How this test works
We look up the MX records and test up to three servers with the highest priority. For each, we read the greeting, send EHLO and, if STARTTLS is offered, negotiate TLS and inspect the certificate: whether it is valid for the MX host name, issued by a trusted authority and not expired.
The session ends with QUIT right after the TLS handshake. We never send MAIL FROM or RCPT TO, so no message is sent and no mailbox is probed. Results are cached for 10 minutes per server, so repeated checks do not open new connections.
Limitations
- Many networks block outgoing connections to port 25. If we cannot connect, the server may still be reachable for other senders.
- Opportunistic TLS between mail servers does not require a valid certificate; certificate problems matter mostly when you use MTA-STS or DANE.
- We test from one location, over one address per server.
- Checked domains are not stored or logged.
Frequently asked questions
What is STARTTLS?
An SMTP command that upgrades an unencrypted connection to TLS (RFC 3207). Without it, mail to your domain travels between servers unencrypted.
Why does the certificate matter if senders don’t check it?
By default many sending servers accept any certificate. With MTA-STS or DANE they validate it, and mail is not delivered when the certificate is wrong.
Which TLS versions are acceptable?
TLS 1.2 and TLS 1.3. RFC 8996 deprecates TLS 1.0 and 1.1.
Does this test send email?
No. It disconnects after the TLS handshake and never names a sender or a recipient.