Enable and Enforce STARTTLS in Postfix

Learn how to configure STARTTLS in Postfix, when you should enforce TLS encryption, and when it will break your public mail flow.

Last updated: July 2026

In short: Transport Layer Security (TLS) via STARTTLS protects email traffic in transit. In Postfix, this is controlled by the smtpd_tls_security_level parameter. While public inbound mail servers (MX) require opportunistic encryption to avoid bouncing legitimate mail, you can enforce mandatory TLS on internal relays and submission endpoints.

When running your own mail server with Postfix, securing connections with TLS is essential. Security scanners like Kuveris often report issues such as STARTTLS not being offered or not being enforced. To resolve these findings, you must correctly configure Postfix's encryption behavior.

Enabling STARTTLS with smtpd_tls_security_level = may

By default, STARTTLS is often disabled in Postfix. To enable opportunistic TLS for incoming emails, set the smtpd_tls_security_level parameter to may.

With the may value, the Postfix SMTP server announces STARTTLS without requiring it. The official documentation explains: With this, the Postfix SMTP server announces STARTTLS support to remote SMTP clients, but does not require that clients use TLS encryption.

This configuration ensures that clients supporting TLS will transmit their messages securely, while older clients that do not support TLS can still deliver mail in plain text.

To configure this, add the following line to your Postfix configuration file /etc/postfix/main.cf:

smtpd_tls_security_level = may

When to Enforce TLS with smtpd_tls_security_level = encrypt

If you need to make TLS mandatory for all incoming connections, set the security level to encrypt.

Postfix describes this configuration as follows: so that the Postfix SMTP server announces STARTTLS and accepts no mail without TLS encryption, by setting

Under this setting, Postfix will refuse any incoming connection that does not use TLS encryption:

smtpd_tls_security_level = encrypt

Enforcing TLS is highly recommended for internal mail relays, submission ports (such as ports 587 or 465) used by your own authenticated users, or private networks where all clients are verified to support TLS.

⚠️ Safety Warning: Do Not Enforce TLS on Public MX Servers

Enforcing TLS on a publicly-referenced inbound mail server (MX) is a critical misconfiguration. According to RFC 2487 and official Postfix recommendations:

MUST NOT be applied in case of a publicly-referenced Postfix SMTP server. This option is off by default and should only seldom be used.

If you set smtpd_tls_security_level = encrypt on a public MX server, legitimate emails sent from services that do not support TLS will be blocked and bounce back to the sender. Therefore, always use the opportunistic smtpd_tls_security_level = may configuration on your public MX hosts.

Outbound Mail Delivery and Opportunistic TLS

For outbound email delivery to external domains, you should also use opportunistic encryption. This behavior is controlled by the smtp_tls_security_level parameter.

The Postfix documentation notes: With opportunistic TLS, mail delivery continues even if the server certificate is untrusted or bears the wrong name.

This ensures that Postfix encrypts outgoing mail whenever the destination server supports TLS, but does not block delivery if the recipient's certificate is expired, self-signed, or has a mismatched hostname.

Verifying Your Configuration