Reference

TLS and Security

All email traffic through PostMTA is encrypted in transit using TLS 1.2+.

Supported TLS Versions

VersionStatus
TLS 1.3Recommended
TLS 1.2Supported
TLS 1.0 / 1.1Deprecated
SSL 3.0Blocked

Cipher Suites

TLS_AES_256_GCM_SHA384
TLS_CHACHA20_POLY1305_SHA256
TLS_AES_128_GCM_SHA256
ECDHE-RSA-AES256-GCM-SHA384
ECDHE-RSA-AES128-GCM-SHA256

Certificate Management

PostMTA manages TLS certificates automatically for all outbound connections. No client certificates needed for sending.

DMARC Policy

PostMTA enforces aligned DKIM and SPF. Recommended DMARC policy:

v=DMARC1; p=quarantine; rua=mailto:dmarc-reports@postmta.com; pct=100

Upgrade to p=reject once you have confirmed all sending sources are aligned:

v=DMARC1; p=reject; rua=mailto:dmarc-reports@postmta.com; pct=100; adkim=s; aspf=s

Zero-Trust API Access