smtp.starttls.not_required
STARTTLS Not Required (Opportunistic TLS)
What we check
After a successful STARTTLS upgrade, we test whether the server also accepts mail without TLS — that is, whether encryption is offered but not enforced. This finding is emitted when the server allows plain-text delivery alongside its encrypted path.
What this finding means
The server offers STARTTLS but does not require it. A sender that supports TLS will negotiate encryption; a sender that does not (or a network attacker that strips the STARTTLS advertisement) can deliver in plain text. This is called opportunistic TLS and is the standard configuration for public MX servers.
How it's graded
Opportunistic TLS carries no penalty. This is the expected, correct configuration for public-facing MX servers. Requiring TLS on a public MX would refuse mail from the significant number of legitimate senders that do not support STARTTLS.
Enforcing TLS on inbound SMTP is the job of MTA-STS and DANE, not the SMTP server's smtpd_tls_security_level. Those mechanisms are evaluated separately. See Grading Methodology for the full scoring model.
Evidence example
S: 220 mail.example.com ESMTP
C: EHLO scanner.example.net
S: 250-mail.example.com
S: 250-STARTTLS
S: 250 ENHANCEDSTATUSCODES
TLS upgrade: successful (TLS 1.3, TLS_AES_256_GCM_SHA384)
Plain-text delivery: also accepted (opportunistic TLS)