How can TLS be disabled for certain domains?

[theshilovs]

Some SMTP mail servers have incorrectly configured certificate chains, causing Zone-MTA to connect to them but messages are not sent due to a connection timeout of 3 minutes:
"Network error: Error connecting to 193.232.108.69. Timeout"

How can TLS be disabled for certain domains?

[theshilovs]

It turns out this is not a certificate chain issue. Even after the certificate chain problem was fixed on the receiving server, the error remained the same. So far, it's been identified on only one mail domain. How are such cases resolved?

[NickOvt]

Use a dedicated sending zone with TLS disabled and route those domains to it.

Example in config/default.js:

zones: {
default: {
// ...
},
no_tls: {
ignoreTLS: true, // do not use STARTTLS
secure: false, // do not start in TLS mode
recipientDomains: ['example.com', 'legacy.example']
}
}

Routing options are in README.md and lib/sending-zone.js (recipientDomains/senderDomains/routingHeaders). If MTA-STS is enabled and enforces TLS for a domain, ZoneMTA will override ignoreTLS; you’d need to disable MTA-STS globally (config/default.js) or set
routing.mxData.skipSTS = true in a queue:route plugin for those specific domains.

[NickOvt]

Additionally, after manually testing this is the picture I see. It seems they have disabled STARTTLS on port 25 alltogether. @theshilovs