1

I am able to connect my postfix server with TLS. All things are set up. But when i send a message with this secure connection, target server (for example gmail) receive my message without TLS/SSL secure connection.

If i use another server which has a cpanel, Gmail receive that message by ESMTP S. But when i sent a message to gmail account, it received by ESMTP (not with TLS connection.)

Sincerely, I discovered that my postfix server does not negotiate with target via SSL/TLS encrypted connection.

http://www.checktls.com reports Your email was sent, however it was NOT SENT SECURELY using TLS.

But why i am able to connect my server via TLS but server is not able to send it via secure connection?

Here is the config files:

main.cf

myhostname =  **hidden**
myorigin = /etc/mailname
mynetworks_style = host
mydestination = domains here...
relayhost =
mynetworks = 127.0.0.0/8 [::ffff:127.0.0.0]/104 [::1]/128
mailbox_size_limit = 0
recipient_delimiter = +
inet_interfaces = all
mailbox_size_limit = 0
message_size_limit = 104857600


mailbox_transport = lmtp:unix:private/dovecot-lmtp
virtual_transport = lmtp:unix:private/dovecot-lmtp

smtpd_tls_cert_file = /etc/ssl/certs/postfix.pem
smtpd_tls_key_file = /etc/ssl/private/postfix.pem

smtpd_use_tls = yes
smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache
smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache
smtpd_tls_security_level=encrypt
smtpd_tls_protocols = !SSLv2, !SSLv3
smtp_dns_support_level = enabled
smtp_tls_loglevel = 1

smtpd_sasl_type = dovecot

smtpd_sasl_path = private/auth

# and the common settings to enable SASL:
smtpd_sasl_auth_enable = yes
# With Postfix version before 2.10, use smtpd_recipient_restrictions
smtpd_relay_restrictions = permit_mynetworks, permit_sasl_authenticated, reject_unauth_destination
smtpd_recipient_restrictions = permit_mynetworks permit_inet_interfaces

append_dot_mydomain = no
readme_directory = no



smtpd_milters           = inet:127.0.0.1:8891
non_smtpd_milters       = $smtpd_milters
milter_default_action   = accept
milter_protocol     = 2

canonical_classes = header_recipient

master.cf

smtp      inet  n       -       -       -       -       smtpd
#submission inet n       -       -       -       -       smtpd
#  -o cleanup_service_name=subcleanup
#  -o smtpd_tls_security_level=encrypt
#  -o smtpd_sasl_auth_enable=yes
#  -o smtpd_client_restrictions=permit_sasl_authenticated,reject
#  -o milter_macro_daemon_name=ORIGINATING
submission inet n      -       n       -       -       smtpd
  -o syslog_name=postfix/submission
  -o smtpd_tls_wrappermode=yes
  -o smtpd_tls_security_level=encrypt
  -o smtpd_sasl_auth_enable=yes
  -o smtpd_recipient_restrictions=permit_mynetworks,permit_sasl_authenticated,reject
  -o milter_macro_daemon_name=ORIGINATING
  -o smtpd_sasl_type=dovecot
  -o smtpd_sasl_path=private/auth
smtps     inet  n       -       -       -       -       smtpd
  -o syslog_name=postfix/submission
  -o smtpd_tls_wrappermode=yes
  -o smtpd_tls_security_level=encrypt
  -o smtpd_sasl_auth_enable=yes
  -o smtpd_recipient_restrictions=permit_mynetworks,permit_sasl_authenticated,reject
  -o milter_macro_daemon_name=ORIGINATING
  -o smtpd_sasl_type=dovecot
  -o smtpd_sasl_path=private/auth
6

Enable opportunistic TLS support, i.e. send messages using TLS when the remote server identifies itself as supporting TLS, but send messages in the clear when the remote server does not :

# main.cf
smtp_tls_security_level = may

You have enabled smtpd_tls_security_level=encrypt in your config (only one letter difference), that only covers incoming e-mail traffic over SMTP, but not the outgoing email.

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.