Does my mail server support STARTTLS and have a valid certificate?
MX STARTTLS high Email transport · 10 of 100 points
What it inspects
For up to 3 MX hosts (lowest preference first, up to 2 public addresses each), this scanner reads the SMTP banner, sends EHLO, sends STARTTLS if offered, completes the TLS handshake and sends QUIT. It never sends MAIL, RCPT or DATA, and never sends mail. Verdicts: PASS when every probed address offers STARTTLS with a valid, unexpired certificate for the MX hostname and TLS 1.2 or newer. WARN for an invalid or expired certificate, a handshake that could not complete, or TLS below 1.2. FAIL when an MX does not offer STARTTLS, or the certificate is invalid while MTA-STS is in enforce mode (mail will bounce). Verdicts are judged on the addresses we could reach; unreachable addresses are noted but not judged. Not applicable if the domain does not receive mail. SKIP if no address could be reached (port 25 blocked or unreachable from our server) or none is public.
Why it matters
Without STARTTLS, mail to your domain crosses the internet in plain text. An invalid certificate does not stop opportunistic delivery, but it blocks senders that require verified TLS, and it is fatal once you enforce MTA-STS.
How to verify by hand
# bash
dig +short MX example.com
# PowerShell
Resolve-DnsName -Name example.com -Type MX
# bash or PowerShell, if OpenSSL is installed: test the handshake against a host it names
openssl s_client -starttls smtp -connect mail.example.com:25 -servername mail.example.comHow to fix
Enable STARTTLS on the mail server with a public-CA certificate that names the MX hostname, and allow TLS 1.2 or newer.
-
Issue a certificate for the MX hostname (for example mail.example.com), not the bare domain, from a public CA.
-
Configure the mail server to offer STARTTLS with that certificate and to allow TLS 1.2 and 1.3.
-
Set up automatic renewal and reload so the certificate never expires.