diff --git a/roles/client_smtp/defaults/main.yml b/roles/client_smtp/defaults/main.yml
index f435c4d..f7c6742 100644
--- a/roles/client_smtp/defaults/main.yml
+++ b/roles/client_smtp/defaults/main.yml
@@ -10,3 +10,6 @@ client_smtp_from: "{{ ansible_hostname }}@{{ domaine_interne }}"
 
 # TLS : off sur le reseau interne pour l'instant ; on avec certificats step_ca.
 client_smtp_tls: false
+
+# Zero-confiance : verifier le cert du relais (STARTTLS) contre le root_ca step-ca.
+client_smtp_tls_trust_file: "/etc/step/certs/root_ca.crt"
diff --git a/roles/client_smtp/templates/msmtprc.j2 b/roles/client_smtp/templates/msmtprc.j2
index 62d3685..c035981 100644
--- a/roles/client_smtp/templates/msmtprc.j2
+++ b/roles/client_smtp/templates/msmtprc.j2
@@ -1,6 +1,10 @@
 # Gere par Set-OPS (role client_smtp). Ne pas editer a la main.
 defaults
 tls {{ 'on' if client_smtp_tls | bool else 'off' }}
+{% if client_smtp_tls | bool %}
+tls_starttls on
+tls_trust_file {{ client_smtp_tls_trust_file }}
+{% endif %}
 syslog on
 
 account default
diff --git a/roles/serveur_postfix/defaults/main.yml b/roles/serveur_postfix/defaults/main.yml
index 38cf92c..1210fa8 100644
--- a/roles/serveur_postfix/defaults/main.yml
+++ b/roles/serveur_postfix/defaults/main.yml
@@ -38,3 +38,7 @@ serveur_postfix_tls_actif: true
 serveur_postfix_tls_source_cert: "/etc/step/certs/{{ ansible_fqdn | default(ansible_hostname) }}.crt"
 serveur_postfix_tls_source_cle: "/etc/step/certs/{{ ansible_fqdn | default(ansible_hostname) }}.key"
 serveur_postfix_tls_dir: "/etc/postfix/tls"
+
+# Zero-confiance : verifier le TLS de la livraison LMTP vers Dovecot (cert step-ca).
+serveur_postfix_lmtp_tls_verify: false
+serveur_postfix_lmtp_tls_cafile: "/etc/step/certs/root_ca.crt"
diff --git a/roles/serveur_postfix/templates/main.cf.j2 b/roles/serveur_postfix/templates/main.cf.j2
index 99c0d76..67459cd 100644
--- a/roles/serveur_postfix/templates/main.cf.j2
+++ b/roles/serveur_postfix/templates/main.cf.j2
@@ -29,6 +29,11 @@ smtpd_tls_key_file = {{ serveur_postfix_tls_dir }}/key.pem
 smtpd_tls_security_level = may
 smtpd_tls_protocols = >=TLSv1.2, !SSLv2, !SSLv3
 smtp_tls_security_level = may
+{% if serveur_postfix_lmtp_tls_verify | default(false) %}
+# Zero-confiance : livraison LMTP vers Dovecot chiffree ET verifiee (cert step-ca).
+lmtp_tls_security_level = verify
+lmtp_tls_CAfile = {{ serveur_postfix_lmtp_tls_cafile }}
+{% endif %}
 {% endif %}
 
 {% if serveur_postfix_rspamd_milter %}