Using the grommunio Appliance already provides the required configurations for opportunistic encryption active:
smtp_tls_CAfile = /etc/grommunio-common/ssl/server-bundle.pem
smtp_tls_cert_file = /etc/grommunio-common/ssl/server-bundle.pem
smtp_tls_key_file = /etc/grommunio-common/ssl/server.key
smtp_tls_security_level = may
smtp_tls_mandatory_protocols=!SSLv2,!SSLv3
smtp_tls_protocols=!SSLv2,!SSLv3
smtp_tls_note_starttls_offer = yes
This way, if the peer supports it, it would negotiate a TLS channel to communicate encrypted like here:
Dec 20 20:23:24 mail postfix/smtp[28711]: Untrusted TLS connection established to mail-as9pr07cu00302.inbound.protection.outlook.com[52.101.73.2]:25: TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)
"Untrusted" TLS connection comes from the peers certificate not being in the directly trusted chain, which is completely normal in an opportunistic encryption world.
The documentation you are looking for is here: https://www.postfix.org/TLS_README.html#client_tls -> As you can see, may is our default.
Using smtp_tls_policy_maps is an alternative approach which is also an endavour you can move forward to, however this might get challenging with forced settings (such as encrypt) as unfortunately, even in 2023, there are still many out there which do not work if you force TLS by hard.
