STARTTLS Check — Does Your Mail Server Offer Encryption?

The other direction

The TLS transport analysis shows how your email arrived here — that is, how your server sends. This check reverses the direction: it connects to your domain's MX servers and examines how receiving is set up. The two can differ substantially, especially when inbound and outbound mail run through different systems.

Concretely, an SMTP connection is opened to the two most important MX hosts and the EHLO response is evaluated. If the server announces 250-STARTTLS there, any sender can deliver encrypted. If the announcement is missing, every incoming message reaches you in plaintext — no matter how well the sender is configured.

What AnalyzeMy.Email checks

• Reachability of the MX hosts on port 25
• STARTTLS announcement in the EHLO response, separately per MX host
• Successful TLS handshake — offered and actually working are two different things

The check runs within the same connection as the certificate analysis, so STARTTLS support and certificate details are evaluated together.

Why the result matters

Without STARTTLS on your MX servers, all inbound communication is unencrypted. The sender cannot tell before sending — their server attempts TLS, is not offered any, and delivers anyway, because opportunistic STARTTLS puts deliverability ahead of confidentiality.

There is a data protection angle too: where personal data travels by email, transport encryption counts as an appropriate technical measure under Art. 32 GDPR. An MX without STARTTLS is hard to justify in that context.

When STARTTLS is missing

• Postfix: set smtpd_tls_security_level = may and a valid key pair via smtpd_tls_cert_file and smtpd_tls_key_file.
• Don't forget the backup MX: the second MX is easily overlooked and then becomes the unencrypted back door.
• Check firewalls and proxies: some SMTP appliances strip the STARTTLS line from the EHLO response.
• Keep the certificate valid: an expired certificate can cause the server to stop offering TLS entirely.