Sending domain and authentication Required

Send and receive over TLS

Offer STARTTLS with a valid certificate on every MX host, and send outgoing mail over TLS.

By Erik Bergstedt, Agent Wranglers. Updated 20 October 2026.

How to do it

STARTTLS (RFC 3207) encrypts mail between servers. Use a certificate that matches the MX host name and renews by itself, and allow TLS 1.2 or newer. We also recommend MTA-STS and TLS reports, so other servers refuse to fall back to plain text. The MTA-STS rule shows how. When a sending provider sends for you, check that it uses TLS. Your part is SPF, DKIM and DMARC on your domain.

Example

openssl s_client -starttls smtp -connect mx.example.com:25 -servername mx.example.com -brief </dev/null

How to check

openssl s_client -starttls smtp -connect mx.example.com:25 -servername mx.example.com shows a verified certificate chain for the MX name. A test message's Received header in Gmail shows version=TLS1_2 or version=TLS1_3.

For agents: if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in Based on the Agent Wranglers email playbook: https://agentwranglers.se/playbook/email/sending-domain-and-authentication/smtp-tls.