STARTTLS
The SMTP command that upgrades an open plaintext connection to TLS, after the server advertises support in its EHLO response.
What it means
Defined in RFC 3207, STARTTLS keeps SMTP on its usual port. The server lists STARTTLS among its EHLO capabilities, the client sends STARTTLS, the server answers 220, and the two run a TLS handshake. Both sides then discard what they learned before encryption, and the client should send EHLO again.
Because the offer travels in plaintext, an attacker in the path can delete it and the client continues unencrypted, a STARTTLS downgrade. Between servers this is accepted by default; MTA-STS, DANE and REQUIRETLS exist to refuse it.
Servers that require encryption refuse commands before STARTTLS; Gmail answers 530 5.7.0 "Must issue a STARTTLS command first".
Example
S: 250-STARTTLS
C: STARTTLS
S: 220 2.0.0 Ready to start TLS
(TLS handshake, then EHLO again)Related terms
On this site
Sources
What this definition rests on. The wording is ours; the facts are theirs.
All 432 terms in the glossaryThe wiki: blocklists and bounce codes