STARTTLS

STARTTLS is a command that upgrades an initially plain-text SMTP (or IMAP/POP3) connection to an encrypted TLS connection, if both the sending and receiving server support it. NIST’s Trustworthy Email guidance (SP 800-177 Rev. 1) covers this same opportunistic-TLS behavior and the MTA-STS/REQUIRETLS mechanisms built to close its downgrade gap. Only once that upgrade completes is it safe for a client to authenticate with SASL over SMTP AUTH, since sending credentials before encryption starts would expose them in plaintext. It’s “opportunistic” encryption by default: if a connection attempt doesn’t offer or accept STARTTLS, most mail servers will silently fall back to sending the message unencrypted rather than failing the delivery, which means an attacker able to intercept and manipulate the connection can sometimes strip the STARTTLS offer entirely (a downgrade attack) without either party noticing. In Postfix, for example, this is the “may” TLS security level, which the Postfix TLS Support documentation describes as opportunistic: the SMTP transaction is encrypted if the server supports STARTTLS, and otherwise messages are sent in the clear. MTA-STS exists specifically to close this gap by letting a domain declare that TLS is mandatory, not optional, for mail addressed to it. SMTP REQUIRETLS closes the same gap a different way, letting an individual sender mark one message as requiring TLS rather than waiting on a domain-wide policy. STARTTLS for SMTP is defined in RFC 3207 (tracked on the IETF Datatracker as a full Proposed Standard), and MTA-STS itself in RFC 8461.

STARTTLS is part of AdminKit’s email authentication cluster; the full AdminKit glossary lists other related terms.