30

Does anyone know how to tell Postfix to encrypt outgoing mail?

I have configured it to use encryption on reception, but I'm unable to do it with the outgoing mail. This is my main.cf file:

smtpd_recipient_restrictions = permit_sasl_authenticated, permit_mynetworks, reject_unauth_destination
smtpd_sasl_auth_enable = yes
smtpd_sasl_path = smtpd
transport_maps = hash:/etc/postfix/transport

# tls config
smtp_use_tls = yes
smtpd_use_tls = yes
smtp_tls_note_starttls_offer = yes
smtpd_tls_key_file = /etc/postfix/ssl/smtpd.pem
smtpd_tls_cert_file = /etc/postfix/ssl/smtpd.pem
smtpd_tls_CAfile = /etc/postfix/ssl/smtpd.pem
smtpd_tls_loglevel = 1
smtpd_tls_received_header = yes
smtpd_tls_session_cache_timeout = 3600s
tls_random_source = dev:/dev/urandom
Improve this question

3 Answers 3

Reset to default
40

smtp_tls_security_level = encrypt or smtp_enforce_tls=yes

For specific destinations you could use smtp_tls_policy_maps

smtp_use_tls = yes and smtp_enforce_tls=yes are deprecated. With Postfix 2.3 and later use smtp_tls_security_level instead.

Remember: Enforcing TLS encryption could cause mail delivery problems for SMTP host, that doesn't have TLS configured. If server is used to deliver mails to only your internal server with configured TLS, it's not a problem in that case. But if server is used to deliver mail to public servers, you cannot assume, that all servers has TLS support. In that case use smtp_tls_security_level = may

Improve this answer
3
  • 2
    I think he only wants to enforce it from the software mailclient to the sending mailserver. Not from mailserver to mailserver (see his comment posted at Mar 7 '10 at 23:26)
    – Cojones
    Sep 6, 2012 at 19:52
  • 2
    I think that whole community is adopting to a couple lazy administrators who don't support TLS. Most of the email servers have TLS configured. If they don't screw them... Just enable TLS and ignore those suckers.
    – 71GA
    Dec 21, 2020 at 20:50
  • Yeah, this does not work. Still unencrypted upon sending.
    – Jeff Davenport
    Jan 19 at 11:43
4

The idea is to force users to configure their email clients with encrypted outgoing smtp server. With the current conf, Thunderbird leave them the option to communicate with the smtp server in plain text...

You cannot disable option in Thunderbird without recompiling source code, but you can configure postfix stmpd daemon (which receives mail from your clients) to enforce encryption. To do that, use smtpd_tls_security_level=encrypt, which is equivalent of obsolete options smtpd_use_tls=yes and smtp_enforce_tls=yes. smtpd_tls_security_level=encrypt and smtp_enforce_tls=yes implies smtpd_tls_auth_only=yes

From postfix documentation about smtpd_tls_security_level=encrypt

Mandatory TLS encryption: announce STARTTLS support to SMTP clients, and require that clients use TLS encryption. According to RFC 2487 this MUST NOT be applied in case of a publicly-referenced SMTP server. Instead, this option should be used only on dedicated servers.

If you use public server, you cannot enforce email encryption on port 25/tcp. Better solution is disable mail delivery on by postfix smtpd daemon port 25/tcp from your clients and enable postfix submission daemon (which is special postfix smtpd daemon used only for receiving mail from your local clients described in RFC 4409 running on port 587/tcp). To do that, set smtpd_tls_security_level=may and remove permit_sasl_authenticated from smtpd_recipient_restrictions. In master.cf uncomment line about submission daemon:

submission inet n       -       n       -       -   submission
  -o smtpd_tls_security_level=encrypt
  -o smtpd_sasl_auth_enable=yes
  -o smtpd_recipient_resrictions=permit_sasl_authenticated,reject
Improve this answer
1

Just curious, how are you telling that it isn't using TLS? The default value for smtp_tls_loglevel (which is different from smtpd_tls_loglevel) is 0, so by default you won't see anything about TLS negotiation for outbound mail in Postfix's logs.

If you set smtp_tls_loglevel = 1 or higher, you should see a line like this in the log when a message is sent:

Mar 7 22:28:10 rack postfix/smtp[27400]: initializing the client-side TLS engine

I admit I'm being lazy, but aside from that (and ms' notes above) the config looks fine to me at a glance.

Improve this answer
4
  • 1
    I've understood, that Simon wants to enforce all mail to be encrypted using TLS. smtp_use_tls = yes allows postfix use of TLS, if remote server supports it (smtp_use_tls = yes is equivalent for smtp_tls_security_level = may). Appropriate message should be placed in maillog, if outgoing mail was encrypted using TLS. You're right that smtp_* options are for different postfix daemon than smtpd_* (smtpd_* is for receiving mails from remote servers, smtp_* is for delivery mails to remote servers).
    – sumar
    Mar 7, 2010 at 22:42
  • Actually I think the question might be a little ambiguous. At least I can't tell whether Simon wants Postfix to require TLS or just use it if the recipient's server supports it.
    – jlupolt
    Mar 7, 2010 at 22:50
  • 1
    Thanks for your words, I probably didn´t explain me well. The idea is to force users to configure their email clients with encrypted outgoing smtp server. With the current conf, Thunderbird leave them the option to communicate with the smtp server in plain text... is it possible to avoid this? Thanks in advance, Simon.
    – Simon
    Mar 7, 2010 at 23:26
  • Easy way to identify whether TLS is active is to look at raw message on receiving side and look for Authentication-Results: domainkeys=neutral (no sig); Which indicates its not using TLS
    – Scott Stensland
    Oct 15, 2016 at 1:07

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .