Prereq: "3.8.8"
diff -ur --new-file /var/tmp/postfix-3.8.8/src/global/mail_version.h ./src/global/mail_version.h
--- /var/tmp/postfix-3.8.8/src/global/mail_version.h	2025-02-16 17:59:17.000000000 -0500
+++ ./src/global/mail_version.h	2025-02-24 10:08:25.000000000 -0500
@@ -20,8 +20,8 @@
   * Patches change both the patchlevel and the release date. Snapshots have no
   * patchlevel; they change the release date only.
   */
-#define MAIL_RELEASE_DATE	"20250216"
-#define MAIL_VERSION_NUMBER	"3.8.8"
+#define MAIL_RELEASE_DATE	"20250224"
+#define MAIL_VERSION_NUMBER	"3.8.9"
 
 #ifdef SNAPSHOT
 #define MAIL_VERSION_DATE	"-" MAIL_RELEASE_DATE
diff -ur --new-file /var/tmp/postfix-3.8.8/HISTORY ./HISTORY
--- /var/tmp/postfix-3.8.8/HISTORY	2025-02-15 16:54:03.000000000 -0500
+++ ./HISTORY	2025-02-24 10:07:19.000000000 -0500
@@ -27444,3 +27444,10 @@
 	configuration; added a post-quantum example to the
 	tls_config_file description. File: proto/postconf.proto.
 	The unused parameters will be deleted in Postfix 3.11.
+
+20250221
+
+	Bugfix (defect introduced: 20250210): a recent 'fix' for the
+	default smtp_tls_dane_insecure_mx_policy setting resulted in
+	unnecessary 'dnssec_probe' warnings, on systems that disable
+	DNSSEC lookups (the default). File: smtp/smtp_addr.c.
diff -ur --new-file /var/tmp/postfix-3.8.8/src/smtp/smtp_addr.c ./src/smtp/smtp_addr.c
--- /var/tmp/postfix-3.8.8/src/smtp/smtp_addr.c	2024-02-28 14:44:02.000000000 -0500
+++ ./src/smtp/smtp_addr.c	2025-02-24 10:07:19.000000000 -0500
@@ -299,7 +299,8 @@
     if (mx_names->dnssec_valid)
 	res_opt = RES_USE_DNSSEC;
 #ifdef USE_TLS
-    else if (smtp_tls_insecure_mx_policy > TLS_LEV_MAY)
+    else if (smtp_tls_insecure_mx_policy > TLS_LEV_MAY
+	     && smtp_dns_support == SMTP_DNS_DNSSEC)
 	res_opt = RES_USE_DNSSEC;
 #endif