diff --git a/data/templates/postfix/main.cf b/data/templates/postfix/main.cf
index 045b8edd0..79a551a6c 100644
--- a/data/templates/postfix/main.cf
+++ b/data/templates/postfix/main.cf
@@ -18,35 +18,39 @@ append_dot_mydomain = no
 readme_directory = no
 
 # -- TLS for incoming connections
-# By default, TLS is disabled in the Postfix SMTP server, so no difference to
-# plain Postfix is visible. Explicitly switch it on with "smtpd_tls_security_level = may".
-smtpd_tls_security_level=may
+###############################################################################
+# generated 2020-04-03, Mozilla Guideline v5.4, Postfix 3.1.14, OpenSSL 1.1.1l, intermediate configuration
+# https://ssl-config.mozilla.org/#server=postfix&version=3.1.14&config=intermediate&openssl=1.1.1l&guideline=5.4
 
-# Sending AUTH data over an unencrypted channel poses a security risk.
-# When TLS layer encryption is optional ("smtpd_tls_security_level = may"), it
-# may however still be useful to only offer AUTH when TLS is active. To maintain
-# compatibility with non-TLS clients, the default is to accept AUTH without
-# encryption. In order to change this behavior, we set "smtpd_tls_auth_only = yes".
-smtpd_tls_auth_only=yes
+# (No modern conf support until we're on buster...)
+# {% if compatibility == "intermediate" %} {% else %} {% endif %}
+
+smtpd_use_tls = yes
+
+smtpd_tls_security_level = may
+smtpd_tls_auth_only = yes
 smtpd_tls_cert_file = /etc/yunohost/certs/{{ main_domain }}/crt.pem
 smtpd_tls_key_file = /etc/yunohost/certs/{{ main_domain }}/key.pem
-smtpd_tls_exclude_ciphers = aNULL, MD5, DES, ADH, RC4, 3DES
+smtpd_tls_mandatory_protocols = !SSLv2, !SSLv3, !TLSv1, !TLSv1.1
+smtpd_tls_protocols = !SSLv2, !SSLv3, !TLSv1, !TLSv1.1
+smtpd_tls_mandatory_ciphers = medium
+
+# curl https://ssl-config.mozilla.org/ffdhe2048.txt > /path/to/dhparam.pem
+# not actually 1024 bits, this applies to all DHE >= 1024 bits
+# smtpd_tls_dh1024_param_file = /path/to/dhparam.pem
+
+tls_medium_cipherlist = ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384
+tls_preempt_cipherlist = no
+###############################################################################
 smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache
 smtpd_tls_loglevel=1
-{% if compatibility == "intermediate" %}
-smtpd_tls_mandatory_protocols=!SSLv2,!SSLv3
-{% else %}
-smtpd_tls_mandatory_protocols=!SSLv2,!SSLv3,!TLSv1,!TLSv1.1
-{% endif %}
-smtpd_tls_mandatory_ciphers=high
-smtpd_tls_eecdh_grade = ultra
 
 # -- TLS for outgoing connections
 # Use TLS if this is supported by the remote SMTP server, otherwise use plaintext.
 smtp_tls_security_level=may
 smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache
-smtp_tls_exclude_ciphers = $smtpd_tls_exclude_ciphers
-smtp_tls_mandatory_ciphers= $smtpd_tls_mandatory_ciphers
+smtp_tls_exclude_ciphers = aNULL, MD5, DES, ADH, RC4, 3DES
+smtp_tls_mandatory_ciphers= high
 smtp_tls_loglevel=1
 
 # Configure Root CA certificates
@@ -167,4 +171,4 @@ default_destination_rate_delay = 5s
 # By default it's possible to detect if the email adress exist
 # So it's easly possible to scan a server to know which email adress is valid
 # and after to send spam
-disable_vrfy_command = yes
\ No newline at end of file
+disable_vrfy_command = yes