For me it was: * make sure that SPF is set on my DNS * make sure that all my IP addresses (including IPv6) have correct reverse lookups * enable opportunisti

For me it was: * make sure that SPF is set on my DNS * make sure that all my IP addresses (including IPv6) have correct reverse lookups * enable opportunistic TLS support on postfix ("smtp_tls_security_level=may") That last one made the difference for me, but I'd done the previous steps already so it could well require all of them.