smtp.starttls.missing

STARTTLS Not Advertised

What we check

After connecting to the mail server on port 25 and issuing an EHLO command, we check whether the server advertises the STARTTLS extension. STARTTLS is the mechanism that upgrades a plain-text SMTP connection to an encrypted TLS session. We perform a confirmation probe (a second connection) to rule out intermittent advertisement.

What this finding means

The server did not advertise STARTTLS in either SMTP session. All mail delivered to this server travels in plain text — readable by anyone on the network path between the sender and this server.

Why it matters

No encryption in transit. Without STARTTLS, every message — headers, body, attachments — crosses the internet unprotected. Any network hop can read or modify the content.
Major senders downgrade or defer. Google, Microsoft, and Yahoo prefer TLS-capable servers. Sending to a server without STARTTLS may cause delays, warnings, or delivery failures.
Compliance risk. Regulations like GDPR expect encryption of personal data in transit. Plain-text SMTP on the open internet is difficult to justify.

How to fix

Enable STARTTLS in your MTA. For Postfix:

# /etc/postfix/main.cf
smtpd_tls_cert_file = /etc/ssl/certs/mail.example.com.pem
smtpd_tls_key_file = /etc/ssl/private/mail.example.com.key
smtpd_tls_security_level = may

may means the server will offer STARTTLS but not require it — the standard for public MX servers.

Reload Postfix:
```
postfix reload
```
Verify the certificate is valid and covers the MX hostname. A self-signed or expired certificate will cause separate findings, but STARTTLS will at least be available.

How it's graded

Missing STARTTLS carries a 40-point penalty in the TLS category. This is one of the heaviest single deductions — encryption is fundamental to mail transport security. See Grading Methodology for the full scoring model.

Evidence example

S: 220 mail.example.com ESMTP
C: EHLO scanner.example.net
S: 250-mail.example.com
S: 250-PIPELINING
S: 250-SIZE 52428800
S: 250-8BITMIME
S: 250 ENHANCEDSTATUSCODES
(no STARTTLS in capability list)