Skip to main content

What is SSL email?

SSL email means the connection between your email app and the mail server is encrypted, so your password and messages can't be read in transit. Today that encryption is TLS; "SSL" is the old name that stuck in mail settings.

What SSL/TLS protects

An email makes at least two trips, and SSL/TLS can protect each one separately:

  1. Your app to your provider. When Outlook, Apple Mail or your website sends mail through SMTP, or reads it through IMAP or POP3. This is the setting you choose, and the one you should always have on: without it your password crosses the network in plain text.
  2. Your provider to the recipient's provider. Mail servers try to upgrade each delivery to TLS with STARTTLS. You don't control this hop, but large providers like Gmail and Outlook use TLS whenever the other side supports it.

SSL/TLS does not encrypt the message where it is stored. Your provider and the recipient's provider can read it. If you need that, use S/MIME or PGP on top.

SSL, TLS and STARTTLS: what the settings mean

  • SSL/TLS (sometimes just "SSL", or "implicit TLS"): the connection is encrypted from the first byte. Used on port 465 for SMTP, 993 for IMAP and 995 for POP3.
  • STARTTLS: the connection starts unencrypted on the normal port, then the client asks the server to switch to TLS before logging in. Used on port 587 for SMTP.
  • None: no encryption. Only acceptable inside a private network. Most providers refuse to let you log in this way.

Both SSL/TLS and STARTTLS end up with the same TLS encryption. The most common mistake is mixing them up: SSL/TLS on port 587, or STARTTLS on port 465. The connection then hangs or fails before login.

SSL email ports

ProtocolSSL/TLSSTARTTLSUnencrypted
SMTP (sending)46558725
IMAP (reading)993143143
POP3 (downloading)995110110

Port 25 is for server-to-server delivery. Most ISPs and cloud providers block it for outgoing connections, so apps should send on 587 or 465.

Test SSL/TLS on your SMTP server

Enter your server and pick SSL/TLS or STARTTLS. The test connects, sets up encryption, logs in and sends one email, and tells you which step failed.

Your password is used for this one test and never stored or logged. We send one fixed test message; you can't change its content.

What this checks

  1. 1. Connect to server
  2. 2. Secure connection (TLS)
  3. 3. Log in
  4. 4. Send test email

If a step fails you get the server's exact reply and what it usually means.

How to turn on SSL in your email app

  1. Open the account settings and find the outgoing (SMTP) server.
  2. Set security to SSL/TLS with port 465, or STARTTLS with port 587, whichever your provider lists.
  3. Do the same for incoming mail: IMAP on 993 or POP3 on 995 with SSL/TLS.
  4. Send yourself a test. If it fails, run the SMTP test with the same settings to see the server's reply.

FAQ

What is SSL in email?
SSL in email is encryption of the connection between your email app and the mail server, so passwords and messages cannot be read on the way. The name comes from the old SSL protocol; today the same setting uses TLS, its successor.
Is SSL the same as TLS?
In email settings, yes. SSL 3.0 was retired in 2015 and every modern server uses TLS 1.2 or 1.3, but mail apps still label the option "SSL" or "SSL/TLS". Choosing it gets you TLS.
Should I use SSL/TLS or STARTTLS?
Use whichever your provider lists. Both encrypt the connection. SSL/TLS (port 465 for SMTP) encrypts from the first byte, and RFC 8314 recommends it. STARTTLS (port 587) starts plain and upgrades, which is also fine when the app refuses to continue without the upgrade.
Does SSL encrypt my email end to end?
No. SSL/TLS protects each hop while the message is moving. The message sits unencrypted on your provider’s and the recipient’s servers. For end-to-end encryption you need S/MIME or PGP.
How do I know if an email was sent with SSL/TLS?
In Gmail, open the message, click the arrow under the sender and look at "security": "Standard encryption (TLS)" means it arrived over TLS. A red open padlock means the last hop was unencrypted.
Do I need an SSL certificate to send email?
Not if you use a provider like Gmail, Outlook or a sending service: their servers already have certificates. You only need your own certificate when you run your own mail server.