diff --git a/mail/postfix/Makefile b/mail/postfix/Makefile
index e49da6dfefd8..ec7c746c0e0e 100644
--- a/mail/postfix/Makefile
+++ b/mail/postfix/Makefile
@@ -1,11 +1,11 @@
 # Created by: Torsten Blum <torstenb@FreeBSD.org>
 
 PORTNAME=	postfix
-DISTVERSION=	3.5.10
+DISTVERSION=	3.6.0
 PORTREVISION?=	0
 PORTEPOCH=	1
 CATEGORIES=	mail
-MASTER_SITES=	ftp://ftp.porcupine.org/mirrors/postfix-release/ \
+MASTER_SITES=	http://ftp.porcupine.org/mirrors/postfix-release/ \
 		http://de.postfix.org/ftpmirror/ \
 		http://cdn.postfix.johnriley.me/mirrors/postfix-release/ \
 		http://www.artfiles.org/postfix.org/postfix-release/ \
@@ -17,20 +17,20 @@ DIST_SUBDIR=	${PORTNAME}
 MAINTAINER=	ohauer@FreeBSD.org
 COMMENT?=	Secure alternative to widely-used Sendmail
 
-LICENSE=	IPL10 EPL
+LICENSE=	EPL IPL10
 LICENSE_COMB=	multi
 LICENSE_FILE=	${WRKSRC}/LICENSE
 LICENSE_NAME_IPL10=	IBM PUBLIC LICENSE VERSION 1.0
 LICENSE_PERMS_IPL10=	dist-mirror dist-sell pkg-mirror pkg-sell auto-accept
 
-PORTSCOUT=	limit:^3\.5\.
+PORTSCOUT=	limit:^3\.6\.
 
 CONFLICTS_INSTALL?=	courier-0.* opensmtpd-[0-9]* sendmail-8.* sendmail+*-8.* \
-		postfix-current-*
+		postfix35-* postfix-current-*
 
 USERS=		postfix
 GROUPS=		mail maildrop postfix
-USES=		shebangfix cpe
+USES=		shebangfix cpe ssl
 SHEBANG_FILES=	auxiliary/qshape/qshape.pl
 
 USE_RC_SUBR=	postfix
@@ -57,7 +57,6 @@ PGSQL_USES=		pgsql
 SASLKMIT_LIB_DEPENDS=	libkrb5.so:security/krb5
 SASL_LIB_DEPENDS=	libsasl2.so:security/cyrus-sasl2
 SQLITE_USES=		sqlite
-TLS_USES=		ssl
 
 BLACKLISTD_DESC=	Enable blacklistd support (FreeBSD 11.0 and later only)
 CDB_DESC=	CDB maps lookups
@@ -89,12 +88,12 @@ MAKEFILEFLAGS+=	DEBUG=
 
 MAKEFILEFLAGS+=	pie=yes CC="${CC}" OPT="${CFLAGS}"
 
-.if ${PORT_OPTIONS:MINST_BASE}
-.if defined(SASL_SLAVE)
-PKGNAMESUFFIX=	-base-sasl
-.else
-PKGNAMESUFFIX=	-base
+.if ${SSL_DEFAULT} == base
+BROKEN_FreeBSD_11=	error: OpenSSL-1.1.1 is the minimum supported version
 .endif
+
+.if ${PORT_OPTIONS:MINST_BASE}
+PKGNAMESUFFIX=	-base
 PREFIX=		/usr
 ETCDIR=		/etc/postfix
 PLIST_SUB+=	BMAN="share/"
diff --git a/mail/postfix/distinfo b/mail/postfix/distinfo
index 4169fdd0d92e..f92f4acedf9b 100644
--- a/mail/postfix/distinfo
+++ b/mail/postfix/distinfo
@@ -1,3 +1,3 @@
-TIMESTAMP = 1618155540
-SHA256 (postfix/postfix-3.5.10.tar.gz) = 5bb4d7d72d7512b58f3a31426dcbd394fd354e0a43de21da89466b057a0228f8
-SIZE (postfix/postfix-3.5.10.tar.gz) = 4621130
+TIMESTAMP = 1619727180
+SHA256 (postfix/postfix-3.6.0.tar.gz) = 77462894d7671d63cbe5fc2733f941088515a6d67108b9f1808b7dae37e83c2e
+SIZE (postfix/postfix-3.6.0.tar.gz) = 4748506
diff --git a/mail/postfix/files/extra-patch-blacklistd b/mail/postfix/files/extra-patch-blacklistd
index a9448d978c7d..2b2bc712e667 100644
--- a/mail/postfix/files/extra-patch-blacklistd
+++ b/mail/postfix/files/extra-patch-blacklistd
@@ -1,6 +1,6 @@
 # PR 225664: support blacklistd on FreeBSD >= 11.0
 #
---- src/smtpd/Makefile.in.orig	2017-02-05 23:36:32 UTC
+--- src/smtpd/Makefile.in.orig	2021-04-18 20:45:05 UTC
 +++ src/smtpd/Makefile.in
 @@ -2,14 +2,14 @@ SHELL	= /bin/sh
  SRCS	= smtpd.c smtpd_token.c smtpd_check.c smtpd_chat.c smtpd_state.c \
@@ -20,9 +20,9 @@
  TESTSRC	= smtpd_token_test.c
  DEFS	= -I. -I$(INC_DIR) -D$(SYSTYPE)
  CFLAGS	= $(DEBUG) $(OPT) $(DEFS)
---- src/smtpd/smtpd_sasl_glue.c.orig	2017-02-19 01:58:21 UTC
+--- src/smtpd/smtpd_sasl_glue.c.orig	2020-08-30 21:03:46 UTC
 +++ src/smtpd/smtpd_sasl_glue.c
-@@ -147,6 +147,7 @@
+@@ -149,6 +149,7 @@
  #include "smtpd.h"
  #include "smtpd_sasl_glue.h"
  #include "smtpd_chat.h"
@@ -30,7 +30,7 @@
  
  #ifdef USE_SASL_AUTH
  
-@@ -332,6 +333,10 @@ int     smtpd_sasl_authenticate(SMTPD_ST
+@@ -350,6 +351,10 @@ int     smtpd_sasl_authenticate(SMTPD_STATE *state,
  	else
  	    smtpd_chat_reply(state, "535 5.7.8 Error: authentication failed: %s",
  			     STR(state->sasl_reply));
@@ -41,11 +41,11 @@
  	return (-1);
      }
      /* RFC 4954 Section 6. */
---- src/smtpd/pfilter.h.orig	2018-02-04 15:36:49 UTC
+--- src/smtpd/pfilter.h.orig	2021-05-06 19:00:00 UTC
 +++ src/smtpd/pfilter.h
 @@ -0,0 +1 @@
 +void pfilter_notify(int, int);
---- src/smtpd/pfilter.c.orig	2018-02-04 15:36:49 UTC
+--- src/smtpd/pfilter.c.orig	2021-05-06 19:00:00 UTC
 +++ src/smtpd/pfilter.c
 @@ -0,0 +1,19 @@
 +#include "pfilter.h"
diff --git a/mail/postfix/files/patch-makedefs b/mail/postfix/files/patch-makedefs
index f688b8ab7338..bc2fcbf36c3b 100644
--- a/mail/postfix/files/patch-makedefs
+++ b/mail/postfix/files/patch-makedefs
@@ -1,27 +1,9 @@
---- makedefs.orig	2021-01-16 15:10:00 UTC
+--- makedefs.orig	2021-04-24 20:49:37 UTC
 +++ makedefs
-@@ -298,6 +298,42 @@ case "$SYSTEM.$RELEASE" in
+@@ -309,6 +309,24 @@ case "$SYSTEM.$RELEASE" in
  		: ${SHLIB_ENV="LD_LIBRARY_PATH=`pwd`/lib"}
  		: ${PLUGIN_LD="${CC} -shared"}
  		;;
-+  FreeBSD.11*)	SYSTYPE=FREEBSD11
-+		: ${CC=cc}
-+		: ${SHLIB_SUFFIX=.so}
-+		: ${SHLIB_CFLAGS=-fPIC}
-+		: ${SHLIB_LD="${CC} -shared"' -Wl,-soname,${LIB}'}
-+		: ${SHLIB_RPATH='-Wl,-rpath,${SHLIB_DIR}'}
-+		: ${SHLIB_ENV="LD_LIBRARY_PATH=`pwd`/lib"}
-+		: ${PLUGIN_LD="${CC} -shared"}
-+		;;
-+  FreeBSD.12*)	SYSTYPE=FREEBSD12
-+		: ${CC=cc}
-+		: ${SHLIB_SUFFIX=.so}
-+		: ${SHLIB_CFLAGS=-fPIC}
-+		: ${SHLIB_LD="${CC} -shared"' -Wl,-soname,${LIB}'}
-+		: ${SHLIB_RPATH='-Wl,-rpath,${SHLIB_DIR}'}
-+		: ${SHLIB_ENV="LD_LIBRARY_PATH=`pwd`/lib"}
-+		: ${PLUGIN_LD="${CC} -shared"}
-+		;;
 +  FreeBSD.13*)	SYSTYPE=FREEBSD13
 +		: ${CC=cc}
 +		: ${SHLIB_SUFFIX=.so}
diff --git a/mail/postfix/files/patch-src_posttls-finger_posttls-finger.c b/mail/postfix/files/patch-src_posttls-finger_posttls-finger.c
deleted file mode 100644
index fdece6346ca5..000000000000
--- a/mail/postfix/files/patch-src_posttls-finger_posttls-finger.c
+++ /dev/null
@@ -1,22 +0,0 @@
---- src/posttls-finger/posttls-finger.c.orig	2019-02-12 13:17:45 UTC
-+++ src/posttls-finger/posttls-finger.c
-@@ -1673,7 +1673,8 @@ static int finger(STATE *state)
-     return (0);
- }
- 
--#if defined(USE_TLS) && OPENSSL_VERSION_NUMBER < 0x10100000L
-+#if defined(USE_TLS) && \
-+    ( OPENSSL_VERSION_NUMBER < 0x10100000L || defined(LIBRESSL_VERSION_NUMBER) )
- 
- /* ssl_cleanup - free memory allocated in the OpenSSL library */
- 
-@@ -2156,7 +2157,8 @@ int     main(int argc, char *argv[])
-     cleanup(&state);
- 
-     /* OpenSSL 1.1.0 and later (de)initialization is implicit */
--#if defined(USE_TLS) && OPENSSL_VERSION_NUMBER < 0x10100000L
-+#if defined(USE_TLS) && \
-+    ( OPENSSL_VERSION_NUMBER < 0x10100000L || defined(LIBRESSL_VERSION_NUMBER) )
-     ssl_cleanup();
- #endif
- 
diff --git a/mail/postfix/files/patch-src_tls_tls__certkey.c b/mail/postfix/files/patch-src_tls_tls__certkey.c
deleted file mode 100644
index b34b8efd2be6..000000000000
--- a/mail/postfix/files/patch-src_tls_tls__certkey.c
+++ /dev/null
@@ -1,11 +0,0 @@
---- src/tls/tls_certkey.c.orig	2019-03-07 23:57:10 UTC
-+++ src/tls/tls_certkey.c
-@@ -144,7 +144,7 @@ static void init_pem_load_state(pem_load
- 
- /* use_chain - load cert, key and chain into ctx or ssl */
- 
--#if OPENSSL_VERSION_NUMBER >= 0x1010100fUL
-+#if OPENSSL_VERSION_NUMBER >= 0x1010100fUL && !defined(LIBRESSL_VERSION_NUMBER)
- static int use_chain(pem_load_state_t *st)
- {
-     int     ret;
diff --git a/mail/postfix/files/patch-src_tls_tls__server.c b/mail/postfix/files/patch-src_tls_tls__server.c
index 92115aa16679..e2e95a3c7d98 100644
--- a/mail/postfix/files/patch-src_tls_tls__server.c
+++ b/mail/postfix/files/patch-src_tls_tls__server.c
@@ -1,6 +1,6 @@
---- src/tls/tls_server.c.orig	2019-02-18 23:03:54 UTC
+--- src/tls/tls_server.c.orig	2020-07-25 23:49:16 UTC
 +++ src/tls/tls_server.c
-@@ -518,7 +518,9 @@ TLS_APPL_STATE *tls_server_init(const TL
+@@ -502,7 +502,9 @@ TLS_APPL_STATE *tls_server_init(const TLS_SERVER_INIT_
  	 * ticket decryption callback already (since 2.11) asks OpenSSL to
  	 * avoid issuing new tickets when the presented ticket is re-usable.
  	 */
diff --git a/mail/postfix/files/patch-src_util_sys__defs.h b/mail/postfix/files/patch-src_util_sys__defs.h
index a31dfd4c24d5..96beb47184f3 100644
--- a/mail/postfix/files/patch-src_util_sys__defs.h
+++ b/mail/postfix/files/patch-src_util_sys__defs.h
@@ -1,10 +1,10 @@
---- src/util/sys_defs.h.orig	2019-10-13 15:32:18 UTC
+--- src/util/sys_defs.h.orig	2020-05-21 18:34:23 UTC
 +++ src/util/sys_defs.h
 @@ -30,7 +30,8 @@
  #if defined(FREEBSD2) || defined(FREEBSD3) || defined(FREEBSD4) \
      || defined(FREEBSD5) || defined(FREEBSD6) || defined(FREEBSD7) \
      || defined(FREEBSD8) || defined(FREEBSD9) || defined(FREEBSD10) \
--    || defined(FREEBSD11) \
+-    || defined(FREEBSD11) || defined(FREEBSD12) \
 +    || defined(FREEBSD11) || defined(FREEBSD12) || defined(FREEBSD13) \
 +    || defined(FREEBSD14) \
      || defined(BSDI2) || defined(BSDI3) || defined(BSDI4) \
diff --git a/mail/postfix/files/pkg-message.in b/mail/postfix/files/pkg-message.in
index 44a62a9e6f4e..f03a454212ff 100644
--- a/mail/postfix/files/pkg-message.in
+++ b/mail/postfix/files/pkg-message.in
@@ -32,6 +32,22 @@ EOM
 If you are upgrading from prior postfix version, please see the README
 files for recommended changes to your configuration and additional
 http://www.postfix.org/COMPATIBILITY_README.html
+
+Incompatible change with postfix 3.5.x
+==========================================
+Internal protocols have changed. You need to "postfix stop" before
+updating, or before backing out to an earlier release, otherwise
+long-running daemons (pickup, qmgr, verify, tlsproxy, postscreen)
+may fail to communicate with the rest of Postfix (warnings, timeouts).
+
+The purpose of this change is to produce better error messages, for
+example, when someone configures the discard daemon as a bounce
+service in master.cf, or vice versa.
+
+This change will break third-party code that implements a
+Postfix-internal protocol such as qpsmtpd. Programs that depend on
+Postfix internal details are not supported.
+
 EOM
 }
 {