Fix SMTP STARTTLS Handshake Timeouts in Microsoft 365
Question details
Users experience connection failures and timeout messages when attempting to send emails via Microsoft 365 using SMTP on port 587.
- Product
- Microsoft 365
- Device & OS
- not provided
- Scenario
- Configuring web applications, PHPMailer scripts, printers, or line-of-business applications to send email through Microsoft 365 SMTP servers.
- Observed behavior
- The SMTP connection to smtp.office365.com fails during the STARTTLS handshake, returning unreadable characters, connection errors, or a stream_socket_enable_crypto timeout message.
Verify that your Microsoft 365 account credentials are correct and ensure your network environment explicitly allows outbound traffic on port 587.
Verify Network and Firewall Port Settings
Ensure that port 587 and STARTTLS traffic are not blocked by security software, proxies, or hosting providers.
Network restrictions are the most common cause of TLS handshake timeouts. Even if the initial connection succeeds, firewalls may intercept or drop the traffic when the secure encryption phase begins.
Access your local firewall or network router settings to ensure outbound traffic on TCP port 587 is explicitly allowed.
Verify that your antivirus, VPN, or proxy server is not intercepting, filtering, or altering SMTP and STARTTLS traffic.
If you are running a PHP application on a web host, contact their support team to confirm they permit outbound connections to smtp.office365.com on port 587.
Update Application and TLS Configurations
Ensure the sending application relies on modern TLS protocols and valid certificate bundles to complete the secure handshake.
Looking for a Lightweight Office Suite Alternative?
While troubleshooting complex Microsoft 365 server connections, you might want an easy-to-use desktop suite for your daily document needs. WPS Office offers a powerful, free alternative that is highly compatible with Microsoft file formats without complex network dependencies.
- 1. Visit the WPS website: Navigate to the official WPS Office website to download the free installation package.
- 2. Install the software: Run the installer and follow the on-screen prompts to set up WPS Office on your device.
- 3. Open your files: Launch WPS Office and directly open your existing Microsoft Office documents to continue your work uninterrupted.
Frequently Asked Questions
What causes a stream_socket_enable_crypto timeout in PHPMailer?
This error usually occurs when the network successfully connects to the SMTP server but fails to establish a secure SSL/TLS connection within the time limit. This can be caused by firewall blocking, outdated OpenSSL libraries, proxy interception, or missing CA certificates.
Why does the connection succeed through EHLO but fail at STARTTLS?
The initial unencrypted SMTP connection (EHLO) is easily established over plain text. However, when the server attempts to upgrade to a secure connection via the STARTTLS command, network restrictions, strict antivirus software, or outdated TLS configurations on the sender's side prevent the secure handshake from completing.
Does Microsoft 365 support TLS 1.0 or 1.1 for SMTP connections?
No, Microsoft has deprecated TLS 1.0 and 1.1 for security reasons. To connect to smtp.office365.com securely, your application, operating system, and web server environment must support and use TLS 1.2 or higher.
