> On Feb 16, 2021, at 3:57 PM, Dominic Raferd <[email protected]> wrote:
>
>> In what way does that improve your security over the default, which
>> allows 1.0 and 1.1?
> As stated this is for auth clients i.e. our own people, using SMTPS or
> STARTTLS. There is no problem for us in enforcing it for them, they don't use
> old MTAs anyway and if they did this would force them to upgrade, which would
> be good. This also seems to be the OP's scenario (as his logs imply the
> problem comes from submission port i.e. 587). We use standard postfix
> settings for permitted protocols for outsider emails (port 25) because (as
> frequently advised here) lower security is better than no security at all. HTH
Yes, on the submission port, dropping support for TLS < 1.2
is much more reasonable, because presumably you can make
informed judgements as to what software the authorised users
have at their disposal.
--
Viktor.
