Email TLS checker
Is mail to your domain encrypted on the way in? Enter a domain and we ask its mail server for STARTTLS, then show the TLS version and cipher you actually get.
The short version
- Encrypts mail in transit: STARTTLS was offered and the handshake worked. Check that the version is TLS 1.2 or 1.3.
- STARTTLS offered, handshake failed: senders that insist on encryption will fail to deliver. Look at the certificate first.
- No STARTTLS at all: mail to this domain moves in plain text. Turn it on at your mail host.
How STARTTLS turns a plain session into an encrypted one
Mail between servers starts unencrypted on port 25. STARTTLS is the command that upgrades that same connection to TLS before any address or message is sent. If the server doesn't list it after EHLO, there's nothing to upgrade to.
We run the check from our own servers, which have port 25 open. Your laptop almost certainly doesn't, which is why a local telnet test so often hangs.
| What you see | What it means | What to do |
|---|---|---|
| TLS 1.3 or 1.2, negotiated | Encrypted with a current version | Nothing; consider MTA-STS to require it |
| TLS 1.0 or 1.1, negotiated | Encrypted with a deprecated version | Upgrade the server or its TLS settings |
| Offered, not negotiated | The handshake broke | Check the certificate and the TLS settings |
| Not offered | Plain-text transport | Enable STARTTLS at your mail host |
TLS 1.0 and 1.1 deprecated by RFC 8996 (March 2021). STARTTLS for SMTP defined in RFC 3207.
Fixing a failed or missing handshake
Most failures come down to the certificate. It has expired, it names a different host than the MX record, or the chain is incomplete. The TLS negotiation failed guide covers each case with the error text you'll see in a bounce.
Want the whole session beyond encryption? The SMTP test shows the banner, every EHLO extension and the response time. And if you're about to mail a list at this domain, the bulk verifier checks each address on the same kind of session and closes before DATA.
Email TLS questions
How do I check if an email server supports TLS?
Connect to the domain's MX host on port 25, send EHLO and look for STARTTLS in the reply. Then send STARTTLS and complete the handshake to see the TLS version and cipher. ZapBounce's TLS checker runs both steps and shows the result in a few seconds.
What TLS version should a mail server use?
TLS 1.2 or 1.3. Versions 1.0 and 1.1 were formally deprecated by RFC 8996 in 2021, and many senders now refuse to negotiate them. A server that offers only the old versions should be upgraded.
Is email encrypted if STARTTLS is offered?
In transit between those two servers, yes, once the handshake succeeds. STARTTLS is opportunistic, so a sender can still fall back to plain text unless the domain publishes an MTA-STS policy that requires encryption.
Why does my TLS handshake fail?
The usual causes are an expired or mismatched certificate, a server that only speaks old TLS versions, or a filter in front of the server that breaks the handshake. The fix guide for TLS negotiation failures walks through each one.
A secure server still needs real addresses
Encryption protects mail in transit. Verification makes sure it goes to mailboxes that exist, and unknowns are never billed.