Disable TLS for specific MX or recipient domain ?

[mnellemann]

Hi,

I have an issue with a specific recipient hosted at an MX that supports TLS, but handshake fails and it turns into a 'failed to deliver message'.

I can see that the MX supports TLS-1.2, but I'm guessing only weak ciphers.

Is there any way to disable TLS for only this specific MX or recipient domain ?

Many thanks in advance.

[mdecimus]

Hi,

Yes, you can define an expression on the starttls setting that disables TLS for this (or multiple) hosts.
Using expressions you can also disable TLS after the nth failed delivery attempt caused by a TLS error.

[mnellemann]

Hi @mdecimus

Would you happen to have an example I could use in my config.toml file ?

Thank you.

/Mark

[mdecimus]

You can use this expression:

[queue.outbound.tls]
starttls = [ { if = "retry_num > 0 && last_error == 'tls'", then = "disable"},
             { else = "optional" }]

[mnellemann]

Many thanks!