← Knowledge base

Email transport

SMTP, IMAP, and POP use different ports and can start TLS immediately or upgrade using STARTTLS. Transport encryption does not establish end-to-end message encryption.

Evidence to collect

1. Identify the protocol and mode before testing: SMTP STARTTLS, IMAP STARTTLS, or implicit TLS are different handshakes.
2. Check submission, receiving MX, mailbox access, and relay-to-relay paths independently.
3. Use the mail transport instructions and record certificate validation plus the selected group.
4. Assess S/MIME, OpenPGP, stored mail, backups, and certificate signatures separately.

Record the scope and result

Record the tested component, client, peer, protocol, selected algorithm, and date. Keep observed negotiation, documented capability, and unknown distinct. A failed check can reflect local tooling, certificate validation, network policy, or configuration; it does not prove that all PQC is unsupported.

Official references

• OpenSSL protocol-specific STARTTLS options
• TLS for email submission and access

Guidance reviewed 24 September 2026. Verify documentation for your deployed release; vendor capabilities and defaults change.