Enable and Configure STARTTLS in Sendmail

Enable STARTTLS in Sendmail and secure email delivery. Learn how to configure certificates, enforce TLS, and set cipher policies.

Last updated: July 2026

In short: Transport Layer Security (TLS) via STARTTLS can be enabled in Sendmail by defining certificate and key files in the .mc configuration. Using the access database, you can enforce encryption, require certificate verification, or disable STARTTLS for specific broken remote hosts.

When running your own mail server with Sendmail, securing SMTP transport with TLS is essential. If security scanners like Kuveris report that STARTTLS is not offered or not enforced, you must configure Sendmail's TLS parameters.

Enabling STARTTLS in Sendmail

To offer STARTTLS, Sendmail needs at least the Certificate Authority (CA) directory, the CA certificate, the server certificate, and the server private key defined in your configuration (usually the .mc file, such as sendmail.mc).

According to the official Sendmail documentation, you must set at least the following variables (the file names and paths are just examples). Add them to your .mc configuration file:

define(`confCACERT_PATH', `/etc/mail/certs/')
define(`confCACERT', `/etc/mail/certs/CA.cert.pem')
define(`confSERVER_CERT', `/etc/mail/certs/my.cert.pem')
define(`confSERVER_KEY', `/etc/mail/certs/my.key.pem')

After modifying the .mc file, regenerate your sendmail.cf configuration (e.g., using make -C /etc/mail or m4) and reload the Sendmail service.

Understanding the Variables

These configuration macros correspond to Sendmail's internal options:

ServerCertFile and ServerKeyFile: ServerCertFile [no short name] File containing the certificate of the server, i.e., this certificate is used when sendmail acts as server (used for STARTTLS). ServerKeyFile [no short name] File containing the private key belonging to the server certificate (used for STARTTLS).
CACERTPath and CACERTFile: CACERTPath [no short name] Path to directory with certificates of CAs. This directory directory must contain the hashes of each CA certificate as filenames (or as links to them). CACERTFile [no short name] File containing one or more CA certificates; see section about STARTTLS for more information.

By default, Sendmail attempts opportunistic encryption for all incoming and outgoing connections: By default STARTTLS is used whenever possible.

Enforcing Encryption and Verification

To determine if an SMTP connection should be allowed, Sendmail uses specific rulesets: The rulesets tls_server, tls_client, and tls_rcpt are used to decide whether an SMTP connection is accepted (or should continue).

You can define enforcement rules in your access map database (usually /etc/mail/access). The right-hand side (RHS) of the map supports the following actions: VERIFY verification must have succeeded VERIFY:bits verification must have succeeded and ${cipher_bits} must be greater than or equal bits. ENCR:bits ${cipher_bits} must be greater than or equal bits.

Note that enforcing encryption on a domain level does not automatically guarantee all mail is encrypted: requiring that e-mail is sent to a server only encrypted, e.g., via TLS_Srv:secure.domain ENCR:112 doesn't necessarily mean that e-mail sent to that domain is encrypted.

When recipient-based checks are executed, the lookup behavior is: A recipient address user@domain is looked up in the access map in four formats: TLS_Rcpt:user@domain, TLS_Rcpt:user@, TLS_Rcpt:domain, and TLS_Rcpt:; the first match is taken.

Enforcement Example

A combined access map configuration enforcing encryption and certificate verification looks like this:

TLS_Srv:secure.example.com      ENCR:112
TLS_Clt:laptop.example.com      PERM+VERIFY:112
TLS_Rcpt:darth@endmail.org	ENCR:112+CN:smtp.endmail.org

Disabling STARTTLS for Broken Servers

If you encounter remote hosts with broken TLS implementations that fail during handshakes, you can disable STARTTLS selectively using the access map:

Try_TLS:broken.server NO Srv_Features:my.domain v Srv_Features: V will turn off STARTTLS when sending to broken.server (or any host in that domain), and request a client certificate during the TLS handshake only for hosts in my.domain.

Add the following rule to your access map:

Try_TLS:broken.server	NO

Hardening Ciphers and Protocols

To secure TLS connections and block outdated ciphers, you can configure cipher lists and SSL options.

The CipherList option allows you to set allowed ciphers: The option CipherList sets the list of ciphers for STARTTLS. See ciphers(1) for possible values.

The ServerSSLOptions and ClientSSLOptions settings pass OpenSSL options to the server and client side respectively: The options ServerSSLOptions and ClientSSLOptions can be used to set SSL options for the server and client side respectively. See SSL_CTX_set_options(3) for a list. Note: this change turns on SSL_OP_NO_SSLv2 and SSL_OP_NO_TICKET for the client.

As the note at the end of that quote indicates, current Sendmail releases already turn on SSL_OP_NO_SSLv2 for the client side by default. For specific OpenSSL option values, consult the documentation for your Sendmail version.

Verifying TLS Sessions

When a TLS session is successfully established, Sendmail adds connection details to the message headers: The Received: header reveals whether STARTTLS has been used. It contains an extra line: (version= ${tls_version} cipher=${cipher} bits=${cipher_bits} verify=${verify}

Reload Sendmail after applying any changes, and verify your configuration using the free Kuveris scanner to ensure STARTTLS is correctly offered.