STARTTLS and MX certificates

SMTP starts as a plaintext conversation. STARTTLS is the command that upgrades it, and every mail server that accepts mail from the internet should offer it. If yours does not, everything sent to you crosses the network readable.

bash

openssl s_client -starttls smtp -connect mail.example.com:25 -servername mail.example.com

Certificates are a softer requirement, until they are not

SMTP TLS is opportunistic. A sender that offers STARTTLS will usually accept whatever certificate it gets, including one that is self signed, expired, or issued for a completely different name. So a mismatch does not break delivery today and can sit there unnoticed for years.

It breaks the moment someone enforces

Senders using MTA-STS in enforce mode, or DANE, do check the name. For them a mismatched certificate is a hard failure and the mail does not arrive. It also means you cannot turn on MTA-STS for your own domain until the certificate covers the MX hostname.

Getting it right

Issue the certificate for the hostname in your MX record, not for your website. If the MX is mail.example.com then that name has to be on the certificate, as the common name or in the subject alternative names. A free certificate from any public CA is fine, and automating the renewal matters more than the issuer does.

While you are there, prefer TLS 1.2 and 1.3 and drop the older versions. They are deprecated everywhere else and there is no reason for mail to be an exception.