TLS Encryption Checker
Check whether a domain's mail server supports TLS encryption via STARTTLS or implicit TLS, so email is protected in transit. Free, over a live connection.
Check TLS encryption
Enter a domain to test its receiving mail server (MX), or a submission host like smtp.gmail.com.
A domain resolves to its MX record, which uses port 25 with STARTTLS. To test a submission server on 587/465, enter its host directly (e.g. smtp.gmail.com).
What this TLS checker does
Common use cases
- 1Confirming mail is encrypted in transit
- 2Auditing a server for TLS support
- 3Meeting compliance requirements for encryption
- 4Debugging TLS negotiation failures
- 5Verifying a mail server upgrade
- 6Preparing for MTA-STS enforcement
Related tools
About SMTP TLS encryption
By default SMTP is plain text. STARTTLS upgrades an existing connection to encryption after the EHLO, while port 465 is encrypted from the first byte (implicit TLS). Without either, message contents and credentials can be read in transit.
This tool connects to the domain's mail server and checks whether TLS is available on the chosen port. Support for STARTTLS is the baseline for MTA-STS and TLS-RPT, which enforce and report on encryption — so a passing result here is the first step toward provably secure mail transport.
More Free Tools Where This Came From
This utility is one of dozens of free, no-login tools for DNS, email, SEO and developers — all instant and private.
HostCloud.in · Pune, India · Serving 34,987+ Websites Since 2020
Got Questions? We Have Answers.
What does the TLS encryption checker test?
It connects to the domain's mail server and checks whether it offers STARTTLS (opportunistic TLS) on the submission or relay port, or implicit TLS on port 465, so mail can be encrypted in transit.
What is the difference between STARTTLS and implicit TLS?
STARTTLS upgrades a plain connection to encryption after the EHLO (ports 587/25), while implicit TLS is encrypted from the first byte (port 465). Both protect the message in transit.
Why does SMTP TLS matter?
Without TLS, email contents and login credentials travel in clear text and can be intercepted. TLS encryption is the baseline for secure mail transport.
How does this relate to MTA-STS?
MTA-STS enforces TLS on inbound mail and TLS-RPT reports on it. A server passing this STARTTLS check is the prerequisite for enabling both.
Is the check a real connection?
Yes. It runs a live EHLO and STARTTLS exchange with the mail server at the moment you run it — no cached data.
Why test on port 587?
587 is the standard submission port where STARTTLS is expected. Port 25 is often blocked outbound, so 587 (or 465 for implicit TLS) gives the most reliable result.