Check mail server TLS certificate expiry

To check mx ssl certificate expiry you must speak SMTP STARTTLS on port 25 or 587 with the correct -servername, not only HTTPS on the marketing site.

Mail infrastructure uses different hostnames, ports, and certificates than www. Operations teams that monitor only the public website learn about mail TLS expiry from bounced mail, TLS-RPT spikes, or mobile clients refusing sync.

This guide lists MX discovery, OpenSSL STARTTLS checks, and how to interpret results beside HTTPS probes—without assuming your MTA shares the web server’s cert bundle.

Deliverability vendors score IP reputation, but an expired check mx ssl certificate condition fails earlier in the handshake—before message bodies matter. Security gateways that decrypt mail add another certificate hop; expiry there blocks entire tenant inboxes while web dashboards stay green.

Hybrid Microsoft environments route mail through connectors you operate. Those connectors terminate TLS with certificates your team renews even when cloud MX records look healthy from a browser-only monitoring stack.

What to check

Verify MX hostnames from DNS, not assumptions from marketing DNS. Each MX A/AAAA target may present its own certificate on 25 (inbound), 587 (submission), and 465 (SMTPS). Certificate expiry is the leaf notAfter for the name clients expect in EHLO/STARTTLS. Trust requires a valid chain for SMTP clients; browsers are irrelevant here.

Distinguish provider-managed mail (Microsoft 365, Google Workspace) from on-prem relays. Cloud MX often uses the vendor’s certs—you still validate the names your MTA-STS policy advertises. On-prem Expired certs on a edge filter affect every domain routing through it.

Compare results with email TLS certificate expired playbooks if users already see handshake failures.

Step-by-step

Resolve MX records

dig +short MX example.com | sort -n

STARTTLS on inbound MX (port 25)

MX=$(dig +short MX example.com | sort -n | head -1 | awk '{print $2}')
echo | openssl s_client -starttls smtp -connect "${MX%.}:25" -servername "$MX" 2>/dev/null \
  | openssl x509 -noout -dates -subject -issuer -ext subjectAltName

Submission path (port 587)

echo | openssl s_client -starttls smtp -connect mail.example.com:587 -servername mail.example.com 2>/dev/null \
  | openssl x509 -noout -dates -subject

SMTPS wrapper (port 465)

echo | openssl s_client -connect smtp.example.com:465 -servername smtp.example.com 2>/dev/null \
  | openssl x509 -noout -dates -subject

Quick expiry-only one-liner per MX

for mx in $(dig +short MX example.com | awk '{print $2}'); do
  host="${mx%.}"
  end=$(echo | openssl s_client -starttls smtp -connect "$host:25" -servername "$host" 2>/dev/null \
    | openssl x509 -noout -enddate 2>/dev/null)
  echo "$host $end"
done

Document each MX separately; lowest preference does not guarantee it is the only live listener.

How to read the output

notBefore= and notAfter= follow the same ASN.1 rules as HTTPS. The subject and subjectAltName must include the hostname clients use (mx1.example.com, mail.example.com, or a provider vanity name). If OpenSSL prints verify error:num=10:certificate has expired, the leaf is past notAfter.

Watch for wrong host symptoms: verification fails with hostname mismatch while dates look fine—SAN omission, not expiry. Multi-hop setups may show a filter appliance cert on port 25 while submission uses another; do not conflate them in one spreadsheet row.

Some providers rotate certs frequently; short lifetimes are normal if automation works. Track trend and last successful probe, not only absolute lifetime, when evaluating Google or Microsoft endpoints you do not operate.

Common mistakes

Testing example.com:443 and declaring mail healthy is the classic miss. Always query MX and use -starttls smtp.

Omitting -servername on shared IP hosts returns a default certificate with unrelated names and misleading dates. Set -servername to the MX hostname or advertised EHLO name.

Checking only the primary MX when secondary MX still accepts mail with an expired cert—some senders retry lower-priority MX records.

Forgetting outbound submission used by apps (smtp.internal:587) while inbound looks fine. Application mail often dies first.

Renaming mail hosts without updating SAN lists on the renewed cert, then blaming “TLS bugs” when the date is valid but names do not match. Cross-check with OpenSSL check certificate expiry date patterns on HTTPS listeners that share the same PKI team.

When to use automation

Mail certs rotate on schedules unrelated to web deploys. Automate STARTTLS probes on every MX and submission hostname from external vantage points, not just inside the corporate network split-tunnel.

Alert on 14/7/1-day notAfter thresholds per mail listener, with separate checks for port 25 versus 587. Include MTA-STS policy hosts if published—they must match the cert users validate against.

Pair TLS monitoring with RDAP domain expiry so MX names remain resolvable during renewal. Free external checks (ssldays-style) can schedule SMTP STARTTLS where supported, while you keep openssl-based runbooks for deep incidents.

After renewal, re-run the same commands from outside the datacenter; internal trust stores may hide missing intermediates that public MTAs reject.

Publish an internal mail TLS matrix listing every hostname, port, owning team, and last probe timestamp. Security reviews reference the matrix instead of asking engineers to rediscover MX during audit season.

When migrating MX to a SaaS provider, keep probing legacy on-prem listeners until SMTP traffic hits zero—straggling apps often hold old relays weeks longer than DNS TTLs suggest.

Capture TLS-RPT aggregate reports if you publish MTA-STS. Spikes in certificate failures sometimes precede user-visible bounces by hours; correlate report timestamps with your openssl transcripts.

Rotate monitoring credentials for provider APIs separately from MX checks. Expiry monitoring should not depend on admin portals you can only reach over VPN with personal MFA devices.

Marketing teams measuring email deliverability sometimes conflate SPAM folder placement with TLS expiry failures. Teach them to request openssl STARTTLS evidence before blaming content or IP reputation when handshake errors appear in SMTP logs.

Managed service providers operating shared MX appliances must document which customer domains share one certificate. Multi-tenant expiry incidents page dozens of clients simultaneously; MSP runbooks should list every affected domain when opening status pages.

Seasonal retailers scale outbound mail during holidays; ensure submission listeners scaled horizontally receive the same renewed PEM simultaneously. Rolling restarts that leave one old node in a pool produce intermittent TLS errors hardest to diagnose without per-node probes.

Compliance frameworks referencing encryption in transit for email should cite archived openssl transcripts stored alongside MX matrix reviews. Auditors accept recurring evidence more readily than ad hoc screenshots.

Disaster recovery mail sites in secondary regions often use different MX priorities; include them in worksheets even when traffic is normally zero. Failover drills switch MX weights and expose expired certificates nobody tested because primary paths looked healthy for years.

Document greylisting and tarpitting behaviors that delay STARTTLS probes; sleeps in scripts should exceed typical greylist windows so openssl completes during repeated monitoring runs without false UNREACHABLE noise.

Publish customer-facing status page criteria distinguishing mail TLS incidents from general site outages. Support macros referencing your internal MX matrix reduce mean time to accurate public communication.

Healthcare organizations transmitting messages governed by policy references to encryption in transit should map each MX probe log to workforce training records annually. Nurses rarely distinguish STARTTLS from HTTPS; leadership needs plain language summaries of check mx ssl certificate health.

Political campaigns with rapid mail scale-ups should schedule expiry probes before voter contact peaks, not after bounce rates spike on polling week.

Aviation and maritime operators using satellite links should note higher latency in openssl timeouts so STARTTLS checks do not false fail when ships or aircraft legitimately hit slow paths.