TLS not negotiated
Your sending server didn't use TLS when connecting to the receiving MTA. Mail was transmitted in plaintext.
Impact — Medium impact
Gmail and Microsoft 365 now visibly flag or demote unencrypted mail. Users see 'This message was sent without encryption' warnings. For sensitive content, this is also a compliance red flag (HIPAA, GLBA, GDPR).
What causes it
- Your mail server has STARTTLS disabled or misconfigured.
- An outbound firewall is stripping STARTTLS from the SMTP conversation.
- Your TLS certificate expired or is self-signed in a way the receiver won't accept.
How to fix it
Step 1: Confirm STARTTLS is enabled
For Postfix: smtp_tls_security_level = may (or encrypt). For Exim: tls_advertise_hosts = *. For sendmail: TLS defines in sendmail.mc.
Step 2: Install a valid TLS certificate
Use Let's Encrypt or your preferred CA. The certificate CN or SAN must match your mail server's HELO/EHLO hostname.
Step 3: Test the TLS handshake
Use openssl to simulate an outbound connection and verify TLS negotiates cleanly.
openssl s_client -starttls smtp -connect gmail-smtp-in.l.google.com:25Fixed it? Run a fresh test to confirm.
Test my inbox →