RFC: Sendmail deprecation ?

[Rich Kulawiec]

On Fri, Dec 08, 2017 at 03:44:56PM +0800, Kevin Lo wrote:
> I seriously don't think dma(8) is a full featured mta.  I would recommend 
> OpenSMTPD.  OpenSMTPD makes smtp easier to implement and manage and more
> secure.

There is little evidence supporting these claims.  OpenSMTPD is an
interesting experiment and it shows some promise, but it's far from a
professional MTA suitable for deployment in production environments.
(And any claims about its security compared to other MTAs are wildly
premature.)  It's also missing quite a few features that are must-haves
for anyone who is serious about running an Internet-facing MTA.

Maybe in 3 or 5 or 10 years it will have those features, and maybe it
will have undergone the kind of rigorous real-world vetting (perhaps
"beating" would be more apropos) that postfix and sendmail and others
have, but it's not there yet.  At this time, I can only recommend it
for small (in terms of volume, users, traffic) environments that have
limited defensive requirements and do not require ready integration with
other mail-related software.  (Note: I'm using it in one that meets that
description, as a long-running experiment in its side-by-side performance
compared to that of postfix.)

So should it be offered as an alternative?  Yes.  Should people with very
limited operational requirements consider it?   Yes.  Should people who
are willing to test it/experiment with it do so?  Yes.  But until it's
far more thoroughly vetted, it's not suitable to be the default.

---rsk