UTM SMTP TLS1.2 enabled - SSL routines:SSL23_GET_CLIENT_HELLO:unknown protocol - No NDR to sender

Question

Hi all, 
 as i can't barely find any information on this: 
 We have set TLS v1.2 as the minimum requirement for SMTP communications (Email Protection -> SMTP - Advanced - TLS Settings). After having a look at the logfiles, there are many connections that have been refused due to this setting (SSL routines:SSL23_GET_CLIENT_HELLO:unknown protocol), which is generally ok for security purposes. But there are also some client, that are obviously still using older protocols, so those Emails are also refused. We have assumed that anyone in this case would get an NDR but this does not seem to be the case (in our configuration?). We are aware that we can exclude those client domains but first of all you (and the client) have to know about it without digging in the logs. This is the case we have now: Client mail got lost without knowing about it on both sides. 
 So the question is: is this the standard behavior or is there a way to enforce NDR? 
 System: UTM 9.705-3 / Exchange 2019 
 Kind regards 
 Dennis

BAlfson · Answer

Hallo Dennis and welcome to the UTM Community! 
 You don't have to dig through the logs manually. To get an ordered list of the rejections in March 2021, execute the following at the command line: 
 zgrep 'SSL23_GET_CLIENT_HELLO' /var/log/smtp/2021/03/*|grep -oP 'from .*? \['|sort -n|uniq -c 
 Or to just see the ones from 16 March through 22 March: 
 zgrep 'SSL23_GET_CLIENT_HELLO' /var/log/smtp/2021/03/smtp-2021-03-{16,22}.log.gz|grep -oP 'from .*? \['|sort -n|uniq -c 
 That's what I recommend doing every week or two after enabling a minimum of TLS v1.2. I just tried that on our SMTP Proxy and see that mails from almost 200 entities have been rejected so far in March - every one likely would have been stopped by anti-spam. When you see a customer/supplier in the list, email them about their exposure so that they know they need to upgrade. You'll be doing them a favor since TLS v1.2 has been required in Germany and all of the EU for years as a part of GDPR. 
 Cheers - Bob