STARTTLS vs SSL/TLS in a Mail App: The Exact Difference

STARTTLS and SSL/TLS are two ways of encrypting the connection between your mail app and the server. SSL/TLS (also called implicit TLS) encrypts the connection from the moment it opens. STARTTLS opens in plain text and then issues a command to switch to encryption before any password is sent. The result is the same level of protection; the difference is the handshake, and each method belongs to a specific port.

Quick summary

• SSL/TLS (implicit): the TLS handshake happens first, then the mail protocol begins inside the encrypted tunnel. Used on IMAP 993, POP3 995 and SMTP 465.
• STARTTLS (explicit): the mail protocol begins in the clear, the server advertises STARTTLS, the client asks for it, then the TLS handshake happens and the session restarts encrypted. Used on SMTP 587 and IMAP 143.
• In both cases the login and the messages are encrypted. Nothing sensitive is sent before the upgrade in a correctly configured client.
• Outlook (classic): File, Account Settings, select the account, More Settings, Advanced tab. The Outgoing server dropdown must show STARTTLS with port 587.
• Apple Mail: Mail, Settings, Accounts, Server Settings. Untick "Automatically manage connection settings" to reveal the port and the Use TLS/SSL checkbox; for 587 the checkbox is ticked and authentication (proof that email really comes from your company) is Password.

What happens on the wire

• SSL/TLS (implicit): the TLS handshake happens first, then the mail protocol begins inside the encrypted tunnel. Used on IMAP 993, POP3 995 and SMTP 465.
• STARTTLS (explicit): the mail protocol begins in the clear, the server advertises STARTTLS, the client asks for it, then the TLS handshake happens and the session restarts encrypted. Used on SMTP 587 and IMAP 143.
• In both cases the login and the messages are encrypted. Nothing sensitive is sent before the upgrade in a correctly configured client.

The port and method must match

IMAP  mail.oqumail.com  993  SSL/TLS
SMTP  mail.oqumail.com  587  STARTTLS

Wrong:  SMTP 587 + SSL/TLS   -> client waits for a TLS handshake the server never starts
Wrong:  SMTP 465 + STARTTLS  -> client sends plain text into an encrypted port
Wrong:  IMAP 993 + STARTTLS  -> same problem on the receiving side

The 587 mistake, explained

On port 587 choose STARTTLS, not SSL/TLS. Picking SSL on 587 is the single most common setup mistake and it makes sending silently fail. On 587 the server is waiting for the client to say EHLO in plain text. A client set to SSL/TLS instead begins a TLS handshake immediately, the server sees bytes it cannot parse, and the connection stalls or drops. Symptoms are messages stuck in the Outbox, "server unexpectedly disconnected", or an SSL error that mentions the wrong protocol version. Receiving still works, which makes it confusing.

How to check which method your app is using

1. Outlook (classic): File, Account Settings, select the account, More Settings, Advanced tab. The Outgoing server dropdown must show STARTTLS with port 587.
2. Apple Mail: Mail, Settings, Accounts, Server Settings. Untick "Automatically manage connection settings" to reveal the port and the Use TLS/SSL checkbox; for 587 the checkbox is ticked and authentication (proof that email really comes from your company) is Password.
3. Thunderbird: Account Settings, Outgoing Server (SMTP), Edit. Connection security: STARTTLS, port 587.
4. iPhone: Settings, Mail, Accounts, your account, SMTP, primary server. Use SSL on, server port 587. iOS negotiates STARTTLS automatically on 587.
5. Send a message to yourself. If it leaves the Outbox and appears in Sent, the pairing is right.

Common encryption mistakes

• Choosing "None" because a wizard failed once. The server refuses authentication without TLS, so this never works.
• Choosing "SSL/TLS (accept all certificates)" to silence a certificate warning. The warning almost always means the server name is wrong, not that you should trust anything.
• Copying settings from a previous provider that used 465, then only changing the hostname.
• Confusing the word SSL in Apple Mail (a single checkbox that covers both methods) with the explicit SSL/TLS option in Outlook and Thunderbird.

OquMail settings that always work

Use mail.oqumail.com on port 993 with SSL/TLS for incoming, and mail.oqumail.com on port 587 with STARTTLS for outgoing. The username is your full email address and the password is your webmail password. OquMail presents a valid certificate for its mail hostname, so no "accept certificate" override is ever needed. If sending still fails, the per-message delivery log in the dashboard shows whether the message reached OquMail at all.

Common questions

Is STARTTLS less secure than SSL/TLS?

Not when the client requires it. A client that treats STARTTLS as optional could be tricked into plain text by an attacker on the network, which is why good apps fail closed. OquMail requires TLS before authentication.

Why does the setting say SSL when SSL is obsolete?

Habit. Every modern connection uses TLS 1.2 or 1.3; the label SSL survives in menus for familiarity.

Can I use 465 with OquMail?

Use 587 with STARTTLS as published. That is the tested and documented configuration.