Inbound TLS for Postfix
Deploy certificates and enforce appropriate SMTP TLS behavior.
Production note: Back up configuration, run
postfix check, and stage changes before reloading.Certificate paths
smtpd_tls_cert_file = /etc/letsencrypt/live/mail.example.com/fullchain.pem
smtpd_tls_key_file = /etc/letsencrypt/live/mail.example.com/privkey.pem
smtpd_tls_security_level = may
smtpd_tls_loglevel = 1Submission policy
Port 25 normally offers opportunistic TLS. Authenticated submission should use encryption and reject plaintext authentication.
Verify certificate and STARTTLS
openssl s_client -starttls smtp -connect mail.example.com:25 -servername mail.example.comRenewal
After certificate renewal, reload Postfix and monitor for permission or path errors.