Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

CentOS 5.x SendMail 8.14.4

An overzealous network security feature is causing TLS negotiations to fail when my Sendmail server tries to talk to external hosts. This is causing sendmail to constantly requeue some messages because it won't fail over to unencrypted delivery.

Is there a way to disable outbound TLS completely? I'm aware that I can add Try_TLS:broken.server NO entries for the individual mx records (or partial domains) but I'd prefer to just disable this entirely until the root cause gets resolved.

As far as I can tell, there doesn't appear to be any way to tell SendMail to not use TLS whatsoever.

I tried Try_TLS:* but that didn't work.

I understand that the root cause is not my specific system but as I don't have control of the affected parts, I'd like to at least get mail flowing. Any ideas?

share|improve this question
up vote 3 down vote accepted

How about:

Try_TLS:  NO

without the wildcard?

share|improve this answer
I stand corrected. That works, thank you. – Mike B Jan 5 '12 at 16:42
Note you have to edit /etc/mail/access – Sam Sanders Jun 4 '15 at 20:27
then "makemap hash /etc/mail/access.db < /etc/mail/access" then "service sendmail restart" – Sam Sanders Jun 4 '15 at 20:39

I prefer @Adamo's answer but just in case someone else stumbles across this, there's an alternate method of doing this.

Locate the CLIENT_OPTIONS part of a file and add M=S.

So for example, if you had something like:

CLIENT_OPTIONS(`Family=inet, Addr=’)dnl

You could change it to:

CLIENT_OPTIONS(`Family=inet, M=S, Addr=’)dnl

The difference is that with this second method, SendMail won't even bother to look for TLS at all (which could be arguably worse depending on how/why you're making this change).

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.