I want to enable mandatory TLS encryption on outgoung mail for some (not all) domains.

I solved it for incoming mail if I set:

smtp_tls_security_level = may
smtp_tls_policy_maps = hash:/etc/postfix/tls_policy

and in tls_policy

example.com encrypt

all connections from the receiving domain example.com are over TLS.

How can I enforce this for outgoing mail for some domains?


You need to look at TLS Policy Maps feature. It is designed for that specific scenario. It allows you to specify 'may' or 'must' to separate domains; like this:

example.net           secure  match=example.net:.example.net
anotherexample.net    may     match=anotherexample.com:.anotherexample.com

Read more about it here:


  • 1
    In the documation it says 'The TLS policy table is indexed by the full next-hop destination, which is either the RECIPIENT domain ... '. But I want to enforce smtp by SENDING domain. May 29 '18 at 8:09
  • Ah; how interesting; I've had almost the same wish. In short; you can't. It appears, that most rule handling is destination based; see serverfault.com/questions/910522/… which I raised. :-) If you have another MTA that can route based on source domain, that might help you.
    – Martin
    May 30 '18 at 16:18

You may be able to do this with a combination of smtpd_tls_received_header and header_checks.

The following is a quick untested example, and may not be entirely suitable, but it might serve as a useful starting point. It's advisable to start with a WARN or INFO action for testing.
It's also possible given the multiline nature of the attempted match that nested_header_check is more suitable than header_checks.


header_checks = pcre:$config_directory/smtpd_tls


if /Return-Path:.+<.+@(example\.com)>/
!/Received: from ([^ ]+) \([^\)]+) +
 \(using [^ ] with cipher [^ ]+ [^(]+\)\)
 +by mx1\.example\.net/x
   REJECT mail from $1 must be sent using TLS

This is intended to match all mail from example.com and reject it if it doesn't contain a pattern similar to:

Received: from smtp.example.com (smtp.example.com  [])
    (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))
    (No client certificate requested)
    by mx1.example.com
  • @rubo77 @sysadmin1138 I will note that smtp which is what the author claims to have solved apply to outgoing messages while smtpd applies to incoming. So the stated solution works for outgoing and not incoming. See also the comment on the other answer where it is strongly implied that the sending domain is sending to the author, i.e. is incoming mail, at least as most people would understand it.
    – 84104
    Oct 20 '19 at 1:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.