I am running an Ubuntu 18.04.6 LTS server with the postfix 3.1.0-3ubuntu0.4 package.

Both the Apple Mail client and the Postbox client experience a weird delay when first sending an email to the smtp service. Eventually Apple Mail retries and works but Postbox gives up.

In the initial exchange, the email client appears to send a '???' as a command after the server greeting, or at least it is logged that way by postfix. The line in the log looks like (actual ip address redacted):

Nov 23 17:11:09 mail postfix/smtpd[3367]: < ipxx-xxx-xxx-xxx.ph.ph.cox.net[xx.xxx.xxx.xxx]: ???

To which the server responds: 502 5.5.2 Error: command not recognized

What is going on here? I cannot find anywhere that the string '???' is considered a valid SMTP command. Is this some sort of hack for older systems?

While both of the above clients seem to send this, the iOS email client does not.

I have not found any documentation of this or tolerating this as a postfix setting.

1 Answer 1


Postfix replaces non-printable() characters with ? in its logs.

One way this could happen is a client instructed to establish a TLS connection yet using a port number where postfix is talking plaintext. The binary TLS1.3 ClientHello not being a valid SMTP command would show as ? in logs. The servers offer to upgrade an already existing unencrypted SMTP connection to a secure channel via the STARTTLS compatibility hack would usually go unnoticed. A clever MUA might recognize this mistake - and retry with settings deviating from configuration - where clever could easily venture in dangerous territory.

Assuming your postfix is setup to allow that; Configure your clients to use port 465/tcp ("Message Submission over TLS protocol") together with the instruction to use TLS right away. That is the recommended secure option for submitting mail. A few keywords that will help you identify the options that go together:

port reserved for message submission via what it is labelled in software settings
465 SMTP over TLS (recommended) implicit TLS, TLS, SMTPS, clean TLS, wrappermode
587 SMTP plaintext with optional TLS explicit TLS, STARTTLS, optional TLS, RFC 3207

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .