How can I test inbound starttls with a given external IP address?
Michael Ko
Co-founder & CEO, Suped
Published 5 May 2025
Updated 18 Aug 2025
8 min read
Ensuring secure email communication is paramount for deliverability and protecting sensitive data. A critical aspect of this security is Transport Layer Security (TLS), specifically how your mail server handles inbound STARTTLS negotiations. When an external mail server attempts to deliver an email to your domain, it initiates a connection. If your server supports STARTTLS, it will offer to upgrade this plain-text connection to an encrypted one.
Testing this inbound STARTTLS functionality from an external IP address is crucial because it simulates the exact conditions under which other mail servers will connect to yours. This verification ensures that your server is properly configured to accept secure connections, preventing emails from being sent in plain text, which could expose confidential information. Without proper encryption, your email might be vulnerable to eavesdropping, and receiving mail servers might flag your domain, leading to deliverability issues.
If your email server lacks proper STARTTLS support or has misconfigured settings, emails sent to your domain could either bounce, be rejected, or be delivered unencrypted. This not only poses a security risk but can also negatively impact your sender reputation, potentially leading to your IP address being placed on a blocklist (or blacklist). Regularly testing your inbound STARTTLS setup from an outside perspective helps maintain trust and ensures your email ecosystem is robust.
Manual checks with OpenSSL
The openssl s_client command is a powerful, built-in tool available on most Linux and macOS systems that can test TLS connections. It allows you to simulate an SMTP client connecting to your mail server and specifically request a STARTTLS handshake. This method provides detailed information about the TLS negotiation, including the protocol version, cipher suite, and certificate details.
To perform an inbound STARTTLS test using openssl s_client, you will need the external IP address or hostname of your mail server and the SMTP port, usually port 25 for inbound mail. The -starttls smtp flag is crucial as it instructs OpenSSL to issue the STARTTLS command after connecting. The -brief flag helps summarize the output, but you can omit it for verbose details.
Upon running the command, look for CONNECTION ESTABLISHED, Protocol version, Ciphersuite, and Verification: OK in the output. These indicators confirm that a secure connection was successfully negotiated and your server's certificate is valid. If you see errors or no TLS information, it indicates a problem with your STARTTLS configuration. This manual approach gives precise control and detailed diagnostics, which is valuable for troubleshooting.
While telnet can establish a basic connection to port 25, it does not inherently support STARTTLS negotiation. You can use it to see if your server announces STARTTLS in its EHLO response, but it won't actually perform the encryption handshake. For full STARTTLS verification, openssl is the preferred command-line utility.
Automated and online tools for STARTTLS
For more comprehensive testing of your inbound STARTTLS, the Swaks (SMTP Swiss Army Knife) utility is highly recommended. This command-line tool offers a vast array of options for testing SMTP servers, including robust STARTTLS capabilities. It can simulate various scenarios, making it invaluable for diagnosing complex email security and deliverability issues. Swaks allows you to specify sender and recipient addresses, authenticate, and control every aspect of the SMTP conversation, including forcing or inspecting TLS. You can find more information about Swaks and its usage on the official website.
For quick, online verification without needing command-line access, services like checktls.com provide a straightforward way to test your mail server's STARTTLS support. You simply enter your domain or IP address, and the service performs a series of checks, providing a summary of your server's TLS capabilities. These online tools are excellent for a quick health check and for users who are less comfortable with command-line interfaces. However, they typically offer less granular control and detail than tools like OpenSSL or Swaks.
Choosing between command-line tools and online services depends on your specific needs. Command-line tools like openssl s_client or Swaks are ideal for in-depth diagnostics and scripting automated tests. Online checkers, on the other hand, are perfect for quick validation and general oversight of your inbound email security. Both types of tools play a vital role in ensuring your email infrastructure is secure and resilient against common vulnerabilities.
Interpreting results and ensuring security
After running your STARTTLS test, the output will contain crucial information. Key elements to look for include:
Protocol version: Ensure it's a modern version like TLSv1.2 or TLSv1.3. Older versions like SSLv3 or TLSv1.0 are considered insecure and should be disabled.
Ciphersuite: Verify that strong, secure cipher suites are being used. Avoid deprecated or weak ciphers.
Certificate details: Check the expiration date, common name (CN), and subject alternative names (SANs). The certificate should be valid and match your server's hostname. An invalid or expired certificate will cause trust issues.
Verification status: Look for OK or similar confirmation that the certificate chain is trusted.
A failure in any of these areas can lead to significant deliverability problems. For example, if your server doesn't offer STARTTLS or uses weak encryption, incoming connections might default to plain text, making your communications susceptible to interception. Furthermore, receiving mail servers, especially those with strict security policies (like Google and Yahoo), may refuse to accept mail from your server entirely, or downgrade your sender reputation, which could also lead to your IP address or domain being added to a blocklist (or blacklist). I've discussed this topic in more detail when examining why you need to test STARTTLS encryption.
Regularly monitoring and updating your mail server's TLS configuration is a crucial step in maintaining good email deliverability and sender reputation. Pay particular attention to certificate renewal processes to avoid unexpected service interruptions. If you find issues, consult your mail server documentation or a system administrator to implement the necessary fixes.
Views from the trenches
Best practices
Always test from an external network, not from within your own server infrastructure.
Use modern TLS versions (TLSv1.2 or TLSv1.3) and strong cipher suites for optimal security.
Automate regular STARTTLS checks as part of your email security routine.
Common pitfalls
Testing only from internal networks, which doesn't reflect real-world inbound connections.
Ignoring warnings about weak ciphers or outdated TLS protocols.
Letting TLS certificates expire, leading to connection failures and trust issues.
Expert tips
For advanced diagnostics, use the verbose output of openssl to see the entire TLS handshake.
Integrate STARTTLS checks into your CI/CD pipelines for automated deployment verification.
Consider implementing DANE (DNS-based Authentication of Named Entities) for added security.
Expert view
Expert from Email Geeks says Swaks is their preferred tool for comprehensive SMTP testing, including STARTTLS, due to its versatility.
2023-10-24 - Email Geeks
Expert view
Expert from Email Geeks says openssl s_client with the -starttls smtp flag provides detailed information about ciphers and certificates.
2023-10-24 - Email Geeks
Ensuring secure inbound email communication
Testing inbound STARTTLS with an external IP address is a fundamental practice for any organization that relies on email. It’s not just about verifying that your server is listening on the correct port, but ensuring that it securely negotiates encrypted connections for all incoming mail. This proactive approach safeguards sensitive data and contributes significantly to your overall email deliverability. Neglecting this crucial aspect can result in emails being blocked, delivered unencrypted, or even land your domain or IP on a blocklist (or blacklist), which can take time and effort to recover from. We also cover this in our guide on what happens when your IP gets blocklisted.
By regularly employing tools like openssl s_client, Swaks, or online checkers, you gain visibility into your email infrastructure's security posture. This allows you to proactively identify and resolve vulnerabilities, ensuring that your inbound email traffic remains confidential and your domain maintains a strong, trustworthy reputation with receiving mail servers.
