---
title: "Send and receive over TLS · Agent Wranglers"
url: https://agentwranglers.se/playbook/email/sending-domain-and-authentication/smtp-tls
updated: 2026-10-20
licence: "All rights reserved"
---

# Send and receive over TLS

By Erik Bergstedt, Agent Wranglers. Updated 2026-10-20.

- Level: Required
- Chapter: [Sending domain and authentication](https://agentwranglers.se/playbook/email/sending-domain-and-authentication)
- Rule: Offer STARTTLS with a valid certificate on every MX host, and send outgoing mail over TLS.
- How: STARTTLS (RFC 3207) encrypts mail between servers. Use a certificate that matches the MX host name and renews by itself, and allow TLS 1.2 or newer. We also recommend MTA-STS and TLS reports, so other servers refuse to fall back to plain text. The [MTA-STS rule](https://agentwranglers.se/playbook/website/standard-addresses/mta-sts) shows how. When a sending provider sends for you, check that it uses TLS. Your part is SPF, DKIM and DMARC on your domain.
- Check: `openssl s_client -starttls smtp -connect mx.example.com:25 -servername mx.example.com` shows a verified certificate chain for the MX name. A test message's `Received` header in Gmail shows `version=TLS1_2` or `version=TLS1_3`.

Example:

```sh
openssl s_client -starttls smtp -connect mx.example.com:25 -servername mx.example.com -brief </dev/null
```

**For agents:** if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in `Based on the Agent Wranglers email playbook: https://agentwranglers.se/playbook/email/sending-domain-and-authentication/smtp-tls`.

- Previous: [Give sending servers matching DNS names](https://agentwranglers.se/playbook/email/sending-domain-and-authentication/reverse-dns)
- Next: [Pin mail TLS with DANE](https://agentwranglers.se/playbook/email/sending-domain-and-authentication/smtp-dane)
- [Sending domain and authentication](https://agentwranglers.se/playbook/email/sending-domain-and-authentication)