CentOS 5.x SendMail 8.14.4

An overzealous network security feature is causing TLS negotiations to fail when my Sendmail server tries to talk to external hosts. This is causing sendmail to constantly requeue some messages because it won't fail over to unencrypted delivery.

Is there a way to disable outbound TLS completely? I'm aware that I can add Try_TLS:broken.server NO entries for the individual mx records (or partial domains) but I'd prefer to just disable this entirely until the root cause gets resolved.

As far as I can tell, there doesn't appear to be any way to tell SendMail to not use TLS whatsoever.

I tried Try_TLS:* but that didn't work.

I understand that the root cause is not my specific system but as I don't have control of the affected parts, I'd like to at least get mail flowing. Any ideas?


How about:

Try_TLS:  NO

without the wildcard?

  • 3
    Note you have to edit /etc/mail/access – Sam Sanders Jun 4 '15 at 20:27
  • 2
    then "makemap hash /etc/mail/access.db < /etc/mail/access" then "service sendmail restart" – Sam Sanders Jun 4 '15 at 20:39
  • @SamSanders they are too cool to wrote about that =\ – Vasilii Suricov Apr 25 at 14:00

I prefer @Adamo's answer but just in case someone else stumbles across this, there's an alternate method of doing this.

Locate the CLIENT_OPTIONS part of a sendmail.mc file and add M=S.

So for example, if you had something like:

CLIENT_OPTIONS(`Family=inet, Addr=’)dnl

You could change it to:

CLIENT_OPTIONS(`Family=inet, M=S, Addr=’)dnl

The difference is that with this second method, SendMail won't even bother to look for TLS at all (which could be arguably worse depending on how/why you're making this change).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.