diff --git a/mail-mta/postfix/Manifest b/mail-mta/postfix/Manifest
index 1b44f469f664..84bc5c71ebc7 100644
--- a/mail-mta/postfix/Manifest
+++ b/mail-mta/postfix/Manifest
@@ -2,5 +2,7 @@ DIST postfix-3.10.8.tar.gz 5040857 BLAKE2B db3bad6842f2067e62e681bc3a1ed6766f95a
 DIST postfix-3.10.8.tar.gz.asc 220 BLAKE2B ad90ef31f84f9181ce9ed6eae90338d8752a8cb37dcf4b4e52ee1c3b3f3eeb7e96d85c3b77c0842caf87ad1481f9aa6dff67eee9e1272bc63f64de34281e6b24 SHA512 0364028ffdfb17724a1513ee48fe7e286b1ce21314049325a96414136e2c4b19573145f77ca0896313e2eb65bbbc13d2bca74c2f5b498394a108390582f32eb2
 DIST postfix-3.11.1.tar.gz 5280696 BLAKE2B 38f5579b9252c6b91f1ea5af170fef3f1348dccdb41aaf0ab1c33eaaca2789d0b757bb03ef4b0e5ade1f69d7b195cbac4a714a0e5f0d2c8768d62db8adce23fc SHA512 065aee35d462a7121ef870f1af5b3d7efedd08e18f18c5d04d7c731b3b051ab8f70499cbdcea6cb559fbfb2115ff39509fa145abf6e99dade232ac4943d178d1
 DIST postfix-3.11.1.tar.gz.asc 220 BLAKE2B 0fb25ba4c6e0507589ba1c5390ba06bd4396a7519bba78ca9bcb8c52ea1f56fbbc88a8972c93dbd03895561d1fe0db8d218db4ca186305183d944a83232ff9ae SHA512 b19b891e3f60ef88c54ffc80599314b68e0e65211b5dd245d1472acf4015be714ebf698ca74003cab655ea2844df84bf8f10fa586b41da6fc9fdae1a6caf2c49
+DIST postfix-3.11.2.tar.gz 5282053 BLAKE2B 94f19c22b5c5047c6f31fb8c73863598bf3a789f2b8d3019b76bde6bb2bd439aed21c509563d7134946aba4d51b8cdddcabc86fc52007839f4ee6b56d4fa820e SHA512 1929bd640bbc0952dc3057fa46990fce23b968ef69e8c051d7f5661c5a99f36657983aa0c0f621430abfe0cf6c1ad5c88a00372864b1093f25cf8fcb1477f119
+DIST postfix-3.11.2.tar.gz.asc 220 BLAKE2B a2960fcc939dc9462f70307648c7c169a9895c01244aef90ebafdb5ea8867e04cfe4df2b53e798de35862a23063b89473e1ee206bd916f15705149cdec2a6a1e SHA512 ad35331f72be947ebdac6f75e53d6b7e9bb1404ad74c30513d3c79d72f3e065e37f83ffc244a39148c8e0c6cf3bb1feeee178fb1943d0ad1802873256f92c7a1
 DIST postfix-3.12-20260429.tar.gz 5397473 BLAKE2B 57ca90c8c80cef3a0f99c907d61608ccd219174c011411a5d1f5662af503ac0263a4065527348e039bf5eea530dac37229b6b0d9fdb8ca7f9b1cdb79c07d4f7e SHA512 55f3c09a7f9ed0c66b228eedd5a4f159f4e65bbdbd9b6aa7840fe18e031177deff784db4fd2e1d0c6e948130a0ffe249e2fc3aa8aa536a87757150fe631c3b94
 DIST postfix-3.12-20260429.tar.gz.asc 220 BLAKE2B 3461f60a0b87ae839e9bc3e3236a4f3807f9934f04baa35925f13f145da9f516ee627f17431d3d85435836d151fb67d34708313ef2fe8375b8dcc2d54dcdd9e4 SHA512 7053bc73a2d5e8f60176e8d689129cd46da67a995cefcb4a8686d3158026f804f6d66f84714828f2738da5f9f0309eeae0e268b71a082f32997aeeadae20d212
diff --git a/mail-mta/postfix/postfix-3.11.2.ebuild b/mail-mta/postfix/postfix-3.11.2.ebuild
new file mode 100644
index 000000000000..f99930a59667
--- /dev/null
+++ b/mail-mta/postfix/postfix-3.11.2.ebuild
@@ -0,0 +1,347 @@
+# Copyright 1999-2026 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/postfix.asc
+inherit eapi9-ver pam systemd toolchain-funcs verify-sig
+
+if [[ ${PV} == *_rc* ]]; then
+	MY_PV="${PV/_rc/-RC}"
+else
+	MY_PV="${PV/_pre/-}"
+fi
+MY_SRC="${PN}-${MY_PV}"
+MY_URI="http://ftp.porcupine.org/mirrors/postfix-release/official"
+RC_VER="2.7"
+
+DESCRIPTION="A fast and secure drop-in replacement for sendmail"
+HOMEPAGE="https://www.postfix.org/"
+SRC_URI="${MY_URI}/${MY_SRC}.tar.gz"
+SRC_URI+=" verify-sig? ( ${MY_URI}/${MY_SRC}.tar.gz.gpg2 -> ${MY_SRC}.tar.gz.asc )"
+S="${WORKDIR}/${MY_SRC}"
+
+LICENSE="|| ( IBM EPL-2.0 )"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
+
+IUSE="+berkdb cdb dovecot-sasl +eai ldap ldap-bind +lmdb mbox memcached mongodb mysql nis pam postgres sasl selinux sqlite ssl tlsrpt"
+
+DEPEND="
+	acct-group/postfix
+	acct-group/postdrop
+	acct-user/postfix
+	dev-libs/libpcre2:0
+	berkdb? ( >=sys-libs/db-3.2:* )
+	cdb? ( || ( >=dev-db/tinycdb-0.76 >=dev-db/cdb-0.75-r4 ) )
+	eai? ( dev-libs/icu:= )
+	ldap? ( net-nds/openldap:= )
+	ldap-bind? ( net-nds/openldap:=[sasl] )
+	lmdb? ( >=dev-db/lmdb-0.9.11:= )
+	mongodb? ( >=dev-libs/mongo-c-driver-1.23.0 >=dev-libs/libbson-1.23.0 )
+	mysql? ( dev-db/mysql-connector-c:0= )
+	nis? ( net-libs/libnsl:= )
+	pam? ( sys-libs/pam )
+	postgres? ( dev-db/postgresql:* )
+	sasl? (  >=dev-libs/cyrus-sasl-2 )
+	sqlite? ( dev-db/sqlite:3 )
+	ssl? ( >=dev-libs/openssl-1.1.1:0= )
+	tlsrpt? ( net-libs/libtlsrpt )
+	"
+
+RDEPEND="${DEPEND}
+	dev-lang/perl
+	memcached? ( net-misc/memcached )
+	net-mail/mailbase
+	!mail-mta/courier
+	!mail-mta/esmtp
+	!mail-mta/exim
+	!mail-mta/msmtp[mta]
+	!mail-mta/netqmail
+	!mail-mta/nullmailer
+	!mail-mta/sendmail
+	!mail-mta/opensmtpd
+	!mail-mta/ssmtp[mta]
+	selinux? ( sec-policy/selinux-postfix )"
+
+BDEPEND="verify-sig? ( sec-keys/openpgp-keys-postfix )"
+
+REQUIRED_USE="
+	ldap-bind? ( ldap sasl )
+	tlsrpt? ( ssl )
+	"
+
+src_prepare() {
+	default
+	sed -i -e "/^#define ALIAS_DB_MAP/s|:/etc/aliases|:${EPREFIX}/etc/mail/aliases|" \
+		src/util/sys_defs.h || die "sed failed"
+	# change default paths to better comply with portage standard paths
+	sed -i -e "s:/usr/local/:/usr/:g" conf/master.cf || die "sed failed"
+}
+
+src_configure() {
+	# bug #915670
+	unset LD_LIBRARY_PATH
+
+	for name in CDB LDAP LMDB MONGODB MYSQL PCRE PGSQL SDBM SQLITE TLSRPT
+	do
+		local AUXLIBS_${name}=""
+	done
+
+	# Make sure LDFLAGS get passed down to the executables.
+	local mycc="" mylibs="${LDFLAGS} -ldl"
+
+	# Determine local database type defaults
+	local default_database_type="lmdb"
+	local default_cache_db_type="lmdb"
+	if ! use lmdb; then
+		if use berkdb; then
+			default_database_type="hash"
+			default_cache_db_type="btree"
+		elif use cdb; then
+			default_database_type="cdb"
+			ewarn
+			ewarn "cdb USE flag is on but lmdb USE flag is not. Local database files"
+			ewarn "for caches will not work. Consider turning lmdb USE flag on."
+			ewarn
+		fi
+	fi
+
+	# libpcre is EOL. prefer libpcre2
+	mycc=" -DHAS_PCRE=2"
+	AUXLIBS_PCRE="$($(tc-getPKG_CONFIG) --libs libpcre2-8)"
+
+	use pam && mylibs="${mylibs} -lpam"
+
+	if use ssl; then
+		mycc="${mycc} -DUSE_TLS"
+		mylibs="${mylibs} -lssl -lcrypto"
+	fi
+
+	if ! use eai; then
+		mycc="${mycc} -DNO_EAI"
+	fi
+
+	if use ldap; then
+		mycc="${mycc} -DHAS_LDAP"
+		AUXLIBS_LDAP="-lldap -llber"
+	fi
+
+	if use lmdb; then
+		mycc="${mycc} -DHAS_LMDB"
+		AUXLIBS_LMDB="-llmdb -lpthread"
+	fi
+
+	if use mongodb; then
+		mycc="${mycc} -DHAS_MONGODB $($(tc-getPKG_CONFIG) --cflags libmongoc-1.0)"
+		AUXLIBS_MONGODB="-lmongoc-1.0 -lbson-1.0"
+	fi
+
+	if use mysql; then
+		mycc="${mycc} -DHAS_MYSQL $(mysql_config --include)"
+		AUXLIBS_MYSQL="$(mysql_config --libs)"
+	fi
+
+	if use postgres; then
+		mycc="${mycc} -DHAS_PGSQL $($(tc-getPKG_CONFIG) --cflags libpq)"
+		AUXLIBS_PGSQL="$($(tc-getPKG_CONFIG) --libs libpq)"
+	fi
+
+	if use sqlite; then
+		mycc="${mycc} -DHAS_SQLITE"
+		AUXLIBS_SQLITE="-lsqlite3 -lpthread"
+	fi
+
+	if use tlsrpt; then
+		mycc="${mycc} -DUSE_TLSRPT"
+		AUXLIBS_TLSRPT="-ltlsrpt"
+	fi
+
+	if use sasl; then
+		if use dovecot-sasl; then
+			# Set dovecot as default.
+			mycc="${mycc} -DDEF_SASL_SERVER=\\\"dovecot\\\""
+		fi
+		if use ldap-bind; then
+			mycc="${mycc} -DUSE_LDAP_SASL"
+		fi
+		mycc="${mycc} -DUSE_SASL_AUTH -DUSE_CYRUS_SASL -I${ESYSROOT}/usr/include/sasl"
+		mylibs="${mylibs} -lsasl2"
+	elif use dovecot-sasl; then
+		mycc="${mycc} -DUSE_SASL_AUTH -DDEF_SERVER_SASL_TYPE=\\\"dovecot\\\""
+	fi
+
+	if ! use nis; then
+		mycc="${mycc} -DNO_NIS"
+	fi
+
+	if ! use berkdb; then
+		mycc="${mycc} -DNO_DB"
+	fi
+
+	if use cdb; then
+		mycc="${mycc} -DHAS_CDB -I${ESYSROOT}/usr/include/cdb"
+		# Tinycdb is preferred.
+		if has_version dev-db/tinycdb ; then
+			AUXLIBS_CDB="-lcdb"
+		else
+			printf -v AUXLIBS_CDB "${ESYSROOT}/usr/$(get_libdir)/%s " \
+				cdb.a alloc.a buffer.a unix.a byte.a || die
+		fi
+	fi
+
+	sed -i -e "/^RANLIB/s/ranlib/$(tc-getRANLIB)/g" "${S}"/makedefs
+	sed -i -e "/^AR/s/ar/$(tc-getAR)/g" "${S}"/makedefs
+
+	emake makefiles \
+		shared=yes \
+		dynamicmaps=no \
+		pie=yes \
+		default_database_type="${default_database_type}" \
+		default_cache_db_type="${default_cache_db_type}" \
+		shlib_directory="/usr/$(get_libdir)/postfix/MAIL_VERSION" \
+		DEBUG="" \
+		CC="$(tc-getCC)" \
+		OPT="${CFLAGS}" \
+		CCARGS="${mycc}" \
+		AUXLIBS="${mylibs} ${AUXLIBS_TLSRPT}" \
+		AUXLIBS_CDB="${AUXLIBS_CDB}" \
+		AUXLIBS_LDAP="${AUXLIBS_LDAP}" \
+		AUXLIBS_LMDB="${AUXLIBS_LMDB}" \
+		AUXLIBS_MONGODB="${AUXLIBS_MONGODB}" \
+		AUXLIBS_MYSQL="${AUXLIBS_MYSQL}" \
+		AUXLIBS_PCRE="${AUXLIBS_PCRE}" \
+		AUXLIBS_PGSQL="${AUXLIBS_PGSQL}" \
+		AUXLIBS_SDBM="${AUXLIBS_SDBM}" \
+		AUXLIBS_SQLITE="${AUXLIBS_SQLITE}"
+}
+
+src_install() {
+	LD_LIBRARY_PATH="${S}/lib" \
+	/bin/sh postfix-install \
+		-non-interactive \
+		install_root="${D}" \
+		config_directory="/etc/postfix" \
+		manpage_directory="/usr/share/man" \
+		command_directory="/usr/sbin" \
+		mailq_path="/usr/bin/mailq" \
+		newaliases_path="/usr/bin/newaliases" \
+		sendmail_path="/usr/sbin/sendmail" \
+		|| die "postfix-install failed"
+
+	# Fix spool removal on upgrade
+	rm -Rf "${ED}"/var
+	keepdir /var/spool/postfix
+
+	# Install rmail for UUCP, closes bug #19127
+	dobin auxiliary/rmail/rmail
+
+	# Provide another link for legacy FSH
+	dosym ../sbin/sendmail /usr/$(get_libdir)/sendmail
+
+	# Install qshape, posttls-finger, collate and tlstype
+	dobin auxiliary/qshape/qshape.pl
+	doman man/man1/qshape.1
+	dobin bin/posttls-finger
+	doman man/man1/posttls-finger.1
+	dobin auxiliary/collate/collate.pl
+	newdoc auxiliary/collate/README README.collate
+	dobin auxiliary/collate/tlstype.pl
+	dodoc auxiliary/collate/README.tlstype
+
+	# Performance tuning tools and their manuals
+	dosbin bin/smtp-{source,sink} bin/qmqp-{source,sink}
+	doman man/man1/smtp-{source,sink}.1 man/man1/qmqp-{source,sink}.1
+
+	# Set proper permissions on required files/directories
+	keepdir /var/lib/postfix
+	fowners -R postfix:postfix /var/lib/postfix
+	fperms 0750 /var/lib/postfix
+	fowners root:postdrop /usr/sbin/post{drop,queue,log}
+	fperms 02755 /usr/sbin/post{drop,queue,log}
+
+	keepdir /etc/postfix
+	keepdir /etc/postfix/postfix-files.d
+	if use mbox; then
+		mypostconf="mail_spool_directory=/var/mail"
+	else
+		mypostconf="home_mailbox=.maildir/"
+	fi
+	LD_LIBRARY_PATH="${S}/lib" \
+	"${ED}"/usr/sbin/postconf -c "${ED}"/etc/postfix \
+		-e ${mypostconf} || die "postconf failed"
+
+	insinto /etc/postfix
+	newins "${FILESDIR}"/smtp.pass saslpass
+	fperms 600 /etc/postfix/saslpass
+
+	newinitd "${FILESDIR}"/postfix.rc6.${RC_VER} postfix
+	# do not start mysql/postgres unnecessarily - bug #359913
+	use mysql || sed -i -e "s/mysql //" "${ED}/etc/init.d/postfix"
+	use postgres || sed -i -e "s/postgresql //" "${ED}/etc/init.d/postfix"
+
+	dodoc *README COMPATIBILITY HISTORY PORTING RELEASE_NOTES*
+	dodoc -r README_FILES/ examples/
+	# postfix set-permissions expects uncompressed man files
+	docompress -x /usr/share/man
+
+	if use pam; then
+		pamd_mimic_system smtp auth account
+	fi
+
+	if use sasl; then
+		insinto /etc/sasl2
+		newins "${FILESDIR}"/smtp.sasl smtpd.conf
+	fi
+
+	# header files
+	insinto /usr/include/postfix
+	doins include/*.h
+
+	systemd_dounit "${FILESDIR}/${PN}.service"
+}
+
+pkg_postinst() {
+	if ver_replacing -lt 3.11 ; then
+		# This is an upgrade which requires user review
+		ewarn "Default database and cache type changed to lmdb"
+		ewarn "with postfix-3.11. Please read the migration guide:"
+		ewarn "  https://www.postfix.org/NON_BERKELEYDB_README.html"
+	fi
+
+	if ! use berkdb && ! use cdb && ! use lmdb; then
+		ewarn
+		ewarn "No backend for local database files is configured."
+		ewarn "newaliases and postmap commands will not work. This"
+		ewarn "is not a supported configuration and you are strongly"
+		ewarn "recommended to turn one of berkdb, cdb or lmdb USE flags"
+		ewarn "on."
+		ewarn
+	else
+		# warn if no aliases database
+		# do not assume berkdb
+		if [[ ! -e /etc/mail/aliases.db \
+		   && ! -e /etc/mail/aliases.cdb \
+		   && ! -e /etc/mail/aliases.lmdb ]] ; then
+			ewarn "You must edit /etc/mail/aliases to suit your needs"
+			ewarn "and then run /usr/bin/newaliases."
+		fi
+		# run newaliases anyway. otherwise, we might break when switching
+		# default database implementation
+		"${EROOT}"/usr/bin/newaliases
+	fi
+
+	# check and fix file permissions
+	"${EROOT}"/usr/sbin/postfix set-permissions
+
+	# hint for configuring tls
+	if use ssl ; then
+		if "${EROOT}"/usr/sbin/postfix tls all-default-client; then
+			elog "To configure client side TLS settings, please run:"
+			elog "${EROOT}"/usr/sbin/postfix tls enable-client
+		fi
+		if "${EROOT}"/usr/sbin/postfix tls all-default-server; then
+			elog "To configure server side TLS settings, please run:"
+			elog "${EROOT}"/usr/sbin/postfix tls enable-server
+		fi
+	fi
+}