Facebook
Twitter
Polli
Basic Pleskian
- Server operating system version
- Debian 12.8
- Plesk version and microupdate number
- 18.0.66#1
Hi
I am having difficulties using DANE on my Plesk server. For example, I see the following entrys in my logs when sending mails:
or
Apparently the connection is encrypted with TLS 1.3 but it looks like DANE is not used. It should actually say TRUSTED i think. How can I configure Postfix so that DANE is used when possible, or actually always. All my domains supports DANE and are configured correctly. However, I cannot force DANE in Postfix, because then no more mails can be delivered. What is the problem?
I have installed Plesk Email Security.
My main.cf file:
Is my cipher list ok? Should I change something there?
What are the default settings of the main.cf file in Plesk? Does plesk regularly recreate the file.
If you need more information, please let me know.
Thanks for your help
I am having difficulties using DANE on my Plesk server. For example, I see the following entrys in my logs when sending mails:
Code:
Untrusted TLS connection established to gmail-smtp-in.l.google.com[172.253.63.26]:25: TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (prime256v1) server-digest SHA256or
Code:
Untrusted TLS connection established to do.havedane.net[37.97.132.208]:25: TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256Apparently the connection is encrypted with TLS 1.3 but it looks like DANE is not used. It should actually say TRUSTED i think. How can I configure Postfix so that DANE is used when possible, or actually always. All my domains supports DANE and are configured correctly. However, I cannot force DANE in Postfix, because then no more mails can be delivered. What is the problem?
I have installed Plesk Email Security.
My main.cf file:
Code:
# See /usr/share/postfix/main.cf.dist for a commented, more complete version
# Debian specific: Specifying a file name will cause the first
# line of that file to be used as the name. The Debian default
# is /etc/mailname.
#myorigin = /etc/mailname
smtpd_banner = $myhostname ESMTP $mail_name (Debian/GNU)
biff = no
# appending .domain is the MUA's job.
append_dot_mydomain = no
# Uncomment the next line to generate "delayed mail" warnings
#delay_warning_time = 4h
readme_directory = no
# See http://www.postfix.org/COMPATIBILITY_README.html -- default to 2 on
# fresh installs.
compatibility_level = 2
# TLS parameters
smtpd_tls_cert_file = /etc/postfix/postfix.pem
smtpd_tls_key_file = $smtpd_tls_cert_file
smtpd_use_tls = yes
smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache
smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache
# See /usr/share/doc/postfix/TLS_README.gz in the postfix-doc package for
# information on enabling SSL in the smtp client.
smtpd_relay_restrictions = permit_mynetworks permit_sasl_authenticated defer_unauth_destination
alias_maps = hash:/etc/aliases, hash:/var/spool/postfix/plesk/aliases
alias_database = hash:/etc/aliases
myorigin = /etc/mailname
mydestination = localhost.startdedicated.net, localhost, localhost.localdomain
relayhost =
mynetworks =
mailbox_size_limit = 0
recipient_delimiter =
inet_interfaces = all
default_transport = smtp
relay_transport = relay
inet_protocols = all
virtual_mailbox_domains = $virtual_mailbox_maps, hash:/var/spool/postfix/plesk/virtual_domains
virtual_alias_maps = $virtual_maps, hash:/var/spool/postfix/plesk/virtual
virtual_mailbox_maps = , hash:/var/spool/postfix/plesk/vmailbox
transport_maps = , hash:/var/spool/postfix/plesk/transport
tls_server_sni_maps = hash:/var/spool/postfix/plesk/certs
smtpd_tls_security_level = may
smtp_tls_security_level = may
smtp_use_tls = no
smtp_tls_loglevel = 1
smtpd_tls_loglevel = 1
#smtpd_timeout = 3600s
#smtpd_proxy_timeout = 3600s
disable_vrfy_command = yes
smtpd_sender_restrictions = check_sender_access hash:/var/spool/postfix/plesk/blacklists,permit_sasl_authenticated
smtpd_client_restrictions = permit_mynetworks, permit_sasl_authenticated
authorized_flush_users =
authorized_mailq_users =
smtp_send_xforward_command = yes
smtpd_authorized_xforward_hosts = 127.0.0.0/8 [::1]/128
smtpd_sasl_auth_enable = yes
smtpd_recipient_restrictions = permit_mynetworks,permit_sasl_authenticated,reject_unauth_destination
virtual_mailbox_base = /var/qmail/mailnames
virtual_uid_maps = static:30
virtual_gid_maps = static:31
smtpd_milters = ,inet:127.0.0.1:12768
sender_dependent_default_transport_maps = hash:/var/spool/postfix/plesk/sdd_transport_maps
virtual_transport = plesk_virtual
plesk_virtual_destination_recipient_limit = 1
mailman_destination_recipient_limit = 1
message_size_limit = 102400000
virtual_mailbox_limit = 0
tls_preempt_cipherlist = no
tls_medium_cipherlist = TLS13-CHACHA20-POLY1305-SHA256:TLS13-AES-256-GCM-SHA384:TLS13-AES-128-GCM-SHA256:EECDH+CHACHA20:EECDH+AESGCM
smtpd_tls_mandatory_ciphers = medium
smtpd_tls_protocols = TLSv1.2 TLSv1.3
smtpd_tls_mandatory_protocols = TLSv1.2 TLSv1.3
smtpd_tls_ciphers = medium
recipient_canonical_maps = tcp:127.0.0.1:12346
recipient_canonical_classes = envelope_recipient,header_recipient
smtputf8_enable = no
smtpd_tls_dh1024_param_file = /opt/psa/etc/dhparams2048.pem
smtpd_forbid_bare_newline = yes
smtpd_forbid_bare_newline_exclusions = $mynetworks
smtpd_timeout = 3600s
non_smtpd_milters = ,inet:127.0.0.1:12768
content_filter = smtp-amavis:[127.0.0.1]:10024Is my cipher list ok? Should I change something there?
What are the default settings of the main.cf file in Plesk? Does plesk regularly recreate the file.
If you need more information, please let me know.
Thanks for your help
