Emails sent without TLS encryption (STARTTLS)

What it means

When your server delivers an email to another server, the two can agree to encrypt the connection. This is called TLS, and the command that starts it on a normal mail connection is STARTTLS.

Your email was delivered without encryption. Anyone able to watch the network between the two servers could read it.

Why it matters

• Gmail shows a red open padlock on emails received without encryption, which worries readers.
• Gmail and Yahoo expect bulk senders to use TLS.
• Emails often contain personal or business information that should not travel in clear text.
• Delivmail removes a small part of the score for an unencrypted delivery.

How to check

• Send a test email: on the home page, copy your unique test address, send it a normal email from the mailbox or tool you want to check, then open the report. The "Encryption (TLS)" line says whether the email arrived encrypted.
• In Gmail, open a received email, click the small arrow under the sender name and look at the "security" line.

How to fix it

If you use a provider

Google Workspace, Microsoft 365 and all serious newsletter tools use TLS automatically. If your test shows no TLS, the email probably went through another system: a website, a printer, a business application or an old relay server. Find it and make it send through your provider instead.

If you run your own mail server

1. Get a certificate for your server name, for example mail.yourdomain.com. A free certificate from Let's Encrypt works well.
2. Turn on outgoing TLS. On Postfix, for example:

   smtp_tls_security_level = may
   smtp_tls_loglevel = 1

   The setting may encrypts whenever the other server supports it, which almost all do today.
3. Turn on incoming TLS too, so others can send to you securely:

   smtpd_tls_cert_file = /etc/letsencrypt/live/mail.yourdomain.com/fullchain.pem
   smtpd_tls_key_file = /etc/letsencrypt/live/mail.yourdomain.com/privkey.pem
   smtpd_tls_security_level = may

4. Reload the server and check its logs for lines mentioning TLS.
5. Renew the certificate automatically. An expired certificate can break encrypted delivery.

If you send from an application

In your application's SMTP settings, choose port 587 with STARTTLS, or port 465 with SSL/TLS. Avoid port 25 without encryption. This protects the connection between your application and your provider; your provider then handles TLS to the recipient.

Check that it is fixed

Send a new test email from the home page with the same server or tool. The "Encryption (TLS)" line should say yes. In Gmail, the red padlock should be gone. If it still says no, check that the email really left through the server you changed, and look at its logs for TLS errors such as an expired or untrusted certificate.