smtpd_tls_auth_only is set to
# postconf smtpd_tls_auth_only
smtpd_tls_auth_only = yes
Then, you have had your
smtpd_tls_security_level set to
# postconf smtpd_tls_security_level
smtpd_tls_security_level = encrypt
This resulted in setting your port 25 to never offer STARTTLS and perfectly explains why the following test TLS exercise shows no encryption offered:
# openssl s_client -connect $YOUR_SMTP_SERVER:25 -starttls smtp -CApath /etc/ssl/certs
no peer certificate available
No client certificate CA names sent
SSL handshake has read 230 bytes and written 334 bytes
New, (NONE), Cipher is (NONE)
Secure Renegotiation IS NOT supported
No ALPN negotiated
Early data was not sent
Verify return code: 0 (ok)
You could still have your Port 25 that only offers that
encrypt option (of which you've set it to), but then you would have drastically altered the nature of port 25 that the rest of the Internet could interoperate with.
This means your server could never be useable in wilderness of the Internet.
To fix that, you must set the following in
# smtpd_tls_security_level (empty)
# The SMTP TLS security level for the Postfix SMTP server; when a
# non-empty value is specified, this overrides the obsolete param-
# eters smtpd_use_tls and smtpd_enforce_tls.
# Specify one of the following security levels:
# TLS will not be used.
# Opportunistic TLS: announce STARTTLS support
# to remote SMTP clients, but do not require that
# clients use TLS encryption.
# Mandatory TLS encryption: announce STARTTLS
# support to remote SMTP clients, and require
# that clients use TLS encryption. According to
# RFC 2487 this MUST NOT be applied in case of
# a publicly-referenced SMTP server. Instead,
# this option should be used only on dedicated
# Note 1: the "fingerprint", "verify" and "secure" levels
# are not supported here. The Postfix SMTP server logs a
# warning and uses "encrypt" instead. To verify remote
# SMTP client certificates, see TLS_README for a
# discussion of the smtpd_tls_ask_ccert,
# smtpd_tls_req_ccert, and permit_tls_clientcerts
# Note 2: The parameter setting
# "smtpd_tls_security_level = encrypt" implies
# "smtpd_tls_auth_only = yes".
# Note 3: when invoked via "sendmail -bs", Postfix will
# never offer STARTTLS due to insufficient privileges to
# access the server private key. This is intended behavior.
smtpd_tls_security_level = may
encrypt setting is only used practically for certain mail relay and mail bastion host within your private network. Change it to