Not sure whether Postscreen should be affected by this too or not, but you could think about these lines in Postfix's configuration as well:

Good catch. I've overlooked that, because in my setup postscreen_dnsbl_sites is empty due a custom postfix-main.cf.

Just a short question: Why is the variable called ENABLE_DNSBL and the function that is executed disables the variables? Wouldn't it make much more sense to remove the lists from the configuration files and add them if ENABLE_DNSBL=1?

It did it this way, because currently there is no DISABLE_VAR. This was just done, to align with the existing namings.

It did it this way, because currently there is no DISABLE_VAR. This was just done, to align with the existing namings.

I'm very much fine with the naming of the variable, just the implementation is logic-wise implemented in exactly the opposite way compared to how I would have done it :) I'd expect the variable to add the lists, not to disable them :D

The result is the same. Background: I mainly migrated my personal "remove blocklists" stuff from my user-patches. That's why it's not the other way around.

TLS cipherlist test was failing similar to what @casperklein was experiencing in a separate issue I think, might be an issue with upstream testssl image (still failing).

EDIT: Ran the tests locally and inspected the JSON, noticed that the fs field we would normally check has been changed to serverPreferences instead. Found the relevant PR that introduced that change upstream and opened up a PR to adapt our test to that change. Once that's merged the test will pass again.

Documentation preview for this PR is ready! 🎉

Built with commit: 54ce77d