2

I have 2 domains registered and MX records set up and pointing at the same server. The output from this tool https://mxtoolbox.com/SuperTool.aspx is

10  mail.mydomain.club          IP  5 min
10  mail.myotherdomain.com  sameIP  5 min

so thats is working.

I followed this guide on setting up postfix with dovecot and MariaDB.

Every example.com is replaced with myotherdomain.com and hostname my machine is mydomain.club (If I change it, /etc/resolv.conf gets reset and I start sending mails as hostname.mydomain.club, so I left that as it is.) My problem is that email services, such as gmail, are saying that the email I send isn't encrypted.

This are ssl entries in my /etc/postfix/main.cf file that I think are relevant:

smtpd_use_tls = yes
smtpd_tls_cert_file = /etc/pki/tls/certs/myotherdomain_com.crt
smtpd_tls_key_file = /etc/pki/tls/certs/server.key

I got PositiveSSL certificate myotherdomain_com.crt from namecheap, when I registered a myotherdomain.com, server.key was generated when I issued

openssl req -new  -newkey rsa:2048 -nodes -keyout server.key -out server.csr

When I send an email with mutt -f . command, while being in /home/vmail/myotherdomain.com/sales/Maildir the email is send from root@mydomain.club and gmail complains that it isn't encrypted. If I use EMAIL="sales@myotherdomain.com" mutt, gmail still complains that email isn't encrypted. myotherdomain.com uses https successfully while mydomain.club uses plain http and also works as desired.

I have no idea why my encryption doesn't work. Can you help me out? Will post any additional files you need. I am running centOS 7.

Message in gmail:

mydomain.club did not encrypt this message

I don't know what it says mydomain.club, because I wanted to send mail as myotherdomain.com for which I bought and installed certificate

enter image description here

Example from /var/mail/maillog file when I try to send mail using myotherdomain.com. Note that mydomain.club still appears in the log file.

Feb 11 22:26:37 mydomain postfix/pickup[19101]: 550544A59: uid=0 from=<root>
Feb 11 22:26:37 mydomain postfix/cleanup[19514]: 550544A59: message-id=<20170211222637.GA19507@mydomain.club>
Feb 11 22:26:37 mydomain postfix/qmgr[5412]: 550544A59: from=<root@mydomain.club.myotherdomain.com>, size=461, nrcpt=1 (queue active)
Feb 11 22:26:38 mydomain postfix/smtp[19522]: 550544A59: to=<send.to@gmail.com>, relay=gmail-smtp-in.l.google.com[2607:f8a0:400e:c04::1b]:25, delay=1.1, $
Feb 11 22:26:38 mydomain postfix/qmgr[5412]: 550544A59: removed
|improve this question
  • 1
    Is it talking about encrypting the transmission, or encrypting the email? – Shadur Feb 10 '17 at 19:39
  • When I click the email in gmail, I see a red open lock with a message: mydomain.club did not encrypt this message. I don't know what it says mydomain.club, because I wanted to send mail as myotherdomain.com for which I bought and installed certificate – sanjihan Feb 10 '17 at 19:46
  • The settings in Postfix are for encrypting the connection between MTAs. Encryption of individual messages are done in MUAs (aka Email clients such as Thunderbird, Outlook, Mutt, etc). – Deathgrip Jun 4 '17 at 20:36
4

The setting you want to put in main.cf to enable opportunistic encryption is

smtp_tls_security_level = may

|improve this answer
2

Here's the tls section of my config for postfix, gmail recognizes messages as being sent encrypted. I'm using a letsencrypt cert on a Debian system

smtpd_use_tls = yes
smtpd_tls_key_file = /etc/letsencrypt/live/my.domain/privkey.pem
smtpd_tls_cert_file = /etc/letsencrypt/live/my.domain/fullchain.pem
smtpd_tls_received_header = yes
smtpd_tls_session_cache_timeout = 3600s
tls_random_exchange_name = /var/run/prng_exch
tls_random_source = dev:/dev/urandom
smtpd_tls_exclude_ciphers = aNULL, eNULL, EXPORT, DES, RC4, MD5, PSK, aECDH, EDH-DSS-DES-CBC3-SHA, EDH-RSA-DES-CDB3-SHA, KRB5-DES, CBC3-SHA
smtpd_tls_dh1024_param_file = /etc/ssl/postfix/dhparams.pem
smtpd_tls_auth_only = yes
smtp_tls_security_level = may
smtpd_use_tls=yes
smtpd_tls_security_level=may
smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache
smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache
smtpd_tls_loglevel=1
smtp_tls_loglevel=1
|improve this answer
  • Thanks. I see your cert_file and key_file have .pem as an extension. mine have .crt and .key. Something to investigate,, – sanjihan Feb 12 '17 at 10:46
  • Nope, .pen extension is just another one in the series of certificate extensions. – sanjihan Feb 12 '17 at 12:36
  • thanks... i add the "smtpd_use_tls = yes" into /etc/postfix/main.cf and worked successfully... :) – Richi Oct 14 '18 at 19:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.