Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

First off, I'm a programmer without much experience in programming with network protocols.

That being said, I'm attempting to connect to a Postfix SMTP server using a secure connection. The instructions I received from the sys admin who set up the SMTP server were to do the following:

  1. Establish the connection.
  2. Issue an EHLO.
  3. Issue a STARTTLS.
  4. Enable TLS on the existing connection.

Is this a normal server setup? I would have thought that Postfix would be listening on a secure port that you can connect to directly rather than doing this whole starting plain text, switching to TLS deal.

share|improve this question
I'm not sure why you even care? There are many libraries for any programming language that already implements SMTP over TLS or/and SSL. – mailq Sep 2 '11 at 21:08
Because the rather robust library that was already integrated supported SMTP over TLS, but was erroring out with an OpenSSL error. The issue appears to have been that it was trying to make the initial connection via TLS, without having first executed a starttls command. The library does not support starttls, and I had to create this functionality myself. – Brad Koch Sep 2 '11 at 21:15
Then again, "robust" must not be the word for it if it didn't have support for this method =) – Brad Koch Sep 2 '11 at 21:31
up vote 3 down vote accepted

Yes, nowadays STARTTLS appears to be the common approach to encrypt SMTP connection. One benefit is that it allows opportunistic encryption in cases where you can't enforce encryption support, such as on the regular port 25.

That being said, it is still possible to setup Postfix in the somewhat more traditional SSL manner you imagined.

share|improve this answer
Thanks! I was seeing all kinds of red flags everywhere, considering that the meticulously designed SMTP Mailer we're using, SwiftMailer, doesn't seem to have support for this starttls method. Guess I get to have fun coding out this method.. – Brad Koch Sep 2 '11 at 21:01

First: This is not a Postfix thing. This is a general SMTP procedure.

Second: There are two (common) possibilities to establish a secure session to (any) SMTP server.

  • Using STARTTLS on port 25 as described in RFC 2959
  • Using SSL from the start (SMTPS) on port 465 or 587 as being a RFC draft and afterwards revoked

So you can use both whereas the first one is the preferred but not exclusive way.

share|improve this answer
Submission (587) is tends to be used for mandatory STARTTLS. Uncertain if it was ever used as smtps. – 84104 Sep 2 '11 at 21:27
This is also not completely correct. RFC 4409 only describes STARTTLS as MAY be used on port 587. Port 465 already has been assigned to some other purpose than SMTPS. – mailq Sep 2 '11 at 21:57

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.