smtp.starttls.failed

STARTTLS Negotiation Failed

What we check

After the server advertises STARTTLS, we send the STARTTLS command and attempt a TLS handshake. This finding is emitted when the server accepts the STARTTLS command but the subsequent TLS handshake fails — the connection cannot be upgraded to encryption.

What this finding means

The server claims to support STARTTLS but the TLS handshake broke down. Common causes: a misconfigured or missing certificate, an incompatible TLS version, or a firewall or proxy stripping the TLS negotiation mid-handshake.

The practical effect is the same as not offering STARTTLS at all — mail is delivered in plain text — but worse, because senders that require encryption will refuse to deliver rather than fall back.

Why it matters

Worse than no STARTTLS. A sender that sees STARTTLS advertised expects encryption to work. When the handshake fails, strict senders (MTA-STS enforce, DANE) reject the message outright. Opportunistic senders fall back to plain text but log the failure.
Indicates a broken configuration. STARTTLS failures rarely fix themselves. The certificate, TLS library, or network path needs attention.
Invisible to the operator. Many mail servers do not alert on failed inbound TLS handshakes. The problem can persist for weeks without anyone noticing.

How to fix

Check the certificate chain. Ensure smtpd_tls_cert_file points to a full chain (leaf + intermediates) and smtpd_tls_key_file matches:
```
openssl s_client -starttls smtp -connect mail.example.com:25 \
    -servername mail.example.com
```
Look for verify error or alert lines in the output.
Check TLS version compatibility. If you restricted the protocol range too aggressively, some clients cannot negotiate. On a public MX, the opportunistic path is governed by smtpd_tls_protocols (Postfix 3.6+ syntax shown):
```
smtpd_tls_protocols = >=TLSv1.2
```
Note: the smtpd_tls_mandatory_protocols variant applies only to enforced-TLS contexts (submission ports, smtpd_tls_security_level = encrypt) — it has no effect on opportunistic port-25 connections.
Check for network interference. Firewalls, load balancers, or SMTP proxies between the internet and your mail server can strip or corrupt the TLS handshake. Test from an external network, not just localhost.
Reload after changes:
```
postfix reload
```

How it's graded

A failed STARTTLS handshake carries a 30-point penalty in the TLS category. See Grading Methodology for the full scoring model.

Evidence example

S: 220 mail.example.com ESMTP
C: EHLO scanner.example.net
S: 250-mail.example.com
S: 250-STARTTLS
S: 250 ENHANCEDSTATUSCODES
C: STARTTLS
S: 220 2.0.0 Ready to start TLS
(TLS handshake failed: certificate verify failed — unable to get local issuer certificate)

References

RFC 3207 — SMTP Service Extension for Secure SMTP over Transport Layer Security