Setting up TLS Encryption for Mail Server using Postfix - email

Question

I am trying to setup outbound TLS encryption for my postfix mail server.
I created a CSR, that had the following attributes:
Attributes:
Requested Extensions:
X509v3 Basic Constraints:
CA:FALSE
X509v3 Subject Key Identifier:
F5:B0:EC:DF:81:32:10:12:DC:60:86:54:D2:03:77:5C:21:C2:EA:2B
X509v3 Key Usage:
Digital Signature, Non Repudiation, Key Encipherment, Data Encipherment, Key Agreement
Netscape Cert Type:
SSL Client, SSL Server, S/MIME, Object Signing
I sent this CSR to a certificate authority (GoDaddy), and the cert that was returned had the following attributes:
X509v3 extensions:
X509v3 Basic Constraints: critical
CA:FALSE
X509v3 Extended Key Usage:
TLS Web Server Authentication, TLS Web Client Authentication
X509v3 Key Usage: critical
Digital Signature, Key Encipherment
X509v3 CRL Distribution Points:
For my postfix main.cf file:
### Client Side:
smtp_tls_security_level = may
smtp_use_tls = yes
smtp_tls_key_file = /etc/postfix/ca/mykey.pem
smtp_tls_cert_file = /etc/postfix/ca/mycert.pem
smtp_tls_CAfile = /etc/postfix/ca/gd_cacert.crt.pem
smtp_tls_loglevel = 3
However, when I send mail, and view the source of the received message, the header does not look like it has any TLS encryption:
Received: from ZZZZZZ by YYYYY with Microsoft SMTP Server (TLS) via Mailbox Transport;
Received: from YYYYY by XXXXXX with Microsoft SMTP Server (TLS) ;
Received: from XXXXX by office365 with Microsoft SMTP Server (TLS) id via Frontend Transport;
Authentication-Results: spf=none (sender IP is 000000 )
smtp.mailfrom=postfixserver; dkim=none (message not signed) dmarc=none action=none header.from= postfixserver;
Received-SPF: None (postfix server does not designate permitted sender hosts)
Received: from postfixserver by office365 (1.1.1.1) with Microsoft SMTP Server (TLS) via Frontend Transport;
Received: by postfixserver (Postfix, from userid 0)
Is there any cert/config setting that I am missing that would allow this functionality to work correctly?

Answer 1

Your Postfix main.cf config look correct. It could very well be you are already sending mail via TLS but your next hop is not showing it in the mail header.
I had a similar issue when sending to Microsoft (office365), gmail, and yahoo the mail header does not indicate I was sending via TLS and it was because I had a mismatch with my ssl cert. To verified I also sent mails to friends whose mail server were on-premise. Because their mail server weren't configured to strip out TLS from sender, the header show I was sending with TLS encryption but my cert authenticity could not be verified.
I suggest making sure your cert common name match your mail server domain name.