I'm using an email client for the first time - for the most part I've always used gmail via the web interface. Now I'm setting up thunderbird to connect to an email server of my own (on my own server, own domain name, etc).

The server machine (and the email server on it) was preconfigured for me. Now i figured out away by which I'm able to send and receive email, but I noticed that in the outgoing and incoming servers section, the connection type was STARTTLS (and not SSL/TLS), and the Authentication Type was "Normal Password".

Does this mean that the password will be sent across in plain text? I'm very paranoid about security - its the only way that it works for me.

Can someone please post links that explain how SMTP (my outbound server) and IMAP (my inbound server) servers work, and what connection type means what?


PS: If this question does not belong here, please redirect me.

closed as off-topic by Jenny D, peterh, MadHatter, Ward, mdpc Jun 22 '17 at 0:14

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "Questions on Server Fault must be about managing information technology systems in a business environment. Home and end-user computing questions may be asked on Super User, and questions about development, testing and development tools may be asked on Stack Overflow." – Jenny D, peterh, MadHatter, Ward, mdpc
If this question can be reworded to fit the rules in the help center, please edit the question.


TLS is very safe and in some ways more "flexible" then SSL since the standard application ports can be used in duel-mode (with and/or without TLS) in a lot of configurations.

The first thing that takes place after the initial application port connect is the TLS negotiation where both sides figure out if they are both TLS capable, if so TLS negotiation takes place and everything else from there on is encrypted base on the negotiated encryption capabilities/configurations.

Here's a quick overview - http://www.tech-faq.com/tls-transport-layer-security.html.


STARTTLS is very secure but the implementations only check that validity of a certificate but do not check that certificate has any ascociation with that domain.

For instance, if you can fake the IP (man in the middle) most MTAs will just log that they connected to a validly signed certificate. You can create a certificate for any domain and use to perform an MITM interception of email. The MITM can then reforward emails.

Not the answer you're looking for? Browse other questions tagged or ask your own question.