TLS_LEVEL

[nickshanks347]

Does TLS_LEVEL support TLS1.3 when set to "immediate"? Or is TLS1.3 only supported on "modern"?

Thanks

[casperklein]

Both levels support TLS 1.3:

docker-mailserver/target/scripts/helpers/ssl.sh

Lines 133 to 153 in da984e5

	# TLS strength/level configuration
	case "${TLS_LEVEL}" in
	( "modern" )
	local TLS_MODERN_SUITE='ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384'
	local TLS_MODERN_IGNORE='!SSLv2,!SSLv3,!TLSv1,!TLSv1.1'
	local TLS_MODERN_MIN='TLSv1.2'
	_apply_tls_level "${TLS_MODERN_SUITE}" "${TLS_MODERN_IGNORE}" "${TLS_MODERN_MIN}"
	_log 'debug' "TLS configured with 'modern' ciphers"
	;;
	( "intermediate" )
	local TLS_INTERMEDIATE_SUITE='ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:DHE-RSA-AES128-SHA256:DHE-RSA-AES256-SHA256'
	local TLS_INTERMEDIATE_IGNORE='!SSLv2,!SSLv3,!TLSv1,!TLSv1.1'
	local TLS_INTERMEDIATE_MIN='TLSv1.2'
	_apply_tls_level "${TLS_INTERMEDIATE_SUITE}" "${TLS_INTERMEDIATE_IGNORE}" "${TLS_INTERMEDIATE_MIN}"
	_log 'debug' "TLS configured with 'intermediate' ciphers"
	;;

[nickshanks347]

Thank you very much... do you have any idea what this would mean?

mail_server     | Jul 29 01:00:05 mail postfix/postscreen[7135]: 
NOQUEUE: reject: RCPT from [*137.184.144.158*]:37254: 550 5.5.1 
Protocol error; from=<noreply@bbs.phreaknet.net>, to=<me@example.com>,
proto=ESMTP, helo=<bbs.phreaknet.org>

me@example.com is just an example.... my real email was in there.

Seems like it's rejecting because of a protocol error with a code of 5.5.1 but I can't find much about it online.

[casperklein]

Nope, I am not using postscreen myself. You can disable it with POSTSCREEN_ACTION=ignore.

PS: Does this only happens with this specific sender? The message indicates, that the sending server does not properly speaks "SMTP".