What Percentage of MX Servers Require TLS? Measuring 366,215 Mail Servers

How many MX servers actually refuse STARTTLS-less connections?

A practitioner ran the numbers on all 366,215 MX servers. The answer: 0.2 percent refused to accept mail without first negotiating an encrypted STARTTLS connection. That is roughly 732 servers worldwide that enforce TLS at the connection level.

The rest accept plaintext SMTP and upgrade to encryption only if the connecting server requests it.

Here is what a STARTTLS enforcement rejection looks like in a real SMTP transaction:

220 mail.example.com ESMTP ready
HELO sending-server.com
250 mail.example.com
MAIL FROM:
553 5.7.1 We do not accept plaintext connections. Please use STARTTLS.

The server responds with a 553 and a plain-English rejection message. This is stricter than the typical behavior, which is to accept the message and then negotiate TLS if both servers support it.

Why enforcing STARTTLS is rare

STARTTLS is opportunistic by design. When two mail servers connect, they advertise whether they support TLS and then negotiate a connection. If either server does not support it, the message is delivered anyway, in plaintext, unless the receiving server explicitly rejects unauthenticated connections.

Requiring TLS removes the plaintext fallback. A server configured to require STARTTLS will reject the message if the connecting server cannot negotiate an encrypted session.

Compatibility is the main reason most operators do not enforce it. The email ecosystem includes a large installed base of mail servers that have not been updated to support TLS, or that are intentionally configured to remain open for legacy reasons. Enforcing TLS at the MX level means mail from those servers does not get delivered. The reason could be a misconfiguration on the sender side, a TLS version mismatch, a certificate problem, or a server that has simply not been updated.

The 0.2 percent figure is a deliberate choice by a small number of operators to harden their MX hosts. It is not the industry default.

Should you require TLS on your MX?

This depends on your sender base and your tolerance for delivery failures.

If your organization communicates primarily with modern mail servers that support TLS, requiring STARTTLS adds a layer of defense against passive surveillance and man-in-the-middle attacks on your inbound mail.

If your sender base includes legacy systems, government domains, or smaller organizations with outdated mail infrastructure, enforcing TLS will generate failures. Those failures mean bounced mail, which means you need a way to detect and investigate TLS negotiation problems quickly.

For most organizations, the practical first step is not enforcement -- it is monitoring. If you can see TLS negotiation failures in your inbound mail reports, you can catch changes in your recipients TLS posture before they cause delivery problems.

How DMARC Aggregate Reports Surface TLS Failures

This is where monitoring connects to DMARC. DMARC aggregate reports are generated by receiving mail servers and sent to the domain owner. They include a record of every inbound connection attempt, including whether the connecting server negotiated TLS successfully.

When a message arrives without TLS, the aggregate report records it. When a message is rejected because the sending server could not negotiate STARTTLS, that also appears in the report, flagged by the receiving server TLS policy.

DMARCFlow processes your aggregate reports and surfaces TLS negotiation failures alongside authentication failures. If a recipient MX that normally accepts TLS starts refusing connections because it now enforces STARTTLS, you will see that pattern in your reports before you discover it through bounced mail.

Think of it this way: 0.2 percent of MX servers enforcing TLS sounds small. But if you send 100,000 emails a day, that is 200 messages a day hitting servers with strict enforcement. Monitoring TLS failures through DMARC aggregate reports is how you catch which ones.

Key takeaways

• Of 366,215 MX servers measured, 0.2 percent refused mail without a STARTTLS handshake -- roughly 732 servers worldwide.
• STARTTLS enforcement at the MX level is rare but real. It is a deliberate hardening choice, not an industry default.
• Most mail servers use opportunistic TLS and accept plaintext when encryption is not available.
• Before enforcing TLS, monitor TLS failures in your DMARC aggregate reports to understand your sender base and catch recipient changes.
• DMARCFlow surfaces TLS failures automatically as part of its aggregate report processing.