Can't receive mails from Gmail
TLDR: Your TLS protocols is too strict because you only allow TLSv1.2 connection.
smtpd_tls_mandatory_protocols = !SSLv2,!SSLv3,!TLSv1,!TLSv1.1
smtpd_tls_protocols=!SSLv2,!TLSv1,!TLSv1.1,!SSLv3
And GMAIL send email to your server with TLSv1 protocol. That's why TLS negotiation fails.
The obvious solution is allowing TLSv1 and TLSv1.1 protocols and still disabling (insecure) SSLv2 and SSLv3 protocols.
Explanation
I can confirm your case when failing to receive email from GMAIL and FACEBOOK over STARTTLS.
Why do only GMAIL who fails to send email to my server
This is the maillog snippet when GMAIL send email
Dec 19 23:37:47 tls postfix/smtpd[3876]: initializing the server-side TLS engine
Dec 19 23:37:47 tls postfix/smtpd[3876]: connect from mail-wg0-f47.google.com[74.125.82.47]
Dec 19 23:37:48 tls postfix/smtpd[3876]: setting up TLS connection from mail-wg0-f47.google.com[74.125.82.47]
Dec 19 23:37:48 tls postfix/smtpd[3876]: mail-wg0-f47.google.com[74.125.82.47]: TLS cipher list "aNULL:-aNULL:ALL:+RC4:@STRENGTH:!aNULL:!DES:!3DES:!MD5:!DES+MD5:!RC4:!RC4-MD5"
Dec 19 23:37:48 tls postfix/smtpd[3876]: SSL_accept:before/accept initialization
Dec 19 23:37:48 tls postfix/smtpd[3876]: SSL_accept:error in unknown state
Dec 19 23:37:48 tls postfix/smtpd[3876]: SSL_accept error from mail-wg0-f47.google.com[74.125.82.47]: -1
Dec 19 23:37:48 tls postfix/smtpd[3876]: warning: TLS library problem: error:140760FC:SSL routines:SSL23_GET_CLIENT_HELLO:unknown protocol:s23_srvr.c:647:
Dec 19 23:37:48 tls postfix/smtpd[3876]: lost connection after STARTTLS from mail-wg0-f47.google.com[74.125.82.47]
Dec 19 23:37:48 tls postfix/smtpd[3876]: disconnect from mail-wg0-f47.google.com[74.125.82.47]
And this is the maillog snippet when FACEBOOK send email
Dec 19 23:11:14 tls postfix/smtpd[3844]: initializing the server-side TLS engine
Dec 19 23:11:14 tls postfix/tlsmgr[3846]: open smtpd TLS cache btree:/var/lib/postfix/smtpd_scache
Dec 19 23:11:14 tls postfix/tlsmgr[3846]: tlsmgr_cache_run_event: start TLS smtpd session cache cleanup
Dec 19 23:11:14 tls postfix/smtpd[3844]: connect from outcampmail003.ash2.facebook.com[66.220.155.162]
Dec 19 23:11:14 tls postfix/smtpd[3844]: setting up TLS connection from outcampmail003.ash2.facebook.com[66.220.155.162]
Dec 19 23:11:14 tls postfix/smtpd[3844]: outcampmail003.ash2.facebook.com[66.220.155.162]: TLS cipher list "aNULL:-aNULL:ALL:+RC4:@STRENGTH:!aNULL:!DES:!3DES:!MD5:!DES+MD5:!RC4:!RC4-MD5"
Dec 19 23:11:14 tls postfix/smtpd[3844]: SSL_accept:before/accept initialization
Dec 19 23:11:15 tls postfix/smtpd[3844]: SSL_accept:error in unknown state
Dec 19 23:11:15 tls postfix/smtpd[3844]: SSL_accept error from outcampmail003.ash2.facebook.com[66.220.155.162]: -1
Dec 19 23:11:15 tls postfix/smtpd[3844]: warning: TLS library problem: error:140760FC:SSL routines:SSL23_GET_CLIENT_HELLO:unknown protocol:s23_srvr.c:647:
Dec 19 23:11:15 tls postfix/smtpd[3844]: lost connection after STARTTLS from outcampmail003.ash2.facebook.com[66.220.155.162]
Dec 19 23:11:15 tls postfix/smtpd[3844]: disconnect from outcampmail003.ash2.facebook.com[66.220.155.162]
Dec 19 23:11:16 tls postfix/smtpd[3844]: connect from outcampmail004.ash2.facebook.com[66.220.155.163]
Dec 19 23:11:17 tls postfix/smtpd[3844]: 962C281443: client=outcampmail004.ash2.facebook.com[66.220.155.163]
Dec 19 23:11:18 tls postfix/cleanup[3849]: 962C281443: message-id=<[email protected]>
Dec 19 23:11:18 tls postfix/qmgr[3843]: 962C281443: from=<[email protected]>, size=18002, nrcpt=1 (queue active)
Dec 19 23:11:18 tls postfix/local[3850]: 962C281443: to=<[email protected]>, orig_to=<[email protected]>, relay=local, delay=1.6, delays=1.5/0/0/0, dsn=2.0.0, status=sent (delivered to mailbox)
Dec 19 23:11:18 tls postfix/qmgr[3843]: 962C281443: removed
Dec 19 23:11:24 tls postfix/smtpd[3844]: disconnect from outcampmail004.ash2.facebook.com[66.220.155.163]
Some analysis
- In first snippet, GMAIL will try to send email over STARTTLS. When TLS negotiation, some error occurs, so GMAIL server disconnect it. We will discuss why the error occurring below.
- In second snippet, FACEBOOK also failing to send email over STARTTLS. In fallback process, FACEBOOK resend email with plain text mode. In this case our server happily accept it.
So, that's explain why only GMAIL fails to send email to your server. GMAIL doesn't have mechanism to fallback if TLS negotiation fails. Other mail server may use fallback mechanism to ensure the email delivery succeed.
Why TLS Negotiation error occurs
I spot interesting line from web.de maillog
Dec 19 17:33:15 foxdev postfix/smtpd[14105]: Anonymous TLS connection established from mout.web.de[212.227.15.3]: TLSv1.2 with cipher DHE-RSA-AES256-GCM-SHA384 (256/256 bits)
And find out that you specify this configuration in main.cf
smtpd_tls_mandatory_protocols = !SSLv2,!SSLv3,!TLSv1,!TLSv1.1
smtpd_tls_protocols=!SSLv2,!TLSv1,!TLSv1.1,!SSLv3
That means your server only accept TLS connection when TLSv1.2 used. Other than TLSv1.2, your server will complain TLS negotiation error.
If I change smtpd_tls_(mandatory_)protocols to !SSLv2,!SSLv3,!TLSv1, the error still occurs. That means GMAIL and FACEBOOK will attempt contact your mail server with protocols other than TLSv1.1 and TLSv1.2.
If I change smtpd_tls_(mandatory_)protocols to !SSLv2,!SSLv3, TLS negotiation will success. It confirm that GMAIL and FACEBOOK will contact your server with TLSv1 protocol
Dec 20 00:21:46 tls postfix/smtpd[4261]: Anonymous TLS connection established from outmail038.prn2.facebook.com[66.220.144.165]: TLSv1 with cipher ECDHE-RSA-AES256-SHA (256/256 bits)
Dec 20 00:23:00 tls postfix/smtpd[4261]: Anonymous TLS connection established from mail-wi0-f174.google.com[209.85.212.174]: TLSv1 with cipher ECDHE-RSA-AES256-SHA (256/256 bits)
Other folks in FreeBSD forum also confirm this behavior.
Solution
The obvious solution is enable TLSv1 and TLSv1.1 in your postfix. This will ensure some mail server who doesn't have fallback mechanism - like GMAIL - can still communicate with your server.
I don't know your reason to disable TLSv1 and TLSv1.1 support, leaving only TLSv1.2 protocol. If it is an webserver and your user will use modern browser only, then you can disable TLSv1 in your server. This is acceptable because only older browser who doesn't support protocol TLSv1.