Can't get Activation Mail in Mailchimp with Postfix

Question

I have a postfix-mailserver, which works for incoming and outgoing mail. Everything was fine until I created a Mailchimp-Account. The Activation-Mail wasn't recieved by my postfix-Server. Several other activation-mails from Amazon/Paypal/... worked fine.

My mail.log:

Dec 20 10:17:30 *** postfix/smtpd[23774]: connect from systemalerts8.mailchimp.com[198.2.140.10]
Dec 20 10:17:30 *** postfix/smtpd[24052]: connect from systemalerts8.mailchimp.com[198.2.140.10]
Dec 20 10:17:30 *** postfix/smtpd[23774]: lost connection after EHLO from systemalerts8.mailchimp.com[198.2.140.10]
Dec 20 10:17:30 *** postfix/smtpd[23774]: disconnect from systemalerts8.mailchimp.com[198.2.140.10]
Dec 20 10:17:30 *** postfix/smtpd[24052]: lost connection after EHLO from systemalerts8.mailchimp.com[198.2.140.10]
Dec 20 10:17:30 *** postfix/smtpd[24052]: disconnect from systemalerts8.mailchimp.com[198.2.140.10]

My main.cf:

#myorigin = /etc/mailname

soft_bounce = yes
biff = no
append_dot_mydomain = no
readme_directory = no
local_recipient_maps =
luser_relay = info

# TLS parameters
smtpd_sasl_auth_enable = yes
smtp_tls_security_level = may
smtpd_tls_cert_file=/etc/letsencrypt/live/***/fullchain.pem
smtpd_tls_key_file=/etc/letsencrypt/live/***/privkey.pem
smtpd_use_tls=yes
smtpd_enforce_tls = yes
smtp_sasl_security_options = noanonymous noplaintext
smtpd_recipient_restrictions = permit_mynetworks    permit_sasl_authenticated   permit_tls_clientcerts  reject_unauth_destination

smtpd_helo_restrictions = permit_sasl_authenticated permit_mynetworks   reject_invalid_hostname reject_unauth_pipelining    reject_non_fqdn_hostname

smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache
smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache

smtpd_relay_restrictions = permit_mynetworks permit_sasl_authenticated defer_unauth_destination
myhostname = sumlane.de
alias_maps = hash:/etc/aliases
alias_database = hash:/etc/aliases
myorigin = /etc/mailname
mydestination = ***.de, ***.com, localhost.de, localhost
relayhost = 
mynetworks = 127.0.0.0/8 [::ffff:127.0.0.0]/104 [::1]/128
mailbox_command = procmail -a "$EXTENSION"
mailbox_size_limit = 1024000000
recipient_delimiter = +
inet_interfaces = all
inet_protocols = all
milter_default_action = accept
milter_protocol = 6
smtpd_milters = inet:localhost:12345
non_smtpd_milters = inet:localhost:12345

Can anyone help me?

Answer 1

smtpd_enforce_tls = yes

You are enforcing STARTTLS for all incoming connections. This is a bad idea, as many mail senders do not support TLS yet, and they will give up as soon as they receive "530 5.7.0 Must issue a STARTTLS command first" from your server.

(Note that TLS is already enforced for the client message submission ports using per-port settings in in master.cf, so you don't need to do it separately.)

In the future, use tcpdump -A "port 25" to see what Mailchimp's server is sending you, and what error messages it is receiving back.