Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have enabled TLS support in POSTFIX and authentication is delegated to Dovecot which offers "plain login cram-md5" methods. The SASL section in my Postfix conf had

smtpd_sasl_local_domain =
smtpd_sasl_auth_enable = yes
smtpd_sasl_security_options = noanonymous, noplaintext
smtpd_sasl_type = dovecot
broken_sasl_auth_clients = yes
smtpd_recipient_restrictions = permit_sasl_authenticated,permit_mynetworks,reject_unauth_destination
smtpd_sasl_path = private/auth-client

Unfortunately a few of the connecting mail clients are Outlook Express and Gmail, both of which do not support CRAM-MD5. To allow those clients to relay, I had to remove the noplaintext constraint and use

smtpd_sasl_security_options = noanonymous

instead. Does that mean that clients like Outlook Express and Gmail will send their credentials in plain text only, even though TLS is enabled? If yes, what options do I have?

Thank you!

share|improve this question
Isn't the idea of TLS to create a secure connection so that authentication sent can't be sniffed? – NickW Mar 6 '13 at 11:39
up vote 2 down vote accepted

Since your connection is encrytped via TLS, there should be no security problem with plaintext authentification. Most mail providers use plaintext auth over TLS/SSL. It is a problem of how probable it is that someone can sniff the contents of the connection.

You have to make sure though that you cannot connect without encryption. You should also use a certificate from a trusted CA.

share|improve this answer
Thanks. How do I check/ensure that I cannot connect without encryption? I have a self-signed certificate that all clients are committed to accept. – Ya. Perelman Mar 6 '13 at 14:53
Disable all non-encrypted protocols – Christopher Perrin Mar 6 '13 at 15:26

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.