DIAGNOSTIC PLAYBOOK
A receiving server no longer advertises STARTTLS
A server that does not advertise STARTTLS cannot upgrade that SMTP session using the extension. Determine whether this is intentional, a server fault or a difference along the connection path.
HealthCheck Email editorial team · · Examples are illustrative
How to investigate
- Inspect the EHLO response from the affected receiving endpoint.
- Compare other MX hosts and network paths, and review recent SMTP proxy or gateway changes.
- Restore the intended STARTTLS support and verify a controlled TLS negotiation.
What this looks like
ILLUSTRATIVE EXAMPLE
A gateway upgrade leaves STARTTLS disabled on one listener while the backend still supports it. External senders interact with the gateway's advertised capabilities.
A mistake to avoid
Do not diagnose interception from one missing capability alone. Server configuration and transient faults can produce similar symptoms.
Keep the result in context
Transport encryption protects a connection between mail systems. It is different from message authentication and does not imply end-to-end encryption. Investigate the receiving MX hostname, the TLS session and the applicable policy separately before deciding which system needs a change.
Take the next step
Use the related check to gather evidence, then compare it with the affected message or service. Keep the result and time with your notes so a later change can be distinguished from the original problem.
Sources and further reading
The protocol references below explain the underlying behavior. Your sending or DNS provider supplies the account-specific settings for its service.