STARTTLS checker

The STARTTLS checker tests services that start as plain text and switch to TLS with a STARTTLS command: mail servers above all, but also FTP, XMPP and PostgreSQL. Pick the protocol, enter the host name and press Check SSL; the result page shows the same certificate, chain and protocol details as the SSL checker.

How to use it

1. Choose the protocol. The port is filled in for you (SMTP 25, submission 587, IMAP 143, POP3 110, FTP 21, XMPP 5222, PostgreSQL 5432) and you can change it.
2. Enter the server's host name. For inbound mail, look up your MX record first (dig MX example.com) and test that host, not the bare domain.
3. For implicit TLS ports choose SMTPS 465, IMAPS 993 or POP3S 995: these speak TLS immediately and do not use STARTTLS.

You can run the same test locally with OpenSSL:

openssl s_client -connect mail.example.com:587 -starttls smtp -servername mail.example.com </dev/null

STARTTLS vs implicit TLS

With STARTTLS the client first exchanges a few plain-text lines, then both sides upgrade the same connection to TLS. With implicit TLS the client starts the TLS handshake immediately. RFC 8314 (2018) recommends implicit TLS on 465 and 993/995 for mail clients; port 25 between servers always uses STARTTLS.

Common problems

• Certificate name mismatch: the certificate covers example.com but the MX host is mail.example.com. Add the MX host name as a SAN.
• Missing intermediate: mail software often reads only the leaf file. Configure the full chain (smtpd_tls_chain_files in Postfix, ssl_cert with the fullchain in Dovecot).
• Old protocols: TLS 1.0/1.1 are still common on mail servers; the TLS config generator has Postfix and Dovecot settings.
• DANE: if your domain publishes TLSA records, the certificate must match them; regenerate records with the TLSA generator before changing keys.