StartTLS

What is StartTLS?

StartTLS is an email security protocol command that upgrades an existing plaintext connection to an encrypted one using Transport Layer Security (TLS). It is supported by mail transmission protocols such as SMTP, IMAP, and POP3, allowing secure communication between mail servers without requiring a separate port for encryption.

StartTLS was introduced to improve the confidentiality and integrity of email in transit. It prevents attackers from intercepting or tampering with messages as they move between servers. Although it uses the same cryptographic foundations as HTTPS, StartTLS is a command issued within existing email protocols rather than a standalone service.

How StartTLS Works

When an email is transmitted using SMTP, the sending and receiving servers initially communicate in plaintext. During this handshake, the sending server checks if the recipient server supports StartTLS. If both systems agree, the session is upgraded to a TLS-encrypted connection before message data is exchanged.

Example command flow:

Benefits of StartTLS

• Encrypts messages in transit, preventing data interception
• Provides backward compatibility with non-TLS servers
• Supports modern authentication mechanisms
• Works with MTA-STS to enforce secure mail delivery

However, because StartTLS is opportunistic, some connections may still occur without encryption if either side does not support TLS. To enforce encryption, organizations can deploy MTA-STS or DANE policies.

StartTLS and DMARCeye

DMARCeye monitors email authentication and transport security to identify where StartTLS is being used or omitted across domains. By correlating mail flow and encryption data, using both AI technologies and smart programming, it helps organizations verify whether messages are being sent securely between servers.

Through its visibility into both authentication and transmission layers, DMARCeye ensures that messages not only pass SPF, DKIM, and DMARC checks but also travel securely using TLS-based encryption.

Sign up for a free trial of DMARCeye today and secure your email domain from spoofing.

To learn more about DMARC and DMARC-related terms, explore the DMARCeye Glossary.