diff --git a/.env.example b/.env.example
index 231d3789..c1c35b60 100644
--- a/.env.example
+++ b/.env.example
@@ -17,6 +17,7 @@ SMTP_USER=
 SMTP_PASSWORD=
 EMAIL_FROM= # e.g. "Kan <hello@mail.kan.bn>"
 SMTP_SECURE= # set to "false" to use port 587
+SMTP_REJECT_UNAUTHORIZED= # set to "false" to accept invalid certs
 
 # Switch email features off entirely (optional)
 NEXT_PUBLIC_DISABLE_EMAIL=
diff --git a/cloud/docker-compose.yml b/cloud/docker-compose.yml
index d13205ea..d3bb4418 100644
--- a/cloud/docker-compose.yml
+++ b/cloud/docker-compose.yml
@@ -35,6 +35,7 @@ services:
       - SMTP_PASSWORD=${SMTP_PASSWORD}
       - SMTP_SECURE=${SMTP_SECURE}
       - EMAIL_FROM=${EMAIL_FROM}
+      - SMTP_REJECT_UNAUTHORIZED=${SMTP_REJECT_UNAUTHORIZED}
 
       # Notifications
       - NOVU_API_KEY=${NOVU_API_KEY}
diff --git a/docker-compose.yml b/docker-compose.yml
index fca7330d..0ccd9b5e 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -24,6 +24,7 @@ services:
       - SMTP_USER=${SMTP_USER}
       - SMTP_PASSWORD=${SMTP_PASSWORD}
       - EMAIL_FROM=${EMAIL_FROM}
+      - SMTP_REJECT_UNAUTHORIZED=${SMTP_REJECT_UNAUTHORIZED}
 
       # Disable email features entirely (optional)
       - NEXT_PUBLIC_DISABLE_EMAIL=${NEXT_PUBLIC_DISABLE_EMAIL}
diff --git a/packages/email/src/sendEmail.tsx b/packages/email/src/sendEmail.tsx
index 41ed1d23..a087606c 100644
--- a/packages/email/src/sendEmail.tsx
+++ b/packages/email/src/sendEmail.tsx
@@ -16,7 +16,17 @@ const emailTemplates: Record<Templates, React.FC> = {
 const transporter = nodemailer.createTransport({
   host: process.env.SMTP_HOST,
   port: Number(process.env.SMTP_PORT),
-  secure: process.env.SMTP_SECURE !== "false",
+  secure:
+    process.env.SMTP_SECURE === undefined
+      ? true
+      : process.env.SMTP_SECURE?.toLowerCase() === "true",
+  tls: {
+    // do not fail on invalid certs
+    rejectUnauthorized:
+      process.env.SMTP_REJECT_UNAUTHORIZED === undefined
+        ? true
+        : process.env.SMTP_REJECT_UNAUTHORIZED?.toLowerCase() === "true",
+  },
   ...(process.env.SMTP_USER &&
     process.env.SMTP_PASSWORD && {
       auth: {
diff --git a/turbo.json b/turbo.json
index e0a56510..eb3c1fdc 100644
--- a/turbo.json
+++ b/turbo.json
@@ -96,6 +96,7 @@
     "SMTP_USER",
     "SMTP_PASSWORD",
     "SMTP_SECURE",
+    "SMTP_REJECT_UNAUTHORIZED",
     "NEXT_PUBLIC_KAN_ENV",
     "NEXT_PUBLIC_WHITE_LABEL_HIDE_POWERED_BY",
     "STRIPE_SECRET_KEY",