Re: Some Windows SMTP Server have problems with STARTTLS

6 msg	DSN relay host
1 msg	Restrict sender and from to one domain on outbo...
10 msg	Outbound postfix routing issue
25 msg	Problem with Black List
3 msg	Looking at new mail server layout
26 msg	why every minute: 'reload configuration /etc/po...
2 msg	myhostname parameter
17 msg	RBL problems with smarthost on private address ...
34 msg	Backscatting filter?
3 msg	how to setup postfix in 'deliver-only' mode?
7 msg	Slow queue configuration

Some Windows SMTP Server have problems with STA...
\ Ralf Hildebrandt (6 May 2008)
. \ Victor Duchovni (6 May 2008)
. . \ Ralf Hildebrandt (6 May 2008)
. . . \ Victor Duchovni (6 May 2008)
. . . . \ Ralf Hildebrandt (6 May 2008)
. . . . . \ Victor Duchovni (6 May 2008)
. . . . . . \ Ralf Hildebrandt (7 May 2008)
. . . . . . . \ Victor Duchovni (7 May 2008)
. . . . . . . . \ Ralf Hildebrandt (8 May 2008)
. . . . . . . . . \ Victor Duchovni (8 May 2008)
. . . . . . . . . . \ Ralf Hildebrandt (8 May 2008)
. . . . . . . . . . . \ Victor Duchovni (8 May 2008)
. . . . . . . . . . . . \ Ralf Hildebrandt (8 May 2008)
. . . . . . . . . . . . . \ Victor Duchovni (8 May 2008)
. . . . . . . . . . . . . . \ Ralf Hildebrandt (8 May 2008)
. . . . . . . . . . . . . . . \ Victor Duchovni (8 May 2008)
. . . . . . . . . . . . . . . . \ Ralf Hildebrandt (8 May 2008)

5 msg	For each check_ns or each check_mx, the value i...
4 msg	postfix and spf
2 msg	Password Validation in postfix
4 msg	catching some spam with warn_if_reject and reje...
9 msg	RFC: Check mail quota at a mail relay (backscat...
31 msg	GPS vs GLD (greylisting)
3 msg	Unmeant update from 2.2.10 to 2.5.1
27 msg	mailq lockups

Subject:	Re: Some Windows SMTP Server have problems with STARTTLS
Group:	Postfix-users
From:	Ralf Hildebrandt
Date:	8 May 2008

> In that case you need smtpd_discard_ehloo_keywords_address_maps
> to hide STARTTLS from all these systems.

Yes, did that.

> OR
>
> Go with a self-signed cert on your public MX hosts, and anyone who wants
> to do secure TLS with with can configure an explicit gateway that uses
> real certs (say port 26 on the same hosts).

:)

> OR
>
> Spend a nickel, and buy certs from a CA that does not use inessential
> critical extensions. :-)

No way, we *STILL* have our honor! :)