please-ignore@lists.denog.de (TLSv1.0, self signed cert)
please-ignore@1wt.eu (no TLS support)
I keep hitting TLS errors:
Jul 15 15:58:48 htznr2 maddy[923]: remote: cannot use MX {"domain":"lists.denog.de","msg_id":"e693452d-66952b17","reason":"TLS it not available or unauthenticated but required","remote_server":"mail1.cluenet.de.","required_tls_level":"encrypted","smtp_code":451,"smtp_enchcode":"4.7.1","smtp_msg":"TLS it not available or unauthenticated but required","tls_err":"tls: server selected unsupported protocol version 301","tls_level":"none"}
Jul 15 15:59:04 htznr2 maddy[923]: remote: cannot use MX {"domain":"1wt.eu","msg_id":"5fe3eac8-66952b14","reason":"TLS it not available or unauthenticated but required","remote_server":"mail.1wt.eu.","required_tls_level":"encrypted","smtp_code":451,"smtp_enchcode":"4.7.1","smtp_msg":"TLS it not available or unauthenticated but required","tls_err":null,"tls_level":"none"}
Log says "required_tls_level":"encrypted" despite all my attempts at configuring maddy to ignore it, including min_tls_level and min_mx_level.
Is this a bug or am I doing something wrong in the configuration file?
Steps to reproduce
Send email through maddy To:
please-ignore@lists.denog.de (TLSv1.0, self signed cert)
please-ignore@1wt.eu (no TLS support)
Log files
See above.
Configuration file
## Maddy Mail Server - default configuration file (2022-06-18)
# Suitable for small-scale deployments. Uses its own format for local users DB,
# should be managed via maddy subcommands.
#
# See tutorials at https://maddy.email for guidance on typical
# configuration changes.
# ----------------------------------------------------------------------------
# Base variables
$(hostname) = server2.example.eu
$(primary_domain) = example.eu
$(local_domains) = example.eu sand.example.eu
#debug yes
tls file /etc/maddy/certs/$(hostname)/fullchain.pem /etc/maddy/certs/$(hostname)/privkey.pem
# ----------------------------------------------------------------------------
# Local storage & authentication
# pass_table provides local hashed passwords storage for authentication of
# users. It can be configured to use any "table" module, in default
# configuration a table in SQLite DB is used.
# Table can be replaced to use e.g. a file for passwords. Or pass_table module
# can be replaced altogether to use some external source of credentials (e.g.
# PAM, /etc/shadow file).
#
# If table module supports it (sql_table does) - credentials can be managed
# using 'maddy creds' command.
auth.pass_table local_authdb {
table sql_table {
driver sqlite3
dsn credentials.db
table_name passwords
}
}
# imapsql module stores all indexes and metadata necessary for IMAP using a
# relational database. It is used by IMAP endpoint for mailbox access and
# also by SMTP & Submission endpoints for delivery of local messages.
#
# IMAP accounts, mailboxes and all message metadata can be inspected using
# imap-* subcommands of maddy.
storage.imapsql local_mailboxes {
driver sqlite3
dsn imapsql.db
}
# ----------------------------------------------------------------------------
# SMTP endpoints + message routing
hostname $(hostname)
table.chain local_rewrites {
optional_step regexp "(.+)\+(.+)@(.+)" "$1@$3"
optional_step static {
entry postmaster postmaster@$(primary_domain)
}
optional_step file /etc/maddy/aliases
}
msgpipeline local_routing {
# Insert handling for special-purpose local domains here.
# e.g.
# destination lists.example.org {
# deliver_to lmtp tcp://127.0.0.1:8024
# }
destination postmaster $(local_domains) {
modify {
replace_rcpt &local_rewrites
}
deliver_to &local_mailboxes
}
default_destination {
reject 550 5.1.1 "User doesn't exist"
}
}
smtp tcp://127.0.0.1:25 {
limits {
# Up to 20 msgs/sec across max. 10 SMTP connections.
all rate 20 1s
all concurrency 10
}
dmarc yes
check {
require_mx_record
dkim
spf
}
source $(local_domains) {
reject 501 5.1.8 "Use Submission for outgoing SMTP"
}
default_source {
destination postmaster $(local_domains) {
deliver_to &local_routing
}
default_destination {
reject 550 5.1.1 "User doesn't exist"
}
}
}
submission tls://0.0.0.0:465 tcp://0.0.0.0:587 {
limits {
# Up to 50 msgs/sec across any amount of SMTP connections.
all rate 50 1s
}
auth &local_authdb
source $(local_domains) {
check {
authorize_sender {
prepare_email &local_rewrites
user_to_email static { entry lukas@example.eu * }
#user_to_email identity
}
}
destination postmaster $(local_domains) {
deliver_to &local_routing
}
default_destination {
modify {
dkim $(primary_domain) $(local_domains) server2A
}
deliver_to &remote_queue
}
}
default_source {
reject 501 5.1.8 "Non-local sender domain"
}
}
target.remote outbound_delivery {
debug yes
limits {
# Up to 20 msgs/sec across max. 10 SMTP connections
# for each recipient domain.
destination rate 20 1s
destination concurrency 10
}
mx_auth {
#dane
#mtasts {
# cache fs
# fs_dir mtasts_cache/
#}
local_policy {
min_tls_level none
min_mx_level none
}
}
tls_client {
protocols tls1.0 tls1.3
}
}
target.queue remote_queue {
max_tries 3
target &outbound_delivery
autogenerated_msg_domain $(primary_domain)
bounce {
modify {
replace_sender static { entry "" "MAILER-DAEMON@example.eu" }
}
destination $(local_domains) {
modify {
dkim $(primary_domain) $(local_domains) server2A
}
deliver_to &remote_queue
}
default_destination {
reject 550 5.0.0 "Refusing to send DSNs to non-local addresses"
}
}
}
# ----------------------------------------------------------------------------
# IMAP endpoints
imap tls://127.0.0.1:993 tcp://127.0.0.1:143 {
auth &local_authdb
storage &local_mailboxes
}
Describe the bug
Despite commenting
daneandmtasts, settingprotocols tls1.0 tls1.3intls_clientand settinglocal_policyto:I cannot figure out a way to send emails to:
I keep hitting TLS errors:
Log says
"required_tls_level":"encrypted"despite all my attempts at configuring maddy to ignore it, includingmin_tls_levelandmin_mx_level.Is this a bug or am I doing something wrong in the configuration file?
Steps to reproduce
Send email through maddy To:
Log files
See above.
Configuration file
Environment information
0.7.1+cee5777 linux/amd64 go1.21.1