Prontuno
Pricing
AI

Appearance

Log in Request access
Tools

ToolsMail servers

Free SMTP TLS checker and STARTTLS test

SMTP TLS encrypts email while it moves between mail servers. Mail servers use port 25, 587, or 465 for TLS. Enter a hostname to test STARTTLS and certificate status.

Background

What is SMTP TLS?

SMTP TLS encrypts email while it moves between mail servers. With STARTTLS, a server upgrades a plaintext SMTP connection to TLS after connecting. With implicit TLS, the connection is encrypted from the start. Both protect messages in transit, but only when the server offers TLS and the handshake succeeds.

How to read the result

STARTTLS upgrades a plaintext SMTP connection to TLS. Implicit TLS encrypts the connection from the start. A passing result means the server negotiated TLS and presented a certificate that can be validated.

Certificate and hostname problems do not always stop delivery, but they prevent senders from verifying they reached the right server.

Coverage

What this tool checks

  • MX lookup when you enter a domain, so every receiving server is tested
  • Whether each server accepts a connection on the port you choose (25 by default)
  • STARTTLS support, or implicit TLS on ports such as 465
  • The TLS version and cipher negotiated, with a warning for outdated versions
  • Whether the certificate is trusted, unexpired, and issued for the hostname

Reference

SMTP ports

Port Used for TLS mode
25 Delivery between mail servers, including to MX hosts. STARTTLS
587 Submission from apps and mail clients. STARTTLS
465 Submission from apps and mail clients. Implicit TLS

Troubleshooting

Common problems and how to fix them

STARTTLS not offered
Enable TLS on the mail server, and confirm the test reached the intended host and port.
Certificate expired
Install a current certificate and restart or reload the mail service so SMTP connections use it.
Hostname mismatch
Use a certificate that covers the mail server’s hostname, or point the MX record at a hostname the certificate covers.
Connection failed
Check firewall rules, the MX targets, and whether the server accepts public connections on that port. Some networks block outbound port 25.

Example

Server:      mx1.example.net:25
TLS mode:    STARTTLS
TLS version: TLS 1.3
Certificate: mx1.example.net, valid until 2027-03-01
A healthy result shows TLS support, a current TLS version, and a valid certificate that matches the hostname.

FAQ

Questions about SMTP TLS

What is STARTTLS?
STARTTLS is an SMTP command that upgrades an existing plaintext connection to an encrypted TLS connection.
Which port should I test?
Use port 25 for server-to-server delivery, which is what MX records receive on. Use 587 for message submission with STARTTLS, or 465 for submission with implicit TLS.
Should I test a domain or a mail server hostname?
Enter a domain to test every server in its MX records. Enter a hostname to test one server directly.
Does TLS guarantee delivery?
No. TLS protects the message in transit. Authentication, sender reputation, content, and the receiver’s policies still decide delivery.

Keep checking

Related tools

  • MX record checker

    Find the mail servers that receive email for a domain and compare their priorities.

  • PTR and reverse DNS checker

    Look up the reverse DNS (PTR) hostname for an IP address and confirm it resolves back to the same address.

  • DNS record checker

    Look up A, AAAA, CNAME, MX, TXT, NS, CAA, and SOA records.

Sending with Prontuno?

SMTP relay

Connect existing apps over SMTP.

About SMTP relay
Specifications
RFC 3207: SMTP Service Extension for Secure SMTP over TLS (opens in a new tab)
RFC 8314: Cleartext Considered Obsolete: Use of TLS for Email Submission and Access (opens in a new tab)