Glossary
DE / EN

Mail transport & reputation

What is STARTTLS? SMTP Service Extension for Secure SMTP over TLS explained

STARTTLS upgrades a running SMTP connection to encryption. If a mail server does not offer it, email travels across the network in plain text.

How STARTTLS works

Mail servers initially talk to each other unencrypted on port 25. After the greeting (EHLO) the receiving server lists its capabilities; if STARTTLS is among them, the sender can encrypt the connection with TLS before the message is transferred.

The server presents a certificate. Plain STARTTLS accepts any certificate – but MTA-STS in enforce mode requires one from a public certificate authority that matches the MX hostname, and DANE requires one that matches the TLSA record.

The Domain Trust Check opens a real SMTP session with the mail servers (EHLO, STARTTLS, QUIT) but never sends an email.

Example

$ openssl s_client -starttls smtp -connect mx1.example.com:25 -servername mx1.example.com
250-mx1.example.com
250-STARTTLS
…
Protocol: TLSv1.3
Verify return code: 0 (ok)

You can test STARTTLS yourself with this command; "Verify return code: 0" means a valid certificate.

Common mistakes

  • A self-signed certificate or one for a different hostname – STARTTLS works, but MTA-STS enforce does not.
  • An expired certificate because automatic renewal only reloads the web server, not the mail server.
  • Only TLS 1.0/1.1 enabled – modern senders refuse these versions.

How the Domain Trust Check rates STARTTLS

Criterion “Mail server TLS (STARTTLS)” (weight 4 of 5): A real SMTP session with the mail servers on port 25 (no mail sent): STARTTLS offered, certificate trusted and matching the MX hostname, remaining validity and TLS 1.2/1.3.

Standard: RFC 3207, RFC 8314

Related terms