What STARTTLS means
A receiving server that supports it advertises STARTTLS in its EHLO response. The client issues the command, the server answers 220, the two negotiate TLS, and the client re-sends EHLO before beginning the real transaction. The extension is RFC 3207. Everything before the handshake — the greeting, the EHLO, the capability list — travels in the clear.
Between mail servers the negotiation is opportunistic and unauthenticated. A sender that receives no offer, or a certificate that does not validate, almost always delivers in plaintext rather than not at all, and RFC 3207 expressly permits that choice. So anyone able to modify the stream can delete the STARTTLS line from the capability list and watch the session continue unencrypted — the stripping attack that MTA-STS and DANE exist to prevent.
Submission is a stricter case: a mail client on port 587 is expected to require TLS and to authenticate, and RFC 8314 recommends implicit TLS on port 465 for the same traffic. When testing a server, check that STARTTLS is offered on port 25, that the certificate is valid for the hostname the MX names and has not expired, and that the negotiated protocol version is a current one.
See it on your own domain. Every term in this glossary is something one of the eleven checks reads and reports.
Browse the lookupsKeep reading
Related checks, definitions and guides.