diff --git a/config/discourse_defaults.conf b/config/discourse_defaults.conf
index d7e80e1f56a..3d6011588ab 100644
--- a/config/discourse_defaults.conf
+++ b/config/discourse_defaults.conf
@@ -92,6 +92,9 @@ smtp_enable_start_tls = true
 # to disable, set to 'none'
 smtp_openssl_verify_mode =
 
+# force implicit TLS as per RFC 8314 3.3
+smtp_force_tls = false
+
 # load MiniProfiler in production, to be used by developers
 load_mini_profiler = true
 
diff --git a/config/environments/production.rb b/config/environments/production.rb
index 75c3a695120..2f0b0d5d277 100644
--- a/config/environments/production.rb
+++ b/config/environments/production.rb
@@ -37,6 +37,10 @@ Discourse::Application.configure do
 
     settings[:openssl_verify_mode] = GlobalSetting.smtp_openssl_verify_mode if GlobalSetting.smtp_openssl_verify_mode
 
+    if GlobalSetting.smtp_force_tls
+      settings[:tls] = true
+    end
+
     config.action_mailer.smtp_settings = settings.reject { |_, y| y.nil? }
   else
     config.action_mailer.delivery_method = :sendmail