Visual RFC.
ALL RFCs / RFC 3848
Read the RFC ↗
RFC 3848 / MAIL TRANSMISSION TRACE

Combine successful STARTTLS and AUTH without guessing

03

STARTTLS begins Transport Layer Security (TLS) negotiation on an SMTP connection. The S suffix records it successfully providing a strong transport encryption layer; adding successful AUTH yields ESMTPSA.

DIAGRAMRead RFC section 1 ↗
RFC 3848 · § 1EXAMPLE
3 / 3
Combine successful STARTTLS and AUTH without guessingThree outcome comparisons distinguish220ready from successful strong STARTTLS encryption, then combine current-state successful AUTH. First a220ready reply is not completed TLS, and premature S attribution is blocked. Separate completed strong STARTTLS with no current AUTH gives ESMTPS. Separate both-properties result gives ESMTPSA. No universal AUTH/TLS order is implied; old preTLS AUTH knowledge is not retained across the RFC3207reset. Tokens expose no cipher/version/certificate detail.S records completed strong STARTTLSStrong STARTTLS layer: yesCurrent SMTP AUTH succeeded: yesESMTPSACombined properties · suffix order S then ANo TLS version or cipher is encoded
03
Combine both completed properties.

A separate final example has strong STARTTLS protection and successful AUTH in the current SMTP state. The combined type is ESMTPSA, not an invented ESMTPAS token.

Source for this drawing: RFC 3848 · Read RFC section 1 ↗

Protocol participantThreat or exceptionProtocol controlSimplified drawings · precise section references
New to this? Start hereA quick picture + helpful background

A message needs an address.

Think of a packet as a small addressed envelope. Devices pass it onward; transport protocols decide what delivery promises an application gets.

Helpful first, if these ideas are unfamiliar

RFC 5321 SMTP RFC 5322 Email message format RFC 3207 SMTP STARTTLS

These pictures are analogies to help you learn. The linked RFC explains the actual rules.

Related RFCs and changes

“Updates” changes part of an earlier RFC. “Obsoletes” replaces it. This list shows selected related documents.

KEY POINT

The two suffix properties are separate observations of this hop.

  • ESMTPS records successful STARTTLS providing the strong transport encryption layer; a 220 ready reply alone is not the completed negotiation.
  • ESMTPSA combines ESMTPS and ESMTPA. Its name does not mandate a universal ordering of TLS and AUTH; the scenes compare final properties.
  • RFC 3207 §4.2 resets pre-TLS SMTP knowledge. A successful AUTH seen only before that reset is not carried forward into the new TLS SMTP state.
  • The label omits TLS version, cipher and certificate-validation details. It is not modern TLS configuration advice or proof of end-to-end encryption.
DETAILS

The drawings compare outcomes, not one continuous AUTH/TLS transcript.

Read the RFC section ↗

All chapters in RFC 3848

Drawing view

Scroll the drawing to see every part. Playback controls stay above it.

RFC 9700 / CHAPTERS

Chapters

For full details, tables, algorithms, and exceptions, read the original RFC.

RFC status and corrections ↗