smtp.starttls.intermittent
Intermittent STARTTLS Advertisement
What we check
We connect to the mail server twice and check whether STARTTLS appears in the EHLO response both times. This finding is emitted when STARTTLS was advertised in one connection but not the other.
What this finding means
The server's STARTTLS advertisement is inconsistent — it appeared in one of two probes but not both. This typically indicates a load balancer routing to multiple backend servers with different TLS configurations, or a server that intermittently drops STARTTLS due to certificate-reload failures or resource exhaustion.
Why it matters
- Unpredictable encryption. Some connections to this server will be encrypted, others will not. The sender has no control over which outcome they get.
- Difficult to diagnose remotely. Intermittent behavior suggests a configuration inconsistency across server instances, which the operator may not be aware of.
- Strict senders see failures. If a sender caches the STARTTLS capability from one connection and expects it on the next, the inconsistency can cause delivery failures.
How to fix
Check all backend servers. If a load balancer distributes SMTP connections across multiple servers, ensure every backend has the same TLS configuration and a valid certificate.
Check certificate auto-renewal. A failed renewal on one server behind a load balancer is the most common cause. Verify all instances have a current certificate:
openssl s_client -starttls smtp -connect mail.example.com:25 \ -servername mail.example.com 2>/dev/null | \ openssl x509 -noout -datesRun this several times to hit different backends.
Monitor TLS readiness. Add health checks that verify STARTTLS is in the EHLO response, not just that port 25 accepts connections.
How it's graded
Intermittent STARTTLS is informational and carries no penalty. The inconsistency is flagged so the operator can investigate, but it is not penalised since STARTTLS was present in at least one probe. See Grading Methodology for the full scoring model.
Evidence example
Probe 1:
S: 250-STARTTLS ← present
Probe 2:
S: 250-PIPELINING
S: 250-SIZE 52428800
S: 250 ENHANCEDSTATUSCODES
(STARTTLS absent from capability list)