Some say that a failed validation just creates a warning in the headers, but even if that's true, the spam detection algorithms might then downgrade the authenticity rating of the message, resulting in more false positive spam detection.

But if I understand correctly, this is not about how our postfix is configured but rather how the receiving partner MTA is configured (which could be postfix, or exchange, or whatever).

Is that right?

The general use case for LetsEncrypt is for web servers, which only need the server-side bit, but several people have already protested that SMTP using TLS needs this client part of the cert (see the discussion at https://community.letsencrypt.org/t/do- … u/237427/5 ).

I am wondering if this will affect iRedMail installations, and, if so, can we expect that the necessary changes will be part of the regular update stream? The required changes seem a bit daunting to we amateurs!

Thanks as always for all help,
Paul