Fix: StartTLS is Required to Send Email

6.7K

This article explains the possible causes for the “STARTTLS is required” error and how to fix it and send an email successfully.

What Does the StartTLS is Required Error Mean?

When you try to send an e-mail message via an SMTP/IMAP host, you may receive the error message “5.7.3 STARTTLS is required“.

In my case, I encountered the error “450 4.4.317 Cannot connect to remote server. 5.7.3 STARTTLS is required to send mail ” in the Exchange Online (Microsoft 365) message tracking log when I tried to send an email to an external SMTP server.

This error can occur in different applications (SQL Server, Jenkins), scripts and programming languages (Visual Basic, PowerShell, Python, Java, C#).

SMTP Without Encryption vs With STARTTLS

The classic SMTP email protocol does not encrypt the connection between the server and the client, and all data is sent in clear text. The StartTLS protocol can be used to encrypt data transmitted within an SMTP session. If the SMTP server supports this protocol, the client sends the STARTTLS command, after which the parameters of the encrypted TLS session are negotiated between the server and the client. An encrypted TLS connection will be established over the current TCP connection, without the need to use a separate port for the encrypted connection. The StartTLS command is used by both SMTP and IMAP (POP3 uses a different STLS command for encryption).

You can manually check the StartTLS protocol support on the remote SMTP server. Open a command prompt and connect to the SMTP host using telnet:

telnet smtp.gmail.com 25

Note. In case telnet is not available, you can enable it with command:

Enable-WindowsOptionalFeature -Online -FeatureName TelnetClient

Then run the EHLO command to list the SMTP options supported by the remote server:

ehlo theitbros.com

In this case, the SMTP server response will contain the line: 250-STARTTLS, which means that the STARTTLS is supported by the server.

TLS Negotiation in SMTP and IMAP

The client can then send the STARTTLS command and receive the response ‘220 2.0.0 Ready to start TLS’. The client and SMTP server are ready to begin TLS negotiation.

Common Causes of “STARTTLS is Required” Errors

This error occurs when the client attempts to send email over an unencrypted connection, while the server requires the connection to be upgraded to TLS using the STARTTLS command.

If the SMTP server returns the StartTLS is Required error, check the following:

Client does not initiate STARTTLS

You may face this error when the client attempts to send email without upgrading the connection to TLS using the STARTTLS command, while the server requires it.

Note.

• Port 587 uses STARTTLS (upgrade existing connection to TLS)
• Port 465 uses implicit SSL (encrypted from the start)

Whether -UseSsl works on port 587 depends on how the SMTP server implements STARTTLS. Before changing the SSL/TLS settings, you need to verify the server requirements. You should use port 465 for implicit SSL or omit -UseSsl for STARTTLS on port 587.

Invalid or missing SSL Certificate

Check that the receiving server is configured to use TLS and that a valid SSL certificate is installed. Most public email servers currently require TLS 1.2 or later. You can use the online service https://ssl-tools.net/ to check the remote SMTP host for support of STARTTLS and TLS 1.2 and other available SSL options.

You can check the SMTP server certificate and STARTTLS negotiation manually with the command:

openssl s_client -starttls smtp -connect smtp.server.com:587

This allows you to inspect the certificate chain, TLS version, and any certificate validation errors returned by the server.

Optionally, first check basic connectivity to the SMTP service with the following command:

Test-NetConnection smtp.server.com -Port 587

TLS Support Not Enabled on Client or Server

Make sure that TLS 1.2 support is enabled in the client operating system and in the application used to send email.

Application Misconfiguration (SQL, Jenkins, PowerShell)

In some applications/clients, you need to check that the Requires a secure connection (SSL) option is enabled (this will enable STARTTLS):

1. STARTTLS is enabled by default in the on-premises Exchange Server. Check this: Get-SendConnector | fl IgnoreStartTLS
2. In Exchange Online, you should verify if SMTP AUTH is enabled for the mailbox in case your app relies on SMTP authentication:
   

   Get-CASMailbox user1@theitbros.com |
   Select SmtpClientAuthenticationDisabled

Microsoft 365 note. Before troubleshooting STARTTLS errors, you should check if SMTP AUTH is allowed for the mailbox and tenant. In Exchange Online, SMTP AUTH may be disabled at the tenant/mailbox level.

Exchange Online SMTP AUTH supports Modern Authentication (OAuth 2.0). For new apps, we generally recommend Microsoft Graph where it fits the app requirements, but SMTP AUTH with OAuth remains available for apps that need SMTP submission.

Keep in mind that basic authentication for Exchange Online is no longer supported. If an application uses SMTP AUTH, you need to config it to use OAuth 2.0 instead of username/password authentication.

Here are optional troubleshooting commands:

Get-TransportConfig | Select SmtpClientAuthenticationDisabled

Get-CASMailbox cyril@theitbros.com |
Select SmtpClientAuthenticationDisabled

StartTLS error in Send-Mailmessage PowerShell Command

You might receive a StartTLS error when you try to send an e-mail by using the Send-MailMessage PowerShell cmdlet:

Send-Mailmessage -smtpServer smtp.theitbros.com -Port 587 -from "admin@theitbros.com" -to "team@theitbros.com" -subject "Alert" -body "Test TLS"

This command may fail with an error:

Send-Mailmessage : The SMTP server requires a secure connection or the client was not authenticated. The server response was: 5.7.0 Must issue a STARTTLS command first.

Or:

Send-MailMessage: Error in processing. The server response was: 5.7.3 STARTTLS is required to send mail.

If you add the -UseSsl option to the PowerShell command, the error text changes:

Send-Mailmessage : Unable to read data from the transport connection: An existing connection was forcibly closed by the remote host.

Note. In PowerShell 7+ Send-MailMessage was deprecated due to security limitations. We recommend using the Send-MgUserMail cmdlet (Microsoft Graph) or the MailKit .NET library for modern implementations.

Here is a MailKit example (STARTTLS on port 587):

Add-Type -Path "MailKit.dll"

$message = [MimeKit.MimeMessage]::new()
$message.From.Add("admin@contoso.com")
$message.To.Add("user@contoso.com")
$message.Subject = "Test"
$message.Body = [MimeKit.TextPart]::new("plain")
$message.Body.Text = "STARTTLS test"

$smtp = [MailKit.Net.Smtp.SmtpClient]::new()
$smtp.Connect("smtp.contoso.com", 587, [MailKit.Security.SecureSocketOptions]::StartTls)
$smtp.Authenticate("admin@contoso.com","password")
$smtp.Send($message)
$smtp.Disconnect($true)

Note that MailKit automatically supports modern TLS negotiation and we recommend it instead of the deprecated Send-MailMessage cmdlet.

This error usually occurs because of a mismatch between the connection method (SSL vs STARTTLS), port configuration, or TLS version. For example, when you use -UseSsl with a server that expects STARTTLS on port 587, your connection may be closed.

Forcing TLS 1.2 in PowerShell Session

To temporarily enable TLS 1.2 in your PowerShell session, add the following command to the beginning of your PS1 script:

[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12

Note that this workaround is primarily applicable to Windows PowerShell 5.1 and older .NET Framework apps. Modern PowerShell (7+) and .NET versions use system-default TLS settings.

Make sure that TLS 1.2 is now supported in the current PowerShell session:

[enum]::GetNames([Net.SecurityProtocolType])

This will force the Send-MailMessage cmdlet to use TLS 1.2.

To permanently enable strong cryptography in PowerShell and other .Net Framework applications add the following values to the registry:

Set-Itemproperty -Path 'HKLM:\SOFTWARE\Microsoft\.NETFramework\v4.0.30319\' -Name SystemDefaultTlsVersions -Value 1 -Type DWord

Set-Itemproperty -Path 'HKLM:\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\' -Name SystemDefaultTlsVersions -Value 1 -Type DWord

Set-Itemproperty -Path 'HKLM:\SOFTWARE\WOW6432Node\Microsoft\.NETFramework\v4.0.30319\' -Name SystemDefaultTlsVersions -Value 1 -Type DWord

Set-Itemproperty -Path 'HKLM:\SOFTWARE\WOW6432Node\Microsoft\.NETFramework\v2.0.50727\' -Name SystemDefaultTlsVersions -Value 1 -Type DWord

For older .NET Framework apps, SystemDefaultTlsVersions is often not sufficient by itself. You should consider also enabling SchUseStrongCrypto to ensure strong TLS protocols are preferred:

Set-ItemProperty -Path 'HKLM:\SOFTWARE\Microsoft\.NETFramework\v4.0.30319' -Name SchUseStrongCrypto -Value 1 -Type DWord

Set-ItemProperty -Path 'HKLM:\SOFTWARE\WOW6432Node\Microsoft\.NETFramework\v4.0.30319' -Name SchUseStrongCrypto -Value 1 -Type DWord

Now .NET Framework apps will use the OS’s default TLS config and prefer strong TLS protocols. You can use the Send-MailMessage cmdlet to send e-mail through a STARTTLS-enabled SMTP host.

Wrapping up

The STARTTLS is required error is most commonly caused by TLS negotiation, SMTP AUTH, certificate, or client config problems.

In case you are using PowerShell scripts, add [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 at the start. For production environments, consider switching from the deprecated Send-MailMessage to a modern alternative like MailKit or Microsoft Graph API.