# STARTTLS Checker: Test SMTP, IMAP, POP3 and FTP TLS

> Check TLS on mail and other STARTTLS services: SMTP 25/587, IMAP 143, POP3 110, FTP, XMPP, PostgreSQL, plus 465/993/995.

Source: https://ssl.sh/tools/starttls-checker/
Last updated: 2026-11-10

Test the TLS setup of mail servers and other services that upgrade a plain connection with STARTTLS.

The STARTTLS checker tests services that start as plain text and switch to TLS with a `STARTTLS` command: mail servers above all, but also FTP, XMPP and PostgreSQL. Pick the protocol, enter the host name and press **Check SSL**; the result page shows the same certificate, chain and protocol details as the [SSL checker](https://ssl.sh/tools/ssl-checker/).

## How to use it

1. Choose the protocol. The port is filled in for you (SMTP 25, submission 587, IMAP 143, POP3 110, FTP 21, XMPP 5222, PostgreSQL 5432) and you can change it.
2. Enter the server's host name. For inbound mail, look up your MX record first (`dig MX example.com`) and test that host, not the bare domain.
3. For implicit TLS ports choose SMTPS 465, IMAPS 993 or POP3S 995: these speak TLS immediately and do not use STARTTLS.

You can run the same test locally with OpenSSL:

```bash
openssl s_client -connect mail.example.com:587 -starttls smtp -servername mail.example.com </dev/null
```

## STARTTLS vs implicit TLS

With STARTTLS the client first exchanges a few plain-text lines, then both sides upgrade the same connection to TLS. With implicit TLS the client starts the TLS handshake immediately. RFC 8314 (2018) recommends implicit TLS on 465 and 993/995 for mail clients; port 25 between servers always uses STARTTLS.

## Common problems

- **Certificate name mismatch**: the certificate covers `example.com` but the MX host is `mail.example.com`. Add the MX host name as a SAN.
- **Missing intermediate**: mail software often reads only the leaf file. Configure the full chain (`smtpd_tls_chain_files` in Postfix, `ssl_cert` with the fullchain in Dovecot).
- **Old protocols**: TLS 1.0/1.1 are still common on mail servers; the [TLS config generator](https://ssl.sh/tools/tls-config-generator/) has Postfix and Dovecot settings.
- **DANE**: if your domain publishes TLSA records, the certificate must match them; regenerate records with the [TLSA generator](https://ssl.sh/tools/tlsa-generator/) before changing keys.


## FAQ

**Which port should I test for my mail server?**

Port 25 for server-to-server mail (what other mail servers use to deliver to you), 587 for submission with STARTTLS, 465 for submission with implicit TLS, and 993/995 for IMAPS/POP3S.

**Why does port 25 time out?**

Usually a firewall drops connections to port 25, the mail service is not listening on that address, or the host name is not the one in your MX record. Some cloud providers also block port 25 by default until you ask them to open it.

**Do mail servers need a publicly trusted certificate?**

For submission (587/465) and IMAP/POP3, yes: mail clients validate it like browsers do. For server-to-server SMTP on port 25, most senders accept any certificate unless you publish DANE TLSA records or MTA-STS, so a valid certificate is still strongly recommended.