title: Postfix as SMTP Relay appears unsecure to GMail
body: <p>I am currently trying to set up postfix on RHEL as an SMTP Relay for our internal ticketing system.</p>
  
  <p>The basic configuration is running and working fine; mails get send and recieved. We do alter some headers to secure our internal networks, but that's about it.</p>
  
  <pre><code>Trying 10.71.17.107...
  Connected to mail-gw.doma.in.
  Escape character is '?'.
  220 mail-gw.doma.in ESMTP Postfix
  STARTTLS
  220 2.0.0 Ready to start TLS
  </code></pre>
  
  <p>Similary, I am able to ask the GMail-Server for STARTTLS, so I presume that firewalls are not an issue:</p>
  
  <pre><code>Trying 108.177.15.26...
  Connected to gmail-smtp-in.l.google.com.
  Escape character is '?'.
  220 **************************************************
  EHLO mail-gw.doma.in
  250-mx.google.com at your service, [91.198.93.107]
  250-STARTTLS
  STARTTLS
  220 2.0.0 Ready to start TLS
  </code></pre>
  
  <p>I have acquired a free SSL Certificate for this mail-gw, and it seems to be valid. However, whenever I relay a message to GMail, it shows me that the message has not been encrypted.</p>
  
  <p><a href="https://i.stack.imgur.com/Lf5a2.png" rel="nofollow noreferrer">Not secure according to google</a></p>
  
  <p>Here is my master.cf</p>
  
  <pre><code>smtp      inet  n       -       n       -       -       smtpd -v
  submission inet n       -       n       -       -       smtpd -v
    -o smtpd_tls_security_level=encrypt
    -o smtpd_sasl_auth_enable=yes
    -o smtpd_reject_unlisted_recipient=no
  </code></pre>
  
  <p>And here is my main.cf</p>
  
  <pre><code>smtp_sasl_auth_enable = no
  smtp_sasl_password_maps = hash:/etc/postfix/relay_passwords
  smtp_tls_CAfile = /etc/pki/tls/certs/mail-gw_doma_in.ca-bundle
  smtp_tls_cert_file = /etc/pki/tls/certs/mail-gw_doma_in.crt
  smtp_tls_key_file = /etc/pki/tls/private/prv.key
  smtp_tls_loglevel = 1
  smtp_tls_note_starttls_offer = yes
  smtp_tls_security_level = may
  smtp_tls_session_cache_database = btree:/var/lib/postfix/smtpd_cache
  smtp_use_tls = yes
  
  smtpd_tls_CAfile = /etc/pki/tls/certs/mail-gw_doma_in.ca-bundle
  smtpd_tls_cert_file = /etc/pki/tls/certs/mail-gw_doma_in.crt
  smtpd_tls_key_file = /etc/pki/tls/private/prv.key
  smtpd_tls_loglevel = 1
  smtpd_tls_received_header = yes
  smtpd_use_tls = yes
  tls_random_source = dev:/dev/urandom
  </code></pre>
  
  <p>I am all out of ideas, especially since all solutions in the internet are smtp_tls_security_level = may.</p>
  
  <p>Any help would be appreciated.</p>
  
  <p>e: As per the comments, here is my connection log with Google.</p>
  
  <pre><code>Nov 15 07:06:44 atdc1-proxy01 postfix/smtp[26878]: &lt; gmail-smtp-in.l.google.com[173.194.76.27]:25: 220 **************************************************
  Nov 15 07:06:44 atdc1-proxy01 postfix/smtp[26878]: name_mask: disable_esmtp
  Nov 15 07:06:44 atdc1-proxy01 postfix/smtp[26878]: name_mask: delay_dotcrlf
  Nov 15 07:06:44 atdc1-proxy01 postfix/smtp[26878]: 14ED21038196: enabling PIX workarounds: disable_esmtp delay_dotcrlf for gmail-smtp-in.l.google.com[173.194.76.27]:25
  Nov 15 07:06:44 atdc1-proxy01 postfix/smtp[26878]: &gt; gmail-smtp-in.l.google.com[173.194.76.27]:25: HELO mail-gw.doma.in
  Nov 15 07:06:44 atdc1-proxy01 postfix/smtp[26878]: &lt; gmail-smtp-in.l.google.com[173.194.76.27]:25: 250 mx.google.com at your service
  Nov 15 07:06:44 atdc1-proxy01 postfix/smtp[26878]: server features: 0x31000 size 0
  Nov 15 07:06:44 atdc1-proxy01 postfix/smtp[26878]: smtp_stream_setup: maxtime=300 enable_deadline=0
  Nov 15 07:06:44 atdc1-proxy01 postfix/smtp[26878]: &gt; gmail-smtp-in.l.google.com[173.194.76.27]:25: MAIL FROM:&lt;dct_test_it@doma.in&gt;
  </code></pre>
  
  <p>Is it supposed to be this way? When I debug incoming connections, I see my server responding with all SMTP options (including STARTTLS)? Even more confusing since telnetting onto the google host also offers me STARTTLS.</p>