Why the mail server certificate matters
With classic opportunistic STARTTLS the sending server often does not validate the presented certificate at all — as long as the connection is encrypted. This laxity is historical and the reason expired or self-signed certificates on mail servers go unnoticed for years.
That changes as soon as MTA-STS in enforce mode or DANE enters the picture: the certificate is then validated strictly, and one that is expired or issued for the wrong hostname results in rejected delivery. Which is precisely why it pays to know the state of things before senders start enforcing it.
What AnalyzeMy.Email checks
A real SMTP connection is established to the two most important MX hosts, STARTTLS is negotiated and the certificate is parsed in full — first verified against the system CAs, and on failure additionally parsed unverified so that all details remain visible even for invalid certificates:
- Subject (common name and organization) and issuer (organization and CN)
- SAN list — every Subject Alternative Name on the certificate
- Hostname match — does the MX hostname match the CN or a SAN entry, including wildcard evaluation?
- Chain verification against the system CAs and detection of self-signed certificates
- Validity window from
not_beforetonot_after, days remaining, expired or not yet valid - Serial number and signature algorithm
- Key type and strength — RSA, EC, DSA, Ed25519 or Ed448 with bit size
- Negotiated TLS version, cipher suite and bit strength of the connection
Common findings
- Hostname mismatch: the certificate is issued for
server42.hoster.comwhile the MX ismail.yourdomain.com. Under MTA-STS enforce this causes rejection. - Self-signed: encrypted, yes, but without any authenticity — a man-in-the-middle would go unnoticed.
- Expired: often inconsequential under opportunistic TLS, an immediate delivery stop under DANE or MTA-STS.
- Incomplete chain: the server does not send the intermediate certificate. Some clients build the chain themselves, others fail.
- Weak key: RSA below 2048 bit should be replaced.
Practical tip
Issue the certificate for the MX hostname, not the mail domain. If you publish mail.yourdomain.com as your MX, that name must appear in the certificate — yourdomain.com alone is not enough. Automate renewal and make the mail server reload afterwards, otherwise it keeps the old certificate in memory.