Problems with website mail module can be really critical. It can end up in the loss order mails, feedback from customers and so on.

Often, bad configuration in custom mail forms or mail module in applications like OsTicket, CiviCRM can show the error “SMTP: STARTTLS failed“.

At Bobcares, we help customers to fix these mail errors as part of our Server Support for web hosts.

Today, we’ll see the top reasons for the “SMTP: STARTTLS failed” error and how our Support Engineers fix them.

What is STARTTLS?

Let’s first see what STARTTLS is.

Mail communication can be set up as secure or insecure. STARTTLS is a way to take an existing insecure connection and upgrade it to a secure connection using SSL/TLS.

Usually, the servers that offer message submission over port 587 require mail clients to use STARTTLS feature.

What causes SMTP: STARTTLS failed error?

We’ve now seen the details of STARTTLS. But, many times STARTTLS failure can block mails. Let’s discuss the top causes for the STARTTLS failed error.

1. Certificate mismatch

From our experience in managing servers, our Support Engineers often see STARTTLS problems due to the server SSL certificate.  When the SMTP server has a self-signed certificate, it can show up the “SMTP: STARTTLS failed” error.

For example, servers having PHP 5.6 will verify peer certificates and host names by default when using SSL/TLS. Therefore, it is a requirement that the certificate name and hostname should match.

Also, our Support Engineers see problems with the certain versions of apps like CiviCRM, where PEAR SMTP package does not support TLS.

2. SMTP Configuration errors

Yet another reason for the STARTTLS failed error can be bad configuration of the mail aka SMTP server. Recently, we saw this error when the server was sending the SMTP EHLO command as “localhost” instead of the real hostname. This made PHP’s verification to fail and report error.

Again, the error can pop up when the SMTP server name is wrongly configured in the application as well.

3. Port restrictions

Port restrictions in the server firewall can also cause this error.

Recently, in one of the servers, the reason for error sending mail was port 587 blocked in the firewall. Here, the mails from the website form failed with the error:

Authentication failure [SMTP: STARTTLS failed (code: 220, response: TLS go ahead)]

How we fix SMTP: STARTTLS failed error?

So far, we saw the various reasons for the SMTP: STARTTLS failed error. Let’s now see how we fix this error.

When customers report problems with mail functionality, we first check the mail server logs. This gives us a clue on the exact settings that create problems.

And, the fixes vary according to the cause.

1. Correcting SMTP settings

Firstly, we check and verify the SMTP settings used in the app. We check and correct the typos in the mail server name, username, password etc.

For example, when one of customers reported “SMTP: STARTTLS failed” error in their mail app, our Support Engineers had to put “ssl://” in front of the SMTP server name. This fixed the problem and the mail started working.

The same fix was applicable when a customer reported problem with osTicket help-desk too.

2. Correcting firewall

Similarly, another customer started receiving this error, soon after a server reboot. Here, customer confirmed that he did not do any modifications in the mail script. From our side, we checked and confirmed that the versions of PHP was fine too.

On a detailed check, our Support Engineers found that the server firewall was causing the issue here. It was blocking access to port 587 of the mail server. To fix the problem, we had to reload the firewall. And mail started working again.

3. Fixing SSL Certificate

Last, but not the least, proper SSL certificate for the mail server is also needed for mail to work. Therefore, our Security Engineers set up mail server with valid SSL certificate that matches the server name.

Additionally, when server uses PEAR packages, we ensure that the module Net_SMTP do support TLS too.

[Are you having problems with your mail server? We can fix it for you.]

Conclusion

SMTP: STARTTLS failed is an error that happens when using mail functionality in various applications. Today, we’ve seen the top reasons for the error and how our Support Engineers fix it.