Probing TLS endpoints...

Relaymetry · 2026·Privacy·Terms·About·Help·Pricing·Guides·Tools·Developers·Deliverability Stats·Deliverability Test

SMTP TLS Posture Check for google.com — Relaymetry

STARTTLS extends SMTP with opportunistic encryption. A mail server advertises STARTTLS during the EHLO handshake, and sending systems can negotiate TLS for the message body. Modern operators expect TLS 1.2 minimum; TLS 1.0 / 1.1 are deprecated.

SMTP TLS Posture Check for google.com

TLS configuration has critical issues.Healthy: STARTTLS supported, TLS 1.2+, valid certificate, MTA-STS enforce or testing mode. Learn more →

Submission server reachable but TLS broken; inbound posture announced cleanly.

Outbound submission TLS posture

TLS configuration has critical issues.

via heuristic `smtp.google.com`

Submission (port 587 / STARTTLS)

Could not connect to the mail server on either port.

Could not connect (ETIMEDOUT).

ETIMEDOUT

SMTPS (port 465 / Implicit TLS)

Could not connect to the mail server on either port.

Could not connect (ETIMEDOUT).

ETIMEDOUT

Inbound MX TLS posture (announced)

TLS configuration looks healthy.

MTA-STS policy

MTA-STS: enforce

MX patterns

smtp.google.com
aspmx.l.google.com
*.aspmx.l.google.com

Max age: 1 days
Policy ID: 20210803T010101

TLS-RPT (reporting)

TLS-RPT published

✉sts-reports@google.com

The result above probes the domains primary MX hosts on ports 25 + 587 (or whichever the domain uses) and reports the TLS version negotiated, certificate validity, SAN match status, and whether MTA-STS / TLS-RPT policies are published.

Configure TLS 1.2 minimum; aim for TLS 1.3 where possible. Ensure the certificate SAN includes the MX hostname (not just the apex domain). Publish MTA-STS to enforce TLS for inbound traffic and TLS-RPT to receive failure reports — both are zero-cost upgrades that meaningfully harden mail-in-transit security.

Full domain report →

Relaymetry · 2026·Privacy·Terms·About·Help·Pricing·Guides·Tools·Developers·Deliverability Stats·Deliverability Test