Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm using my own root server for my email accounts. All the traffic between my pc and my server is encrypted. Is there a possibility to force my email-server to communicate with other email-servers also encrypted?

share|improve this question
Other SMTP servers could probably relay mail over unencrypted links, anyway. Short of PGP, I don't think you can rely on email being secure. – gparent Apr 14 '12 at 20:14
Which MTA (mail server) are you using? – grifferz Apr 14 '12 at 20:19
It really depends on your threat model -- what you're trying to protect from whom. – cjc Apr 14 '12 at 21:50
up vote 9 down vote accepted

Yes, you can tell your mail server that you want it to use encryption when talking to other mail server. Of course, there is always the possibility that the mail server on the other side of the SMTP connection don't want to establish an encrypted connection. Hence you will need to have a policy on whatever to allow the connection to proceed or not in such a case.

The two configuration options you are after are smtp_tls_security_level and smtpd_tls_security_level. smtp_tls_* controls sending while smtpd_tls_* controls receiving.

The usually sensible thing, for Internet wide e-mail, is to allow for opportunistic encryption. That translates into the config value may.

smtp_tls_security_level = may
smtpd_tls_security_level = may
share|improve this answer
so smtpd_* is for the communication between my pc and my mailserver and smtp_* is for the communication between my mailserver and other mailservers? – soupdiver Apr 15 '12 at 11:14
Kind of, but not necessarily, that depends. The smtp_ configs are for when your server initiates the connection, when it sends e-mail to other mail servers. The smtpd_ settings are for when your mail server is on the receiving/listening end of a connection, which would apply when your PC is initiating the connection. It would also apply in case your mail server is a MX server, having other mail servers connecting to it. – andol Apr 15 '12 at 12:25
ah ok! thanks for the explanation – soupdiver Apr 15 '12 at 13:09

Only if they support SSL as well.

I assume from the tag you are using postfix. There is an option in for that: smtp_tls_security_level.

You can have it verify certificates or not, or use SSL when available but still send email when it isn't. Keep in mind that requiring encryption will make any mail you send to sites that do not support SSL undeliverable, and requiring valid certificates will make mail undeliverable from your site to those with self-signed certificates.

Here is the documentation for that option:

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.