STARTTLS support for SMTP #6912

New Issue

GiteaMirror · 2025-11-02T07:10:54-06:00

GiteaMirror commented

2025-11-02 07:10:54 -06:00

Originally created by @tomaswarynyca on GitHub (Feb 22, 2021).

When trying to connect poste.io my mail provider to authenticate and gitea only supports TLS.
The provider gives me only STARTTLS

Originally created by @tomaswarynyca on GitHub (Feb 22, 2021). When trying to connect poste.io my mail provider to authenticate and gitea only supports TLS. The provider gives me only STARTTLS

GiteaMirror added the type/question label 2025-11-02 07:10:54 -06:00

GiteaMirror closed this issue

2025-11-02 07:10:54 -06:00

GiteaMirror commented

2025-11-02 07:10:55 -06:00

@zeripath commented on GitHub (Feb 22, 2021):

From: https://docs.gitea.io/en-us/email-setup/

Please note: authentication is only supported when the SMTP server communication is encrypted with TLS or HOST=localhost. TLS encryption can be through:

Via the server supporting TLS through STARTTLS - usually provided on port 587. (Also known as Opportunistic TLS.)
SMTPS connection (SMTP over transport layer security) via the default port 465.
Forced SMTPS connection with IS_TLS_ENABLED=true. (These are both known as Implicit TLS.)

This is due to protections imposed by the Go internal libraries against STRIPTLS attacks.

From: https://docs.gitea.io/en-us/config-cheat-sheet/#mailer-mailer

HOST: : SMTP mail host address and port (example: smtp.gitea.io:587).
- Using opportunistic TLS via STARTTLS on port 587 is recommended per RFC 6409.
IS_TLS_ENABLED : false : Forcibly use TLS to connect even if not on a default SMTPS port.
- Note, if the port ends with 465 SMTPS/SMTP over TLS will be used despite this setting.
- Otherwise if IS_TLS_ENABLED=false and the server supports STARTTLS this will be used. Thus if STARTTLS is preferred you should set IS_TLS_ENABLED=false.

Therefore you should set IS_TLS_ENABLED=false and use port 587. STARTTLS will be used by default.

@zeripath commented on GitHub (Feb 22, 2021): From: https://docs.gitea.io/en-us/email-setup/ --- Please note: authentication is only supported when the SMTP server communication is encrypted with TLS or HOST=localhost. TLS encryption can be through: * Via the server supporting TLS through STARTTLS - usually provided on port 587. (Also known as Opportunistic TLS.) * SMTPS connection (SMTP over transport layer security) via the default port 465. * Forced SMTPS connection with IS_TLS_ENABLED=true. (These are both known as Implicit TLS.) This is due to protections imposed by the Go internal libraries against STRIPTLS attacks. --- From: https://docs.gitea.io/en-us/config-cheat-sheet/#mailer-mailer * HOST: <empty>: SMTP mail host address and port (example: smtp.gitea.io:587). - Using opportunistic TLS via STARTTLS on port 587 is recommended per RFC 6409. * IS_TLS_ENABLED : false : Forcibly use TLS to connect even if not on a default SMTPS port. - Note, if the port ends with 465 SMTPS/SMTP over TLS will be used despite this setting. - Otherwise if IS_TLS_ENABLED=false and the server supports STARTTLS this will be used. Thus if STARTTLS is preferred you should set IS_TLS_ENABLED=false. --- Therefore you should set IS_TLS_ENABLED=false and use port 587. STARTTLS will be used by default.

Sign in to join this conversation.

Branches Tags

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/gitea#6912