---
title: "STARTTLS failures during email verification - Emvero"
description: "Read STARTTLS failures and their limits. Learn what Emvero’s opportunistic TLS checks do, how the certificate code differs, and why a failed upgrade is inconclusive."
url: https://emvero.io/glossary/tls-failure/
language: en
updated: 2026-10-07
---

All terms

Glossary

# TLS and STARTTLS failures

A TLS failure interrupts the encryption upgrade in an SMTP connection. When it happens before the recipient command, the probe has obtained no evidence about the mailbox.

## Where the encryption upgrade happens

A mail server may advertise `STARTTLS` in its `EHLO` response. The client can then upgrade the existing connection to TLS encryption under [RFC 3207](https://www.rfc-editor.org/rfc/rfc3207.html#section-4). The [SMTP handshake explanation](https://emvero.io/glossary/smtp-handshake/) shows this step in the command sequence.

Emvero uses opportunistic TLS. It attempts encryption when the server offers STARTTLS and can continue without encryption when there is no offer. An absent offer therefore has a different meaning from an attempted upgrade that fails.

## What the failure tells you

`SMTP_STARTTLS_FAILED` records an upgrade that could not finish. Emvero stops before `MAIL FROM` and `RCPT TO`, and does not retry the same conversation in plaintext. The server has not heard the recipient, so the failure supplies no evidence of mailbox existence.

The reason-code vocabulary includes `SMTP_TLS_CERTIFICATE_FAILED`. The current probe does not validate certificate chains or hostnames, however, and does not emit this code from those checks. An expired, self-signed or mismatched certificate is not automatically rejected. Verification cannot certify the destination’s identity or certificate health.

A command-and-reply failure after a successful TLS upgrade is a separate condition, covered by [SMTP protocol errors](https://emvero.io/glossary/smtp-protocol-error/). Read the reported cause before treating an interrupted connection as a certificate failure.

## Handling an inconclusive check

When no other evidence determines the decision, a completed inconclusive check returns `unknown` with `allow_with_email_confirmation`. If it is `pending`, retrieve the same check after `retry_after_ms`. The [verification result guide](https://emvero.io/blog/reading-a-verification-result/) explains both workflows.

A later attempt may add evidence, without guaranteeing a conclusion. When mailbox access matters, your application can send confirmation; Emvero’s probe sends no email. [Unknown versus undeliverable](https://emvero.io/compare/unknown-kept-apart/) explains how to handle the unresolved result.

## Related reason codes

The API uses these identifiers to explain a check. The notes identify values that the current verification policy or probe does not return.

`SMTP_STARTTLS_FAILED`

STARTTLS handshake failed

`SMTP_TLS_CERTIFICATE_FAILED`

Defined certificate-failure code; the current probe does not perform this check

## Related terms

### SMTP handshake

The greeting and commands used to ask a mail server about a recipient, stopping before message content is sent.

### Protocol errors

A reply or exchange cannot be processed within the SMTP client’s protocol and resource limits. A valid negative reply is a different case.

### Codes that describe us, not the address

Service protections, capacity limits or incomplete work can prevent a probe. These codes explain the check, rather than the mailbox.

[All terms](https://emvero.io/glossary/)

## Try a check in your account.

Choose the check that fits your question and inspect the result.

Start for free