Technical Tip: How to disable STARTTLS for older MTA to allow connection with FortiMail

[pchee]

Description	This article describes how to disable FortiMail from offering STARTTLS.
Scope	FortiMail
Solution	Test the connection from [FortiMail Gateway] acting as an MTA and it is possible to see that FortiMail offers STARTTLS in the initial EHLO: Go to the target receiving host, in this case, it will be [FortiMail Server mode]. Go under Policy -> Access Control -> Receiving. Create a new Policy that defines the source IP and Recipient pattern. Under the TLS Profile, create a new TLS profile namely NO_STARTTLS with the TLS Option set to NONE. When performing a second test connection from [FortiMail Gateway], the result no longer offers STARTTLS in the initial connection.