Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

CentOS 5.x SendMail 8.14.4

An overzealous network security feature is causing TLS negotiations to fail when my Sendmail server tries to talk to external hosts. This is causing sendmail to constantly requeue some messages because it won't fail over to unencrypted delivery.

Is there a way to disable outbound TLS completely? I'm aware that I can add Try_TLS:broken.server NO entries for the individual mx records (or partial domains) but I'd prefer to just disable this entirely until the root cause gets resolved.

As far as I can tell, there doesn't appear to be any way to tell SendMail to not use TLS whatsoever.

I tried Try_TLS:* but that didn't work.

I understand that the root cause is not my specific system but as I don't have control of the affected parts, I'd like to at least get mail flowing. Any ideas?

share|improve this question
up vote 2 down vote accepted

I am not sure, but a quick search turned up this which says (emphasis mine):

To be able to send to (or receive from) those MTAs, the ruleset try_tls (srv_features) can be used that work together with the access map. Entries for the access map must be tagged with Try_TLS (Srv_Features) and refer to the hostname or IP address of the connecting system. A default case can be specified by using just the tag.

share|improve this answer

I prefer Aaron's answer but just in case someone else stumbles across this, there's an alternate method of doing this.

Locate the CLIENT_OPTIONS part of a sendmail.mc file and add M=S.

So for example, if you had something like:

CLIENT_OPTIONS(`Family=inet, Addr=’)dnl

You could change it to:

CLIENT_OPTIONS(`Family=inet, M=S, Addr=’)dnl

The difference is that with this second method, SendMail won't even bother to look for TLS at all (which could be arguably worse depending on how/why you're making this change).

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.