Skip to Content

How to disable STARTTLS for older MTA to allow connection with FortiMail

By: Author Alex Lim

Posted on

Categories Troubleshooting

This article describes how to disable FortiMail from offering STARTTLS.

Scope

FortiMail

Solution

Step 1: Test the connection from [FortiMail Gateway] acting as an MTA and it is possible to see that FortiMail offers STARTTLS in the initial EHLO:

Test the connection from [FortiMail Gateway] acting as an MTA and it is possible to see that FortiMail offers STARTTLS in the initial EHLO.

Step 2: Go to the target receiving host, in this case, it will be [FortiMail Server mode].

Step 3: Go under Policy > Access Control > Receiving.

Step 4: Create a new Policy that defines the source IP and Recipient pattern.

Create a new Policy that defines the source IP and Recipient pattern.

Step 5: Under the TLS Profile, create a new TLS profile namely NO_STARTTLS with the TLS Option set to NONE.

Under the TLS Profile, create a new TLS profile namely NO_STARTTLS with the TLS Option set to NONE.

Step 6: When performing a second test connection from [FortiMail Gateway], the result no longer offers STARTTLS in the initial connection.

When performing a second test connection from [FortiMail Gateway], the result no longer offers STARTTLS in the initial connection.