When you set up an email account, you'll often run into the SSL/TLS and STARTTLS options. Both aim to secure the connection, but they do it at different moments —and that difference matters.
What is SSL/TLS?
In email, choosing SSL/TLS usually means a connection that is encrypted from the very start —a method known as Implicit TLS. Encryption is established before any data is exchanged between the client and the server:
- The connection begins directly over TLS.
- Nothing travels in plain text —including authentication.
Common ports: SMTP (sending) 465 · IMAP (reading) 993 · POP3 995.
What is STARTTLS?
STARTTLS is an extension that lets an initially unencrypted connection be upgraded to an encrypted one:
Plain connection
Server offers STARTTLS
Upgrade to TLS
Most common port: SMTP (sending) 587.
The key difference
It's the moment encryption begins. With SSL/TLS (Implicit TLS) security is there from the first byte —no plain-text phase. With STARTTLS the connection starts open and is then upgraded, so there's a brief initial phase that can be exposed if it isn't configured carefully.
Which one to prefer
STARTTLS remains the operational standard for server-to-server relay (SMTP between mail servers), and it's fine there. The best practice for a production setup is to support both —prioritizing SSL/TLS for modern clients and keeping STARTTLS for compatibility— always making encryption mandatory and properly validated.
Still stuck?
If you didn't find what you were looking for, write to us and we'll help with your specific case.