[GH-ISSUE #410] Add option to make TLS mandatory for sending e-mail notification #313

New issue

Open

opened 2026-05-07 00:22:59 +02:00 by BreizhHardware · 1 comment

BreizhHardware commented

2026-05-07 00:22:59 +02:00

Owner

Originally created by @cmeis on GitHub (Sep 22, 2022).
Original GitHub issue: https://github.com/binwiederhier/ntfy/issues/410

The subject says it all.
I'd like to able to restrict outgoing mails to be sent only over TLS encrypted SMTP connections, by setting a option in the server.yml.

Originally created by @cmeis on GitHub (Sep 22, 2022). Original GitHub issue: https://github.com/binwiederhier/ntfy/issues/410 The subject says it all. I'd like to able to restrict outgoing mails to be sent only over TLS encrypted SMTP connections, by setting a option in the server.yml.

BreizhHardware added the

enhancement

server

labels

2026-05-07 00:23:00 +02:00

BreizhHardware commented

2026-05-07 00:23:00 +02:00

Author

Owner

@ntninja commented on GitHub (Nov 20, 2025):

And related to this, please also add options:

To disable StartTLS entirely
To specify a custom SNI / expected hostname for TLS validation

If someone wants to implement this:

Copy the code of the SendMail function from https://go.dev/src/net/smtp/smtp.go
Replace the call to that same SendMail function in github.com/binwiederhier/ntfy@b531bc95ea/server/smtp_sender.go (L56) with the copied code
Alter the logic for when StartTLS is attempted / not attempted and which hostname is passed into the tls.Config

This is log-hanging fruit, but someone needs to do it!

@ntninja commented on GitHub (Nov 20, 2025): And related to this, please also add options: * To disable StartTLS entirely * To specify a custom SNI / expected hostname for TLS validation If someone wants to implement this: 1. Copy the code of the `SendMail` function from https://go.dev/src/net/smtp/smtp.go 2. Replace the call to that same `SendMail` function in https://github.com/binwiederhier/ntfy/blob/b531bc95ea9faedf68c5b3987f2744df0960384d/server/smtp_sender.go#L56 with the copied code 3. Alter the logic for when StartTLS is attempted / not attempted and which hostname is passed into the `tls.Config` This is log-hanging fruit, but someone needs to do it!