex_name = EVP_PKEY_get0_type_name(dh_pkey);
+	    break;
+#endif
+
 	case EVP_PKEY_DH:
 	    kex_name = "DHE";
 	    TLScontext->kex_bits = EVP_PKEY_bits(dh_pkey);
@@ -1056,8 +1062,17 @@
 	    break;
 #endif
 	}
-	EVP_PKEY_free(dh_pkey);
     }
+    if (kex_name) {
+	TLScontext->kex_name = mystrdup(kex_name);
+	TLScontext->kex_curve = kex_curve;
+    }
+    /* Not a problem if NULL */
+    EVP_PKEY_free(dh_pkey);
+
+    /* Resumption makes no use of signature keys or digests */
+    if (TLScontext->session_reused)
+	return;
 
     /*
      * On the client end, the certificate may be preset, but not used, so we
@@ -1078,12 +1093,19 @@
 	 * the more familiar name.  For "RSA" keys report "RSA-PSS", which
 	 * must be used with TLS 1.3.
 	 */
-	if ((nid = EVP_PKEY_type(EVP_PKEY_id(local_pkey))) != NID_undef) {
+	if ((nid = EVP_PKEY_id(local_pkey)) != NID_undef) {
 	    switch (nid) {
 	    default:
-		locl_sig_name = OBJ_nid2sn(nid);
+		if ((nid = EVP_PKEY_type(nid)) != NID_undef)
+		    locl_sig_name = OBJ_nid2sn(nid);
 		break;
 
+#if defined(EVP_PKEY_KEYMGMT)
+	    case EVP_PKEY_KEYMGMT:
+		locl_sig_name = EVP_PKEY_get0_type_name(local_pkey);
+		break;
+#endif
+
 	    case EVP_PKEY_RSA:
 		/* For RSA, TLS 1.3 mandates PSS signatures */
 		locl_sig_name = "RSA-PSS";
@@ -1106,6 +1128,13 @@
 	 */
 	if (SSL_get_signature_nid(ssl, &nid) && nid != NID_undef)
 	    locl_sig_dgst = OBJ_nid2sn(nid);
+
+	if (locl_sig_name) {
+	    SIG_PROP(TLScontext, srvr, name) = mystrdup(locl_sig_name);
+	    SIG_PROP(TLScontext, srvr, curve) = locl_sig_curve;
+	    if (locl_sig_dgst)
+		SIG_PROP(TLScontext, srvr, dgst) = mystrdup(locl_sig_dgst);
+	}
     }
     /* Signature algorithms for the peer end of the connection */
     if ((peer_cert = TLS_PEEK_PEER_CERT(ssl)) != 0) {
@@ -1116,11 +1145,18 @@
 	 * the more familiar name.  For "RSA" keys report "RSA-PSS", which
 	 * must be used with TLS 1.3.
 	 */
-	if ((nid = EVP_PKEY_type(EVP_PKEY_id(peer_pkey))) != NID_undef) {
+	if ((nid = EVP_PKEY_id(peer_pkey)) != NID_undef) {
 	    switch (nid) {
 	    default:
-		peer_sig_name = OBJ_nid2sn(nid);
+		if ((nid = EVP_PKEY_type(nid)) != NID_undef)
+		    peer_sig_name = OBJ_nid2sn(nid);
+		break;
+
+#if defined(EVP_PKEY_KEYMGMT)
+	    case EVP_PKEY_KEYMGMT:
+		peer_sig_name = EVP_PKEY_get0_type_name(peer_pkey);
 		break;
+#endif
 
 	    case EVP_PKEY_RSA:
 		/* For RSA, TLS 1.3 mandates PSS signatures */
@@ -1144,24 +1180,14 @@
 	if (SSL_get_peer_signature_nid(ssl, &nid) && nid != NID_undef)
 	    peer_sig_dgst = OBJ_nid2sn(nid);
 
+	if (peer_sig_name) {
+	    SIG_PROP(TLScontext, !srvr, name) = mystrdup(peer_sig_name);
+	    SIG_PROP(TLScontext, !srvr, curve) = peer_sig_curve;
+	    if (peer_sig_dgst)
+		SIG_PROP(TLScontext, !srvr, dgst) = mystrdup(peer_sig_dgst);
+	}
 	TLS_FREE_PEER_CERT(peer_cert);
     }
-    if (kex_name) {
-	TLScontext->kex_name = mystrdup(kex_name);
-	TLScontext->kex_curve = kex_curve;
-    }
-    if (locl_sig_name) {
-	SIG_PROP(TLScontext, srvr, name) = mystrdup(locl_sig_name);
-	SIG_PROP(TLScontext, srvr, curve) = locl_sig_curve;
-	if (locl_sig_dgst)
-	    SIG_PROP(TLScontext, srvr, dgst) = mystrdup(locl_sig_dgst);
-    }
-    if (peer_sig_name) {
-	SIG_PROP(TLScontext, !srvr, name) = mystrdup(peer_sig_name);
-	SIG_PROP(TLScontext, !srvr, curve) = peer_sig_curve;
-	if (peer_sig_dgst)
-	    SIG_PROP(TLScontext, !srvr, dgst) = mystrdup(peer_sig_dgst);
-    }
 }
 
 /* tls_log_summary - TLS loglevel 1 one-liner, embellished with TLS 1.3 details */
diff -ur --new-file /var/tmp/postfix-3.8.7/src/util/peekfd.c ./src/util/peekfd.c
--- /var/tmp/postfix-3.8.7/src/util/peekfd.c	2017-12-27 17:29:45.000000000 -0500
+++ ./src/util/peekfd.c	2025-02-07 17:07:04.000000000 -0500
@@ -39,6 +39,9 @@
 
 #include <sys_defs.h>
 #include <sys/ioctl.h>
+#ifdef SUNOS5
+#include <sys/socket.h>			/* shutdown(2) */
+#endif
 #ifdef FIONREAD_IN_SYS_FILIO_H
 #include <sys/filio.h>
 #endif