STARTTLS is an extension to SMTP that lets two mail servers turn an existing plain-text connection into an encrypted one. Rather than using a separate secure port, the sending server issues the STARTTLS command after connecting, and if the receiving server advertises support, both sides negotiate TLS and continue the conversation in private.
It matters because, without it, email between servers crosses the internet as readable text, exposing message contents and credentials to interception. STARTTLS makes opportunistic encryption the norm for server-to-server delivery.
Its weakness is that the upgrade is optional and unauthenticated by default, so an attacker positioned in the path can strip the offer (a downgrade attack) and force the connection back to plain text. MTA-STS and DANE close this gap by requiring TLS and validating the server certificate, and TLS-RPT reports when negotiation fails.
To check STARTTLS on a domain, test its MX hosts on port 25 and confirm they advertise the command and present a valid certificate. Pairing STARTTLS with MTA-STS or DANE turns best-effort encryption into enforced, tamper-resistant transport security.
Check it on your domain
- MTA-STS Checker: checks the MTA-STS record and the hosted policy file.
- TLS-RPT Checker: validates the TLS-RPT reporting record.
- SMTP Test: resolves a domain's mail servers and probes SMTP.