I need to get SSL certificate of some mail servers. I know I need to do execute following steps.

  1. Do a DNS mx query on the domain name (dig google.com mx).
  2. Use the information to download SSL certificate (openssl s_client -showcerts -connect google.com:443).

But I am not sure what information I should pick up from step 1 and how it should be used in step 2.

To get the SSL/TLS Certificate of an SMPT server pick the domain of one MX record from the answer section of your DNS query and feed it to openssl:

$ dig gmail.com mx
gmail.com.      3599    IN  MX  20 alt2.gmail-smtp-in.l.google.com.
gmail.com.      3599    IN  MX  5 gmail-smtp-in.l.google.com.
gmail.com.      3599    IN  MX  30 alt3.gmail-smtp-in.l.google.com.
gmail.com.      3599    IN  MX  10 alt1.gmail-smtp-in.l.google.com.
gmail.com.      3599    IN  MX  40 alt4.gmail-smtp-in.l.google.com.

$ openssl s_client -connect gmail-smtp-in.l.google.com:25 -starttls smtp

Note: it's not a safe assumption that the web server (if there is any) running on the same machine as the SMTP server uses the same certificate.

see also https://serverfault.com/questions/131627/how-to-inspect-remote-smtp-servers-tls-certificate#131628

Your Answer


By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.