Email SSL is the encryption that protects an email connection while a message is being sent or read. Strictly, SSL (Secure Sockets Layer) is the old name. The version in use today is TLS (Transport Layer Security), but mail settings, error messages and everyday speech still say "SSL". When your email app asks you to choose "SSL/TLS" or "STARTTLS", it is asking how to encrypt the connection to the mail server. This guide answers "what is email SSL" and "what is SSL with email", explains the settings you will meet, and shows how to test and fix a connection.
What is SSL in email?
When your app sends a message to a mail server, the message crosses the network. Without encryption, anyone who can watch that traffic can read it, including the username and password you use to log in. SSL, and its successor TLS, wrap the connection in encryption so that the data cannot be read or changed on the way. The same protection is used on websites, where it shows as https and a padlock.
SSL 2.0 and 3.0 are long retired because of security flaws, and TLS 1.0 and 1.1 were formally deprecated in RFC 8996. Current software should use TLS 1.2 or TLS 1.3. The old name stuck, which is why settings pages still say "SSL". Whenever you see "SSL" in an email setting today, read it as "TLS".
What email SSL protects, and what it does not
- It protects the connection. The login details and the message are encrypted between your app and the server, and between servers that both support TLS.
- It does not protect the message at rest. After the message arrives, the mail server and the recipient's provider can read it. TLS does not hide content from them.
- It is not end-to-end encryption. Systems such as S/MIME and OpenPGP encrypt the content so only the recipient can open it. TLS and these systems solve different problems, and they can be used together.
- It does not prove a message is genuine. Proving that a message was sent by the domain it claims is the job of SPF, DKIM and DMARC. See our SPF guide, DKIM guide and DMARC guide.
Where SSL/TLS is used in an email system
| Connection | Common port | How encryption starts |
|---|---|---|
| Your app sends mail to a server (SMTP submission) | 587 | STARTTLS: the connection begins in plain text, then upgrades |
| Your app sends mail to a server (SMTP submission) | 465 | Implicit TLS: encrypted from the first byte (RFC 8314) |
| Mail server to mail server | 25 | Opportunistic STARTTLS: used if both sides support it |
| Reading mail with IMAP | 993 (implicit TLS) or 143 (STARTTLS) | As listed |
| Reading mail with POP3 | 995 (implicit TLS) or 110 (STARTTLS) | As listed |
SSL/TLS vs STARTTLS: which setting should you choose?
There are two ways to turn on encryption for a mail connection, and they use different ports. This is the setting that causes most email errors.
- Implicit TLS (called "SSL/TLS" in many apps). The client connects and starts the encrypted handshake straight away. This is normally port 465 for sending.
- STARTTLS (called "TLS" or "STARTTLS" in many apps). The client connects in plain text, asks the server what it supports, and then sends the STARTTLS command to switch to encryption before logging in. This is normally port 587 for sending, and RFC 3207 defines the command.
Both reach the same level of protection when the client insists on the upgrade. A client that carries on in plain text when STARTTLS fails is open to a downgrade attack, so always make encryption required, not optional. Our guide to SMTP settings, ports and authentication gives the full settings table and examples. Choose one combination, never both: 587 with STARTTLS, or 465 with SSL/TLS.
How to set up email SSL in your application
- Get the connection details. Copy the host name, port, user name and password from your provider's dashboard.
- Choose the matching security mode. Port 587 pairs with STARTTLS. Port 465 pairs with SSL/TLS.
- Require encryption. Turn off any option that says "none", "unencrypted" or "allow insecure".
- Keep certificate checking on. Do not disable certificate verification to make an error disappear.
- Test the connection. Use the commands below, then send one real message.
# Port 587, upgrade with STARTTLS
openssl s_client -connect smtp.example.com:587 -starttls smtp
# Port 465, encrypted from the start
openssl s_client -connect smtp.example.com:465A good result shows the certificate chain, the protocol version (look for TLSv1.2 or TLSv1.3) and the line "Verify return code: 0 (ok)". The host name is a placeholder; use the one from your dashboard. In Python the two modes look like this:
import smtplib, ssl
ctx = ssl.create_default_context()
# Port 587: connect, then upgrade
with smtplib.SMTP("smtp.example.com", 587) as s:
s.starttls(context=ctx)
s.login("SMTP_USER", "SMTP_PASSWORD")
# Port 465: encrypted from the first byte
with smtplib.SMTP_SSL("smtp.example.com", 465, context=ctx) as s:
s.login("SMTP_USER", "SMTP_PASSWORD")Common email SSL errors and fixes
| Symptom | Likely cause | Fix |
|---|---|---|
| "wrong version number" or "SSL: WRONG_VERSION_NUMBER" | Implicit TLS used on a STARTTLS port, or the other way round | Use SSL/TLS with 465, or STARTTLS with 587 |
| "certificate verify failed" or "hostname mismatch" | The host name in your settings is not the name on the certificate | Connect to the exact host name from your provider, not an IP address |
| "certificate has expired" | The server certificate expired, or your device clock is wrong | Check your system date; if correct, tell the provider |
| Connection times out | The network blocks the port | Try the other submission port your provider supports, and check firewall rules |
| "530 Must issue a STARTTLS command first" | The server requires encryption before login | Enable STARTTLS in the client |
| Handshake failure | Old software that only supports TLS 1.0 or 1.1 | Update the library or runtime so it supports TLS 1.2 or 1.3 |
Never turn off certificate checks to "fix" an error. Doing so removes the protection that tells you that you are talking to the real server. Fix the host name, the date or the library instead.
TLS between mail servers: MTA-STS and DANE
Between servers, encryption is usually opportunistic: if both sides support TLS, they use it, and if not, the mail may travel in plain text. A domain owner can ask senders to require TLS by publishing an MTA-STS policy (RFC 8461) or by using DANE. These are advanced settings for domains that receive mail, and they matter less for an application that only sends. If you also run your own mail domain, read about them and enable them when you can monitor the results.
What this means for senders
If you send from an application, you control the first hop, the connection from your software to the sending service. Use encryption on every submission, store credentials in environment variables or a secrets manager and not in code, and rotate them when staff leave. For the rest of the journey, authentication and a clean sending reputation decide whether the message reaches the inbox. If messages are being filtered, work through our spam troubleshooting checklist. For a wider view of choosing where to send from, see what an email provider is and how to choose one.
Having trouble with an SMTP connection or certificate error? Send us the exact error message and the host and port you are using, and we will help you find which setting is wrong.
References and further reading
Frequently asked questions
What is SSL in email?
SSL is the older name for the encryption that protects the connection between your email app or server and another mail server. Today the protocol is TLS, but settings and error messages still say SSL.
Is SSL the same as TLS?
TLS is the successor to SSL. SSL versions are retired, and TLS 1.2 and 1.3 are the versions to use. Many apps still label the setting SSL/TLS.
What is the difference between SSL/TLS and STARTTLS?
With SSL/TLS (implicit TLS), the connection is encrypted from the first byte, normally on port 465. With STARTTLS the connection starts in plain text and upgrades to encryption before login, normally on port 587. Use one or the other with its matching port.
Does email SSL encrypt the message end to end?
No. It protects the connection while the message is in transit. The mail servers that handle the message can still read it. End-to-end encryption needs a separate system such as S/MIME or OpenPGP.
Why do I get a 'wrong version number' SSL error when sending email?
It usually means the security mode does not match the port, for example implicit SSL on port 587 or STARTTLS on port 465. Use STARTTLS with 587, or SSL/TLS with 465.