I've been following how to set up a mail server - by Flurdy in order to set up a more secure mail server on my Amazon EC2 Ubuntu 12.04 instance. I've followed the article to the letter, but I can't get it working alongside Amazon SES.

Amazon SES has been set up for Postfix following this document

#Amavis configuration:
content_filter = amavis:[]:10024

#SES configuration:
relayhost = email-smtp.us-east-1.amazonaws.com:25
smtp_sasl_auth_enable = yes
smtp_sasl_security_options = noanonymous
smtp_sasl_password_maps = hash:/etc/postfix/sasl_passwd
smtp_use_tls = yes
smtp_tls_security_level = encrypt
smtp_tls_note_starttls_offer = yes
smtp_tls_CAfile = /etc/ssl/certs/ca-certificates.crt

With the Amavis content_filter uncommented the mail logs reveal deferred

>> postfix/smtp[6534]: 0C1084605: to=<xxxxx@xxx.com, relay=[]:10024, delay=35, delays=35/0.03/0/0, dsn=4.7.4, status=deferred (TLS is required, but was not offered by host[])

However when content_filter is commented out - the relay is set to Amazon SES - and emails are sent fine..

>> postfix/smtp[6697]: 333744B3B: to=<xxxxx@xxx.com>, relay=email-smtp.us-east-1.amazonaws.com[]:25, delay=19, delays=17/0/0.8/0.6, dsn=2.0.0, status=sent (250 Ok 0000013e5a87e718-87720c2b-5542-4e3d-8034-57f3152e2e05-000000)

Can anyone shed some light? Cheers

1 Answer 1


with smtp_tls_security_level = encrypt you force postfix to use TLS, even through your local amavis filter which might not support it

you could add -o smtp_tls_security_level=none to the amavis/reinject instance in master.cf to get this working

so, copying from from your how-to page, your master.cf should probably look like this:

amavis unix - - - - 2 smtp 
  -o smtp_data_done_timeout=1200 
  -o smtp_send_xforward_command=yes 
  -o disable_dns_lookups=yes 
  -o max_use=20
  -o smtp_tls_security_level=none        <----- add this line inet n - - - - smtpd 
  -o content_filter= 
  -o local_recipient_maps= 
  -o relay_recipient_maps= 
  -o smtpd_restriction_classes= 
  -o smtpd_delay_reject=no 
  -o smtpd_client_restrictions=permit_mynetworks,reject 
  -o smtpd_helo_restrictions= 
  -o smtpd_sender_restrictions= 
  -o smtpd_recipient_restrictions=permit_mynetworks,reject 
  -o smtpd_data_restrictions=reject_unauth_pipelining 
  -o smtpd_end_of_data_restrictions= 
  -o mynetworks= 
  -o smtpd_error_sleep_time=0 
  -o smtpd_soft_error_limit=1001 
  -o smtpd_hard_error_limit=1000 
  -o smtpd_client_connection_count_limit=0 
  -o smtpd_client_connection_rate_limit=0 
  -o receive_override_options=no_header_body_checks,no_unknown_recipient_checks
  -o smtp_tls_security_level=none    <----- add this line

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.