1

Setting up a new CentOS 6 server with Plesk 10.4.4 using Postfix, I am unable to send emails from any user account on port 25, 465, or 587 without having SSL enabled. If I check to use SSL in Apple Mail, on iPhone, or in Outlook, everything works fine. Without, emails will not send and I get errors saying the SMTP server connection failed. I'm using apf and have the ports enabled, and have also disabled the firewall during testing and still have no luck.

On my old CentOS 5 box with Plesk 10.1 this isn't a problem, and I have all users sending email through 587 with user/pass authentication due to most ISPs blocking access to 25. I've seen plenty of articles on what to do if you can send without SSL but not with, however I'm not finding much on the other way around. Any help would be much appreciated!

2
  • So what is the question here?
    – mailq
    Jan 1, 2012 at 20:54
  • This is not uncommon if you are trying to relay outside the receiving servers domains. It is a simple SPAM control function.
    – BillThor
    Aug 16, 2017 at 1:10

2 Answers 2

3

Find the Postfix main.cf file and set:

smtpd_tls_security_level = may

I have no idea where main.cf might be located in CentOS with Plesk, but the usual location is /etc/postfix/main.cf.

If TLS is being enforced via the Postfix config, smtpd_tls_security_level will be set to encrypt. may makes it optional.

http://www.postfix.org/TLS_README.html

0

It seems that the new version has improved security. Without encryption you are passing user ids and passwords in clear text or a near equivalent. If things work with SSL enabled, you shouldn't have much of a problem.

If you are looking for documentation on how to enable harvesting of your passwords, you likely want to undo some documented steps. Look for documentation on how to enforce SSL on connections. Find where that has been done and remove that configuration. I would not do so or allow an administrator reporting to me to do so.

2
  • 2
    Enforcing TLS an port 25 is indeed not a bad idea, but there are still lots of services out there, which are not able to / are not configured to speak TLS on outgoing SMTP connections. Most of these are Services/Applications which send out notifications or alike. Sadly, but true :(
    – sebix
    Jul 13, 2014 at 7:52
  • I agree with the above comment. Outside of govt and the big providers like Gmail etc, the minority of organisations are using TLS, still. However, you can set up access restrictions to enforce TLS with certain domains/senders (which is what we do). NB: you shouldn't be offering SSL as an encryption type these days for email. It's insecure and deprecated.
    – LeeM
    Aug 16, 2017 at 1:07

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .