Test SSL/TLS Security on Your Mail Server
Test SSL/TLS security on mail servers. Support for SMTP (587/465), IMAP (993), and POP3. Verify STARTTLS and certificate validity.
📖 Learn more: How to test email SSL/TLS security
Check Mail Server SSL
Common Mail Server Ports
- SMTP: Port 587 (STARTTLS) or 465 (SSL/TLS)
- IMAP: Port 993 (SSL/TLS) or 143 (STARTTLS)
- POP3: Port 995 (SSL/TLS) or 110 (STARTTLS)
Popular Mail Servers:
- Gmail: smtp.gmail.com (587), imap.gmail.com (993)
- Outlook: smtp-mail.outlook.com (587), outlook.office365.com (993)
- Yahoo: smtp.mail.yahoo.com (587), imap.mail.yahoo.com (993)
How to Test Mail Server SSL/TLS
- Enter your mail server hostname, for example
mail.example.com. Use the hostname your mail clients connect to, not your website domain. - Enter the port and choose the protocol: SMTP, IMAP or POP3.
- Click Check Server. On ports 465, 993 and 995 the tool connects with TLS straight away; on 587, 143 and 110 it connects in plain text and upgrades with STARTTLS, just like a real mail client.
- Review the certificate, protocol version and any errors in the results.
Implicit TLS vs STARTTLS
Implicit TLS (ports 465, 993 and 995) encrypts the connection from the very first byte. STARTTLS (ports 587, 143 and 110) starts in plain text and then asks the server to upgrade to TLS. Both are secure when configured correctly, but STARTTLS is only safe if clients refuse to continue when the upgrade fails. RFC 8314 now recommends implicit TLS for mail submission and access where possible.
Common Mail Server SSL Problems
Certificate name does not match the hostname
Mail clients check the certificate against the hostname they connect to. If your certificate covers example.com but clients use mail.example.com, add that name to the certificate.
STARTTLS not supported
The server did not advertise STARTTLS after the greeting, so mail would travel unencrypted. Enable TLS in your mail server (Postfix smtpd_tls_security_level, Exim tls_advertise_hosts, Dovecot ssl = yes).
Expired or self-signed certificate
Many control panels install a self-signed certificate on the mail service by default. Replace it with a trusted certificate; Let's Encrypt works for mail servers as well as websites.
Old protocols still enabled
TLS 1.0 and 1.1 are deprecated (RFC 8996). Restrict your mail server to TLS 1.2 and 1.3.
Frequently Asked Questions
How do I check my mail server's SSL?
Enter your mail server hostname and port, for example smtp.gmail.com on port 587, choose the protocol and click Check Server. The tool verifies the TLS connection and the certificate the server presents.
What is STARTTLS?
STARTTLS is a command that upgrades an existing plain-text connection to an encrypted TLS connection. It is used on SMTP port 587, IMAP port 143 and POP3 port 110.
Which port should I use for SMTP?
Use port 587 with STARTTLS or port 465 with implicit TLS for sending mail from clients. Port 25 is for server-to-server delivery and is often blocked by ISPs.
Does this tool send or read any email?
No. It only opens a connection, performs the TLS handshake (and STARTTLS where needed) and reads the certificate. It never logs in, sends mail or reads messages.
Why does my mail client warn about the certificate when the website is fine?
Your website and mail server often use different certificates. Check the mail hostname here, and see our guide to testing email SSL/TLS security for the full checklist.