Opportunistic TLS
Using TLS when the other side offers it and falling back to plaintext when it does not, usually without verifying the certificate: the default between mail servers.
What it means
RFC 7435 describes opportunistic security as encrypting when possible, even without authentication, rather than settling for cleartext. SMTP relay works this way by default: a sending server tries STARTTLS, commonly accepts the receiver's certificate even when it is invalid, and sends in plaintext if TLS is not offered.
That stops passive eavesdropping but not an active attacker, who can strip the STARTTLS offer or intercept with a false certificate. RFC 8689 lists these attacks. MTA-STS and DANE let a domain move its inbound mail from opportunistic to required, authenticated TLS.
Related terms
Sources
What this definition rests on. The wording is ours; the facts are theirs.
All 432 terms in the glossaryThe wiki: blocklists and bounce codes