How to verify that email from own server to google relay SMTP service is using TLS

run_the_race

12/5/22, 6:40 PM

I have a server which only sends mail out, as follows:

django/python --> postfix -----> smtp-relay.gmail.com -----> destination

When I open a gmail client that received the email, and check the details it says: security: Standard encryption (TLS) Learn more

Now I suspect its saying from smtp-relay.gmail.com --> gmail destination was TLS, but I am concerned I am sending email in plain text from postfix to smtp-relay.gmail.com.

My postfix configuration file has: relayhost = smtp-relay.gmail.com:587

However if I set it to: relayhost = smtp-relay.gmail.com:25

It also works.

This is the tutorial I followed

If I set django settings to EMAIL_USE_TLS = True and try to send an email, it fails with:

 File "/usr/lib/python3.8/smtplib.py", line 755, in starttls
    raise SMTPNotSupportedError(
smtplib.SMTPNotSupportedError: STARTTLS extension not supported by server.

This makes me think its not using TLS, but I don't know how to verify.

802

1 + 1

postfix

Paul

12/5/22, 7:18 PM

Depending on your log settings, you may see the negotiation and cert verification for the transaction.

Score:10

Server

anx

12/5/22, 7:07 PM

You want to look at the Received: header of your mail as it was received, the line where Google traces your message being transmitted from your Postfix server to the first Google server. That header should specify the protocol as ESMTPS - the (second) S signalling a secure channel.

There will be another Received: header where your Postfix server notes the receipt of the message from django/python, but if that submission is guaranteed to never leave your machine (connection from ::1 to ::1), it should be of little concern whether that connection employed any transport security.

It is customary to have such trace headers additionally contain information about specific protocol versions and ciphers used (Google appears to do that most of the time).

If you know your mail server is not supposed to send out mail unencrypted - because you exclusively send mail to modern providers, or you are relaying all your mail to Google - consider enforcing that via smtp_tls_security_level in your postfix configuration. Looking at one message only tells you that in this particular instance, everything worked. You may not want it to silently fallback to unencrypted submission in the future.

0 + 2

run_the_race

12/5/22, 7:48 PM

Thank you for that insight. I do indeed see 'ESMTPS' now, whereas before it was just `ESMTP`. It appears django fails when setting TLS because then the talking from django to localserver is TLS, and it fails.

NStorm

12/5/22, 8:15 PM

You can also add `smtp_tls_loglevel = 1` to your postfix configuration to log TLS connections, including version & cipher.

Elon Musk

I sit in a Tesla and translated this thread with Ai:

EN: How to verify that email from own server to google relay SMTP service is using TLS

TH: วิธีตรวจสอบว่าอีเมลจากเซิร์ฟเวอร์ของตัวเองไปยังบริการ SMTP ของ google relay ใช้ TLS

RO: Cum să verificați că e-mailul de la propriul server către serviciul SMTP Google Relay utilizează TLS

RU: Как проверить, что электронная почта с собственного сервера на службу SMTP google relay использует TLS

VI: Cách xác minh rằng email từ máy chủ của chính dịch vụ SMTP chuyển tiếp của google đang sử dụng TLS

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.