Have you changed the certificates from the default iRedMail installed certs?

Are you requiring SSL connections for smtp?
What is the output of:

#  postconf | grep smtp_tls_security_level

Have you changed the default iredmail postfix settings for encryption levels?
What is the output of:

#  postconf | grep smtp_tls_mandatory_ciphers

Hi, thanks for the replies.

I haven't changed any of the default settings and I haven't changed the SSL. The log I gave I believe was only missing 1 more line I believe which indicated the mail was queued.. Ill also include some IPs incase that helps.

( I searched log for anything containing 26506 which I believe should be everything for this thread? )

Jan 23 16:14:38 mx1 postfix/smtp[26506]: warning: TLS library problem: 26506:error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong version number:s3_pkt.c:337:

Jan 23 16:14:38 mx1 postfix/smtp[26506]: 4A01413C6287: to=<x@y.com>, relay=x.info[217.36.37.130]:25, delay=17345, delays=17344/0.01/0.47/0.02, dsn=4.4.2, status=deferred (lost connection with x.info[217.36.37.130] while sending MAIL FROM)

Jan 23 16:14:39 mx1 postfix/smtp[26506]: 662F713C6288: to=<x@y.co.uk>, relay=remote.clientsexchangeserver.co.uk[x.x.x.x]:25, delay=0.59, delays=0/0/0.2/0.39, dsn=2.6.0, status=sent (250 2.6.0 <20140123161438.662F713C6288@mx1.z.co.uk> Queued mail for delivery)

# postconf | grep smtp_tls_security_level
smtp_tls_security_level = may

# postconf | grep smtp_tls_mandatory_ciphers
smtp_tls_mandatory_ciphers = medium

# postconf -n
alias_database = hash:/etc/postfix/aliases
alias_maps = hash:/etc/postfix/aliases
allow_min_user = no
allow_percent_hack = no
append_dot_mydomain = no
biff = no
bounce_queue_lifetime = 4h
broken_sasl_auth_clients = yes
config_directory = /etc/postfix
content_filter = smtp-amavis:[127.0.0.1]:10024
delay_warning_time = 0h
disable_vrfy_command = yes
dovecot_destination_recipient_limit = 1
enable_original_recipient = no
home_mailbox = Maildir/
inet_interfaces = all
inet_protocols = ipv4
mailbox_command = /usr/lib/dovecot/deliver
maximal_backoff_time = 4000s
maximal_queue_lifetime = 4h
message_size_limit = 15728640
minimal_backoff_time = 300s
mydestination = $myhostname, localhost, localhost.localdomain, localhost.$myhostname
mydomain = tmesolutions.co
myhostname = mx1.tmesolutions.co.uk
mynetworks = 127.0.0.0/8
mynetworks_style = host
myorigin = mx1.tmesolutions.co.uk
proxy_read_maps = $canonical_maps $lmtp_generic_maps $local_recipient_maps $mydestination $mynetworks $recipient_bcc_maps $recipient_canonical_maps $relay_domains $relay_recipient_maps $relocated_maps $sender_bcc_maps $sender_canonical_maps $smtp_generic_maps $smtpd_sender_login_maps $transport_maps $virtual_alias_domains $virtual_alias_maps $virtual_mailbox_domains $virtual_mailbox_maps $smtpd_sender_restrictions
queue_run_delay = 300s
recipient_bcc_maps = proxy:mysql:/etc/postfix/mysql/recipient_bcc_maps_user.cf, proxy:mysql:/etc/postfix/mysql/recipient_bcc_maps_domain.cf
recipient_delimiter = +
relay_domains = $mydestination, proxy:mysql:/etc/postfix/mysql/relay_domains.cf
relayhost =
sender_bcc_maps = proxy:mysql:/etc/postfix/mysql/sender_bcc_maps_user.cf, proxy:mysql:/etc/postfix/mysql/sender_bcc_maps_domain.cf
smtp-amavis_destination_recipient_limit = 1
smtp_data_init_timeout = 240s
smtp_data_xfer_timeout = 600s
smtp_tls_CAfile = $smtpd_tls_CAfile
smtp_tls_security_level = may
smtpd_banner = $myhostname ESMTP $mail_name (Debian/GNU)
smtpd_data_restrictions = reject_unauth_pipelining
smtpd_end_of_data_restrictions = check_policy_service inet:127.0.0.1:10031
smtpd_helo_required = yes
smtpd_helo_restrictions = permit_mynetworks, permit_sasl_authenticated, reject_non_fqdn_helo_hostname, reject_invalid_helo_hostname, check_helo_access pcre:/etc/postfix/helo_access.pcre
smtpd_recipient_restrictions = reject_unknown_sender_domain, reject_unknown_recipient_domain, reject_non_fqdn_sender, reject_non_fqdn_recipient, reject_unlisted_recipient, check_policy_service inet:127.0.0.1:7777, check_policy_service inet:127.0.0.1:10031, permit_mynetworks, permit_sasl_authenticated, reject_unauth_destination
smtpd_reject_unlisted_recipient = yes
smtpd_reject_unlisted_sender = yes
smtpd_sasl_auth_enable = yes
smtpd_sasl_authenticated_header = no
smtpd_sasl_local_domain =
smtpd_sasl_path = ./dovecot-auth
smtpd_sasl_security_options = noanonymous
smtpd_sasl_type = dovecot
smtpd_sender_login_maps = proxy:mysql:/etc/postfix/mysql/sender_login_maps.cf
smtpd_sender_restrictions = permit_mynetworks, reject_unauthenticated_sender_login_mismatch, permit_sasl_authenticated
smtpd_tls_CAfile = /etc/ssl/certs/iRedMail_CA.pem
smtpd_tls_cert_file = /etc/ssl/certs/iRedMail_CA.pem
smtpd_tls_key_file = /etc/ssl/private/iRedMail.key
smtpd_tls_loglevel = 0
smtpd_tls_security_level = may
swap_bangpath = no
tls_random_source = dev:/dev/urandom
transport_maps = proxy:mysql:/etc/postfix/mysql/transport_maps_user.cf, proxy:mysql:/etc/postfix/mysql/transport_maps_domain.cf
virtual_alias_domains =
virtual_alias_maps = proxy:mysql:/etc/postfix/mysql/virtual_alias_maps.cf, proxy:mysql:/etc/postfix/mysql/domain_alias_maps.cf, proxy:mysql:/etc/postfix/mysql/catchall_maps.cf, proxy:mysql:/etc/postfix/mysql/domain_alias_catchall_maps.cf
virtual_gid_maps = static:2000
virtual_mailbox_base = /var/vmail
virtual_mailbox_domains = proxy:mysql:/etc/postfix/mysql/virtual_mailbox_domains.cf
virtual_mailbox_maps = proxy:mysql:/etc/postfix/mysql/virtual_mailbox_maps.cf
virtual_minimum_uid = 2000
virtual_transport = dovecot
virtual_uid_maps = static:2000

Note, dont know if this helps but I found another different example. The previous log was my mail server connecting to another server to send an email. This log seems to be a server connecting to us to send us an email with a similar error:

Jan 21 15:32:54 mx1 postfix/smtpd[10007]: connect from service19.mimecast.com[91.220.42.10]
Jan 21 15:32:54 mx1 postfix/smtpd[10007]: SSL_accept error from service19.mimecast.com[91.220.42.10]: 0
Jan 21 15:32:54 mx1 postfix/smtpd[10007]: warning: TLS library problem: 10007:error:14094416:SSL routines:SSL3_READ_BYTES:sslv3 alert certificate unknown:s3_pkt.c:1256:SSL alert number 46:
Jan 21 15:32:54 mx1 postfix/smtpd[10007]: lost connection after STARTTLS from service19.mimecast.com[91.220.42.10]
Jan 21 15:32:54 mx1 postfix/smtpd[10007]: disconnect from service19.mimecast.com[91.220.42.10]

Thanks for any help.

Thanks for the reply,

*) Do you use self-signed SSL certificate or a purchased one?

It is self signed - "out of the box as created by your installer". Could this cause an issue? Should I use a purchased one? I did plan to upgrade to a paid certificate at some point and I have no issues doing so.

*) Does comment out "smtp_tls_security_level = may" solve this issue?

Yes, this seems to fix it, but I presume this is just disabling all TLS security so all emails are sent plain text even when TLS/SSL is available. I presume we would want to avoid this. Do you think there is another solution?

Thanks for your help.

I guess ill have to keep "smtp_tls_security_level = may" commented out for now. Like I said though, its not a fix, its just disabling a good feature.

Its disabling All TLS communication to remote servers even if they support it.

I dont understand why having "may" would cause an issue, surely it just tried, fails and then reverts to plain, but apparently not.

From my research I believe this may be an issue with openssl 1.0.1 but its not my area of expertise and I really dont know where to go from here

Thanks