Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am trying to configure postfix to disable TLS for a specific remote smtp server that serves for multiple recipient domains.

I have set up a policy map that already contains some entries for specific recipient domains that work fine. But ist there a way to configure postfix to disable TLS for a remote smtp server regardless of what domains are hosted there?

I have tried quite a few entries in my TLS policy map file but without any success. I tried:

  • smtp.server.com none
  • [smtp.server.com] none
  • smtp.server.com:25 none
  • [smtp.server.com]:25 none
  • 12.23.34.45 none
  • [12.23.34.45] none
  • 12.23.34.45:25 none
  • [12.23.34.45]:25 none

btw: yes, I postmapped the modified policy file :)

Still postfix tries to relay to that host using a TLS connection. As soon as I configure a specific recipient domain delivered via this mx, things work fine and no TLS connection is established. But since there are hundreds of recipient domains on the remote host, I cannot configure all of them in my policy :)

Any suggestions? Thanks in advance!

Best regards

share|improve this question
add comment

1 Answer

As documented in http://www.postfix.org/TLS_README.html#client_tls_policy, a hostname or IP enclosed in square brackets is not resolved to an MX; it is assumed to be the MX.

Please provide postmap -q output for this map, and log entries that show what goes wrong.

share|improve this answer
    
Yes, that's what I was thinking about. I entered the hostnames and IP-addresses of the remote MX in my tls policy file, enclosed in sqare brackets, with and without trailing port number. –  Chris S. Sep 27 '12 at 13:27
    
postmap -q [mx.server.net] <tls_policy_file> returns "none" as it is configured in the policy. But anyway postfix logs say (partial, not enough characters :): setting up TLS connection to mx.server.net[12.23.34.45]:25 Trusted TLS connection established to mx.server.net[12.23.34.45]:25: TLSv1 (...) status=deferred (lost connection with mx.server.net[12.23.34.45] while performing the HELO handshake) When I set up a tls policy for the recipient domain (that is served on that host), then no TLS connection is established. –  Chris S. Sep 27 '12 at 13:47
    
WHat happens when you use the IP literal ? –  adaptr Sep 28 '12 at 14:09
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.