SMTP ports and TLS
Which ports Mailyoto's mail servers listen on, which TLS settings they accept, and how Mailyoto encrypts forwarded email on its way out, MTA-STS included.
Updated 27 October 2026
Mailyoto encrypts SMTP with TLS 1.2 or newer. Mailyoto refuses older versions, such as TLS 1.0, TLS 1.1 and SSL 3.
Ports#
| Port | Host | Used for | Encryption |
|---|---|---|---|
25 | mx1.mailyoto.com, mx2.mailyoto.com | Other mail servers delivering email to your aliases | STARTTLS when the sending server asks for it |
587 | smtp.mailyoto.com | Sending from your mail app or code, on paid plans | STARTTLS |
465 | smtp.mailyoto.com | Sending, for apps that need implicit TLS | TLS from the first byte |
Use port 587 with STARTTLS unless your app only offers implicit TLS (often labelled SSL/TLS). Port 25 is for server-to-server delivery and isn’t documented for sending.
Encryption settings#
All 3 ports follow Mozilla’s “intermediate” recommendations.
| Setting | Value |
|---|---|
| TLS versions | TLS 1.2, TLS 1.3 |
| TLS 1.2 cipher suites | ECDHE key exchange with AES-GCM or ChaCha20-Poly1305 |
| TLS 1.3 cipher suites | TLS_AES_128_GCM_SHA256, TLS_AES_256_GCM_SHA384, TLS_CHACHA20_POLY1305_SHA256 |
| Curves | X25519, P-256 and P-384. Ports 25 and 587 also accept P-521 and X448. |
| Cipher order | The connecting client’s |
| Session tickets | None |
Signing in to send#
| Setting | Value |
|---|---|
| Authentication methods | PLAIN, LOGIN |
| When you can sign in | Only once the connection uses TLS |
| Username | The full credential address, such as amina@lunavera.com |
Signing in before STARTTLS gets 538 5.7.11 Encryption required for requested authentication mechanism. Turn on STARTTLS in your app, or switch to port 465.
A wrong username or password gets 535 5.7.8 Authentication credentials invalid.
Email arriving for your aliases#
Mailyoto offers STARTTLS on port 25, with TLS 1.2 or newer. A server that doesn’t use it can still deliver without encryption.
Email Mailyoto forwards and sends#
When the destination’s server offers STARTTLS, Mailyoto encrypts the connection with TLS 1.2 or newer.
Most mail servers present a certificate that names another host or that they signed themselves. So unless the destination’s domain publishes a policy, Mailyoto encrypts without checking the certificate.
When the destination offers no encryption, or the encrypted connection fails, Mailyoto delivers without encryption rather than hold your email.
Destinations that publish MTA-STS#
A domain can publish an MTA-STS policy (RFC 8461) that requires encrypted delivery. Gmail and Outlook.com do. When the policy is in enforce mode, Mailyoto:
- delivers only to the mail servers the policy names;
- checks that each server’s certificate is valid and names that server;
- never delivers without encryption.
When a check fails, the email waits and Mailyoto retries it on the usual schedule. Its log entry shows the reason, starting with 4.7.5.
A policy in testing mode changes nothing. Mailyoto doesn’t check DANE (TLSA) records.
Mailyoto’s own domains#
The domains that receive mail for Mailyoto publish an MTA-STS policy in testing mode and a TLS-RPT address (RFC 8460). Mail servers that support TLS-RPT report failed TLS checks to Mailyoto. These domains include mailyoto.com and the domains your contacts’ replies and bounce reports arrive on.