SMTP STARTTLS Explained: How Email TLS Works
STARTTLS lets an SMTP connection that begins in plaintext request an upgrade to encrypted TLS. Diagnostic tools can inspect SMTP connectivity, STARTTLS advertisement, TLS negotiation, certificates and ciphers.
SMTP before STARTTLS
An SMTP client connects to the server and receives a greeting. After EHLO, the server can advertise supported extensions.
If STARTTLS is advertised, the client can issue the STARTTLS command and attempt to negotiate TLS.
What a STARTTLS checker can observe
A checker can test TCP connectivity, read the SMTP response, inspect advertised capabilities and attempt the STARTTLS command.
When the handshake succeeds, the resulting TLS connection can expose cipher and certificate metadata.
Why SMTP testing is network dependent
Many VPS and hosting providers restrict outbound SMTP connections to reduce abuse. Remote mail systems may also behave differently depending on source network or policy.
Therefore an unreachable SMTP server from a specific diagnostic host is not automatically evidence that the target domain is broken.
Certificates and ciphers
After TLS negotiation, a diagnostic service may inspect certificate subject, issuer and validity information together with the negotiated cipher.
These observations complement policy-layer technologies such as MTA-STS, TLS-RPT and DANE.
Free email diagnostics
FreeMailCheck provides free tools for SPF, DKIM, DMARC, DNS, SMTP, TLS, reverse DNS, email headers and sender compliance.
Browse all 61 tools →