Docker中Postfix配置Let's Encrypt证书后无法通过TLS发送邮件至Gmail的问题求助

各位好，我碰到了一个Postfix在Docker容器里的TLS发送问题，折腾好一阵没解决，想请大家帮忙看看。

环境与配置情况 #

• Postfix部署在Docker容器内，证书是用Certbot生成的Let's Encrypt证书
• 当前Postfix核心TLS配置如下：

smtpd_tls_cert_file=/var/keys/fullchain.pem
smtpd_tls_key_file=/var/keys/privkey.pem
smtpd_use_tls=yes
smtp_tls_security_level = encrypt

遇到的问题 #

每次尝试给Gmail发邮件时，都会收到延迟投递的错误：

status=deferred (TLS is required but was not offered by host alt1.aspmx.l.google.com)

如果把smtp_tls_security_level改成may，邮件确实能发出去，但完全没有使用TLS，这显然不是我想要的解决方式。

另外，我用openssl做过TLS连接检查，结果显示一切正常，但Postfix就是没法在发送邮件时启用TLS加密。

调试日志（禁用IPv6并添加debug_peer_list后） #

Feb  8 10:50:24 92d95fdf2397 postfix/cleanup[489]: 2910E1667CE: message-id=<152ab11ab7027719630ac639f395ba9a@swift.generated>
Feb  8 10:50:24 92d95fdf2397 postfix/qmgr[481]: 2910E1667CE: from=<acc@service.example.net>, size=6181, nrcpt=1 (queue active)
Feb  8 10:50:24 92d95fdf2397 postfix/smtp[490]: initializing the client-side TLS engine
Feb  8 10:50:24 92d95fdf2397 postfix/smtpd[485]: disconnect from ec2-54-154-126-37.eu-west-1.compute.amazonaws.com[54.154.126.37]
Feb  8 10:50:24 92d95fdf2397 postfix/smtp[490]: 2910E1667CE: enabling PIX workarounds: disable_esmtp delay_dotcrlf for aspmx.l.google.com[66.102.1.26]:25
Feb  8 10:50:24 92d95fdf2397 postfix/smtp[490]: 2910E1667CE: TLS is required, but was not offered by host aspmx.l.google.com[66.102.1.26]
Feb  8 10:50:24 92d95fdf2397 postfix/smtp[490]: 2910E1667CE: enabling PIX workarounds: disable_esmtp delay_dotcrlf for alt1.aspmx.l.google.com[142.250.153.27]:25
Feb  8 10:50:24 92d95fdf2397 postfix/smtp[490]: 2910E1667CE: TLS is required, but was not offered by host alt1.aspmx.l.google.com[142.250.153.27]
Feb  8 10:50:24 92d95fdf2397 postfix/smtp[490]: 2910E1667CE: enabling PIX workarounds: disable_esmtp delay_dotcrlf for alt2.aspmx.l.google.com[142.251.9.27]:25
Feb  8 10:50:24 92d95fdf2397 postfix/smtp[490]: 2910E1667CE: TLS is required, but was not offered by host alt2.aspmx.l.google.com[142.251.9.27]
Feb  8 10:50:24 92d95fdf2397 postfix/smtp[490]: smtp_stream_setup: maxtime=300 enable_deadline=0
Feb  8 10:50:24 92d95fdf2397 postfix/smtp[490]: < aspmx3.googlemail.com[142.251.9.27]:25: 220 ********************************************************************************
Feb  8 10:50:24 92d95fdf2397 postfix/smtp[490]: name_mask: disable_esmtp
Feb  8 10:50:24 92d95fdf2397 postfix/smtp[490]: name_mask: delay_dotcrlf
Feb  8 10:50:24 92d95fdf2397 postfix/smtp[490]: 2910E1667CE: enabling PIX workarounds: disable_esmtp delay_dotcrlf for aspmx3.googlemail.com[142.251.9.27]:25
Feb  8 10:50:24 92d95fdf2397 postfix/smtp[490]: > aspmx3.googlemail.com[142.251.9.27]:25: HELO mail.example.net
Feb  8 10:50:24 92d95fdf2397 postfix/smtp[490]: < aspmx3.googlemail.com[142.251.9.27]:25: 250 mx.google.com at your service
Feb  8 10:50:24 92d95fdf2397 postfix/smtp[490]: server features: 0x30000 size 0
Feb  8 10:50:24 92d95fdf2397 postfix/smtp[490]: 2910E1667CE: TLS is required, but was not offered by host aspmx3.googlemail.com[142.251.9.27]
Feb  8 10:50:24 92d95fdf2397 postfix/smtp[490]: smtp_stream_setup: maxtime=300 enable_deadline=0
Feb  8 10:50:24 92d95fdf2397 postfix/smtp[490]: > aspmx3.googlemail.com[142.251.9.27]:25: QUIT
Feb  8 10:50:24 92d95fdf2397 postfix/smtp[490]: name_mask: resource
Feb  8 10:50:24 92d95fdf2397 postfix/smtp[490]: name_mask: software
Feb  8 10:50:24 92d95fdf2397 postfix/smtp[490]: 2910E1667CE: enabling PIX workarounds: disable_esmtp delay_dotcrlf for aspmx2.googlemail.com[142.250.153.27]:25
Feb  8 10:50:24 92d95fdf2397 postfix/smtp[490]: 2910E1667CE: to=<kamil+bdosr@example.com>, relay=aspmx2.googlemail.com[142.250.153.27]:25, delay=0.37, delays=0.05/0.01/0.31/0, dsn=4.7.4, status=deferred (TLS is required, but was not offered by host aspmx2.googlemail.com[142.250.153.27])

有没有大佬能帮我分析下哪里出问题了？感谢！

备注：内容来源于stack exchange，提问作者Chrzanek