You can use this listener to enforce TLS for submission:
https://github.com/i-MSCP/imsc…postfix_submission_tls.pl
This entry should be sufficient:
And I think, you do not want to use "tls_wrappermode" for submission - all latest mail clients are correctly using StartTLS.
CSF and LFD may be also an alternative: https://www.configserver.com/cp/csf.html
Pros:
* Easy to maintain
* Bruteforce detection
* Customizable with regex
* Build in Firewall, which is easy to configure
* Can work with any CMS which logs bad login attemptions (Custom Log and Custom Rules)
Cons:
* Firewall is limitted to in- and outgoing - not a blocker for I-MSCP
No, the name servers are not required to have an IPv6 address. They only point to the correct destination and are independent services.
Conclusion in your case:
Name servers have IPv4 (only)
Services may have: IPv4 & IPv6 or only IPv4 or only IPv6
I suspected that a reboot could be required after network changes.
I am not familiar with Hetzner, but I think if it is working, it is going to be ok 
Concerning /etc/hosts: This is up to you. As long as you have IPv4 entries in /etc/hosts, everything will work as expected It is not necessary to add the IPv6 address for Dualstack IPv4/IPv6 systems 
Did you add the address in automatic or manual mode? I added them manually. eth0 should be fine in your case
Your network configuration can look like this (as example):
There is no need to create a secondary/an alias interface
Update: Saw that you added it automatically - remove it and add the address manually. Also change/adjust your network settings based on my example and all should be fine
You do not have to - it is only for "monitoring" the services over the I-MSCP backend - some kind of status page within I-MSCP.
But I suggest to add the address under:
* Settings -> Address Management
You are fine with the shortened IPv6 address - it should work out of the box.
All of them are valid and the same address:
2041:0:140F::875B:131B
2041:0000:140F::875B:131B
2041:0:140F:0:0:0:875B:131B
2041:0000:140F:0000:0000:0000:875B:131B
If no prefix-length is given, /128 is assumed - your entry: ip6:2041:0000:140F::875B:131B, will be interpreted as: ip6:2041:0:140F::875B:131B/128
You can use a double colon to replace many 0 (zero) blocks in an IPv6-address - but it can only used once, so this address would be invalid: 2041::140F::875B:131B
Your SPF looks fine and you are using ~all, so no message should be rejected based on the SPF-Check.
I do not think that your issues with Outlook/Hotmail are related to your IPv6 change
I am not familiar with postfix and smarthost, but I think your configuration should be something like this:
In your case the MASTER CF_PARAMETERS can be empty.
What is logged in /var/log/mail.log after sending an email?
