5

I have a server which only sends mail out, as follows:

django/python --> postfix -----> smtp-relay.gmail.com -----> destination

When I open a gmail client that received the email, and check the details it says: security: Standard encryption (TLS) Learn more

Now I suspect its saying from smtp-relay.gmail.com --> gmail destination was TLS, but I am concerned I am sending email in plain text from postfix to smtp-relay.gmail.com.

My postfix configuration file has: relayhost = smtp-relay.gmail.com:587

However if I set it to: relayhost = smtp-relay.gmail.com:25

It also works.

This is the tutorial I followed

If I set django settings to EMAIL_USE_TLS = True and try to send an email, it fails with:

 File "/usr/lib/python3.8/smtplib.py", line 755, in starttls
    raise SMTPNotSupportedError(
smtplib.SMTPNotSupportedError: STARTTLS extension not supported by server.

This makes me think its not using TLS, but I don't know how to verify.

1
  • 1
    Depending on your log settings, you may see the negotiation and cert verification for the transaction.
    – Paul
    Aug 5 at 19:18
10

You want to look at the Received: header of your mail as it was received, the line where Google traces your message being transmitted from your Postfix server to the first Google server. That header should specify the protocol as ESMTPS - the (second) S signalling a secure channel.

There will be another Received: header where your Postfix server notes the receipt of the message from django/python, but if that submission is guaranteed to never leave your machine (connection from ::1 to ::1), it should be of little concern whether that connection employed any transport security.

It is customary to have such trace headers additionally contain information about specific protocol versions and ciphers used (Google appears to do that most of the time).

If you know your mail server is not supposed to send out mail unencrypted - because you exclusively send mail to modern providers, or you are relaying all your mail to Google - consider enforcing that via smtp_tls_security_level in your postfix configuration. Looking at one message only tells you that in this particular instance, everything worked. You may not want it to silently fallback to unencrypted submission in the future.

2
  • Thank you for that insight. I do indeed see 'ESMTPS' now, whereas before it was just ESMTP. It appears django fails when setting TLS because then the talking from django to localserver is TLS, and it fails. Aug 5 at 19:48
  • 1
    You can also add smtp_tls_loglevel = 1 to your postfix configuration to log TLS connections, including version & cipher.
    – NStorm
    Aug 5 at 20:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.