如何在postfix中加密外發電子郵件

Question

我已經在幾個在線指南中設置了postfix和dovecot，並始終存在我發送的電子郵件不會被加密的問題。 我一直在通過發送電子郵件到我的@ gmail.com帳戶來測試設置，因爲我確信谷歌服務器將支持TLS加密，並且Gmail郵件webmail中的電子郵件清楚地顯示紅色劃掉的掛鎖以顯示它們未加密。

如果我設置

smtpd_tls_security_level = encrypt 
smtp_tls_security_level = encrypt 

我得到這個錯誤

TLS is required, but was not offered by host gmail-smtp-in.l.google.com[64.233.167.27] 

如果我將它設置爲可發送電子郵件，而無需對其進行加密。

這是postconf的輸出-n

alias_database = hash:/etc/aliases 
alias_maps = hash:/etc/aliases 
append_dot_mydomain = no 
biff = no 
home_mailbox = Maildir/ 
inet_interfaces = all 
inet_protocols = all 
mailbox_command = 
mailbox_size_limit = 0 
mydestination = $myhostname, localdomain, localhost, localhost.localdomain, localhost, mail.example.com, example.com 
myhostname = mail.example.com 
mynetworks = 127.0.0.0/8 [::ffff:127.0.0.0]/104 [::1]/128 
mynetworks_style = subnet 
myorigin = /etc/mailname 
readme_directory = no 
recipient_delimiter = + 
smtp_tls_CAfile = /routeto/my.ca-bundle 
smtp_tls_cert_file = /routeto/my.crt 
smtp_tls_key_file = /routeto/my.key 
smtp_tls_loglevel = 1 
smtp_tls_note_starttls_offer = yes 
smtp_tls_security_level = may 
smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache 
smtp_use_tls = yes 
smtpd_banner = $myhostname ESMTP $mail_name (Ubuntu) 
smtpd_client_restrictions = permit_mynetworks, permit_sasl_authenticated, reject_unknown_client_hostname 
smtpd_recipient_restrictions = permit_mynetworks permit_sasl_authenticated reject_unauth_destination 
smtpd_relay_restrictions = permit_mynetworks permit_sasl_authenticated defer_unauth_destination 
smtpd_sasl_auth_enable = yes 
smtpd_sasl_local_domain = example.com 
smtpd_sasl_path = private/auth 
smtpd_sasl_type = dovecot 
smtpd_tls_CAfile = /routeto/my.ca-bundle 
smtpd_tls_cert_file = /routeto/my.crt 
smtpd_tls_key_file = /routeto/my.key 
smtpd_tls_loglevel = 1 
smtpd_tls_received_header = yes 
smtpd_tls_security_level = may 
smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache 
smtpd_use_tls = yes 

，這是一個遠程登錄的輸出端口25上，接着EHLO測試

250-mail.example.com 
250-PIPELINING 
250-SIZE 10240000 
250-VRFY 
250-ETRN 
250-STARTTLS 
250-AUTH PLAIN LOGIN 
250-ENHANCEDSTATUSCODES 
250-8BITMIME 
250 DSN 

和在端口587

同樣的事情

250-mail.example.com 
250-PIPELINING 
250-SIZE 10240000 
250-VRFY 
250-ETRN 
250-STARTTLS 
250-ENHANCEDSTATUSCODES 
250-8BITMIME 
250 DSN 

Answer 1

TLS是必需的，但沒有提供主機gmail-smtp-in.l.google.com [64.233.167.27]

這清楚地表明，主機不會向您的服務器提供STARTTLS。但是，衆所周知，gmail提供了STARTTLS，並且您使用telnet進行測試來確認它。我的猜測是你從另一個系統中完成了遠程登錄，並且你的郵件服務器位於某個（透明）防火牆後面，該防火牆攔截了流量來分析它。爲了不處理加密的SMTP流量，通常只需從服務器對EHLO的響應中剝離STARTTLS命令，以便郵件服務器假定不支持TLS。請參閱What happens if STARTTLS dropped in SMTP?。