I have setup postfix and dovecot, I can even receive e-mails and pick them up remotely using Thunderbird client connecting via IMAP

However, I can not send out using the Smtp server, when I telnet locally to my server using telnet mail.mydomain.com 25 and then perform ehlo mail.mydomain.com there is no 250-auth line - is this the problem and how do I fix it ?

I have smtpd_sasl_auth_enable = yes in main.cf

  • isn't smtpd_sasl_auth_enable = yes a setting for master.cf? – Sgaduuw Aug 1 '11 at 15:34
  • Hi Sgaduuw, it's in main.cf. – Zhang Huangbin Aug 2 '11 at 0:08
smtpd_tls_auth_only = yes

Needed to change this to

smtpd_tls_auth_only = no

Is the out put of postconf smtpd_tls_auth_only smtpd_tls_auth_only = yes?
If so, need to use starttls before authenticating.
Could disable setting to allow for unencrypted authentication (not advised).

Can debug with starttls using:
openssl s_client -connect $YOUR_SMTP_SERVER:25 -starttls smtp -CApath $PATH_TO_CA_DIR

  • Currently, for submitting e-mail from the MUA to the server one should use port 587. The protocol is still SMTP, but the standard requires authentication to be performed at this port before mail can be sent. – Hubert Kario Aug 1 '11 at 20:23

This is kind of stretch, but have you verified that it's listening on TCP 25 with lsof?

  • Nim telnets to port 25 and gets a response. – ΤΖΩΤΖΙΟΥ Aug 4 '11 at 7:35

If your smtpd_tls_auth_only is set to yes:

# postconf smtpd_tls_auth_only
smtpd_tls_auth_only = yes

Then, you have had your smtpd_tls_security_level set to encrypt.

# postconf smtpd_tls_security_level
smtpd_tls_security_level = encrypt

This resulted in setting your port 25 to never offer STARTTLS and perfectly explains why the following test TLS exercise shows no encryption offered:

# openssl s_client -connect $YOUR_SMTP_SERVER:25 -starttls smtp -CApath /etc/ssl/certs
no peer certificate available
No client certificate CA names sent
SSL handshake has read 230 bytes and written 334 bytes
Verification: OK
New, (NONE), Cipher is (NONE)
Secure Renegotiation IS NOT supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
Early data was not sent
Verify return code: 0 (ok)

You could still have your Port 25 that only offers that encrypt option (of which you've set it to), but then you would have drastically altered the nature of port 25 that the rest of the Internet could interoperate with.

This means your server could never be useable in wilderness of the Internet.

To fix that, you must set the following in /etc/postfix/main.cf:

# smtpd_tls_security_level (empty)
#   The  SMTP TLS security level for the Postfix SMTP server; when a
#   non-empty value is specified, this overrides the obsolete param-
#   eters smtpd_use_tls and smtpd_enforce_tls.
#   Specify one of the following security levels:
#     none
#         TLS will not be used. 
#     may
#         Opportunistic TLS: announce STARTTLS support 
#         to remote SMTP clients, but do not require that 
#         clients use TLS encryption. 
#     encrypt
#         Mandatory TLS encryption: announce STARTTLS 
#         support to remote SMTP clients, and require 
#         that clients use TLS encryption. According to 
#         RFC 2487 this MUST NOT be applied in case of 
#         a publicly-referenced SMTP server. Instead, 
#         this option should be used only on dedicated
#          servers. 
#     Note 1: the "fingerprint", "verify" and "secure" levels 
#     are not supported here. The Postfix SMTP server logs a 
#     warning and uses "encrypt" instead. To verify remote 
#     SMTP client certificates, see TLS_README for a 
#     discussion of the smtpd_tls_ask_ccert, 
#     smtpd_tls_req_ccert, and permit_tls_clientcerts 
#     features.
#     Note 2: The parameter setting 
#     "smtpd_tls_security_level = encrypt" implies 
#     "smtpd_tls_auth_only = yes".
#     Note 3: when invoked via "sendmail -bs", Postfix will 
#     never offer STARTTLS due to insufficient privileges to 
#     access the server private key. This is intended behavior.
smtpd_tls_security_level = may

In short, encrypt setting is only used practically for certain mail relay and mail bastion host within your private network. Change it to may.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.