Check TLS Encryption — The Email's Transport Path

How email gets encrypted — and how it doesn't

SMTP was designed without encryption. Today's common protection is called STARTTLS: the sending server asks during connection setup whether the recipient offers TLS and then upgrades the existing plaintext connection to an encrypted one. That protects the message across exactly one leg — from one server to the next.

The distinction matters: this is transport encryption, not end-to-end encryption. On every intermediate server the message exists in plaintext. And because STARTTLS is optional, a connection can silently end up unencrypted if one side does not cooperate or an attacker strips the TLS announcement from the stream.

What AnalyzeMy.Email checks

• TLS version of the connection your mail arrived on
• Cipher suite and negotiated key strength in bits
• Routing path: all Received headers are parsed and each hop is shown with whether that leg was encrypted

The data comes from the Received headers every server writes when accepting a message. That also reveals whether the mail already travelled unencrypted on earlier legs.

Assessing the result

• TLSv1.3 — current state of the art, faster handshake and only algorithms still considered secure. Full marks in the security score.
• TLSv1.2 — still secure and widely deployed, provided a strong cipher suite was negotiated.
• TLSv1.0 / TLSv1.1 — obsolete and formally deprecated since 2021. Should be switched off.
• NONE — the message was transmitted in plaintext. Anyone on the network path could read along.

For key strength: 256 bit is the target, 128 bit is acceptable, anything below is a problem.

TLS: NONE — what now?

Missing TLS is almost always caused by the sending mail server, not the recipient. Check in order:

• Does your server advertise STARTTLS in EHLO? In Postfix this is governed by smtp_tls_security_level for outbound and smtpd_tls_security_level for inbound connections.
• Is a valid certificate installed? Some servers silently refuse TLS when the certificate has expired.
• Is a firewall or SMTP proxy blocking the STARTTLS announcement? Some appliances actively strip it.

If you want to rule out downgrade attacks entirely, MTA-STS or DANE are unavoidable — both enforce TLS instead of merely offering it.