SMTP-STARTTLS-FAILED
STARTTLS is offered but the handshake fails
What it means
Senders that insist on TLS (and MTA-STS enforcement) will not deliver; others fall back to plain text.
How to fix it
- 1Check the certificate on the mail server: expiry, chain, and that it covers the MX host name.
- 2Allow TLS 1.2 and 1.3 and disable SSLv3/TLS 1.0.
Re-check after the change
DNS changes can take up to the record's TTL to be seen; use Re-run on the result page to bypass our 10-minute cache.