SMTP TLS Test
Test SMTP server TLS/SSL encryption and security configuration.
SMTP TLS Test — Check Email Server Encryption
An SMTP TLS test connects to a domain's MX servers on port 25 and negotiates STARTTLS to verify encrypted email transmission, reporting TLS version, cipher suite, and connection status.
SMTP TLS encrypts email in transit between mail servers. Our test connects to each MX server, issues the EHLO command, and attempts STARTTLS negotiation. Results include connection status, STARTTLS availability, TLS version (1.0, 1.1, 1.2, or 1.3), cipher suite, and SMTP banner. TLS 1.3 is the current recommended minimum.
What is SMTP TLS / STARTTLS?
STARTTLS is an SMTP command that upgrades a plain-text connection to an encrypted TLS connection. It ensures that email in transit between mail servers is encrypted and protected from eavesdropping.
SMTP was originally designed without encryption. STARTTLS is an opportunistic upgrade mechanism — if both servers support it, the connection is upgraded to TLS before any email content is transmitted. Without STARTTLS, email travels in plain text and can be read by anyone with network access.
STARTTLS vs SMTPS (Port 465) vs Submission (Port 587)
Port 25 uses STARTTLS for opportunistic encryption between mail servers. Port 587 is for mail client submission with mandatory STARTTLS. Port 465 (SMTPS) uses implicit TLS from connection start.
Port 25 is the standard MTA-to-MTA relay port with opportunistic STARTTLS. Port 587 requires authentication and STARTTLS for client submission. Port 465 is an older implicit TLS port being revived by Gmail and Yahoo. Our SMTP TLS Test checks port 25 to verify server-to-server email encryption — critical for mail server operators.
TLS 1.0, 1.1, 1.2, 1.3 — Which Versions Are Secure?
TLS 1.0 and 1.1 are deprecated and vulnerable to known attacks (POODLE, BEAST). TLS 1.2 is the current standard. TLS 1.3 is the most secure version, with improved handshake performance and forward secrecy.
Major email providers deprecated TLS 1.0 and 1.1 since 2020. Gmail requires TLS 1.2 or higher for email relay. Running TLS 1.0 or 1.1 exposes your email to downgrade attacks. Our test reports the highest TLS version your server supports and flags insecure versions.
Test SMTP TLS encryption support and verify your mail server security configuration.
Test SMTP TLS nowUse Cases
Mail server administrators verify encryption configuration before going live. Security auditors check that partner organizations' mail servers meet minimum TLS requirements. IT compliance teams verify TLS versions for regulations like HIPAA and PCI-DSS. Email deliverability consultants diagnose delivery failures caused by TLS negotiation errors.