Re: Postfix not doing TLS like I need

7 msg	problem sending cc messages

Postfix not doing TLS like I need
\ Louis Bohm (13 Jun 2007)
. \ Martin Schmitt (13 Jun 2007)
. . \ Martin Schmitt (13 Jun 2007)
. \ Louis Bohm (13 Jun 2007)
. . \ Martin Schmitt (13 Jun 2007)
. . . \ (Wietse Venema) (13 Jun 2007)
. . . . \ Victor Duchovni (13 Jun 2007)
. \ Louis Bohm (13 Jun 2007)
. . \ (Wietse Venema) (13 Jun 2007)
. \ Louis Bohm (13 Jun 2007)
. \ Victor Duchovni (13 Jun 2007)
. \ Louis Bohm (13 Jun 2007)
. . \ Victor Duchovni (13 Jun 2007)

6 msg	cannot open file: File too large
4 msg	Postfix, quotas, and bouncing back (rejecting)
2 msg	Restrict sending host for some (but not all) re...
1 msg	Re: Implementing custom blacklists
6 msg	SMTP question
7 msg	Application to integrate Postfix, Dovecot, and ...
6 msg	How to use smtpd_reject_unlisted_recipient?
2 msg	Problem
4 msg	Spam issues
1 msg	Emails from postfix and php
9 msg	Postfix Body Check Questions part 2
12 msg	relay_recipient_maps
5 msg	Newbie to both Linux and Postfix looking for he...
3 msg	problem with postfix and dns updates
4 msg	Steps to create virtual email boxes
6 msg	Best Practices (looking for some) : Attachment ...
1 msg	having postfix deliver mail for one host name i...
2 msg	Postfix Body Check Questions

Subject:	Re: Postfix not doing TLS like I need
Group:	Postfix-users
From:	Victor Duchovni
Date:	13 Jun 2007

On Wed, Jun 13, 2007 at 12:15:44PM -0400, Louis Bohm wrote:

> All I care about is what our Business Partner/Funder cares about. All
> out bound mail from us to them must be via TLS or bounced. In bound
> mail from them may or may not be TLS on our side. They are forcing the
> outbound TLS to us on their side.

Good, it is *their* responsibility to enforce TLS when sending *to
you*. It is *your* responsibility to enforce TLS when sending *to them*.

Since they are already doing their part, you don't need any TLS enforcement
in your SMTP *server* (smtpd). All you need is

main.cf:
smtp_tls_policy_maps = hash:/etc/postfix/tls_policy

tls_policy:
example.com encrypt|verify|secure [attr=val ...]

If mail to them is routed via a transport table entry:

transport:
example.com smtp:[tls.example.com]

then the policy table lookup key must be the transport table nexthop:

tls_policy:
[tls.example.com] encrypt|verify|secure [attr=val ...]

> See, http://www.postfix.org/TLS_README.html#client_tls_limits
>
> This explains why TLS policy enforcement is up to the sending client,
> with the server passively enabling the client to do the right thing.
>
> It is not really possible to do useful selective TLS enforcement on
> the server.

--
Viktor.

Disclaimer: off-list followups get on-list replies or get ignored.
Please do not ignore the "Reply-To" header.

To unsubscribe from the postfix-users list, visit
http://www.postfix.org/lists.html or click the link below:
<mailto:majordomo?body=unsubscribe%20postfix-users>

If my response solves your problem, the best way to thank me is to not
send an "it worked, thanks" follow-up. If you must respond, please put
"It worked, thanks" in the "Subject" so I can delete these quickly.