Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsStart with one controlled message, capture its Postfix queue ID, and follow that ID through the complete mail log. The decisive clue is usually the remote SMTP reply or the local error immediately before it—not the fact that a message appears to be “stuck.” Classify the failure as local submission, queueing, DNS or route lookup, TCP connection, TLS negotiation, SASL authentication, relay authorization, or recipient rejection before changing configuration.
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
This guide shows a stage-by-stage method for diagnosing deferred mail, bounces, authentication errors, STARTTLS failures, remote-domain delivery problems, and possible VPS provider blocks. Commands and defaults can vary with the installed Postfix release, so record the version before applying parameter advice.
As an Amazon Associate I earn from qualifying purchases.
Build an evidence trail before changing anything
Postfix documents that SMTP problems and transactions are logged through syslogd(8) or postlogd(8). On Linux, the records are commonly in /var/log/mail.log, /var/log/maillog, or the system journal. Use the location provided by your distribution, then preserve the full line containing the queue ID, sender, recipient, timestamp, SMTP status, and enhanced status code.
Record the installed release
Configuration parameters, defaults, and even parameter availability are release-sensitive. Capture the effective version before comparing advice from another system:
#1 Best Overall
- BLUE LIGHT BLOCKING GLASSES: Our blue light glasses for women boast UV400 protection, blocking harmful blue rays from computer screens. With these bluelight glasses women, you can enjoy gaming, reading, or watching TV with no worries of eye strain.
- EYE RELIEF: Our blue light glasses are engineered to reduce blurry vision or strain caused by prolonged screen time. These womens blue light glasses aid in better sleep by preventing blue light from disrupting your natural sleep cycle, helping you fall asleep faster and enjoy a more restful night's sleep, making them the perfect christmas present.
- COMFORTABLE: Crafted from durable material, our trendy blue light glasses for woman or blue light glasses men ensure long-lasting comfort. The high-transmittance lenses accessories, gamer gifts for men, help keep your eyes relaxed. Perfect stocking stuffers, gifts for gamers men, christmas gifts for men, halloween costumes.
- LIGHTWEIGHT: These clear blue light glasses feature a lightweight frame, meaning they’ll stay comfy for long-term wear. Perfect as blue blockers glasses for women or mens blue light glasses, these non-prescription fake glasses for men can be worn throughout the day. The blue light blocking glasses women feature polycarbonate HD lenses, which are anti-reflective and restore true color.
- WORRY-FREE PURCHASE: If you experience any issues, our support team is ready to assist you quickly. These are the perfect costume glasses for cosplay dressing up.
postconf mail_versionIf that parameter is not available in your package, use the package’s own version command and record the distribution release as well. Do not copy a setting from a different Postfix generation without checking the matching postconf(5) and smtp(8) documentation.
Reproduce one message and retain its queue ID
Send a single test message to one controlled recipient. The log entry normally includes an identifier such as 3F2AB12345; use that identifier to isolate all subsequent entries. Searching only by recipient can mix several retries together, especially on an active server.
grep '3F2AB12345' /var/log/mail.logOn a journal-based system, use the equivalent journal query for the Postfix service and the time window of the test. Keep the unabridged remote response. A line ending in an enhanced code such as 4.4.1, 5.1.1, or 5.7.1 is more useful than a summary such as “delivery failed.”
Classify the stage
| Stage | Typical evidence | What it means |
|---|---|---|
| Local submission | The client cannot hand the message to Postfix, or the local send command reports an immediate error. | Inspect the submission service, permissions, message size, sender policy, and local client settings. |
| Queueing | The message receives a queue ID but remains queued, active, deferred, held, or repeatedly retried. | Postfix accepted the message locally; inspect the delivery attempt and retry reason. |
| DNS or route lookup | “Host not found,” missing MX, resolver timeout, or no usable route appears before a connection attempt. | Fix name resolution, address selection, or routing before changing SMTP policy. |
| TCP connection | Connection timeout, refusal, unreachable network, or failure on one address family. | The next hop, destination port, firewall, route, or VPS provider policy is blocking progress. |
| TLS negotiation | STARTTLS is absent, the handshake fails, certificate validation fails, or a required security level is unmet. | Check advertisement, protocol policy, certificate identity, trust chain, and the selected TLS mode. |
| SASL authentication | The server returns an authentication failure after AUTH, or a submission client cannot log in. |
Inspect the correct inbound or outbound SASL configuration, credentials, mechanism, and TLS requirement. |
| Relay authorization | The server accepts a connection but rejects the recipient as an unauthorized relay. | Authentication and authorization are separate checks; verify that the authenticated client is permitted to relay. |
| Recipient acceptance | The remote host returns a 4xx or 5xx reply after MAIL FROM, RCPT TO, or message data. |
Follow the receiving host’s stated policy, recipient, sender-authentication, or reputation reason. |
Inspect the queue and distinguish retry from failure
List the current queue
Use the queue listing to confirm whether the message is waiting, actively being delivered, deferred for retry, or held. A queue ID that is still present means Postfix has retained the message; it does not by itself identify the cause.
postqueue -pRead the status text beside the queue ID and correlate it with the complete log entry. A deferred item generally has a temporary delivery failure and will be retried according to Postfix’s scheduling rules. Repeated retries can make an outage look like a new failure, so focus on the first attempt that produced the error.
Understand queue states
- Queued or deferred: Postfix has not obtained a final delivery result. Preserve the latest 4xx reply or transport error and fix the underlying condition before forcing retries.
- Active: A delivery process is currently working on the message. Check whether the process is waiting on DNS, a TCP connection, TLS, or the remote reply.
- Held: The message will not proceed until it is released. Verify why it was held before releasing a large batch.
- Bounced or permanently failed: A final address, policy, or configuration error was reported. Correct the cause and submit a new controlled message; repeated retries will not turn a permanent 5xx response into success.
- Corrupt: Postfix moves unreadable message files to a corrupt queue for inspection. Preserve those files and investigate storage or filesystem problems instead of repeatedly attempting delivery.
Do not flush the entire queue as a first response. A broad retry can duplicate deliveries, increase remote rate limits, and obscure which change fixed the original message.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallRank #2
- WINDEX GAMING WIPES: effortlessly clean all your gaming gear and gaming electronics in one easy step with our new Windex Gaming Wipes
- AMMONIA FREE: our ammonia-free formula is safe to use on all of your favorite gaming equipment like consoles, headsets, controllers, screens, keyboards, and more
- PRE-MOISTENED WIPES: each wipe instantly removes dust, dirt, and stubborn smudges and fingerprints leaving a streak-free shine
- ANTI-STATIC: great for cleaning and wiping down your gaming gear and electronics leaving behind no visible residue
- COMPACT RESEALABLE PACKAGE: store your pack of Windex Gaming Wipes anywhere in your home for whenever a quick and easy wipedown is needed
Verify the effective configuration, not just the file you edited
Postfix reads multiple configuration files and applies defaults that may not be visible in a manually edited file. Display the non-default effective configuration:
postconf -nReview parameters relevant to the stage you identified: the configured relay or next hop, destination restrictions, TLS security levels, SASL maps and mechanisms, interface or address-family choices, and submission-service settings. Check the release-specific documentation for every parameter because a name, default, or supported value can differ between versions.
Separate inbound submission from outbound delivery
The smtpd side receives mail from local applications or remote clients. The submission service commonly runs with stricter authentication and TLS requirements. The smtp client side delivers to a relay or directly to a destination MX. A successful login to the submission service does not prove that outbound relay authentication is configured, and an outbound relay credential does not authorize arbitrary inbound clients.
Confirm the intended path
Decide whether the server should deliver directly to recipient-domain MX hosts or hand mail to a smarthost. A direct path requires working DNS, outbound TCP access, and acceptance by each recipient domain. A relay path requires the relay hostname, port, authentication method, and any required TLS policy. Troubleshooting the wrong path produces convincing but irrelevant test results.
Check DNS, address selection, and routing from the VPS
Verify MX and address records
Resolve the recipient domain from the VPS itself, not from a workstation on another network. Confirm that the resolver returns the expected MX records and that each MX hostname has usable A or AAAA records. An answer that works intermittently can produce alternating success and deferral.
dig MX example.net
dig A mail.example.net
dig AAAA mail.example.netUse the resolver configured for the VPS and repeat a failed lookup after a short interval. If the resolver times out or returns inconsistent data, fix the resolver path before tuning Postfix. Postfix has resolver controls that affect how DNS results are consumed, and those controls are version-sensitive.
Rank #3
- Ergonomic & Adjustable Design: Fight "text neck" and improve your posture. Designed for comfort, it offers an adjustable height (7.1in-8.5in) (1.4in adjustable range) and angle (5°-85°) Please note: cell phone stand is only 9 inches tall—the length of a standard pencil
- Without blocking subtitles Perfect for office desk Tiktok Face Time Zoom video—this is the ultimate kitchen desk essential for phones! Perfect viewing experience while reducing neck back strain, A must-have for gamers streamers desk, and anyone who values both style and support!
- Sleek & Stable Design fits Otterbox Case: Say goodbye to bent cables, tangles, and tip-overs! LISEN’s stylish adjustable desk phone holder features a built-in charging hole and smart cable management, keeping your phone secure and your workspace clutter-free cool gadgets for men
- ANTI-SLIP DESIGN free hands: The under 10.00 items easy gadgets back and the bottom of this kitchen essentials for women are fully covered by anti-skid silicone, which LISEN stand up desk decor can provide maximum protection device from any scratches and slides
- Your Perfect Viewing Companion:If your product arrives damaged or breaks within 365 days, reach out to LISEN for a quick and hassle-free solution. Struggling with assembly, like tightening the screw? We’ve got your back! Your experience matters to us. (Product including: phone Holder stand*1, screw*1, hexagon screwdriver*1, specification*1)
Account for IPv4 and IPv6 separately
A destination may be reachable over IPv4 but not IPv6, or the reverse. Test both address families when the VPS has both enabled. A failed IPv6 route, firewall rule, or provider policy can appear as a generic delivery timeout while IPv4 would succeed. The official Postfix documentation treats IPv6 as a separate support area; do not assume that a successful IPv4 test validates the IPv6 path.
Consider DNSSEC, DANE, and TLSA records
DANE/TLSA behavior depends on DNSSEC validation. If a policy requires authenticated TLSA data, an unvalidated or broken DNSSEC chain can prevent delivery even when ordinary MX lookups work. Record whether the VPS resolver validates DNSSEC and whether the destination publishes TLSA data before changing DANE-related settings.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Test TCP reachability before debugging SMTP policy
From the VPS, test the actual next hop and port configured for delivery. Direct-to-MX delivery normally targets the destination’s SMTP port; a submission relay may use a different port and authentication policy. A timeout, connection refusal, or unreachable route is a network or provider-policy problem before it is a Postfix restriction problem.
nc -4 -vz mail.example.net 25
nc -6 -vz mail.example.net 25Use the relay hostname and port when a smarthost is configured. Interpret results narrowly:
- Connection succeeds: TCP routing is working; continue with the SMTP banner, STARTTLS, authentication, or remote response.
- Connection is refused: The destination is reachable but is not accepting that port, or a local policy is actively rejecting it.
- Connection times out: Investigate firewalls, security groups, missing routes, address-family selection, and VPS provider restrictions on outbound SMTP.
- Only one address family fails: Correct that family or constrain Postfix deliberately while you repair it; do not mask a broken route indefinitely.
Some VPS providers restrict outbound port 25 to reduce abuse. Evidence of a provider block is a consistent failure from the VPS to multiple unrelated destinations, while other outbound ports work. Ask the provider for its current policy and removal procedure; changing Postfix relay settings cannot override an upstream block.
Diagnose STARTTLS and certificate failures
Confirm that STARTTLS is actually advertised
An SMTP server must advertise the STARTTLS extension before a client can request it. If the extension is absent, check that you connected to the intended service and port, that the server’s TLS configuration loaded successfully, and that a proxy or filtering device did not alter the banner. Do not force a TLS requirement against a service that does not offer the required extension unless you intend delivery to defer.
Check identity, trust, and protocol policy
For a TLS handshake to satisfy a strict policy, the certificate name must match the relay hostname, the chain must be trusted by the VPS, and the negotiated protocol and ciphers must meet the configured security level. An expired certificate, incomplete intermediate chain, wrong hostname, or outdated trust store can all look like a generic handshake failure.
Rank #4
- Easy Installation: Our gaming lights have been designed to enhance your entertainment experience. Simply position the led light bar next to your TV or game console to create a game room environment with ease. They come with USB power and a 60 inch cord for direct mounting and mobility
- Audio Syncing & Extensive Mode: The built-in high-sensitivity music sensor allows you to sync the TV led lights to your favorite music. Lights react and move to the beat of music, film and game audio, creating an incredible immersive sound and light experience – and all without the need for an additional hub. You can choose from 64+ patterns, including strobe, illusion, jump, energy, gradient, running, chasing, fluttering mode etc. Each mode can be applied to different scenes
- 64+ Chasing IC+RGB & W Effect: The independent control design of IC+RGB and white all-in-one multifunctional rgbw led bar lights monitor backlight allows you to easily switch the led lights for desk between IC+RGB and white to enjoy a variety of lighting effects, you can choose white lighting mode with high brightness for better illumination when working, etc. Choose IC+RGB lighting mode when you need to create an entertaining atmosphere for the light show, 16 million colours of Color changing rgb light bar let you dance to the beat and create a dynamic party atmosphere
- Dynamic and Dimmable Lights: 1%-full brightness free brightness adjustment gives you the flexibility to adjust dimmable led light bar for room decorations or a variety of occasions
- USB Powered: USB light bars for room can be powered by powernank, usb charger, TV, Monitor, laptop PC mainframe, making behind TV led lighting bar easy to install in any location.TV led lights are powered by the TV usb interface / PC mainframe, can be turned on/off synchronously with TV / PC
openssl s_client -starttls smtp -connect mail.example.net:25 -servername mail.example.netUse this as an observation tool: note the server banner, whether STARTTLS is accepted, the presented certificate subject and alternative names, the verification result, and the negotiated protocol. A successful handshake test does not prove that Postfix’s own policy permits the same connection, so compare the result with the effective postconf -n settings.
Raise logging briefly and restore it
Postfix provides TLS logging levels ranging from handshake summaries through negotiation details and protocol traces. Increase the client or server TLS log level for one controlled reproduction, collect the queue ID’s entries, and return to the normal level immediately. Continuous protocol tracing can expose credentials or message metadata and can create excessive logs.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Understand opportunistic versus required TLS
With opportunistic TLS, a client may retry without encryption when the remote server does not offer STARTTLS or when a handshake fails, subject to the configured policy. With a strict TLS requirement, Postfix defers delivery when the required protection cannot be established. Neither behavior is automatically a bug: it is the direct consequence of the selected security level. Decide whether the relay requires confidentiality, certificate validation, or authenticated TLS, then configure the least permissive policy that the delivery path supports.
Postfix’s TLS documentation describes the security purpose plainly: an encrypted session protects information transmitted with SMTP mail or SASL authentication. Lowering a requirement may restore delivery, but it also changes the protection applied to credentials and message traffic; treat that as a deliberate security decision, not a permanent diagnostic shortcut.
Debug SASL authentication and relay authorization
Identify which side is authenticating
For inbound clients, inspect the smtpd or submission service. For outbound relay authentication, inspect the smtp client and its password map. A successful inbound login proves only that the server accepted that client under the inbound policy. It says nothing about credentials Postfix uses when it connects to an external relay.
Check the complete authentication chain
- Password map: Confirm that the relay hostname, port, and username are stored under the exact key Postfix looks up.
- Lookup permissions: Ensure the Postfix process can read the map and any generated database file, while keeping the file inaccessible to ordinary users.
- Username format: Some relays require a full address, while others require a short account name. Use the format specified by that relay.
- Mechanism restrictions: Verify that the client and server share an enabled SASL mechanism. A credential can be correct yet unusable when its mechanism is disabled.
- TLS requirement: Many deployments permit authentication only after TLS. Confirm that STARTTLS completes before
AUTHis attempted.
SASL authentication gives a remote client a way to receive relay privileges; it is not the same as allowing every unauthenticated client to relay. Postfix’s SASL guidance emphasizes that SMTP servers must decide whether a client is authorized to send to remote destinations. Keep authentication protected by TLS and verify the authorization rule that follows it.
Interpret common authentication outcomes
An immediate “authentication failed” response points to credentials, map lookup, mechanism, or username format. An “authentication required” or “relay access denied” response after a successful TCP and TLS session points to authorization: the client may not be recognized as authenticated, may be connecting to the wrong service, or may not be permitted to relay to that recipient class. Do not solve an authorization error by broadly permitting unauthenticated relay.
Best Value
- Compatible with Wide Screens - To ensure compatibility with the dual monitor mount, your each monitor must meet three conditions at the same time: First, computer screens size range: 13 to 32 inches. Second, screen weight range: 4.4 to 19.8 lbs. Third, the back of the monitor screen must have VESA mounting holes with a pitch of 75x75mm or 100x100mm.
- Regarding the compatibility with desks - Your desk must meet three conditions at the same time: First, desk material: Only wooden desks are recommended, plastic or glass desks cannot be used. Second, desk thickness range: 0.59" - 3.54". Third, the bottom of the desk should not have any cross beams or panels, as this will interfere with installation. We recommend carefully checking that your desk and monitors meets all above conditions before purchasing.
- Dual C-Clamp Hold - Worried your dual monitors might wobble or slip? Our upgraded base uses a larger platform plus a dual C-clamp structure to lock the dual monitor arm firmly to your desk. Each arm safely keeps your screens steady while you type, click and game—no shaking, no sliding, just a clean and secure setup you can trust every day. It also provides Grommet Mounting installation choice, both options ensure stable and secure fixation for your 0.59" - 3.54" desk.
- Full-Motion Adjustment For Comfortable View - Pull the screen closer when you’re deep in a spreadsheet, push it back to watch videos, or rotate to portrait for coding — moving everything smoothly with just one hand. The monitor stand offers +85°/-50° tilt, ±90° swivel and 360° rotation. Raise your monitor up to 15.75″ to support a healthy sitting posture. Whether you’re working from home, gaming through the night, or switching between video calls and documents, getting the screens to your natural line of sight helps relieve neck, shoulder and back strain so you can stay focused longer with less fatigue.
- Keep Your Desk Organized: By lifting both screens off the desktop, this dual monitor stand opens up valuable space for your keyboard, notebook, docking station or a simple, clutter-free work area. Built-in cable management guides wires along the arms, keeping cords out of sight and out of the way. Enjoy a tidy, modern workstation that looks as good as it feels to use.
Read remote SMTP responses literally
| Response class | Likely meaning | Correct next action |
|---|---|---|
| 2xx | The receiving server accepted the command or message. | Follow the queue ID for final completion; acceptance of one command does not guarantee later delivery. |
| 4xx | Transient failure such as temporary policy, rate limiting, greylisting, or unavailable service. | Preserve the exact text, check retry behavior, and correct local causes such as DNS, TLS, or connection instability before retrying. |
| 5xx | Permanent rejection of the command, recipient, sender, or policy. | Correct the address, authentication, sender policy, or reputation issue and submit a new message. |
| 5.1.1 or similar recipient code | The receiving host reports that the recipient address is invalid or unavailable. | Verify the address with the sender; changing TLS or queue settings will not fix a nonexistent mailbox. |
| 5.7.x or similar policy code | Sender authentication, relay authorization, reputation, or content policy rejection. | Read the entire explanatory text and verify the sending identity and authorization requirements. |
| 4.4.x or connection-related code | Postfix could not complete a network conversation. | Inspect DNS, IPv4/IPv6 routing, TCP reachability, firewall rules, and provider restrictions. |
Do not rewrite a remote response as a generic “Postfix bug.” The receiving host usually states the immediate reason, and its policy may be outside your server’s control. A remote rejection can coexist with a perfectly healthy local queue and TLS configuration.
Use targeted branches for common symptoms
“Mail is stuck in the queue”
- Find the queue ID in
postqueue -p. - Search every log entry for that ID and identify the first delivery error.
- If the message is deferred with a 4xx response, fix the named DNS, connection, TLS, or policy condition and allow one retry.
- If it is held, determine who or what placed it on hold before releasing it.
- If it is corrupt, preserve the corrupt-queue file and investigate filesystem or storage errors.
“The server sends locally but not to a remote domain”
Local delivery proves only that message submission and local transport work. Resolve the remote domain’s MX records from the VPS, test the selected addresses and SMTP port, then inspect the remote reply. If all unrelated domains fail at the connection stage, investigate outbound SMTP filtering by the VPS provider. If one domain fails after connection, follow that domain’s TLS, authentication, or policy response.
“STARTTLS fails”
- Confirm that the test reached the intended hostname and port.
- Check that the banner advertises STARTTLS.
- Inspect certificate name, expiration, chain, and trust result.
- Compare the negotiated protocol with the configured TLS security level.
- Raise TLS logging for one reproduction, then restore normal logging.
- Determine whether the policy is opportunistic or strict and accept the associated retry or defer behavior.
“SMTP authentication fails”
Determine whether the failure is on inbound submission or outbound relay. Verify the relevant password map, map permissions, username format, mechanism restrictions, and TLS prerequisite. Then check whether authentication succeeded but relay authorization failed; these are distinct stages.
Recommended Free Tools
“IPv4 works but delivery still fails”
Check whether Postfix selected IPv6 for the failed attempt. Compare A and AAAA reachability and routing, and inspect the queue log for the address used. Repair the IPv6 path or make an intentional, documented address-family choice while the route is fixed.
Apply changes safely and prove the result
Use a small blast radius for every remediation. Prefer a change that addresses the observed stage, preserves the strongest practical TLS policy, affects only the intended path (inbound submission, outbound relay, or direct MX delivery), and can be reverted quickly.
| Remediation choice | When it fits | Trade-off to document |
|---|---|---|
| Repair DNS or resolver behavior | MX, A, AAAA, DNSSEC, or resolver timeouts occur before connection. | May affect every destination if the system resolver is changed. |
| Fix one address family or route | Only IPv4 or IPv6 fails. | Restricting an address family can hide an infrastructure defect until it is repaired. |
| Correct certificate or trust configuration | STARTTLS handshake or verification fails. | Replacing certificates affects every service using that key and chain. |
| Adjust TLS security level | The remote service cannot meet the current requirement and the business decision permits a different level. | Lowering requirements can expose SMTP or SASL traffic to weaker protection; raising them can defer incompatible deliveries. |
| Repair SASL map or authorization | Authentication or relay permission fails after network and TLS succeed. | Credential and permission changes affect only the selected relay or submission path when scoped correctly. |
| Request provider SMTP unblocking | Outbound connections to multiple destinations are consistently filtered upstream. | Approval, identity checks, or rate limits may apply; Postfix changes cannot remove an upstream block. |
After one change, send one controlled message, capture its new queue ID, and compare the complete log sequence with the original. Confirm that the failure stage changed and that the final status is the intended one. Avoid mass retries until the single-message path is stable.
Quick Recap
Final operating checklist
- Record the Postfix and operating-system package versions.
- Capture one queue ID, sender, recipient, timestamp, and complete remote SMTP response.
- Read the queue state and identify the first failing stage.
- Review
postconf -nand consult documentation matching the installed release. - Resolve MX, A, and AAAA records from the VPS and consider DNSSEC requirements for DANE/TLSA.
- Test the configured next hop over every enabled address family and intended port.
- Verify STARTTLS advertisement, certificate identity, trust chain, and the selected security level.
- Separate inbound SASL submission from outbound relay authentication and relay authorization.
- Classify the remote response as transient, permanent, recipient, authentication, or policy related.
- Change one setting or infrastructure component at a time, re-test once, and restore temporary diagnostic logging.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →
