Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am trying to configure postfix to disable TLS for a specific remote smtp server that serves for multiple recipient domains.

I have set up a policy map that already contains some entries for specific recipient domains that work fine. But ist there a way to configure postfix to disable TLS for a remote smtp server regardless of what domains are hosted there?

I have tried quite a few entries in my TLS policy map file but without any success. I tried:

  • none
  • [] none
  • none
  • []:25 none
  • none
  • [] none
  • none
  • []:25 none

btw: yes, I postmapped the modified policy file :)

Still postfix tries to relay to that host using a TLS connection. As soon as I configure a specific recipient domain delivered via this mx, things work fine and no TLS connection is established. But since there are hundreds of recipient domains on the remote host, I cannot configure all of them in my policy :)

Any suggestions? Thanks in advance!

Best regards

share|improve this question

As documented in, a hostname or IP enclosed in square brackets is not resolved to an MX; it is assumed to be the MX.

Please provide postmap -q output for this map, and log entries that show what goes wrong.

share|improve this answer
Yes, that's what I was thinking about. I entered the hostnames and IP-addresses of the remote MX in my tls policy file, enclosed in sqare brackets, with and without trailing port number. – Chris S. Sep 27 '12 at 13:27
postmap -q [] <tls_policy_file> returns "none" as it is configured in the policy. But anyway postfix logs say (partial, not enough characters :): setting up TLS connection to[]:25 Trusted TLS connection established to[]:25: TLSv1 (...) status=deferred (lost connection with[] while performing the HELO handshake) When I set up a tls policy for the recipient domain (that is served on that host), then no TLS connection is established. – Chris S. Sep 27 '12 at 13:47
WHat happens when you use the IP literal ? – adaptr Sep 28 '12 at 14:09

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.