First off, I'm a programmer without much experience in programming with network protocols.

That being said, I'm attempting to connect to a Postfix SMTP server using a secure connection. The instructions I received from the sys admin who set up the SMTP server were to do the following:

  1. Establish the connection.
  2. Issue an EHLO.
  3. Issue a STARTTLS.
  4. Enable TLS on the existing connection.

Is this a normal server setup? I would have thought that Postfix would be listening on a secure port that you can connect to directly rather than doing this whole starting plain text, switching to TLS deal.

  • I'm not sure why you even care? There are many libraries for any programming language that already implements SMTP over TLS or/and SSL. – mailq Sep 2 '11 at 21:08
  • Because the rather robust library that was already integrated supported SMTP over TLS, but was erroring out with an OpenSSL error. The issue appears to have been that it was trying to make the initial connection via TLS, without having first executed a starttls command. The library does not support starttls, and I had to create this functionality myself. – Brad Koch Sep 2 '11 at 21:15
  • Then again, "robust" must not be the word for it if it didn't have support for this method =) – Brad Koch Sep 2 '11 at 21:31

Yes, nowadays STARTTLS appears to be the common approach to encrypt SMTP connection. One benefit is that it allows opportunistic encryption in cases where you can't enforce encryption support, such as on the regular port 25.

That being said, it is still possible to setup Postfix in the somewhat more traditional SSL manner you imagined.

| improve this answer | |
  • Thanks! I was seeing all kinds of red flags everywhere, considering that the meticulously designed SMTP Mailer we're using, SwiftMailer, doesn't seem to have support for this starttls method. Guess I get to have fun coding out this method.. – Brad Koch Sep 2 '11 at 21:01

First: This is not a Postfix thing. This is a general SMTP procedure.

Second: There are two (common) possibilities to establish a secure session to (any) SMTP server.

  • Using STARTTLS on port 25 as described in RFC 2959
  • Using SSL from the start (SMTPS) on port 465 or 587 as being a RFC draft and afterwards revoked

So you can use both whereas the first one is the preferred but not exclusive way.

| improve this answer | |
  • 1
    Submission (587) is tends to be used for mandatory STARTTLS. Uncertain if it was ever used as smtps. – 84104 Sep 2 '11 at 21:27
  • This is also not completely correct. RFC 4409 only describes STARTTLS as MAY be used on port 587. Port 465 already has been assigned to some other purpose than SMTPS. – mailq Sep 2 '11 at 21:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.