How to encrypt Postfix emails with SSL

Question

I have 2 domains registered and MX records set up and pointing at the same server. The output from this tool https://mxtoolbox.com/SuperTool.aspx is

10  mail.mydomain.club          IP  5 min
10  mail.myotherdomain.com  sameIP  5 min

so thats is working.

I followed this guide on setting up postfix with dovecot and MariaDB.

Every example.com is replaced with myotherdomain.com and hostname my machine is mydomain.club (If I change it, /etc/resolv.conf gets reset and I start sending mails as hostname.mydomain.club, so I left that as it is.) My problem is that email services, such as gmail, are saying that the email I send isn't encrypted.

This are ssl entries in my /etc/postfix/main.cf file that I think are relevant:

smtpd_use_tls = yes
smtpd_tls_cert_file = /etc/pki/tls/certs/myotherdomain_com.crt
smtpd_tls_key_file = /etc/pki/tls/certs/server.key

I got PositiveSSL certificate myotherdomain_com.crt from namecheap, when I registered a myotherdomain.com, server.key was generated when I issued

openssl req -new  -newkey rsa:2048 -nodes -keyout server.key -out server.csr

When I send an email with mutt -f . command, while being in /home/vmail/myotherdomain.com/sales/Maildir the email is send from root@mydomain.club and gmail complains that it isn't encrypted. If I use EMAIL="sales@myotherdomain.com" mutt, gmail still complains that email isn't encrypted. myotherdomain.com uses https successfully while mydomain.club uses plain http and also works as desired.

I have no idea why my encryption doesn't work. Can you help me out? Will post any additional files you need. I am running centOS 7.

Message in gmail:

mydomain.club did not encrypt this message

I don't know what it says mydomain.club, because I wanted to send mail as myotherdomain.com for which I bought and installed certificate

Example from /var/mail/maillog file when I try to send mail using myotherdomain.com. Note that mydomain.club still appears in the log file.

Feb 11 22:26:37 mydomain postfix/pickup[19101]: 550544A59: uid=0 from=<root>
Feb 11 22:26:37 mydomain postfix/cleanup[19514]: 550544A59: message-id=<20170211222637.GA19507@mydomain.club>
Feb 11 22:26:37 mydomain postfix/qmgr[5412]: 550544A59: from=<root@mydomain.club.myotherdomain.com>, size=461, nrcpt=1 (queue active)
Feb 11 22:26:38 mydomain postfix/smtp[19522]: 550544A59: to=<send.to@gmail.com>, relay=gmail-smtp-in.l.google.com[2607:f8a0:400e:c04::1b]:25, delay=1.1, $
Feb 11 22:26:38 mydomain postfix/qmgr[5412]: 550544A59: removed

Answer 1

The setting you want to put in main.cf to enable opportunistic encryption is

smtp_tls_security_level = may

Answer 2

Here's the tls section of my config for postfix, gmail recognizes messages as being sent encrypted. I'm using a letsencrypt cert on a Debian system

smtpd_use_tls = yes
smtpd_tls_key_file = /etc/letsencrypt/live/my.domain/privkey.pem
smtpd_tls_cert_file = /etc/letsencrypt/live/my.domain/fullchain.pem
smtpd_tls_received_header = yes
smtpd_tls_session_cache_timeout = 3600s
tls_random_exchange_name = /var/run/prng_exch
tls_random_source = dev:/dev/urandom
smtpd_tls_exclude_ciphers = aNULL, eNULL, EXPORT, DES, RC4, MD5, PSK, aECDH, EDH-DSS-DES-CBC3-SHA, EDH-RSA-DES-CDB3-SHA, KRB5-DES, CBC3-SHA
smtpd_tls_dh1024_param_file = /etc/ssl/postfix/dhparams.pem
smtpd_tls_auth_only = yes
smtp_tls_security_level = may
smtpd_use_tls=yes
smtpd_tls_security_level=may
smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache
smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache
smtpd_tls_loglevel=1
smtp_tls_loglevel=1