I'd like to gracefully handle sendmail STARTTLS handshake failures. On outgoing mail, it would be best if there were an immediate retry without STARTTLS in the case of failure. On inbound mail, ideally a site that caused handshake failures would be whitelisted to not use STARTTLS in the future, though I realize this is likely impractical.

As an alternative in this specialized environment, a method to default to not using STARTTLS, and specify only specific sites/domains that would be offered STARTTLS for inbound and/or outbound mail, would likely suffice for now. Any suggestions appreciated. Thanks.


Sorry to be the bearer of bad news but AFAIK, sendmail does not offer that level of granularity. For outbound mail, that means a simple three-step opportunistic format by default:

  1. Check to see if remote downstream MTA advertises support STARTTLS.
  2. If the remote side DOES advertise support, proceed to negotiate a STARTTLS connection.
  3. If the remote side does not advertise support for STARTTLS, continue the SMTP communication in the clear.

Unfortunately there isn't a "fall back" logic -- if the remote party advertises TLS support, sendmail assumes that it can/should use it. As such, if a problem occurs during step 2, the message queues and sendmail tries again later.

If you want to disable that STARTTLS logic, you'll need to leverage the try_tls ruleset (described here).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.