Postfix
傳入 gmx 郵件的後綴 TLS 配置
我用 postfix 2.7.1 和 dovecot 1.2.15 設置了我的郵件伺服器,一切似乎都很好,但現在我發現使用@gmx.net 地址的人無法向我發送電子郵件,而是收到錯誤消息
Connected to <MYIPADDRESS> but sender was rejected. Remote host said: 530 5.7.0 Must issue a STARTTLS command first
/var/log/mail.log 顯示:
postfix/smtpd[22743]: connected to mailout-de.gmx.net[213.165.64.23] postfix/smtpd[22743]: disconnect from mailout-de.gmx.net[213.165.64.23]
更詳細的日誌告訴我:
postfix/smtpd[22743]: match_hostname: mailout-de.gmx.net ~? 127.0.0.0/8 postfix/smtpd[22743]: match_hostaddr: 213.165.64.23 ~? 127.0.0.0/8 postfix/smtpd[22743]: match_hostname: mailout-de.gmx.net ~? [::ffff:127.0.0.0]/104 postfix/smtpd[22743]: match_hostaddr: 213.165.64.23 ~? [::ffff:127.0.0.0]/104 postfix/smtpd[22743]: match_hostname: mailout-de.gmx.net ~? [::1]/128 postfix/smtpd[22743]: match_hostaddr: 213.165.64.23 ~? [::1]/128 postfix/smtpd[22743]: match_list_match: mailout-de.gmx.net: no match postfix/smtpd[22743]: match_list_match: 213.165.64.23: no match postfix/smtpd[22743]: auto_clnt_open: connected to private/anvil postfix/smtpd[22743]: send attr request = connect postfix/smtpd[22743]: send attr ident = smtp:213.165.64.23 postfix/smtpd[22743]: private/anvil: wanted attribute: status postfix/smtpd[22743]: input attribute name: status postfix/smtpd[22743]: input attribute value: 0 postfix/smtpd[22743]: private/anvil: wanted attribute: count postfix/smtpd[22743]: input attribute name: count postfix/smtpd[22743]: input attribute value: 1 postfix/smtpd[22743]: private/anvil: wanted attribute: rate postfix/smtpd[22743]: input attribute name: rate postfix/smtpd[22743]: input attribute value: 1 postfix/smtpd[22743]: private/anvil: wanted attribute: (list terminator) postfix/smtpd[22743]: input attribute name: (end) postfix/smtpd[22743]: > mailout-de.gmx.net[213.165.64.23]: 220 <MYDOMAIN> ESMTP Postfix (Debian/GNU) postfix/smtpd[22743]: watchdog_pat: 0x7f1549946d00 postfix/smtpd[22743]: < mailout-de.gmx.net[213.165.64.23]: HELO mailout-de.gmx.net postfix/smtpd[22743]: > mailout-de.gmx.net[213.165.64.23]: 250 <MYDOMAIN> postfix/smtpd[22743]: watchdog_pat: 0x7f1549946d00 postfix/smtpd[22743]: < mailout-de.gmx.net[213.165.64.23]: MAIL FROM:<SomeAddress@gmx.net> postfix/smtpd[22743]: > mailout-de.gmx.net[213.165.64.23]: 530 5.7.0 Must issue a STARTTLS command first postfix/smtpd[22743]: watchdog_pat: 0x7f1549946d00 postfix/smtpd[22743]: < mailout-de.gmx.net[213.165.64.23]: QUIT postfix/smtpd[22743]: > mailout-de.gmx.net[213.165.64.23]: 221 2.0.0 Bye postfix/smtpd[22743]: match_hostname: mailout-de.gmx.net ~? 127.0.0.0/8 postfix/smtpd[22743]: match_hostaddr: 213.165.64.23 ~? 127.0.0.0/8 postfix/smtpd[22743]: match_hostname: mailout-de.gmx.net ~? [::ffff:127.0.0.0]/104 postfix/smtpd[22743]: match_hostaddr: 213.165.64.23 ~? [::ffff:127.0.0.0]/104 postfix/smtpd[22743]: match_hostname: mailout-de.gmx.net ~? [::1]/128 postfix/smtpd[22743]: match_hostaddr: 213.165.64.23 ~? [::1]/128 postfix/smtpd[22743]: match_list_match: mailout-de.gmx.net: no match postfix/smtpd[22743]: match_list_match: 213.165.64.23: no match postfix/smtpd[22743]: send attr request = disconnect postfix/smtpd[22743]: send attr ident = smtp:213.165.64.23 postfix/smtpd[22743]: private/anvil: wanted attribute: status postfix/smtpd[22743]: input attribute name: status postfix/smtpd[22743]: input attribute value: 0 postfix/smtpd[22743]: private/anvil: wanted attribute: (list terminator) postfix/smtpd[22743]: input attribute name: (end) postfix/smtpd[22743]: disconnect from mailout-de.gmx.net[213.165.64.23]
所以 gmx 只是不發出 STARTTLS 命令,對嗎?但為什麼?我不明白為什麼其他郵件伺服器可以連接到我的郵件伺服器但 gmx 不能,以及為什麼 gmx 可以連接到任何其他郵件伺服器但不能連接到我的郵件伺服器。
我的 /etc/postfix/main.cf 如下所示: smtpd_banner = $ myhostname ESMTP $ mail_name (Debian/GNU) biff = no append_dot_mydomain = no readme_directory = no
smtpd_tls_cert_file = /etc/ssl/certs/my_mail_cert.pem smtpd_tls_key_file = /etc/ssl/private/my_mail_cert.pem smtpd_tls_CAfile = /etc/ssl/certs/my_mail_ca_cert.pem smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache smtpd_tls_loglevel = 1 debug_peer_list = mailout-de.gmx.net #log problematic host smtpd_tls_security_level = may smtpd_tls_auth_only = yes myhostname = <MYHOSTNAME> alias_maps = hash:/etc/aliases alias_database = hash:/etc/aliases myorigin = /etc/mailname mydestination = localhost.org, , localhost mynetworks = 127.0.0.0/8 [::ffff:127.0.0.0]/104 [::1]/128 mailbox_command = procmail -a "$EXTENSION" mailbox_size_limit = 0 recipient_delimiter = + smtpd_sasl_auth_enable = yes smtpd_sasl_local_domain = <MYDOMAIN> smtpd_recipient_restrictions = permit_mynetworks permit_sasl_authenticated reject_unauth_destination virtual_mailbox_domains = mysql:/etc/postfix/mysql-virtual-mailbox-domains.cf virtual_mailbox_maps = mysql:/etc/postfix/mysql-virtual-mailbox-maps.cf virtual_alias_maps = mysql:/etc/postfix/mysql-virtual-alias-maps.cf virtual_transport = dovecot dovecot_destination_recipient_limit = 1 smtpd_sasl_type = dovecot smtpd_sasl_path = private/auth smtpd_tls_security_level = encrypt
在配置文件的底部,您有
smtpd_tls_security_level = encrypt
,這要求所有入站 SMTP 客戶端都使用 TLS。如果入站客戶端不支持 TLS,則連接將失敗。(鑑於錯誤消息,這似乎是 gmx.net 的情況。)如果您設置
smtpd_tls_security_level = may
,那麼您應該能夠從不支持 TLS 的伺服器接收電子郵件。(這似乎在您的文件中設置得更高,但稍後會被加密設置覆蓋。)