Documentation / Postfix Engineering

Outbound TLS Policy

Configure opportunistic or policy-driven TLS for deliveries and relays.

v2.4Updated 2026-07-20Production guidance

Production note: Back up configuration, run postfix check, and stage changes before reloading.

Baseline

smtp_tls_security_level = may
smtp_tls_loglevel = 1
smtp_tls_CAfile = /etc/pki/tls/certs/ca-bundle.crt

Per-destination policy

smtp_tls_policy_maps = hash:/etc/postfix/tls_policy

# tls_policy
example.net encrypt
[relay.example.com]:587 secure match=relay.example.com

Build and test

postmap /etc/postfix/tls_policy
postmap -q example.net hash:/etc/postfix/tls_policy
postfix reload

Operational risk

Mandatory TLS can defer mail when remote systems are misconfigured. Apply strict policy only where the business requirement and certificate identity are understood.