diff --git a/usr.sbin/sendmail/cf/cf/knecht.mc b/usr.sbin/sendmail/cf/cf/knecht.mc
index 648b9709ed20..111ac7828846 100644
--- a/usr.sbin/sendmail/cf/cf/knecht.mc
+++ b/usr.sbin/sendmail/cf/cf/knecht.mc
@@ -38,9 +38,10 @@ divert(-1)
 #
 
 divert(0)dnl
-VERSIONID(`@(#)knecht.mc	8.11 (Berkeley) 6/12/97')
+VERSIONID(`@(#)knecht.mc	8.13 (Berkeley) 7/7/97')
 OSTYPE(bsd4.4)dnl
 DOMAIN(generic)dnl
+define(`confFORWARD_PATH', `$z/.forward.$w:$z/.forward+$h:$z/.forward')dnl
 define(`confDEF_USER_ID', `mailnull')dnl
 define(`confHOST_STATUS_DIRECTORY', `.hoststat')dnl
 define(`confTO_ICONNECT', `10s')dnl
@@ -61,23 +62,71 @@ Kdomaincheck hash -o /etc/domaincheck
 
 LOCAL_RULESETS
 
-# reject bogus return addresses
+######################################################################
+###  LookUpDomain -- search for domain in domaincheck database
+###
+###	Parameters:
+###		<$1> -- key (domain name)
+###		<$2> -- default (what to return if not found in db)
+###		<$3> -- passthru (additional data passed through)
+######################################################################
+
+SLookUpDomain
+R<$+> <$+> <$*>		$: < $( domaincheck $1 $: ? $) > <$1> <$2> <$3>
+R<OK> <$+> <$+> <$*>	$@ <OK> < $3 >
+R<?> <$+.$+> <$+> <$*>	$@ $>LookUpDomain <. $2> <$3> <$4>
+R<?> <$+> <$+> <$*>	$@ <$2> <$3>
+R<$+> $*		$#error $: $1
+
+
+######################################################################
+###  LookUpAddress -- search for host address in domaincheck database
+###
+###	Parameters:
+###		<$1> -- key (dot quadded host address)
+###		<$2> -- default (what to return if not found in db)
+###		<$3> -- passthru (additional data passed through)
+######################################################################
+
+SLookUpAddress
+R<$+> <$+> <$*>		$: < $( domaincheck $1 $: ? $) > <$1> <$2> <$3>
+R<OK> <$+> <$+> <$*>	$@ <OK> < $3 >
+R<?> <$+.$-> <$+> <$*>	$@ $>LookUpAddress <$1> <$3> <$4>
+R<?> <$+> <$+> <$*>	$@ <$2> <$3>
+R<$+> $*		$#error $: $1
+
+######################################################################
+###  check_relay
+######################################################################
+
+Scheck_relay
+R$+ $| $+		$: $>LookUpDomain < $1 > <?> < $2 >
+R<?> < $+ >		$: $>LookUpAddress < $1 > <OK> <>
+
+######################################################################
+###  check_mail
+######################################################################
+
 Scheck_mail
 R<>			$@ <OK>
 R$*			$: <?> $>Parse0 $>3 $1		make domain canonical
-R<?> $* < @ $+ . > $*	$: < $( domaincheck $2 $: OK $) > $1 < @ $2 . > $3
-							tag resolved names
-R<?> $* < @ $+ > $*	$: < $( domaincheck $2 $: ? $) > $1 < @ $2 > $3
-							check for overrides
+R<?> $* < @ $+ . > $*	$: <OK> $1 < @ $2 > $3		pick default tag
+R<?> $* < @ $+ > $*	$: <FAIL> $1 < @ $2 > $3	... OK or FAIL
+R<$+> $* < @ $+ > $*	$: $>LookUpDomain <$3> <$1> <>
 R<OK> $*		$@ <OK>
-R<?> $* < @ $+ > $*	$#error $: 451 Sender domain must resolve
-R<?> $*			$: < ? $&{client_name} > $1	no @domain on address...
+R<FAIL> $*		$#error $: 451 Sender domain must resolve
+
+# handle case of no @domain on address
+R<?> $*			$: < ? $&{client_name} > $1
 R<?> $*			$@ <OK>				...local unqualed ok
 R<? $+> $*		$#error $: 551 Domain name required
 							...remote is not
 R<$+> $*		$#error $: $1			error from domaincheck
 
-# disallow relaying
+######################################################################
+###  check_rcpt
+######################################################################
+
 Scheck_rcpt
 # anything terminating locally is ok
 R$*			$: $>Parse0 $>3 $1		strip local crud
diff --git a/usr.sbin/sendmail/mail.local/mail.local.c b/usr.sbin/sendmail/mail.local/mail.local.c
index d854e788ae50..ee2c6422864e 100644
--- a/usr.sbin/sendmail/mail.local/mail.local.c
+++ b/usr.sbin/sendmail/mail.local/mail.local.c
@@ -30,7 +30,7 @@
  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  * SUCH DAMAGE.
  *
- * $Id: mail.local.c,v 1.8 1997/03/31 05:11:16 imp Exp $
+ * $Id: mail.local.c,v 1.9 1997/06/27 15:17:01 peter Exp $
  */
 
 #ifndef lint
@@ -40,7 +40,7 @@ static char copyright[] =
 #endif /* not lint */
 
 #ifndef lint
-static char sccsid[] = "@(#)mail.local.c	8.39 (Berkeley) 5/28/97";
+static char sccsid[] = "@(#)mail.local.c	8.43 (Berkeley) 8/2/97";
 #endif /* not lint */
 
 /*
@@ -145,24 +145,24 @@ static char sccsid[] = "@(#)mail.local.c	8.39 (Berkeley) 5/28/97";
 # endif
 #endif
 
-#ifndef BSD4_4
+#ifdef BSD4_4
+# define HAS_ST_GEN	1
+#else
 # define _BSD_VA_LIST_	va_list
 #endif
 
 #if defined(BSD4_4) || defined(linux)
 # define HASSNPRINTF	1
+#else
+extern char	*strerror __P((int));
+extern int	snprintf __P((char *, size_t, const char *, ...));
+extern FILE	*fdopen __P((int, const char *));
 #endif
 
 #if SOLARIS >= 20600 || (SOLARIS < 10000 && SOLARIS >= 206)
 # define HASSNPRINTF	1		/* has snprintf starting in 2.6 */
 #endif
 
-#if !defined(BSD4_4) && !defined(linux)
-extern char	*strerror __P((int));
-extern int	snprintf __P((char *, size_t, const char *, ...));
-extern FILE	*fdopen __P((int, const char *));
-#endif
-
 /*
  * If you don't have setreuid, and you have saved uids, and you have
  * a seteuid() call that doesn't try to emulate using setuid(), then
@@ -397,7 +397,11 @@ tryagain:
 		mbfd = open(path,
 		    O_APPEND|O_CREAT|O_EXCL|O_WRONLY, S_IRUSR|S_IWUSR);
 		if (lstat(path, &sb) < 0)
-			goto filechanged;
+		{
+			eval = EX_CANTCREAT;
+			warn("%s: lstat: file changed after open", path);
+			goto err1;
+		}
 		else
 			sb.st_uid = pw->pw_uid;
 		if (mbfd == -1) {
@@ -425,12 +429,17 @@ tryagain:
 		warn("%s: %s", path, strerror(errno));
 		goto err0;
 	} else if (fstat(mbfd, &fsb) < 0 ||
-	    fsb.st_nlink != 1 || sb.st_nlink != 1 ||
-	    !S_ISREG(fsb.st_mode) || sb.st_dev != fsb.st_dev ||
-	    sb.st_ino != fsb.st_ino || sb.st_uid != fsb.st_uid) {
-filechanged:
-		eval = EX_CANTCREAT;
-		warn("%s: file changed after open", path);
+	    fsb.st_nlink != 1 ||
+	    sb.st_nlink != 1 ||
+	    !S_ISREG(fsb.st_mode) ||
+	    sb.st_dev != fsb.st_dev ||
+	    sb.st_ino != fsb.st_ino ||
+#if HAS_ST_GEN && 0		/* AFS returns random values for st_gen */
+	    sb.st_gen != fsb.st_gen ||
+#endif
+	    sb.st_uid != fsb.st_uid) {
+		eval = EX_TEMPFAIL;
+		warn("%s: fstat: file changed after open", path);
 		goto err1;
 	}
 
diff --git a/usr.sbin/sendmail/makemap/makemap.c b/usr.sbin/sendmail/makemap/makemap.c
index 7ef4612639db..8e10907a787b 100644
--- a/usr.sbin/sendmail/makemap/makemap.c
+++ b/usr.sbin/sendmail/makemap/makemap.c
@@ -33,7 +33,7 @@
  */
 
 #ifndef lint
-static char sccsid[] = "@(#)makemap.c	8.35 (Berkeley) 6/10/97";
+static char sccsid[] = "@(#)makemap.c	8.37 (Berkeley) 7/10/97";
 #endif /* not lint */
 
 #include <sys/types.h>
@@ -137,7 +137,7 @@ main(argc, argv)
 	RunAsUid = RealUid = getuid();
 	RunAsGid = RealGid = getgid();
 	pw = getpwuid(RealUid);
-	if (pw != NULL) 
+	if (pw != NULL)
 	{
 		if (strlen(pw->pw_name) > MAXNAME - 1)
 			pw->pw_name[MAXNAME] = 0;
@@ -314,7 +314,7 @@ main(argc, argv)
 
 	if (!notrunc)
 		sff |= SFF_CREAT;
-	switch (type) 
+	switch (type)
 	{
 #ifdef NEWDB
 	  case T_BTREE:
@@ -328,7 +328,7 @@ main(argc, argv)
 		strcpy(dbuf, mapname);
 		if (!ignoresafeties &&
 		    (st = safefile(dbuf, RealUid, RealGid, RealUserName,
-				   sff, S_IWUSR, &std)) != 0) 
+				   sff, S_IWUSR, &std)) != 0)
 		{
 			fprintf(stderr,
 				"%s: could not create: %s\n",
@@ -346,9 +346,8 @@ main(argc, argv)
 			exit(EX_USAGE);
 		}
 		sprintf(dbuf, "%s.dir", mapname);
-		if (!ignoresafeties &&
-		    (st = safefile(dbuf, RealUid, RealGid, RealUserName,
-				   sff, S_IWUSR, &std)) != 0) 
+		if ((st = safefile(dbuf, RealUid, RealGid, RealUserName,
+			   sff, S_IWUSR, &std)) != 0 && !ignoresafeties)
 		{
 			fprintf(stderr,
 				"%s: could not create: %s\n",
@@ -356,15 +355,21 @@ main(argc, argv)
 			exit(EX_CANTCREAT);
 		}
 		sprintf(pbuf, "%s.pag", mapname);
-		if (!ignoresafeties &&
-		    (st = safefile(pbuf, RealUid, RealGid, RealUserName,
-				   sff, S_IWUSR, &stp)) != 0) 
+		if ((st = safefile(pbuf, RealUid, RealGid, RealUserName,
+			   sff, S_IWUSR, &stp)) != 0 && !ignoresafeties)
 		{
 			fprintf(stderr,
 				"%s: could not create: %s\n",
 				pbuf, errstring(st));
 			exit(EX_CANTCREAT);
 		}
+		if (std.st_dev == stp.st_dev && std.st_ino == stp.st_ino)
+		{
+			fprintf(stderr,
+				"%s: cannot run with GDBM\n",
+				mapname);
+			exit(EX_CONFIG);
+		}
 		break;
 #endif
 	  default:
@@ -765,7 +770,7 @@ errstring(err)
 #if HASSTRERROR
 	return strerror(err);
 #else
-	if (err < 0 || err > sys_nerr) 
+	if (err < 0 || err > sys_nerr)
 	{
 		sprintf(errstr, "Error %d", err);
 		return errstr;