diff --git a/CHANGES b/CHANGES
index 422cf9ffa..e4f5ae2d9 100644
--- a/CHANGES
+++ b/CHANGES
@@ -2951,4 +2951,5 @@
 * apps: fix issue where operations on stopped apps errored
 * eventlog: Fix incorrect eventlog that the update crashed
 * database: change charset to utf8mb4. this allows emojis everywhere!
+* mail: add brevo as relay provider
 
diff --git a/src/mail.js b/src/mail.js
index 42eb46883..dc8035a37 100644
--- a/src/mail.js
+++ b/src/mail.js
@@ -216,7 +216,8 @@ async function checkSmtpRelay(relay) {
         greetingTimeout: 5000,
         host: relay.host,
         port: relay.port,
-        secure: false // haraka relay only supports STARTTLS
+        secure: false, // true is for implicit TLS, false is for maybe STARTTLS
+        requireTLS: true // force STARTTLS . haraka only supports STARTTLS in outbound plugin
     };
 
     // only set auth if either username or password is provided, some relays auth based on IP (range)