STARTTLS Not Supported / TLS Handshake Failed: Mail App and Script Fixes

Two ways exist to encrypt a mail connection. On port 465 the connection is encrypted from the first byte (implicit TLS). On port 587 it starts in plain text and the client sends the STARTTLS command to upgrade it. Every error on this page is one side using the wrong method for the port: a client expecting encryption on 587 from the start, or a client sending STARTTLS on a port that is already encrypted. The server is fine; the pairing is wrong.

Quick answer

For OquMail, use port 587 with STARTTLS. In apps that label the options, choose STARTTLS (or TLS), not SSL/TLS, for the outgoing server on 587. In code, that is secure: false in Nodemailer, starttls() after connecting in Python, ENCRYPTION_STARTTLS in PHPMailer, and MAIL_ENCRYPTION=tls in Laravel. The incoming server is the opposite: port 993 with SSL/TLS.

The errors and what each means

• "Server does not support STARTTLS" or "STARTTLS is required": the client connected to a port where the server was not offering STARTTLS, usually because the client picked port 465 or 25 while asking for STARTTLS.
• "SSL routines: wrong version number" or "ssl3_get_record:wrong version number": the client tried to start TLS immediately (implicit) on port 587, where the server answered in plain text. Classic SSL-on-587 mistake.
• "TLS handshake failed" or "Connection reset during TLS": same mismatch seen from the other direction, or an antivirus intercepting the connection.
• "Must issue a STARTTLS command first": the client tried to log in before upgrading to TLS. Enable STARTTLS in the client; the server refuses plain-text logins.
• Thunderbird "Security error" when fetching: the IMAP side set to STARTTLS on port 993, which is implicit SSL/TLS. Set the incoming server to SSL/TLS on 993.

The pairs that work

• Outgoing: mail.oqumail.com, port 587, STARTTLS, authentication on.
• Incoming: mail.oqumail.com, port 993, SSL/TLS.
• Not port 465 with STARTTLS, not port 587 with SSL/TLS, and never port 25 from a mail app.

Test the server yourself

This command connects on 587, upgrades with STARTTLS and prints the certificate. If it shows a 250 response and a certificate for mail.oqumail.com, the server is fine and the problem is in your client settings:

openssl s_client -starttls smtp -connect mail.oqumail.com:587 -crlf

Fix it per client

• Outlook (classic): File, Account Settings, the account, More Settings, Advanced. Outgoing server 587, encrypted connection type STARTTLS (older versions call it TLS).
• Apple Mail and iPhone: Use SSL on with port 587 for SMTP; Apple negotiates STARTTLS automatically when SSL is on with 587.
• Thunderbird: Outgoing Server, Connection security STARTTLS, Port 587, authentication (proof that email really comes from your company) Normal password.
• Nodemailer: port 587 with secure: false; the library upgrades with STARTTLS itself. secure: true is only for 465.
• Python smtplib: smtplib.SMTP(host, 587) then ehlo(), starttls(), ehlo(), login(). Do not use SMTP_SSL on 587.
• PHPMailer: Port 587, SMTPSecure = PHPMailer::ENCRYPTION_STARTTLS.

Common questions

Why not just use port 465?

OquMail's submission port is 587, which every client supports with STARTTLS, so there is one correct pairing instead of two.

Is STARTTLS less secure than SSL/TLS?

Not with a modern server. After the upgrade the connection uses the same TLS. The only risk is a client configured to fall back to plain text if STARTTLS fails; OquMail refuses logins without TLS, so that fallback cannot leak a password.

It worked yesterday and fails today.

Look for an antivirus or VPN update that started intercepting mail connections, or a changed network. The server's TLS configuration does not change day to day.