SSL/TLS for Email: SMTP Encryption Explained

SSL/TLS for email encrypts the connection used to submit, relay, or retrieve messages. In SMTP, encryption usually happens through STARTTLS, where a plain SMTP connection upgrades to TLS. This protects mail in transit, but it does not encrypt the message after it reaches the recipient's mailbox.

RFC 3207 defines the SMTP STARTTLS extension, which lets SMTP clients and servers use TLS for private, authenticated communication over the internet (RFC 3207). That is the foundation most senders mean when they say "TLS email delivery."

Table of contents

What is SSL/TLS for email?

SSL/TLS is transport encryption for email connections. SSL is the older name; TLS is the modern protocol family. In email, TLS can protect submission from a mail client to a sending server, relay from one mail server to another, and retrieval through IMAP or POP.

The important boundary: TLS protects the pipe, not the stored message. Once mail reaches a mailbox provider, it can be stored, scanned, indexed, forwarded, or downloaded according to that provider's systems and the user's settings. If you need message-level secrecy, look at S/MIME or PGP, not just SMTP TLS.

How does STARTTLS work?

STARTTLS begins as a normal SMTP session. The receiving server advertises STARTTLS in its capabilities. The sending server asks to upgrade. If both sides agree, they negotiate TLS and continue the SMTP conversation inside the encrypted connection.

Simplified flow:

S: 220 mx.example.com ESMTP
C: EHLO sender.example
S: 250-STARTTLS
C: STARTTLS
S: 220 Ready to start TLS
... TLS negotiation ...
C: EHLO sender.example
C: MAIL FROM:<bounce@example.com>

The catch is opportunistic delivery. Traditional SMTP prefers delivery over encryption. If TLS fails and no stricter policy is active, some senders may fall back to unencrypted delivery. RFC 8689 describes REQUIRETLS because opportunistic STARTTLS is limited from a security standpoint (RFC 8689).

What is the difference between SSL, TLS, and STARTTLS?

TLS is the protocol. SSL is the older, imprecise label many people still use. STARTTLS is the SMTP command used to upgrade a connection to TLS.

Term	Meaning	Email context
SSL	Old protocol name	Often used casually to mean TLS
TLS	Modern transport encryption	Encrypts SMTP, IMAP, POP, and HTTPS connections
STARTTLS	Upgrade command	Turns an SMTP session into a TLS-protected session
MTA-STS	Policy layer	Tells senders to require valid TLS for your domain

Use our MTA-STS generator if you want a starting policy for stricter inbound transport security.

What ports should you use?

For sending from an app or mail client, use port 587 with STARTTLS in most cases. Port 465 is implicit TLS submission and is also common. Port 25 is for server-to-server SMTP delivery, not normal client submission.

For mailbox retrieval, IMAPS usually uses 993 and POP3S uses 995. These are different from SMTP delivery. Do not mix them up when configuring an application.

RFC 8314 documents modern guidance for cleartext-considered-obsolete mail access and recommends TLS-protected submission and access patterns (RFC 8314). The short version: avoid cleartext credentials and prefer encrypted submission and retrieval.

How do you check whether email used TLS?

Check the message headers. Received: lines often include tokens such as with ESMTPS and TLS comments that name the protocol and cipher. They are not perfectly consistent, but they are useful. Our email header analyzer can parse those traces.

Example:

with ESMTPS id abc123
(version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384);

When you review a real header, look for the receiving server's trace line rather than the visible From: field. The TLS details usually live inside a Received: header comment, close to the queue ID and timestamp. If the trace shows plain SMTP across a public hop, investigate the sending route.

TLS does not replace SPF, DKIM, or DMARC. TLS protects transport; authentication proves sending identity. Use both.

Key takeaways

• TLS encrypts email connections, not the stored message itself.
• STARTTLS upgrades SMTP to TLS when both sides support it.
• MTA-STS and REQUIRETLS exist because opportunistic TLS can fall back.

Frequently asked questions

Is email SSL the same as TLS?

People often say SSL, but modern email systems use TLS. SSL is the older protocol family and should not be the target for current configurations.

Does TLS make email fully private?

No. TLS protects the connection between servers or between a client and server. It does not encrypt the message end-to-end after delivery.

How can I tell if an email used TLS?

Inspect the Received: headers for ESMTPS, STARTTLS, TLS version, or cipher details. Header formats vary by provider.

Related resources

• MTA-STS generator
• Email header analyzer
• SPF, DKIM, and DMARC for developers
• SSL/TLS glossary