EMail, TLS and the home user

I recently discovered that my home mail server can't start a TLS session with a remote server. From talking to support it seems likely that something is interfering with the STARTTLS command - probably a firewall. Does anyone have any experience of this?

It's a home installation and the only things I can think of that might interfere are:

Windows 7 firewall.
NetGear wnr1000 router.
Avast AV (although I think I disabled port 25 checking on that a long time ago).

I'd be a bit surprised (maybe even impressed) if any of those did application level checking but the Windows 7 firewall is pretty advanced.

FWIW this from the session log:

28/1/2013 20:09:10.115 - M00000005<220 smtp2.ch2m.co.uk ESMTP
28/1/2013 20:09:10.115 - M00000005>EHLO xxxx.xxxx.xxxx
28/1/2013 20:09:10.147 - M00000005<250-smtp2.ch2m.co.uk
28/1/2013 20:09:10.147 - M00000005<250-8BITMIME
28/1/2013 20:09:10.147 - M00000005<250-SIZE 31457280
28/1/2013 20:09:10.147 - M00000005<250 STARTTLS
28/1/2013 20:09:10.147 - M00000005>STARTTLS
28/1/2013 20:09:10.209 - M00000005<500 #5.5.1 command not recognized

28/1/2013 20:09:10.147 - M00000005>STARTTLS
28/1/2013 20:09:10.209 - M00000005<500 #5.5.1 command not recognized

while not familiar with the syntax, this suggests the command is received but not supported or the format is wrong ?

In reply to a post by yarwell:

or the format is wrong ?

In reference to student.brighton.ac.uk/burks/internet/rfcs/rfcs/87/rfc2487.htm:

5. The STARTTLS Command

The format for the STARTTLS command is:

STARTTLS

with no parameters.

The line above says it is available:

In reply to a post by Andrue:

28/1/2013 20:09:10.147 - M00000005<250 STARTTLS

so is the server error referring to an (invisible) negotiation failing, or just generating an error in response to an apparently correct command ?

In reply to a post by yarwell:

so is the server error referring to an (invisible) negotiation failing, or just generating an error in response to an apparently correct command ?

Good question. According to support (and some web sites) it's possible for a firewall to block STARTTLS in order to ensure they can continue monitoring SMTP traffic. So the suspicion is that something (firewall or Avast) sees the STARTTLS in the data stream and does something to break it.

At present I'm suspicious of Avast. I did disable some aspect of it a couple of years ago on the server in order to allow mail to work but it's possible that it's still monitoring the connection in some way. Maybe all I did was tell it to allow incoming traffic on 25. Perhaps I need to tell it to bog off completely. I have found a lot of comments on forums regarding Avast and TLS. It would make sense that if it's trying to scan mail for viruses and other nasties it might want to prevent my server creating an encrypted connection.

It was Avast. I'm not sure what I did disable all those months ago but the solution this time was to disable scanning of outbound mail.