Negotiate the boundary between SMTP and TLS
01SMTP means Simple Mail Transfer Protocol. STARTTLS is a command that switches this existing SMTP connection into a TLS handshake; it does not encrypt earlier traffic.
The server sends 220 Ready to start TLS. The next client traffic must begin the TLS negotiation; a MAIL command at this point is stopped.
Source for this drawing: RFC 3207 · Read RFC section 4 ↗
New to this? Start hereA quick picture + helpful background
A message needs an address.
Think of a packet as a small addressed envelope. Devices pass it onward; transport protocols decide what delivery promises an application gets.
Helpful first, if these ideas are unfamiliar
These pictures are analogies to help you learn. The linked RFC explains the actual rules.
Terms in this drawing
Related RFCs and changes
“Updates” changes part of an earlier RFC. “Obsoletes” replaces it. This list shows selected related documents.
A 220 reply permits TLS negotiation, not more SMTP commands.
- The server advertises STARTTLS in its EHLO reply with no parameters. The STARTTLS command itself also has no parameters and adds no MAIL parameter.
- After a 220 reply to STARTTLS, the client MUST start TLS negotiation before sending another SMTP command. If it cannot start the handshake, it SHOULD abort the connection.
- If SMTP pipelining is used, STARTTLS must be the last command in its group; do not queue later SMTP commands across this boundary.
The greeting and unrelated EHLO extensions are omitted from this fictional dialogue. STARTTLS is an SMTP extension, not a TLS version or an end-to-end message-encryption format. Commands/replies before the TLS handshake remain in cleartext.
Read the RFC section ↗