starttls-not-supported
Your server did not offer STARTTLS
By Jose Pollman · Published
How it appears in a report
"result-type": "starttls-not-supported"What it means
A sender tried to upgrade the connection to your mail server to TLS, and your server did not offer STARTTLS or refused it. Because their policy required encryption, they did not fall back to delivering in the clear — so that mail did not reach you.
Your mail server. This is your own receiving setup. The report describes senders failing to reach your MX, so the certificate, policy or DNS record at fault is yours to fix.
Worth being clear about the direction, because it is easy to get backwards: you publish TLS-RPT for your own domain, and senders report the failures they hit while delivering to you. So policy-domain and receiving-mx-hostname in your reports are yours, and sending-mta-ip belongs to whoever sent the report.
Why it happens
Either your MX genuinely has no TLS configured, or something between the sender and your server is stripping the STARTTLS capability from the connection. The second is worth taking seriously: middleboxes and older firewalls did this routinely for years, and from the sender’s side it is indistinguishable from your server not supporting TLS at all.
How to fix it
- Connect to your own MX on port 25 from outside your network and check that it advertises STARTTLS in the EHLO response.
- If it does advertise it, something in front of it is stripping it — check your firewall, any SMTP proxy, and your hosting provider’s edge.
- If it does not, enable TLS on the mail server. A publicly trusted certificate is required if any sender enforces MTA-STS against you.
- Treat this as urgent: senders enforcing a policy are not delivering to you at all, and you will see no bounce because the failure is at their end.