text: Q:
  
  Postfix STARTTLS encryption before authentication
  
  I'm trying my best to configure Postfix with STARTTLS using port 25. Now the problem is STARTTLS is not working on port 25. 
  250-VRFY
  250-ETRN
  250-XXXXXXXA
  250-AUTH PLAIN LOGIN
  250-ENHANCEDSTATUSCODES
  250-8BITMIME
  250 DSN
  AUTH LOGIN
  334 xxxxxxxxxx
  334 xxxxxxxxxxxxx
  235 2.7.0 Authentication successful
  RSET
  250 2.0.0 Ok
  MAIL FROM: <user1@domain.com>
  250 2.1.0 Ok
  RCPT TO: <user2@domain.com>
  
  When using port 587, there is a STARTTLS feature, but I don't see "220 2.0.0 Ready to start TLS". 
  STARTTLS should start before authention. If the device/client doesn't support STARTTLS, auth should be rejected automatically.
  It should be like this with port 25.
  250-VRFY
  250-ETRN
  250-STARTTLS
  250-ENHANCEDSTATUSCODES
  250-8BITMIME
  250 DSN
  220 2.0.0 Ready to start TLS
  250-AUTH PLAIN LOGIN
  AUTH PLAIN am9obkBleGFtcGxlLm9yZwBqb2huQGV4YW1wbGUub3JnAHN1bW1lcnN1bg==
  
  Please advice where the mistake is? Did I miss out something?
  Possible to use STARTTLS with port 25? 
  main.cf
  smtp_tls_security_level = may
  smtpd_use_tls = yes
  smtpd_tls_key_file = /etc/postfix/certs/key.key
  smtpd_tls_cert_file = /etc/postfix/certs/crt.crt
  smtpd_tls_CAfile = /etc/postfix/certs/mcabundle.ca-bundle
  smtp_tls_key_file = /etc/postfix/certs/key.key
  smtp_tls_cert_file = /etc/postfix/certs/crt.crt
  smtp_tls_CAfile = /etc/postfix/certs/ca-bundle
  tls_random_source = dev:/dev/urandom
  smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache
  smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache
  smtpd_sasl_auth_enable = yes
  smtpd_sasl_path = smtpd
  smtpd_sasl_security_options = noanonymous
  smtpd_sasl_type = cyrus
  smtp_sasl_password_maps = hash:/etc/postfix/sasl_password
  smtpd_delay_reject = yes
  smtpd_client_restrictions = permit_sasl_authenticated, reject
  
  master.cf
  smtp      inet  n       -       n     -       -       smtpd
  #smtp      inet  n       -       n       -       1       postscreen
  #smtpd     pass  -       -       n       -       -       smtpd
  #dnsblog   unix  -       -       n       -       0       dnsblog
  #tlsproxy  unix  -       -       n       -       0       tlsproxy
  #submission inet n       -       n       -       -       smtpd
  #  -o syslog_name=postfix/submission
  #  -o smtpd_tls_security_level=encrypt
    -o smtpd_sasl_auth_enable=yes
  
  A:
  
  To get TLS on port 25, place smtpd_tls_security_level = may in main.cf.
  You should also place smtpd_tls_auth_only = yes in main.cf, so that it is not possible to authenticate without first encrypting connections.
  
  Additionally, I recommend adjusting your master.cf to:
  smtp      inet  n       -       n     -       -       smtpd
  #smtp      inet  n       -       n       -       1       postscreen
  #smtpd     pass  -       -       n       -       -       smtpd
  #dnsblog   unix  -       -       n       -       0       dnsblog
  #tlsproxy  unix  -       -       n       -       0       tlsproxy
  submission inet n       -       n       -       -       smtpd
    -o syslog_name=postfix/submission
    -o smtpd_tls_security_level=encrypt
    -o smtpd_sasl_auth_enable=yes
  
  After this change the submission port (587/tcp) will be active and require encryption. It will also be easier to distinguish in the logs.
  
  