3

I have 2 domains registered and MX records set up and pointing at the same server. The output from this tool https://mxtoolbox.com/SuperTool.aspx is

10  mail.mydomain.club          IP  5 min
10  mail.myotherdomain.com  sameIP  5 min

so thats is working.

I followed this guide on setting up postfix with dovecot and MariaDB.

Every example.com is replaced with myotherdomain.com and hostname my machine is mydomain.club (If I change it, /etc/resolv.conf gets reset and I start sending mails as hostname.mydomain.club, so I left that as it is.) My problem is that email services, such as gmail, are saying that the email I send isn't encrypted.

This are ssl entries in my /etc/postfix/main.cf file that I think are relevant:

smtpd_use_tls = yes
smtpd_tls_cert_file = /etc/pki/tls/certs/myotherdomain_com.crt
smtpd_tls_key_file = /etc/pki/tls/certs/server.key

I got PositiveSSL certificate myotherdomain_com.crt from namecheap, when I registered a myotherdomain.com, server.key was generated when I issued

openssl req -new  -newkey rsa:2048 -nodes -keyout server.key -out server.csr

When I send an email with mutt -f . command, while being in /home/vmail/myotherdomain.com/sales/Maildir the email is send from [email protected] and gmail complains that it isn't encrypted. If I use EMAIL="[email protected]" mutt, gmail still complains that email isn't encrypted. myotherdomain.com uses https successfully while mydomain.club uses plain http and also works as desired.

I have no idea why my encryption doesn't work. Can you help me out? Will post any additional files you need. I am running centOS 7.

Message in gmail:

mydomain.club did not encrypt this message

I don't know what it says mydomain.club, because I wanted to send mail as myotherdomain.com for which I bought and installed certificate

enter image description here

Example from /var/mail/maillog file when I try to send mail using myotherdomain.com. Note that mydomain.club still appears in the log file.

Feb 11 22:26:37 mydomain postfix/pickup[19101]: 550544A59: uid=0 from=<root>
Feb 11 22:26:37 mydomain postfix/cleanup[19514]: 550544A59: message-id=<[email protected]>
Feb 11 22:26:37 mydomain postfix/qmgr[5412]: 550544A59: from=<[email protected]>, size=461, nrcpt=1 (queue active)
Feb 11 22:26:38 mydomain postfix/smtp[19522]: 550544A59: to=<[email protected]>, relay=gmail-smtp-in.l.google.com[2607:f8a0:400e:c04::1b]:25, delay=1.1, $
Feb 11 22:26:38 mydomain postfix/qmgr[5412]: 550544A59: removed
3
  • 1
    Is it talking about encrypting the transmission, or encrypting the email? Commented Feb 10, 2017 at 19:39
  • When I click the email in gmail, I see a red open lock with a message: mydomain.club did not encrypt this message. I don't know what it says mydomain.club, because I wanted to send mail as myotherdomain.com for which I bought and installed certificate
    – sanjihan
    Commented Feb 10, 2017 at 19:46
  • The settings in Postfix are for encrypting the connection between MTAs. Encryption of individual messages are done in MUAs (aka Email clients such as Thunderbird, Outlook, Mutt, etc).
    – Deathgrip
    Commented Jun 4, 2017 at 20:36

2 Answers 2

7

The setting you want to put in main.cf to enable opportunistic encryption is

smtp_tls_security_level = may

2

Here's the tls section of my config for postfix, gmail recognizes messages as being sent encrypted. I'm using a letsencrypt cert on a Debian system

smtpd_use_tls = yes
smtpd_tls_key_file = /etc/letsencrypt/live/my.domain/privkey.pem
smtpd_tls_cert_file = /etc/letsencrypt/live/my.domain/fullchain.pem
smtpd_tls_received_header = yes
smtpd_tls_session_cache_timeout = 3600s
tls_random_exchange_name = /var/run/prng_exch
tls_random_source = dev:/dev/urandom
smtpd_tls_exclude_ciphers = aNULL, eNULL, EXPORT, DES, RC4, MD5, PSK, aECDH, EDH-DSS-DES-CBC3-SHA, EDH-RSA-DES-CDB3-SHA, KRB5-DES, CBC3-SHA
smtpd_tls_dh1024_param_file = /etc/ssl/postfix/dhparams.pem
smtpd_tls_auth_only = yes
smtp_tls_security_level = may
smtpd_use_tls=yes
smtpd_tls_security_level=may
smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache
smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache
smtpd_tls_loglevel=1
smtp_tls_loglevel=1
3
  • Thanks. I see your cert_file and key_file have .pem as an extension. mine have .crt and .key. Something to investigate,,
    – sanjihan
    Commented Feb 12, 2017 at 10:46
  • Nope, .pen extension is just another one in the series of certificate extensions.
    – sanjihan
    Commented Feb 12, 2017 at 12:36
  • thanks... i add the "smtpd_use_tls = yes" into /etc/postfix/main.cf and worked successfully... :)
    – ultra.deep
    Commented Oct 14, 2018 at 19:34

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .