TLS vs STARTTLS: which email encryption setting to choose
Email apps ask you to pick "SSL/TLS" or "STARTTLS". Both encrypt the connection; they just start it differently. Here's what that means and which to choose.
SSL/TLS (often called implicit TLS) encrypts the connection from the very first byte, on ports 465 (sending) and 993 (IMAP). STARTTLS connects in plain text, then upgrades to encryption, usually on port 587. Both are secure when set up correctly. Use whatever your provider lists; if it offers both, implicit TLS on 465 is slightly safer because nothing is ever sent unencrypted.
The two ways to start encryption
| Feature | Implicit TLS ("SSL/TLS") | STARTTLS |
|---|---|---|
| How it starts | Encrypted from the first byte | Starts plain, then the client sends STARTTLS and both sides switch to encryption |
| Sending (SMTP) | Port 465 | Port 587 |
| Receiving (IMAP) | Port 993 | Port 143 |
| Receiving (POP) | Port 995 | Port 110 |
"SSL" is the old name. Modern servers use TLS, but many apps still label the setting SSL or SSL/TLS.
Which one should you pick?
- Use the setting your provider lists. Our email settings pages show the exact ports and security for each provider.
- If both are offered, the email standards now recommend implicit TLS (465, 993) for apps, because a STARTTLS upgrade can be stripped by an attacker if the app doesn't insist on it.
- Never choose "None" for security. Your password would cross the network unencrypted.
Server-to-server: port 25 and opportunistic STARTTLS
Between mail servers, delivery uses port 25 with STARTTLS. It's "opportunistic": if the other server doesn't offer encryption, most servers send the message unencrypted rather than fail. Domains can close that gap with:
- MTA-STS: a policy that tells senders "always use TLS with a valid certificate when sending to us".
- TLS-RPT: daily reports about encryption failures when others send to your domain.
- DANE: publishes certificate details in DNSSEC-signed DNS; used more in Europe.
TLS is not end-to-end encryption
TLS protects the message while it travels between two servers. On each server it's stored readable, and your provider can read it. End-to-end encryption (such as S/MIME, PGP or Proton Mail between Proton users) encrypts the message itself, so only the recipient can open it. See encrypt email in Gmail and encrypt email in Outlook.
Questions people ask
- Is port 587 secure?
- Yes, when STARTTLS is required, which all major providers do. The connection is encrypted before your password is sent.
- Should I use SSL or TLS?
- Choose the option your app calls SSL/TLS or TLS. SSL itself is obsolete; the setting name is just old.
- Why does my app show a certificate warning?
- The server name you typed doesn't match the server's certificate, or the certificate expired. Check the server name against your provider's settings rather than accepting the warning.
Sending one email to a whole list? Check the addresses first with Veml, which removes bad and risky emails before you hit send. (Veml and EmailNa have the same owner.)