Postfix has released version 3.10.3 (stable) addressing two TLS-related bugs introduced in the 3.10.0 release. The update ensures that the TLS security level is now included in SMTP connection cache keys, preventing connections from being reused between messages with different TLS requirements. It also stops the SMTP client from performing DANE TLSA lookups when a message explicitly opts out of TLS (“TLS-Required: no”), avoiding unnecessary delivery failures.
These changes affect deployments using the default tls_required_enable = yes setting introduced in 3.10. Administrators enforcing TLS on outbound mail should upgrade promptly to prevent policy violations and reduce TLS-related bounces.
Full details: Postfix 3.10.3 Announcement
