Verify Email TLS with Google Relay SMTP Service – How to Guide

emailpostfix

I have a server which only sends mail out, as follows:

django/python --> postfix -----> smtp-relay.gmail.com -----> destination

When I open a gmail client that received the email, and check the details it says: security: Standard encryption (TLS) Learn more

Now I suspect its saying from smtp-relay.gmail.com –> gmail destination was TLS, but I am concerned I am sending email in plain text from postfix to smtp-relay.gmail.com.

My postfix configuration file has:
relayhost = smtp-relay.gmail.com:587

However if I set it to:
relayhost = smtp-relay.gmail.com:25

It also works.

This is the tutorial I followed

If I set django settings to EMAIL_USE_TLS = True and try to send an email, it fails with:

 File "/usr/lib/python3.8/smtplib.py", line 755, in starttls
    raise SMTPNotSupportedError(
smtplib.SMTPNotSupportedError: STARTTLS extension not supported by server.

This makes me think its not using TLS, but I don't know how to verify.

Best Answer

You want to look at the Received: header of your mail as it was received, the line where Google traces your message being transmitted from your Postfix server to the first Google server. That header should specify the protocol as ESMTPS - the (second) S signalling a secure channel.

There will be another Received: header where your Postfix server notes the receipt of the message from django/python, but if that submission is guaranteed to never leave your machine (connection from ::1 to ::1), it should be of little concern whether that connection employed any transport security.

It is customary to have such trace headers additionally contain information about specific protocol versions and ciphers used (Google appears to do that most of the time).

If you know your mail server is not supposed to send out mail unencrypted - because you exclusively send mail to modern providers, or you are relaying all your mail to Google - consider enforcing that via smtp_tls_security_level in your postfix configuration. Looking at one message only tells you that in this particular instance, everything worked. You may not want it to silently fallback to unencrypted submission in the future.

Related Topic