3

This is my postfix main.cnf configuration file

smtpd_banner = $myhostname ESMTP $mail_name (Ubuntu)
biff = no

# appending .domain is the MUA's job.
append_dot_mydomain = no

# Uncomment the next line to generate "delayed mail" warnings
#delay_warning_time = 4h

readme_directory = no

# TLS parameters
smtpd_sasl_auth_enable = yes
broken_sasl_auth_clients = yes
smtp_sasl_security_options = noanonymous
smtpd_tls_loglevel = 1
smtpd_tls_auth_only = yes
smtp_tls_ciphers = export
smtp_tls_security_level = encrypt

smtp_tls_note_starttls_offer = yes
smtpd_tls_cert_file=/etc/ssl/certs/smtpd.crt
smtpd_tls_key_file=/etc/ssl/private/smtpd.key
smtpd_tls_CAfile = /etc/ssl/certs/cacert.pem
smtpd_use_tls=yes
smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache
smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache

# See /usr/share/doc/postfix/TLS_README.gz in the postfix-doc package for
# information on enabling SSL in the smtp client.

smtpd_relay_restrictions = permit_mynetworks permit_sasl_authenticated reject_unauth_destination
myhostname = 4051.localdomain
alias_maps = hash:/etc/aliases
alias_database = hash:/etc/aliases
myorigin = /etc/mailname
mydestination = $myhostname, 4051.localdomain, localhost.localdomain, localhost
relayhost =
mynetworks = 127.0.0.0/8 [::ffff:127.0.0.0]/104 [::1]/128
mailbox_size_limit = 0
recipient_delimiter = +
inet_interfaces = all
inet_protocols = ipv4

I'm trying to send an email and this is the error:

Aug 23 15:23:08 4051 postfix/qmgr[31284]: 7BC223100C2D: from=<noreply@mydomain.com>, size=931, nrcpt=1 (queue active)
Aug 23 15:23:08 4051 postfix/smtp[31344]: 7BC223100C2D: TLS is required, but was not offered by host gmail-smtp-in.l.google.com[74.125.195.27]
Aug 23 15:23:09 4051 postfix/smtp[31344]: 7BC223100C2D: TLS is required, but was not offered by host alt1.gmail-smtp-in.l.google.com[173.194.221.26]
Aug 23 15:23:10 4051 postfix/smtp[31344]: 7BC223100C2D: TLS is required, but was not offered by host alt2.gmail-smtp-in.l.google.com[74.125.68.26]
Aug 23 15:23:11 4051 postfix/smtp[31344]: 7BC223100C2D: TLS is required, but was not offered by host alt3.gmail-smtp-in.l.google.com[64.233.189.26]
Aug 23 15:23:13 4051 postfix/smtp[31344]: 7BC223100C2D: to=<myemail@gmail.com>, relay=alt4.gmail-smtp-in.l.google.com[173.194.72.26]:25, delay=487, delays=482/0.04/4.4/0, dsn=4.7.4, status=deferred (TLS is required, but was not offered by host alt4.gmail-smtp-in.l.google.com[173.194.72.26])

I'm quite sure Gmail supports encrypted email so what is the possible cause of the issue?

  • 2
    Are you behind some form of firewall that might be transparently catching the SMTP session and rewriting it (eg Cisco PIX?). What happens if you do telnet 173.194.221.26 smtp and after seeing the greeting EHLO myserver. You should see STARTTLS in the output. If you don't then something is "stealing" your connection. – Stephen Harris Aug 23 '16 at 15:34
  • root@4051:/etc/ssl/private# telnet 173.194.221.26 smtp Trying 173.194.221.26... Connected to 173.194.221.26. Escape character is '^]'. 220 mx.google.com ESMTP i65si1549916lfi.213 - gsmtp EHLO myserver 250-mx.google.com at your service, [xx.xxx.xxx.xx] 250-SIZE 157286400 250-8BITMIME 250-ENHANCEDSTATUSCODES 250 SMTPUTF8 What to do then? – Gotenks Aug 23 '16 at 15:35
  • You should be seeing more than that; 250-SIZE 157286400 250-8BITMIME 250-STARTTLS 250-ENHANCEDSTATUSCODES 250-PIPELINING 250-CHUNKING 250 SMTPUTF8 I think you have a firewall in the middle that's not allowing direct communication. You need to look at that. – Stephen Harris Aug 23 '16 at 15:39
  • 2
    If you don't see STARTTLS in the telnet output then nothing you can do on postfix will get TLS working. You have a lower level dataflow problem. – Stephen Harris Aug 23 '16 at 16:17
  • 1
    Thanks Stephen, it was like you suggested. "Thank you for your patience. You were unable to send encrypted e-mail letters due to our anti-spam and anti-virus software. It was checking for virus files in e-mail letters. We are forced to check all e-mail letters going from our servers due to high risk of being added to blacklists. Regarding your request we have whitelisted your server, which will not be checked any more and you will be able to send encrypted e-mail letters." @Matija: I have replaced the smtp_tls_security_level = encrypt with smtp_tls_security_level = may – Gotenks Aug 24 '16 at 10:51
1

For Cisco IOS Firewalls:

Thanks to Stephen Harris's comment, above, quoted here:

If you don't see STARTTLS in the telnet output then nothing you can do on postfix will get TLS working. You have a lower level dataflow problem.

I am behind a Cisco 2851 with Cisco IOS v 15.1. The solution for me was correcting the esmtp inspection filter. Have a read: Application Inspection and Control for SMTP. For example, it replaced EHLO command 250-STARTTLS with XXX's: 250-XXXXXXXX.

show running-config on the router command line revealed a list of active filters including esmtp:

ip inspect name APPWIZ http
ip inspect name APPWIZ https
ip inspect name APPWIZ tcp
ip inspect name APPWIZ udp
ip inspect name APPWIZ sip
ip inspect name APPWIZ pop3
ip inspect name APPWIZ imap
ip inspect name APPWIZ icmp
ip inspect name APPWIZ ftp
ip inspect name APPWIZ dns
ip inspect name APPWIZ esmtp

The immediate solution for me was to disable the esmtp inspection (until I'm able to configure it suitably) like so:

configure terminal
no ip inspect name APPWIZ esmtp
exit
write memory

You will need to replace APPWIZ with the name of your inspection class-map.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.