Demo
Demo

Knowledge base

PMTA knowledge base›Block <domain>›Directive§ 3.3.10.108.15

smtp-tls-ciphers

<domain>

Cipher set for versions up to and including TLS 1.2
in the configuration this is a linesmtp-tls-ciphers HIGH:!ADH:@STRENGTHinside the block <domain>
What exactly to encrypt with — up to version 1.2

The line sets the list of allowed ciphers in the notation of the OpenSSL ciphers command. It applies only to versions up to TLS 1.2: TLS 1.3 suites are structured differently and are set with the smtp-tls-v13-ciphersuites line.

The default is sensible — HIGH:!ADH:@STRENGTH: only strong ciphers, without anonymous Diffie-Hellman, sorted by strength. It usually does not need changing.

openssl-security-level applies on top of the list. It can forbid a cipher the list allows: PowerMTA has its own encryption library, built into the distribution, and its security level outweighs any configuration line.

The main trap is narrowing the list and losing receivers silently. If no common cipher is found with a receiver, negotiation fails, and then everything depends on require-starttls: either the message goes out in plain text or it does not go out at all. Neither looks like “wrong cipher list”.
What the Hub does. It does not write it — it leaves the vendor default. The default already excludes the weak ones, and narrowing further means losing receivers with an old stack for no gain: the large ones negotiate modern ciphers anyway.
Recommended values

The value is a string in OpenSSL notation. What to keep in mind:

What Note
HIGH:!ADH:@STRENGTH (default) strong ciphers, no anonymous ones, in descending order of strength
your own narrowing check that the large receivers still negotiate
version 1.3 not set by this line — there is a separate one
openssl-security-level may forbid even what is allowed here

Check the list not by eye but by negotiation — with the command from the reference, before applying it across the fleet.

The default and the restriction to versions up to 1.2 are from the manual (§ 3.3.10.108.15). The advice to check by negotiation is ours.
Example configuration
# the default written out explicitly — this way the configuration reads without knowing the defaults
<domain example.com>
    smtp-tls-ciphers HIGH:!ADH:@STRENGTH</domain>
The manual’s example repeats the default. If you write your own, first check that the large receivers still negotiate at least one cipher from the list.
yellow — — directive names, blue — blocks. They are highlighted the same way in the text of the card.
▲

Common mistakes and problems

what people get wrong and how it ends2 mistakes▶

Narrowing the list in the general recipient block

our experience

What it costsLarge receivers will not notice, small ones with an old stack will lose the common cipher. Then — either plain text or non-delivery, depending on require-starttls.
How to spot itFor some receivers the protocol version disappears from accounting or queues grow.
How to do it rightNarrow per specific receiver and check negotiation in advance.

Expecting the line to affect TLS 1.3

§ 3.3.10.108.16

What it costsIt will not: version 1.3 has its own list, smtp-tls-v13-ciphersuites. The setting looks applied and takes no part in modern connections.
How to spot itThe list is narrowed, but the negotiated cipher is not in it.
How to do it rightSet both lines if the restriction is really needed.
Compatibility
PowerMTA 6.0
described in the manual of this version · platform: any
The vendor does not state the first version for every directive — there is no note here. The name also appears in the 5.0 edition of the manual.
Reference data
Syntax
smtp-tls-ciphers <string>
Values
a cipher list string in the notation of the OpenSSL ciphers command
Default
HIGH:!ADH:@STRENGTH § 3.3.10.108.15
Applying
reload, no restart needed
Queue
will not touch what is already queued
Where to write it
<domain>
How many times
once in the block
Everything here comes from the manual, with the section.
Inheritance
The directive lives in <domain> and merges by the usual rule for recipient blocks: the most precise match by receiver name wins. The same three levels apply by sending address. On top of everything stands openssl-security-level — there is one per node and it has no levels.
⇄

Related directives

1 relation

Does not work without

use-starttls<domain>The cipher set is negotiated during encryption and does not apply without it. § 3.3.10.108.15

How to check on the node
Check the list by negotiating with a real receiver:
openssl s_client -starttls smtp -connect mx.example.com:25 -cipher 'HIGH:!ADH:@STRENGTH'
A Cipher is … line in the response means a common cipher was found. A negotiation error means the list is too narrow for this receiver, and on the node this will turn into either plain text or a rejection.
◇

What else to read

3 articles

◇Submission over HTTPS on its own listener, modeled on SparkPostA separate entry point: its own listener with a certificate, its own keys and a reserved source name through which the usual submission settings apply to such mail.◇The receiver declares an encryption requirement on its websiteThe node fetches the recipient domain’s policy over HTTPS and, if it is in enforce mode, delivers only when the MX matches, the connection is encrypted and the certificate is verified.◇The receiver declares an encryption requirement in its DNS zoneThe node looks at the recipient domain’s DANE records and, if STARTTLS is required, sends only over an encrypted channel with a certificate verified by fingerprint.

In the Hub
Cost of a mistake
reversible: harms only while it is set
Scenarios
Connection encryption
Neighboring settings of the block <domain>:use-mta-stssmtp-tls-min-versionuse-starttlsuse-danerequire-starttlsAll 135 directives of the block →