Certificates matter for mail as well as the website.
WHAT SECURES MAIL
Connections between your mail client and the server are encrypted using the same certificate system. The client verifies the certificate covers the hostname it connected to.
THE CORRECT SETTINGS
Incoming: mail.yourdomain.com, port 993, SSL/TLS
Outgoing: mail.yourdomain.com, port 465 with SSL, or 587 with STARTTLS
WHY WARNINGS APPEAR
AutoSSL has not covered the mail hostname The domain does not yet resolve here Mail records are proxied through Cloudflare, which breaks both the connection and validation
THE FIX
Set mail records to DNS-only, run AutoSSL covering the mail hostnames, reconnect.
THE INTERIM
Use the server hostname from your welcome email, which is covered by the server's own certificate.
WHAT NOT TO DO
Disabling certificate verification in the client. That exposes your mailbox password on every connection and hides a real problem.
AFTER A MIGRATION
Mail certificate warnings are common. Run AutoSSL covering mail hostnames as part of your post-migration checks.
