Postfix, DANE And Every Setting Done Properly
Out of the box Postfix sends in the clear when the far end offers no TLS and takes mail from anybody claiming to be anybody. This is the other build: Postfix 3.10.13 with Dovecot for logins, Rspamd for SPF, DKIM and DMARC, and postfix-tlspol for DANE and MTA-STS. No plaintext in or out, port 25 never relays, a login owns its addresses in the envelope and the From header, sender domains that do not exist are refused, and a tampered or spoofed message never gets past DATA. Every reply was captured in a lab over IPv4 and IPv6, along with the five settings that silently do nothing until something else is set too, the certbot default that breaks DANE on renewal, and what all of it costs you in forwarded mail.