Gmail can't deliver to my mailbox: "TLS Negotiation failed"

When Gmail tries to send you mail, it bounces with an error like this:

TLS Negotiation failed: FAILED_PRECONDITION: starttls error (71) ... SSL alert number 47

This almost always happens when your DNS is at Cloudflare (or a similar service) and the mail traffic goes through its proxy. Cloudflare's proxy only handles web traffic. Mail that passes through it can't set up an encrypted connection, so Gmail gives up.

The fix

1. Find your mail server's name. In the dashboard, open your web hosting, go to Email and pick your mail domain. The Set up a mail app card shows the server name.
2. Check the MX record. At Cloudflare (or your DNS provider), make sure your domain's MX record points to that server name.
3. Turn the proxy off for mail. Every record used for mail (the MX target and any mail record) must be set to DNS only: click the orange cloud so it turns grey. Your website records can stay proxied.
4. Save and wait. Changes usually work within an hour, sometimes up to 24 hours.
5. Test by sending a message from Gmail again.

Easier still: move your DNS to us. We then add the mail records for you and nothing gets in between.

More background is in Cloudflare's guide to email issues.