Connect to the exact SMTP hostname and port used by the mail flow.

For STARTTLS, negotiate the SMTP protocol first and then upgrade the connection. For implicit TLS submission, TLS begins immediately.

Inspect:

  • certificate names;
  • validity dates;
  • issuer/chain;
  • negotiated TLS version;
  • whether the client validates the intended hostname.

A valid certificate on www.example.com tells you nothing about the certificate on mx1.example.com:25.

Reference material