Free email tool
See whether a domain's mail servers accept encrypted connections: STARTTLS, the TLS version and cipher they negotiate, and whether their certificate is valid. No email is sent.
Instant result, no email needed.
CloudSpex connects to the highest-priority mail servers (up to two) on port 25, reads the greeting, sends EHLO, starts TLS if it is offered, reads the certificate and disconnects. No MAIL FROM or RCPT TO command is sent, so no email is delivered. A server that cannot be reached is reported as not reached, not as broken: some networks block port 25.
To publish a policy that requires TLS for incoming mail, see the MTA-STS Checker.
Without it, mail to the domain travels unencrypted between servers. Almost every large provider offers it; a server without it is rare and worth fixing.
Usually not: most sending servers use TLS opportunistically and accept any certificate. It does matter with MTA-STS or DANE, which require a valid certificate that matches the MX name.
TLS 1.2 and 1.3. TLS 1.0 and 1.1 are deprecated and should be disabled.
No. The test stops after STARTTLS and sends QUIT. Nothing reaches a mailbox.
Add your domain to CloudSpex to monitor its mail setup continuously.
Start Monitoring Free