i recently begin to see domains give connection timeout posttls-finger -l none gmail.dki use -l none here in case it was just openssl problem, in gentoo last openssl is compiled without weak-ssl-ciphers
postfix version 3.6.5 with default smtp_* for ciphers is others see same problems ?
