deepfence / deepfence/ThreatMapper
SMTP submission fails with Office 365
- Dominant language
- TypeScript
- Stars
- 5.3k
- Forks
- 631
- PR merge metrics
- No merged PRs in 30d
Description
**Describe the bug**
Configuring email notifications in ThreatMapper with Microsoft 365 (SMTP) fails with the error:
`tls: first record does not look like a TLS handshake`
The exact same Microsoft 365 SMTP credentials work in other applications, so this appears specific to ThreatMapper’s SMTP/TLS handling.
---
**To Reproduce**
1. Go to **Settings → email configuration → Add configuration**
2. Select **SMTP** as the provider
3. Fill in:
- **Email/Username:** `noreply-threatmapper@company.com`
- **Password:** mailbox password
- **SMTP server:** `smtp.office365.com`
- **Port:** `587` (also tested with `465`)
4. Click **Send Test Email**
5. Observe the error: `tls: first record does not look like a TLS handshake`
---
**Expected behavior**
ThreatMapper should successfully send the test email using Microsoft 365 SMTP when valid credentials are provided.
---
**Screenshots**
---
**Components/Services affected**
- [x] UI/Frontend
- [x] API/Backend
- [ ] Agent
- [ ] Deployment/YAMLs
- [ ] CI/CD Integration
- [ ] Other (specify)
---
**Additional context**
- Microsoft 365 supports:
- Port **587** with **STARTTLS** (preferred)
- ThreatMapper fails on 587 with the above TLS error, which suggests the client may be attempting implicit TLS on 587 instead of performing a STARTTLS upgrade.
- SMTP AUTH is enabled for the mailbox and the account is licensed.
- [Reference Documentation](https://learn.microsoft.com/en-us/exchange/mail-flow-best-practices/how-to-set-up-a-multifunction-device-or-application-to-send-email-using-microsoft-365-or-office-365)
**Environment details**
- ThreatMapper version: 2.5.7
- Deployment: Kubernetes - Helm chart `deepfence-console`, version: 2.5.7
- Network: outbound TCP 587/465 open from the ThreatMapper host/pod
Contributor guide
Assessment
This issue has not been assessed yet.