diff --git a/bewcloud.config.sample.ts b/bewcloud.config.sample.ts
index c2bb6dc..39e6dcd 100644
--- a/bewcloud.config.sample.ts
+++ b/bewcloud.config.sample.ts
@@ -32,7 +32,7 @@ const config: PartialDeep<Config> = {
   //   from: 'help@bewcloud.com',
   //   host: 'localhost',
   //   port: 465,
-  //   tlsMode: null,  // May be "immediate", "starttls" or "none", defaults to immediate TLS if port is 465, StartTLS otherwise
+  //   tlsMode: "auto",  // “auto” means “immediate” on port 465, “starttls” otherwise; `null` is legacy behaviour that will be removed in v4: on port 465 it also means “immediate”, otherwise it will use opportunistic StartTLS falling back to plain transmission
   //   tlsVerify: true,  // Whether to verify the TLS certificate, if a string is used the hostname will be verified using that name
   // },
   // contacts: {
diff --git a/lib/config.ts b/lib/config.ts
index 731b254..957d84e 100644
--- a/lib/config.ts
+++ b/lib/config.ts
@@ -37,7 +37,7 @@ export class AppConfig {
         from: 'help@bewcloud.com',
         host: 'localhost',
         port: 465,
-        tlsMode: null,  // Depends on the port number above
+        tlsMode: null,
         tlsVerify: true,
       },
       contacts: {
@@ -99,6 +99,10 @@ export class AppConfig {
 
       console.info('\nConfig loaded from bewcloud.config.ts', JSON.stringify(this.config, null, 2), '\n');
 
+      if (this.config.email.port !== 465 && this.config.email.tlsMode === null) {
+        console.warn("DEPRECATION WARNING: When using `config.email.port` with a value other than `465`, please set `config.email.tlsMode` to either `'starttls'` or `'none'` to explicitly enable or disable usage of StartTLS! Support for legacy opportunistic StartTLS will be removed in bewCloud 4!");
+      }
+
       if (this.config.core.enabledApps.length === 0) {
         throw new Error('At least one app must be enabled. Please check the config.core.enabledApps array.');
       }
diff --git a/lib/models/email.ts b/lib/models/email.ts
index 4ab7a51..7a67d73 100644
--- a/lib/models/email.ts
+++ b/lib/models/email.ts
@@ -16,7 +16,10 @@ export class EmailModel {
     }
 
     let tlsMode = emailConfig.tlsMode;
-    if (!["immediate", "starttls", "none"].includes(tlsMode)) {
+    if (tlsMode === null) {
+      // Value “default” will be ignored below causing the nodemailer default behaviour of using opportunistic StartTLS
+      tlsMode = Number(emailConfig.port) === 465 ? "immediate" : "default";
+    } else if (!["immediate", "starttls", "none"].includes(tlsMode)) {
       tlsMode = Number(emailConfig.port) === 465 ? "immediate" : "starttls";
     }
 
diff --git a/lib/types.ts b/lib/types.ts
index 9952c2b..9f00767 100644
--- a/lib/types.ts
+++ b/lib/types.ts
@@ -206,8 +206,8 @@ export interface Config {
     host: string;
     /** The SMTP port to send emails from */
     port: number;
-    /** How to use TLS when connecting: default is “immediate” on port 465, “starttls” otherwise */
-    tlsMode: null | "immediate" | "starttls" | "none";
+    /** “auto” means “immediate” on port 465, “starttls” otherwise; `null` is legacy behaviour that will be removed in v4: on port 465 it also means “immediate”, otherwise it will use opportunistic StartTLS falling back to plain transmission */
+    tlsMode: null | "auto" | "immediate" | "starttls" | "none";
     /** Whether to verify the TLS certificate, if a string is used the hostname will be verified using that name */
     tlsVerify: boolean | string;
   };