TLS directive

require-starttls

Require TLS for delivery to a destination.

Purpose

Require TLS for delivery to a destination. This reference focuses on operational intent, placement, validation, and failure modes rather than presenting a value as universally safe.

Example syntax

require-starttls yes

Placement and scope

The effective scope depends on where the directive is placed: global, source, SMTP user, virtual MTA, pool, or destination domain. Keep related controls together and comment the business purpose of each override.

Verification procedure

1. Back up the active configuration and included files.
2. Confirm the directive is supported by the installed PowerMTA release.
3. Validate every referenced VMTA, pool, file, hostname, IP address, selector, and pattern list.
4. Reload safely and watch the main log for parser or runtime errors.
5. Send a controlled test and inspect the exact source IP, EHLO, headers, TLS state, and SMTP response.

Common failure modes

• Placing the directive in a scope where it is ignored or overridden.
• Referencing an object that is misspelled or not defined.
• Copying syntax from a different PowerMTA version.
• Using aggressive values without measuring provider acceptance and queue age.

Related resources