email-transport · severity medium

Mail server certificate

Among mail servers offering STARTTLS, the share presenting a self-signed or expired certificate — TLS that authenticates nothing.

Measured every Friday · last updated

How it is measured

Complete STARTTLS, inspect the leaf certificate. Denominator: MXs offering STARTTLS.

Why it matters

SMTP TLS is opportunistic (RFC 7435) — senders accept any certificate — so an invalid certificate still encrypts but authenticates nothing, leaving the connection open to interception. It only becomes a hard failure under DANE or MTA-STS enforce.

Limits of this measurement

Honesty demands the split. Because opportunistic TLS tolerates mismatches, only self_signed and expired are counted as the quiet failure; hostname_mismatch is reported but not counted.

The base rate

Two independent populations. The global, domain-anchored figure is unbiased; the company-anchored figures are built by matching company names to domains and skew toward more digitally-mature firms. Both are published, so the gap is visible.

Global (all domains) 4.81% fail · n=1,101
valid: 80.74%hostname_mismatch: 14.44%self_signed: 1.82%expired: 3%
France companies 6.06% fail · n=578
valid: 90.14%hostname_mismatch: 3.81%self_signed: 5.71%expired: 0.35%
UK companies 1.59% fail · n=1,071
valid: 92.62%hostname_mismatch: 5.79%self_signed: 1.12%expired: 0.47%
Norway companies 0.62% fail · n=812
valid: 97.41%hostname_mismatch: 1.97%self_signed: 0.25%expired: 0.37%
valid · 97.41%hostname_mismatch · 1.97%self_signed · 0.25%expired · 0.37%

By company size band

Company-anchored cuts (national registries with a size proxy), split by size band. Right-hand figure is the share not meeting the control.

France
micron=136
valid: 86.03%hostname_mismatch: 7.35%self_signed: 5.88%expired: 0.74%
6.62%
smalln=173
valid: 91.91%hostname_mismatch: 2.31%self_signed: 5.78%
5.78%
mediumn=139
valid: 89.93%hostname_mismatch: 3.6%self_signed: 6.47%
6.47%
largen=130
valid: 92.31%hostname_mismatch: 2.31%self_signed: 4.62%expired: 0.77%
5.38%
UK
smalln=394
valid: 91.88%hostname_mismatch: 6.6%self_signed: 0.76%expired: 0.76%
1.52%
medium/largen=419
valid: 93.08%hostname_mismatch: 5.01%self_signed: 1.43%expired: 0.48%
1.91%
Norway
micron=239
valid: 96.65%hostname_mismatch: 2.51%self_signed: 0.42%expired: 0.42%
0.84%
smalln=213
valid: 97.18%hostname_mismatch: 2.82%
0%
mediumn=218
valid: 97.71%hostname_mismatch: 1.83%expired: 0.46%
0.46%
largen=142
valid: 98.59%self_signed: 0.7%expired: 0.7%
1.41%

Every segment

Pick one to see the citable answer for a company like yours, with its trend and methodology.

Show the remaining 2 segments

Slices below 100 measured members are withheld rather than shown with a wide interval — an absent country or issuer means too little data, not zero failures. Licensed CC BY 4.0. Machine-readable data per segment: append .json or .csv to its URL.