Active Oldest Votes. Improve this answer. Otherwise recipients might receive duplicate messages: You cannot simply set a new IP:port for a service; this creates a second instance of the service, with the same name potentially confusing , and is more than likely outside the OPs purview. Thanks for the comment, but I am well aware of that.
Multiple instances of services are necessary when hosting multiple domains with different SSL certificates and therefore different IP addresses. I simply gave a real-world example where one would override settings from main.
I'd not consider this "real-world" and fail to see where "SSL certificates" enter into it. I answerd OP's question in my first sentence. And yes, it is a real-world example, taken from one of our Postfix servers hosting 18 domains. Otherwise there is no way to present correct SSL certificates to clients. Those settings are overrides of main. Sign up or log in Sign up using Google. Sign up using Facebook. Sign up using Email and Password. Post as a guest Name.
Information that exceeds the limit is discarded. The limit is enforced by the cleanup 8 server. The format of the Postfix-generated From: header. Postfix generates the format " From: address " when name information is unavailable or the envelope sender address is empty.
This is the same behavior as prior to Postfix 3. In the standard form, the name will be quoted if it contains specials as defined in RFC , or the "!
The maximal amount of memory in bytes for storing a message header. If a header is larger, the excess is discarded. Optional pathname of a mailbox file relative to a local 8 user's home directory. The maximal number of Received: message headers that is allowed in the primary message headers. A message that exceeds the limit is bounced, in order to stop a mailer loop. The location of Postfix HTML files that describe how to build, configure or operate a specific Postfix subsystem or feature.
This behavior is required by the SMTP standard. This violates the SMTP standard and can result in mis-delivery of mail. Examples of relevant parameters:. Time to pause before accepting a new message, when the message arrival rate exceeds the message delivery rate. The network interface addresses that this mail system receives mail on.
Specify "all" to receive mail on all network interfaces default , and "loopback-only" to receive mail on loopback network interfaces only Postfix version 2. The parameter also controls delivery of mail to user [ip. Note 2: address information may be enclosed inside [] , but this form is not required here.
Support for IPv6 is available in Postfix version 2. On a multi-homed firewall with separate Postfix instances listening on the "inside" and "outside" interfaces, this can prevent each instance from being able to reach remote SMTP servers on the "other side" of the firewall. This preserves the Postfix SMTP client's loop detection, by ensuring that each side of the firewall knows that the other IP address is still the same host. The Internet protocols Postfix will attempt to use when making or accepting connections.
Specify one or more of "ipv4" or "ipv6", separated by whitespace or commas. The form "all" is equivalent to "ipv4, ipv6" or "ipv4", depending on whether the operating system implements IPv6.
For backwards compatibility with these releases, the Postfix 2. This compatibility workaround will be phased out as IPv6 deployment becomes more common. The email address form that will be used in non-debug logging info, warning, etc. As of Postfix 3. The external and internal forms are identical for the vast majority of email addresses that contain no spaces or other special characters in the localpart. The logging in external form is consistent with the address form that Postfix 3.
This is therefore the more useful form for non-debug logging. Postfix uses the unquoted form internally, because an attacker can specify an email address in different forms by playing games with quotes and backslashes. An attacker should not be able to use such games to circumvent Postfix access policies.
The initial per-destination concurrency level for parallel delivery to the same destination. Specify zero or more of the following, separated by whitespace or comma. The user is warned.
The time after which a client closes an idle internal communication channel. The purpose is to allow Postfix daemon processes to terminate voluntarily after they become idle. This is used, for example, by the Postfix address resolving and rewriting clients. The time limit for sending or receiving information over an internal communication channel. The purpose is to break out of deadlock situations. If the time limit is exceeded the software aborts with a fatal error.
The time after which a client closes an active internal communication channel. The purpose is to allow Postfix daemon processes to terminate voluntarily after reaching their client limit.
Optional setting that avoids lookups in the services 5 database. This feature was implemented to address inconsistencies in the name of the port "" service. The ABNF is:. The comma is required. Whitespace is optional but it cannot appear inside a service name or port number. Upon input, long lines are chopped up into pieces of at most this length; upon delivery, long lines are reconstructed.
Each time a database becomes full, its size limit is doubled. See there for details. When a remote LMTP server announces no DSN support, assume that the server performs final delivery, and send "delivered" delivery status notifications instead of "relayed". The default setting is backwards compatible to avoid the infinitesimal possibility of breaking existing LMTP-based content filters. When the LMTP client receives a request for the same connection the connection is reused.
This parameter is available in Postfix version 2. The effectiveness of cached connections will be determined by the number of remote LMTP servers in use, and the concurrency limit specified for the Postfix LMTP client. Cached connections are closed under any of the following conditions:. Most of these limitations have been with the Postfix a connection cache that is shared among multiple LMTP client programs.
When no connection can be made within the deadline, the LMTP client tries the next address on the mail exchanger list. When no response is received within the deadline, a warning is logged that the mail may be delivered multiple times. The maximal number of parallel deliveries to the same destination via the lmtp message delivery transport. This limit is enforced by the queue manager. The message delivery transport name is the first field in the entry in the master.
The maximal number of recipients per message for the lmtp message delivery transport. A case insensitive list of LHLO keywords pipelining, starttls, auth, etc. Optional list of relay hosts for LMTP destinations that can't be found or that are unreachable. In main. The fallback relays must be TCP destinations, specified without a leading "inet:" prefix.
Specify a host or host:port. This information can be specified in the main. If a remote host or domain has no username:password entry, then the Postfix LMTP client will not attempt to authenticate to the remote host. Typically this specifies the name of a configuration file or rendezvous point. SASL security options; as of Postfix 2.
The available types are listed with the " postconf -A " command. This allows an lmtp 8 delivery agent, used for content filter message injection, to forward the name, address, protocol and HELO name of the original client to the content filter and downstream queuing LMTP server. Before you change the value to yes, it is best to make sure that your content filter supports this command. Specify a symbolic name see services 5 or a numeric port. Optional shell program for local 8 delivery to non-Postfix command.
Note: when a shell program is specified, it is invoked even when the command contains no shell built-in commands or meta characters. Optional filter for the local 8 delivery agent to change the status code or explanatory text of successful or unsuccessful deliveries. A low limit of 2 is recommended, just in case someone has an expensive shell command in a.
You don't want to run lots of those at the same time. The maximal number of recipients per message delivery via the local mail delivery transport. The purist and default setting: rewrite headers only in mail from Postfix sendmail and in SMTP mail from this machine. Note: this setting will not prevent remote mail header address rewriting when mail from a remote client is forwarded by a neighboring system. A list of lookup tables that are searched by the UNIX login name, and that return a list of allowed envelope sender patterns separated by space or comma.
These sender patterns are enforced by the Postfix postdrop 1 command. The default is backwards-compatible: every user may specify any sender envelope address. Specify domain as a wild-card for domains that do not have a valid recipient list. If this parameter is non-empty the default , then the Postfix SMTP server will reject mail for unknown local users. The default setting assumes that you use the default Postfix local delivery agent for local delivery.
Beware: if the Postfix SMTP server runs chrooted, you need to access the passwd file via the proxymap 8 service, in order to overcome chroot access restrictions.
The alternative, maintaining a copy of the system password file in the chroot jail is not practical. By default, local mail is delivered to the transport called "local", which is just the name of a service that is defined the master. Optional catch-all destination for unknown local 8 recipients. The mail system name that is displayed in Received: headers, in the SMTP greeting banner, and in bounced mail.
Specify the name of an unprivileged user account that does not share a user or group ID with other accounts, and that owns no other files or processes on the system. In particular, don't specify nobody or daemon. When this parameter value is changed you need to re-run " postfix set-permissions " with Postfix version 2. The directory where local 8 UNIX-style mailboxes are kept.
The default setting depends on the system type. Note: maildir delivery is done with the privileges of the recipient. Postfix will not create it. The version of the mail system. Stable releases are named major. Experimental releases also include the release date. The version string can be used in, for example, the SMTP greeting banner.
Optional external command that the local 8 delivery agent should use for mailbox delivery. The command is run with the user ID and the primary group ID privileges of the recipient.
This is not a problem, because 1 mail for root should always be aliased to a real user and 2 don't log in as root, use "su" instead. This is to make it easier to specify shell syntax see example below. If you can, avoid shell meta characters because they will force Postfix to run an expensive shell process. If you're delivering via "procmail" then running a shell won't make a noticeable difference in the total cost.
Optional lookup tables with per-recipient external commands to use for local 8 mailbox delivery. How to lock a UNIX-style local 8 mailbox before attempting delivery. For a list of available file locking methods, use the " postconf -l " command. This setting is ignored with maildir style delivery, because such deliveries are safe without explicit locks. The maximal size of any local 8 individual mailbox or maildir file, or zero no limit. In fact, this limits the size of any file that is written to upon local delivery, including files written by external commands that are executed by the local 8 delivery agent.
Optional message delivery transport that the local 8 delivery agent should use for mailbox delivery to all local recipients, whether or not they are found in the UNIX passwd database. Optional lookup tables with per-recipient message delivery transports to use for local 8 mailbox delivery, whether or not the recipients are found in the UNIX passwd database.
The name of an optional logfile that is written by the Postfix postlogd 8 service. An empty value selects logging to syslogd 8.
Stdout logging requires that Postfix is started with "postfix start-fg". Note 2: Some Postfix non-daemon programs may still log information to syslogd 8 , before they have processed their configuration parameters and command-line options. The command is run with the rotated logfile name as its first argument.
This is a safety feature to contain the damage from a single configuration mistake. Specify one or more prefix strings, separated by comma or whitespace. See strftime 3 for syntax. Sendmail compatibility feature that specifies where the Postfix mailq 1 command is installed. This command can be used to list the Postfix mail queue. By default, address masquerading is limited to envelope sender addresses, and to header sender and header recipient addresses.
This allows you to use address masquerading on a mail gateway while still being able to forward mail to users on individual machines. Selectively disable master 8 listener ports by service type or by service name and type. As with other Postfix matchlists, a search stops at the first match.
By default, all master 8 listener ports are enabled. This is intentional. The maximum amount of time that an idle Postfix daemon process waits for an incoming connection before terminating voluntarily. This parameter is ignored by the Postfix queue manager and by other long-lived Postfix daemon processes. The maximal number of incoming connections that a Postfix daemon process will service before terminating voluntarily.
Specify a list of header names, separated by comma or space. Names are matched in a case-insensitive manner. The list of supported header names is limited only by available memory.
The set of characters that Postfix will reject in message content. Note 1: this feature does not recognize text that requires MIME decoding. Note: be careful when making changes. Excessively small values will result in the loss of non-delivery notifications, when a bounce message size exceeds the local or remote MTA's message size limit.
The set of characters that Postfix will remove from message content. The location of non-executable files that are shared among multiple Postfix instances, such as postfix-files, dynamicmaps. This directory should contain only Postfix-related files. For backwards compatibility with Postfix versions 2.
The time limit for sending an SMTP command to a Milter mail filter application, and for receiving the response. Specify a non-zero time value an integral value plus an optional one-letter suffix that specifies the time unit.
The time limit for connecting to a Milter mail filter application, and for negotiating protocol options. The time limit for sending message content to a Milter mail filter application, and for receiving the response.
The default action when a Milter mail filter response is unavailable for example, bad Postfix configuration or Milter failure. Specify one of the following:. The macros that are sent to Milter mail filter applications after the message end-of-data. The macros that are sent to Milter mail filter applications after the end of the message header. Optional lookup tables for content inspection of message headers that are produced by Milter applications.
The following example sends all mail that is marked as SPAM to a spam handling machine. Note that matches are case-insensitive by default.
For example it could be used to skip heavy content inspection for DKIM-signed mail from known friendly domains. These defaults are used when there is no corresponding information from the message delivery context. The mail filter protocol version and optional protocol extensions for communication with a Milter application; prior to Postfix 2. Postfix sends this version number during the initial protocol handshake. It should match the version number that is expected by the mail filter application or by its Milter library.
The macros that are sent to version 3 or higher Milter mail filter applications after an unknown SMTP command. The maximal length of MIME multipart boundary strings. The maximal recursion level that the MIME processor will handle. Postfix refuses mail that is nested deeper than the specified limit. The minimal time between attempts to deliver a deferred message; prior to Postfix 2. This parameter also limits the time an unreachable destination is kept in the short-term, in-memory, destination status cache.
An optional list of non-default Postfix configuration directories; these directories belong to additional Postfix instances that share the Postfix executable files and documentation with the default Postfix instance, and that are started, stopped, etc. Specify a list of pathnames separated by comma or whitespace. Currently, this parameter setting is ignored except for the default main. Allow this Postfix instance to be started, stopped, etc. By default, new instances are created in a safe state that prevents them from being started inadvertently.
This parameter is reserved for the multi-instance manager. The optional instance group name of this Postfix instance. A group identifies closely-related Postfix instances that the multi-instance manager can start, stop, etc. The optional instance name of this Postfix instance. The pathname may be followed by initial command arguments separated by whitespace; shell metacharacters such as quotes are not supported in this context. The postfix 1 command invokes the manager command with the postfix 1 non-option command arguments on the manager command line, and with all installation configuration parameters exported into the manager command process environment.
The default mydestination value specifies names for the local machine only. Do not specify the names of virtual domains - those domains are specified elsewhere. Do not specify the names of domains that this machine is backup MX host for. The internet domain name of this mail system.
The internet hostname of this mail system. You can specify the list of "trusted" network addresses by hand or you can let Postfix do it for you which is the default. The netmask specifies the number of bits in the network part of a host address. The method to generate the default value for the mynetworks parameter. This is the list of trusted networks for relay access control etc. On Linux, this works correctly only with interfaces specified with the "ifconfig" command.
Caution: this may cause Postfix to "trust" your entire provider's network. Instead, specify an explicit mynetworks list by hand, as described with the mynetworks configuration parameter. The domain name that locally-posted mail appears to come from, and that locally posted mail is delivered to. Sendmail compatibility feature that specifies the location of the newaliases 1 command. This command can be used to rebuild the local 8 aliases 5 database.
A list of Milter mail filter applications for new mail that does not arrive via the Postfix smtpd 8 server. This includes local submission via the sendmail 1 command line, new mail that arrives via the Postfix qmqpd 8 server, and old mail that is re-injected into the queue with "postsuper -r".
Specify space or comma as separator. The list of error classes that are reported to the postmaster. These postmaster notifications do not replace user notifications. The default is to report only the most serious problems.
The paranoid may wish to turn on the policy UCE and mail relaying and protocol error broken mail software reports. It is the system administrator's responsibility to treat such information with care. The location of the OpenSSL command line program openssl 1. This is used by the " postfix tls " command to create private keys, certificate signing requests, self-signed certificates, and to compute public key digests for DANE TLSA records.
In multi-instance environments, this parameter is always determined from the configuration of the default Postfix instance. This feature is useful for mailing lists. A list of Postfix features where the pattern "example. This is planned backwards compatibility: eventually, all Postfix features are expected to require explicit ".
The parameter value syntax is the same as with the mynetworks parameter; note, however, that the default value is empty. The name of the pickup 8 service. This service picks up local mail submissions from the Postfix maildrop queue. Optional filter for the pipe 8 delivery agent to change the delivery status code or explanatory text of successful or unsuccessful deliveries.
The name of the postlogd 8 service entry in master. How much time a postlogd 8 process may take to process a request before it is terminated by a built-in watchdog timer. This is a safety mechanism that prevents postlogd 8 from becoming non-responsive due to a bug in Postfix itself or in system software. This limit cannot be set under 10s. The postfix 1 commands that the postmulti 1 instance manager treats as "control" commands, that operate on running instances.
For these commands, disabled instances are skipped. The postfix 1 commands that the postmulti 1 instance manager treats as "start" commands. For these commands, disabled instances are "checked" rather than "started", and failure to "start" a member instance of an instance group will abort the start-up of later instances.
The postfix 1 commands that the postmulti 1 instance manager treats as "stop" commands. For these commands, disabled instances are skipped, and enabled instances are processed in reverse order. Specify a comma- or whitespace-separated list of commands in upper or lower case or lookup tables. The search stops upon the first command that fires for the client IP address. A list of local postscreen 8 server IP addresses where a non-allowlisted remote SMTP client can obtain postscreen 8 's temporary allowlist status.
By default, a client can obtain postscreen 8 's allowlist status on any local postscreen 8 server IP address. Thus, clients that connect only to backup MX addresses will never become allowlisted, and will never be allowed to talk to a Postfix SMTP server process.
The action that postscreen 8 takes when a remote SMTP client sends a bare newline character, that is, a newline not preceded by carriage return. Enable "bare newline" SMTP protocol tests in the postscreen 8 server. The amount of time that postscreen 8 will use the result from a successful "bare newline" SMTP protocol test. During this time, the client IP address is excluded from this test. The amount of time between postscreen 8 cache cleanup runs.
Cache cleanup increases the load on the cache database and should therefore not be run frequently. This feature requires that the cache database supports the "delete" and "sequence" operators. Specify a zero interval to disable cache cleanup. After each cache cleanup run, the postscreen 8 daemon logs the number of entries that were retained and dropped. This requires Postfix version 2. The amount of time that postscreen 8 will cache an expired temporary allowlist entry before it is removed.
This prevents clients from being logged as "NEW" just because their cache entry expired an hour ago. It also prevents the cache from filling up with clients that passed some deep protocol test once and never came back. How many simultaneous connections any remote SMTP client is allowed to have with the postscreen 8 daemon. This SMTP engine defers or rejects all attempts to deliver mail, therefore there is no need to enforce separate limits on the number of junk commands and error commands.
A mechanism to transform commands from remote SMTP clients. The time limit to read an entire command line with postscreen 8 's built-in SMTP protocol engine. The table is not searched by hostname for robustness reasons.
A case insensitive list of EHLO keywords pipelining, starttls, auth, etc. Specify a negative value to enable this feature. The maximum amount of time that postscreen 8 will use the result from a successful DNS-based reputation test before a client IP address is required to pass that test again. The default setting is backwards-compatible with older Postfix versions. The minimum amount of time that postscreen 8 will use the result from a successful DNS-based reputation test before a client IP address is required to pass that test again.
For maximal stability it is best to use a file that is read into memory such as pcre :, regexp : or texthash : texthash : is similar to hash :, except a there is no need to run postmap 1 before the file can be used, and b texthash : does not detect changes after the file is read. The filter has the form d. Specify a negative number for allowlisting. To use example. This is separate from the timeouts in the dnsblog 8 daemon which are defined by system resolver 3 routines.
The amount of time that postscreen 8 will use the result from a successful DNS-based reputation test before a client IP address is required to pass that test again.
List of commands that the postscreen 8 server considers in violation of the SMTP protocol. The text in the optional " text Specify an empty value to disable this feature. The default is relatively short, because a good client can immediately talk to a real Postfix SMTP server.
The amount of time that postscreen 8 will wait for an SMTP client to send a command before its turn, and for DNS blocklist lookup results to arrive default: up to 2 seconds under stress, up to 6 seconds otherwise. Enable "non-SMTP command" tests in the postscreen 8 server.
These tests are expensive: a client must disconnect after it passes the test, before it can talk to a real Postfix SMTP server.
The default is long because a client must disconnect after it passes the test, before it can talk to a real Postfix SMTP server. The action that postscreen 8 takes when a remote SMTP client sends multiple commands instead of sending one command and waiting for the server to respond.
Enable "pipelining" SMTP protocol tests in the postscreen 8 server. These tests are expensive: a good client must disconnect after it passes the test, before it can talk to a real Postfix SMTP server. The amount of time that postscreen 8 will use the result from a successful "pipelining" SMTP protocol test.
The default is long because a good client must disconnect after it passes the test, before it can talk to a real Postfix SMTP server. When this queue is full, all clients will receive a response. The number of non-allowlisted clients that can be waiting for a decision whether they will receive service from a real Postfix SMTP server process.
When this queue is full, all non-allowlisted clients will receive a response. Optional information that is appended after a 4XX or 5XX postscreen 8 server response. Optional lookup table for information that is appended after a 4XX or 5XX postscreen 8 server response. The name of the proxy protocol used by an optional before-postscreen proxy agent. When a proxy agent is used, this protocol conveys local and remote address and port information. How much time a postscreen 8 process may take to respond to a remote SMTP client command or to perform a cache operation before it is terminated by a built-in watchdog timer.
This is a safety mechanism that prevents postscreen 8 from becoming non-responsive due to a bug in Postfix itself or in system software. To avoid false alarms and unnecessary cache corruption this limit cannot be set under 10s.
The message delivery contexts where the Postfix local 8 delivery agent prepends a Delivered-To: message header with the address that the mail was delivered to. This information is used for mail delivery loop detection. By default, the Postfix local delivery agent prepends a Delivered-To: header when forwarding mail and when delivering to file mailbox and command. Turning off the Delivered-To: header when forwarding mail is not recommended. This is a read-only parameter.
For example, with a virtual 5 mapping of " joe example. Specify zero or more of canonical , virtual , alias , forward , include or generic. These cause address extension propagation with canonical 5 , virtual 5 , and aliases 5 maps, with local 8. Note: enabling this feature for types other than canonical and virtual is likely to cause problems when mail is forwarded to other sites, especially with mail that is sent to a mailing list exploder address. The network interface addresses that this mail system receives mail on by way of a proxy or network address translation unit.
The lookup tables that the proxymap 8 server is allowed to access for the read-only service. Table references that don't begin with proxy : are ignored. The lookup tables that the proxymap 8 server is allowed to access for the read-write service. The name of the proxymap read-only table lookup service. This service is normally implemented by the proxymap 8 daemon. The name of the proxywrite read-write table lookup service. The minimal delay between warnings that a specific destination is clogging up the Postfix active queue.
Specify 0 to disable. How much time a Postfix queue manager process may take to handle a request before it is terminated by a built-in watchdog timer. Obsolete feature: the percentage of delivery resources that a busy mail system will use up for delivery of a large mailing list message. This feature exists only in the oqmgr 8 old queue manager. The current queue manager solves the problem in a better way. The time limit for the queue manager to send or receive information over an internal communication channel.
If the time limit is exceeded the software either retries or aborts the operation. The maximal number of messages in the active queue. The maximal number of recipients held in memory by the Postfix queue manager, and the maximal size of the short-term, in-memory "dead" destination status cache.
The minimal number of in-memory recipients for any message. This takes priority over any other in-memory recipient limits i. The minimum value allowed for this parameter is 1. By default, no client is allowed to use the service. This is because the QMQP server will relay mail to any destination. Specify a list of client patterns. When a pattern specifies a file name, its contents are substituted for the file name; when a pattern is a " type:table " table specification, table lookup is used instead.
In order to reverse the result, precede a pattern with an exclamation point! The logging format is "host[address]:port". The purpose is to slow down confused or malicious clients. The time limit for sending or receiving information over the network. The location of the Postfix top-level queue directory. This is the root directory of Postfix daemon processes that run chrooted.
The minimal amount of free space in bytes in the queue file system that is needed to receive mail. With Postfix versions 2. The time between deferred queue scans by the queue manager; prior to Postfix 2.
The name of the qmgr 8 service. This service manages the Postfix queue and schedules delivery requests. Optional lookup tables with RBL response templates. The tables are indexed by the RBL domain name.
Some mail servers are connected to the Internet via a network address translator NAT or proxy. This means that systems on the Internet connect to the address of the NAT or proxy, instead of connecting to the network address of the mail server. The NAT or proxy forwards the connection to the network address of the mail server, but Postfix does not know this. You may specify symbolic hostnames instead of network addresses. The syslogd process sorts events by class and severity, and appends them to logfiles.
At the very least you need something like:. You must create files before re starting syslogd. Hopefully, the number of problems will be small, but it is a good idea to run every night before the syslog files are rotated:. The second line looks for problem reports from the mail software, and reports how effective the relay and junk mail access blocks are. This may produce a lot of output.
You will want to apply some postprocessing to eliminate uninteresting information. Postfix daemon processes can be configured via the master. This provides a significant barrier against intrusion. The barrier is not impenetrable chroot limits file system access only , but every little bit helps.
Sites with high security requirements should consider to chroot all daemons that talk to the network: the smtp 8 and smtpd 8 processes, and perhaps also the lmtp 8 client. The author's own porcupine. When you're finished, execute "postfix reload" to make the change effective.
For successful use of a chroot jail, most UNIX systems require you to bring in some files or device nodes. Additionally, you almost certainly need to configure syslogd so that it listens on a socket inside the Postfix queue directory. Examples of syslogd command line options that achieve this for specific systems:. The myhostname parameter specifies the fully-qualified domain name of the machine running the Postfix system. By default, myhostname is set to the local machine name.
If your local machine name is not in fully-qualified domain name form, or if you run Postfix on a virtual interface, you will have to specify the fully-qualified domain name that the mail system should use.
Alternatively, if you specify mydomain in main. Conversely, if you specify mydomain in main. The default is to listen on all active interfaces.
0コメント