SMTP wasn't originally designed with security in mind, which means that without encryption, an email travels across the internet as readable plain text. Anyone positioned on the network path between the sending and receiving servers could potentially read or alter it. Encryption is the layer added on top of SMTP to close that gap, and it's one of the first things worth verifying when you set up a mailbox.
Why encryption is necessary
Without it, email is exposed to a few specific risks:
- Interception: Attackers on the network path can read message content in transit.
- Tampering: Messages can be altered between sender and recipient without either party noticing.
- Spoofing: Without additional authentication layered on top, attackers can impersonate legitimate senders.
- Compliance exposure: Handling personal or financial data over unencrypted email can put you at odds with regulations like GDPR or HIPAA.
TLS vs. SSL
SSL was the original protocol used to secure email and web traffic, but it's been retired due to known vulnerabilities. TLS (Transport Layer Security) replaced it and is the current standard. Even though the term SSL still shows up in some settings menus and port names for historical reasons, what's actually running underneath is TLS.
STARTTLS vs. SMTPS
There are two common ways an SMTP connection gets encrypted:
- STARTTLS (port 587): The connection starts unencrypted, and the client explicitly requests an upgrade to TLS partway through. This is the recommended method for most outbound mail submission today.
- SMTPS (port 465): The entire connection is encrypted with TLS from the very first byte, with no plain-text negotiation step.
One important caveat with STARTTLS: it's opportunistic by default, meaning that if the receiving server doesn't support it, the connection can fall back to sending unencrypted. That's why standards like MTA-STS exist — to enforce encryption rather than merely request it.
Which TLS version should you use?
- TLS 1.3 — the current standard, offering the best security and performance. Use this whenever both ends support it.
- TLS 1.2 — still secure and widely supported as a fallback for older servers.
- TLS 1.0 and 1.1 — deprecated and should not be used.
- SSL 3.0 — deprecated and considered insecure.
Getting started
When configuring a mail client, use port 587 with STARTTLS enabled for outgoing mail unless your provider specifically directs you to port 465 with SMTPS. Both are secure options as long as TLS 1.2 or higher is negotiated. Avoid port 25 for client-to-server sending — it's intended for server-to-server relay and is blocked by most ISPs for outbound consumer traffic anyway.
Common questions
Is my email automatically encrypted? Most major providers enforce TLS by default, but it's worth confirming your own client's SMTP settings explicitly specify STARTTLS or SSL/TLS rather than 'none.'
Does encryption alone guarantee my emails reach the inbox? No. Encryption protects your message in transit, but inbox placement also depends on proper SPF, DKIM, and DMARC records and your sender reputation.
What's the difference between encryption and authentication? Encryption protects the content of your message from being read or altered; authentication (SMTP AUTH, SPF, DKIM) verifies who actually sent it. You need both for secure, trustworthy email.
