diff --git a/app/models/mail_identity.rb b/app/models/mail_identity.rb
index 5c1cdb2..ad9c495 100644
--- a/app/models/mail_identity.rb
+++ b/app/models/mail_identity.rb
@@ -15,6 +15,7 @@ class MailIdentity < ApplicationRecord
   validates :smtp_port, numericality: { in: 1..65535 }
   validates :encryption, inclusion: { in: ENCRYPTIONS }
   validates :smtp_authentication, inclusion: { in: Catalog::MAIL_AUTH_METHODS.keys }
+  validate :encryption_matches_port
 
   scope :active, -> { where(active: true) }
   scope :ordered, -> { order(:name) }
@@ -38,4 +39,16 @@ class MailIdentity < ApplicationRecord
     end
     settings
   end
+
+  private
+
+  def encryption_matches_port
+    return if smtp_port.blank? || encryption.blank?
+
+    if encryption == "tls" && smtp_port == 587
+      errors.add(:smtp_port, "con SSL/TLS va usata la porta 465 (es. smtps.aruba.it)")
+    elsif encryption == "starttls" && smtp_port == 465
+      errors.add(:smtp_port, "con STARTTLS va usata la porta 587 (es. smtp.aruba.it)")
+    end
+  end
 end
diff --git a/app/views/mail_identities/_form.html.erb b/app/views/mail_identities/_form.html.erb
index 9083905..cc527b3 100644
--- a/app/views/mail_identities/_form.html.erb
+++ b/app/views/mail_identities/_form.html.erb
@@ -25,6 +25,7 @@
     <div>
       <label class="mb-1 block text-sm font-medium">Porta</label>
       <%= f.number_field :smtp_port, required: true, min: 1, max: 65535, class: input_class %>
+      <p class="mt-1 text-xs text-zinc-500">587 con STARTTLS · 465 con SSL/TLS (Aruba: smtp.aruba.it:587 oppure smtps.aruba.it:465)</p>
     </div>
     <div>
       <label class="mb-1 block text-sm font-medium">Crittografia</label>
diff --git a/test/models/mail_identity_test.rb b/test/models/mail_identity_test.rb
new file mode 100644
index 0000000..c2dcba2
--- /dev/null
+++ b/test/models/mail_identity_test.rb
@@ -0,0 +1,52 @@
+require "test_helper"
+
+class MailIdentityTest < ActiveSupport::TestCase
+  test "smtp settings use starttls on port 587" do
+    identity = MailIdentity.new(
+      name: "Test",
+      from_name: "Test",
+      from_email: "hello@example.com",
+      smtp_host: "smtp.example.com",
+      smtp_port: 587,
+      encryption: "starttls",
+      smtp_authentication: "plain",
+      active: true
+    )
+    assert identity.valid?
+    settings = identity.smtp_settings
+    assert settings[:enable_starttls_auto]
+    assert_not settings[:ssl]
+  end
+
+  test "smtp settings use ssl on port 465" do
+    identity = MailIdentity.new(
+      name: "Test",
+      from_name: "Test",
+      from_email: "hello@example.com",
+      smtp_host: "smtps.example.com",
+      smtp_port: 465,
+      encryption: "tls",
+      smtp_authentication: "plain",
+      active: true
+    )
+    assert identity.valid?
+    settings = identity.smtp_settings
+    assert settings[:ssl]
+    assert_not settings[:enable_starttls_auto]
+  end
+
+  test "rejects ssl encryption on port 587" do
+    identity = MailIdentity.new(
+      name: "Test",
+      from_name: "Test",
+      from_email: "hello@example.com",
+      smtp_host: "smtps.example.com",
+      smtp_port: 587,
+      encryption: "tls",
+      smtp_authentication: "plain",
+      active: true
+    )
+    assert_not identity.valid?
+    assert_includes identity.errors[:smtp_port], "con SSL/TLS va usata la porta 465 (es. smtps.aruba.it)"
+  end
+end