It protects message contents
TLS stops your mail being read or altered as it crosses the internet between servers.
Free Email Tool
TLS Checker
TLS is the encryption that protects email as it travels between servers, and it depends on a valid, current certificate. An expired or weak certificate breaks secure delivery. This guide explains what to look for — and a specialist will check your mail server's TLS for you, free.
Information:
Automated checker coming soon
What this tool checks
What healthy mail TLS looks like.
A TLS check looks at the certificate and encryption your mail server presents. These are the parts that decide whether mail moves securely.
-
A valid certificate
Your mail server should present a certificate trusted by a recognised authority, not a self-signed or untrusted one.
-
It is not expired
Certificates have an expiry date. An expired certificate is one of the most common — and most avoidable — TLS failures.
-
The hostname matches
The certificate must be issued for the mail server's hostname, or receivers cannot trust the connection.
-
Strong protocols and ciphers
Modern TLS versions and strong ciphers should be offered; outdated protocols weaken or break secure delivery.
-
STARTTLS is advertised
For SMTP, the server should advertise STARTTLS so sending servers can upgrade the connection to encrypted.
-
Renewal is handled
A healthy setup renews certificates automatically and well before expiry, so encryption never lapses unnoticed.
Why it matters
TLS keeps your mail private and deliverable.
Encryption in transit protects the contents of your email and is increasingly expected by receivers. When the certificate fails, both privacy and delivery suffer.
Receivers increasingly require it
With standards like MTA-STS, more receivers refuse mail that cannot be delivered over valid TLS.
Expiry breaks things overnight
An unrenewed certificate can break secure delivery the moment it lapses — a quiet outage waiting to happen.
Common problems
The TLS mistakes we see most.
Almost every TLS problem is one of these — and most are entirely preventable with monitoring. A check finds them before delivery breaks.
-
An expired certificate
Renewal was missed, the certificate lapsed, and secure delivery quietly stopped working overnight.
-
A hostname mismatch
The certificate does not cover the mail server's actual hostname, so receivers cannot validate the connection.
-
A self-signed or untrusted certificate
A certificate no recognised authority vouches for is not trusted, undermining the whole point of TLS.
-
Outdated protocols or ciphers
Old TLS versions and weak ciphers leave mail exposed and can cause modern receivers to refuse the connection.
Preview the checker
Check a mail server's TLS certificate
This is a preview of the automated TLS checker we are building. It does not run a live handshake or store anything you type.
Coming soon
Automated checking is on its way. A human audit is available now.
We are building instant, automated checkers as part of our Email Operations Center roadmap. Until then, a specialist will run this check by hand as part of a free Email Audit — and explain what it means for your business in plain English, with no jargon and no obligation.
- A real specialist reviews your setup — not an automated guess.
- Plain-English findings and the next step that actually matters.
- Free, with no obligation — we work alongside your existing IT.
Questions
Answers, in plain English.
What is TLS for email, in plain English?
TLS (Transport Layer Security) is the encryption that protects email while it travels between mail servers, so it cannot be read or tampered with along the way. It relies on a valid certificate that proves the server is who it claims to be.
What happens when a mail certificate expires?
When a certificate expires, sending servers can no longer establish a trusted, encrypted connection. Depending on the receiver this can downgrade security or stop delivery entirely — a common cause of mail suddenly failing. Automatic renewal prevents it.
What is STARTTLS?
STARTTLS is the command an SMTP server advertises to say "we can upgrade this connection to encrypted." When the server offers it and presents a valid certificate, the two servers switch to a secure, encrypted conversation before exchanging mail.
Does a self-signed certificate work for email?
It can technically encrypt a connection, but because no recognised authority vouches for it, receivers cannot trust it — which undermines the security TLS is meant to provide. A certificate from a trusted authority is the right approach.
Does this tool run a live TLS check?
Not yet — the automated checker is in development. This page explains mail TLS and what a healthy setup looks like, and the form is a preview that does not run a live handshake. For results today, request a free manual audit.
How do I stop certificates expiring on me?
Automatic renewal and monitoring. As part of our Email Infrastructure and managed services, we renew certificates well before they expire and watch their validity — so encryption never lapses unnoticed.