"530 5.7.0 Must issue a STARTTLS command first" (and "451 5.7.3 STARTTLS is required"): how to fix it

What it means

Your app, website, printer or mail server tried to send an email without encrypting the connection first, and the server refused. The message usually looks like this:

530 5.7.0 Must issue a STARTTLS command first

Microsoft 365 (Exchange Online) writes a similar error:

451 5.7.3 STARTTLS is required to send mail

STARTTLS is the command that turns a normal email connection into an encrypted one (TLS). Most servers that accept emails from users and apps, and more and more servers in general, refuse to continue until it has been done. Without it, your password and message would travel in clear text.

Why it happens

• TLS is turned off in the sending settings: "Encryption: None", "Use SSL/TLS: No", or a similar option.
• Wrong port. The port and the security setting do not match (see below).
• Old device or software. Printers, scanners, alarm systems, old CMS plugins and old libraries may only know old TLS versions, which recent servers no longer accept, or may not support STARTTLS at all.
• Your own mail server sending to another server that requires TLS, while TLS is disabled or badly configured on your side.
• Something in between, such as some firewalls or antivirus programs, removes the STARTTLS offer from the connection.

The three ports, simply

• Port 587: for apps and users sending through their provider. Connect in clear, then STARTTLS, then log in. Choose "STARTTLS" or "TLS" in the settings.
• Port 465: same use, but encrypted from the very first second (often called "SSL" or "implicit TLS" in settings). Choose "SSL/TLS".
• Port 25: for servers talking to other servers. Apps should normally not use it to send through a provider, and many internet and cloud providers block it.

A common mistake is choosing port 465 with "STARTTLS", or port 587 with "SSL". The connection then fails or falls back to clear text.

How to check

1. Read your sending settings: server name, port, encryption option and login.
2. Test the server from a command line:

   openssl s_client -starttls smtp -connect smtp.example.com:587

   If you see a certificate and a 250 answer, the server supports STARTTLS on that port.
3. Run a Delivmail test. Once your app sends again, send an email to the unique address on the home page (/). The report confirms that the email arrived, shows the sending IP and server, and checks SPF, DKIM and DMARC for that app.

How to fix it

1. Turn on encryption in your app, plugin or device: select "STARTTLS" (or "TLS") with port 587, or "SSL/TLS" with port 465.
2. Use the exact server name given by your provider (for example smtp.office365.com for Microsoft 365), so the certificate matches.
3. Update old software. Update the printer firmware, the CMS plugin or the library. If the device cannot do modern TLS, send through a small relay that can, or use a scan-to-folder option instead.
4. On your own mail server, enable outgoing TLS. In Postfix, set smtp_tls_security_level = may and make sure a recent OpenSSL is installed.
5. Check firewalls and antivirus that scan email: turn off their SMTP inspection if they break STARTTLS.

Microsoft 365 note

Microsoft 365 also requires login (SMTP AUTH) to be allowed for the mailbox, and only accepts recent TLS versions. If TLS is on and it still fails, check that SMTP AUTH is enabled for that account in the admin center.

Check that it is fixed

Send a test from the app or device, then a Delivmail test to the address on the home page. If it arrives and the report looks good, resend the emails that failed. If your app shows a certificate error, check the server name and port once more.