How to Check SSL Certificates for the Websites Behind an Email List

To check the SSL certificates behind an email list, read the certificate each address's domain serves on port 443. The bulk email SSL certificate checker does this for every address in a pasted list or CSV and gives each one a row: Valid, Expires soon, Expired, Wrong name, Not trusted, No HTTPS or Doesn't resolve.

The check reads the domain's website certificate, not the mailbox.

Why check certificates on an email list

A company website whose certificate expired weeks ago is often a website nobody looks after, which can mean the company has slowed down or closed. It is a hint, not proof, and a domain used only for mail often has no website at all. A list of thousands of addresses has far fewer unique domains, so reading one certificate per domain is cheap.

The by-hand way

1. Take the domain after the @, for example acme.example from sam@acme.example.
2. Connect to it on port 443 and read the certificate, for example with openssl s_client -connect acme.example:443 -servername acme.example.
3. Read the validity dates, the names it covers and whether the chain is trusted.
4. Repeat for every unique domain.

For a longer list of websites, see check SSL certificate expiry for many websites.

Step 1: paste the addresses

Paste addresses one per line, or upload a CSV. Only the unique domains are sent, never the mailbox names, 10 a request.

Step 2: run the check

Press Check certificates. One TLS handshake is made on port 443 per domain from our server, and nothing is sent after it. No mail is sent.

Step 3: read the result

Result	What it means
Valid	Trusted, covers the name, more than 30 days left
Expires soon	Trusted and covers the name, 30 days or fewer left
Expired	The certificate's end date has passed
Wrong name	The certificate lists other names
Not trusted	Self-signed, or the chain is incomplete
No HTTPS	Nothing answered TLS on port 443
Doesn't resolve	The name has no address record

The CSV carries the subject, issuer, end date and days left beside each address. No address is dropped from the list handed on to the mailbox check, because a website certificate does not say whether mail works.

What this check cannot do

• It checks the domain, not the mailbox.
• Only the bare domain on port 443 is read, not www. and not a mail server's certificate.
• A domain used only for mail often has no website, so No HTTPS means little.
• Up to 100 unique domains a run without an account, 500 signed in.

For hosts and www names use the bulk SSL certificate checker.

Next: the rest of the list

For the addresses that remain, use the verify page: the first 100 checks are free with a Google sign-in, no card.

Try it now

Paste your list into the bulk email SSL certificate checker at simpleverifier.com.