Postfix not doing TLS like I need

7 msg	problem sending cc messages

Postfix not doing TLS like I need
\ Louis Bohm (13 Jun 2007)
. \ Martin Schmitt (13 Jun 2007)
. . \ Martin Schmitt (13 Jun 2007)
. \ Louis Bohm (13 Jun 2007)
. . \ Martin Schmitt (13 Jun 2007)
. . . \ (Wietse Venema) (13 Jun 2007)
. . . . \ Victor Duchovni (13 Jun 2007)
. \ Louis Bohm (13 Jun 2007)
. . \ (Wietse Venema) (13 Jun 2007)
. \ Louis Bohm (13 Jun 2007)
. \ Victor Duchovni (13 Jun 2007)
. \ Louis Bohm (13 Jun 2007)
. . \ Victor Duchovni (13 Jun 2007)

6 msg	cannot open file: File too large
4 msg	Postfix, quotas, and bouncing back (rejecting)
2 msg	Restrict sending host for some (but not all) re...
1 msg	Re: Implementing custom blacklists
6 msg	SMTP question
7 msg	Application to integrate Postfix, Dovecot, and ...
6 msg	How to use smtpd_reject_unlisted_recipient?
2 msg	Problem
4 msg	Spam issues
1 msg	Emails from postfix and php
9 msg	Postfix Body Check Questions part 2
12 msg	relay_recipient_maps
5 msg	Newbie to both Linux and Postfix looking for he...
3 msg	problem with postfix and dns updates
4 msg	Steps to create virtual email boxes
6 msg	Best Practices (looking for some) : Attachment ...
1 msg	having postfix deliver mail for one host name i...
2 msg	Postfix Body Check Questions

Subject:	Postfix not doing TLS like I need
Group:	Postfix-users
From:	Louis Bohm
Date:	13 Jun 2007

I am trying to get postfix (2.4.1) to do TLS inbound and outbound for a
specific domain. All other domains should be NON TLS unless their
servers supports TLS. For that one domain the rule is that we will do
TLS or not send/receive the message.

Here is what I have setup in the main.cf:

smtp_tls_CAfile = /etc/postfix_out/mail.site.com-cacert.pem
smtp_tls_session_cache_database =
btree:/var/spool/postfix_out/smtp_tls_session_cache
smtp_use_tls = yes
smtpd_use_tls = yes
smtpd_tls_CAfile = /etc/postfix_out/mail.site.com-cacert.pem
smtpd_tls_cert_file = /etc/postfix_out/mail.site.com-cert.pem
smtpd_tls_key_file = /etc/postfix_out/mail.site.com-key.pem
smtpd_tls_received_header = yes
smtpd_tls_session_cache_database =
btree:/var/spool/postfix_out/smtpd_tls_session_cache
tls_random_source = dev:/dev/urandom
smtp_tls_security_level = may
smtpd_tls_security_level = may
smtpd_tls_loglevel = 3
smtp_tls_loglevel = 3
smtp_tls_policy_maps = hash:/etc/postfix_out/tls_policy_map
smtpd_tls_policy_maps = hash:/etc/postfix_out/tls_policy_map

in the tls_policy_map I have the following:
domain.com secure
.domain.com secure
*.domain.com secure

What I officially need is to receive TLS from servers that support TLS
(this one domain being one of them). And send to this one domain TLS.
All other domains TLS if supported otherwise NON TLS. Also for this one
domain. If our server cannot do TLS to theirs then do not send the
mail.

According to what I have read the above setup should do that and also
require TLS inbound to us. But when I send mail in by hand I am not
getting being forced into TLS. I cannot even see postfix trying to look
up the domain in the tls_policy_map file. Though this is probably
because I am not logging on the correct thing.

Any help would be appreciated.

Thanks,
Louis

~~
-------------------------------------
Louis Bohm
Network Administrator
Adnexus Therapeutics
781.209.2324
-------------------------------------