email-transport · severity medium

Mail server certificate

Among mail servers offering STARTTLS, the share presenting a self-signed or expired certificate — TLS that authenticates nothing.

Measured every Friday · last updated

How it is measured

Complete STARTTLS, inspect the leaf certificate. Denominator: MXs offering STARTTLS.

Why it matters

SMTP TLS is opportunistic (RFC 7435) — senders accept any certificate — so an invalid certificate still encrypts but authenticates nothing, leaving the connection open to interception. It only becomes a hard failure under DANE or MTA-STS enforce.

Limits of this measurement

Honesty demands the split. Because opportunistic TLS tolerates mismatches, only self_signed and expired are counted as the quiet failure; hostname_mismatch is reported but not counted.

The base rate

Two independent populations. The global, domain-anchored figure is unbiased; the company-anchored figures are built by matching company names to domains and skew toward more digitally-mature firms. Both are published, so the gap is visible.

Global (all domains) 4.82% fail · n=1,100
valid: 81.27%hostname mismatch: 13.91%self-signed: 1.82%expired: 3%
France companies 1.03% fail · n=585
valid: 94.7%hostname mismatch: 4.27%self-signed: 0.51%expired: 0.51%
UK companies 0.83% fail · n=1,088
valid: 94.39%hostname mismatch: 4.78%self-signed: 0.37%expired: 0.46%
Norway companies 0.74% fail · n=813
valid: 96.19%hostname mismatch: 3.08%self-signed: 0.25%expired: 0.49%
valid · 96.19%hostname mismatch · 3.08%self-signed · 0.25%expired · 0.49%

By company size band

Company-anchored cuts (national registries with a size proxy), split by size band. Right-hand figure is the share not meeting the control.

France
micron=150
valid: 93.33%hostname mismatch: 5.33%self-signed: 0.67%expired: 0.67%
1.33%
smalln=163
valid: 98.77%hostname mismatch: 1.23%
0%
mediumn=155
valid: 89.03%hostname mismatch: 9.03%self-signed: 0.65%expired: 1.29%
1.94%
largen=117
valid: 98.29%hostname mismatch: 0.85%self-signed: 0.85%
0.85%
UK
smalln=410
valid: 93.41%hostname mismatch: 5.85%self-signed: 0.24%expired: 0.49%
0.73%
medium/largen=441
valid: 95.92%hostname mismatch: 2.95%self-signed: 0.45%expired: 0.68%
1.13%
Norway
micron=244
valid: 95.49%hostname mismatch: 4.1%expired: 0.41%
0.41%
smalln=208
valid: 96.63%hostname mismatch: 3.37%
0%
mediumn=228
valid: 96.93%hostname mismatch: 2.19%expired: 0.88%
0.88%
largen=133
valid: 95.49%hostname mismatch: 2.26%self-signed: 1.5%expired: 0.75%
2.26%

Every segment

Pick one to see the citable answer for a company like yours, with its trend and methodology.

Show the remaining 2 segments

Slices below 100 measured members are withheld rather than shown with a wide interval — an absent country or issuer means too little data, not zero failures. Licensed CC BY 4.0. Machine-readable data per segment: append .json or .csv to its URL.