SMTP transport security was not tested
What this check looks for
We could not test your mail servers' encryption on this scan. Nothing below was measured — this is a gap in our result, not a finding about your mail.
Why it matters
Reporting nothing is honest; reporting a pass we did not earn would not be. Treat SMTP TLS as unknown for this scan rather than as working.
What it costs your score
This check never deducts. It reports a fact — or reports that something could not be verified — and is shown on the report without moving the score.
- Severity
- info
- Default confidence
- confirmed
- Status when triggered
- info
- Deduction
- 0 points
- Family cap
- none
- Category
- Email transport
- Module
- Email smtp tls
- Fix owned by
- third party
- In the ruleset since
- 2026.09
Technical detail
Testing STARTTLS requires an outbound TCP connection to port 25, which Cloudflare Workers block synchronously inside connect() (docs/22 §2.2). The check therefore runs on a separate probe host, and that host was unavailable for this scan: ‹reason›. Mail servers not tested: ‹mx hosts›.
Standards and references
Test this on your domain
Run the check that produces this finding, on its own, against any domain.
Other email smtp tls checks
- Mail server's SMTP greeting does not conform to the protocol
- Mail server's TLS certificate has expired or is not yet valid
- Mail server's certificate does not cover its own hostname
- Mail server's TLS certificate does not verify
- Mail server does not offer STARTTLS
- Mail server does not accept connections on port 25
- STARTTLS is advertised but the handshake does not complete
- Mail server negotiates a deprecated TLS version