dotvitals

Mail server negotiates a deprecated TLS version

MediumConfirmedQuick winemail.smtp-tls.weak-protocol

What this check looks for

Your mail server agreed to an old, deprecated version of TLS. It still encrypts, but with a protocol that has known weaknesses and that senders are actively dropping support for.

Why it matters

As senders remove TLS 1.0 and 1.1, a server that offers nothing newer stops being able to encrypt with them at all — and the fallback is plaintext, or no delivery under an enforcing policy.

When the check passes, your report says: “The mail server negotiates a current version of TLS”.

What it costs your score

When this check fails it removes 10 points from your Email transport score, before the status, confidence and repeat multipliers are applied. Email transport carries a weight of 8 in the overall score.

It shares the email-transport.smtp-tls family ceiling of 40 points: however many findings that family produces, together they cannot remove more than that from Email transport. One underlying problem showing up in several places is still one problem.

Severity
medium
Default confidence
confirmed
Status when triggered
warn
Deduction
10 points
Family cap
email-transport.smtp-tls · 40
Category
Email transport
Module
Email smtp tls
Fix owned by
mail provider
In the ruleset since
2026.09

How the whole score is calculated

How to fix it

Set the mail server's minimum TLS version to ‹minimum protocol› and enable TLS 1.3.

Deprecated versions are being removed by senders; a server that offers only those will soon encrypt with nobody.

  1. Postfix: smtpd_tls_protocols = >=TLSv1.2 and smtpd_tls_mandatory_protocols = >=TLSv1.2.

  2. Exim: tls_require_ciphers = NORMAL:-VERS-ALL:+VERS-TLS1.2:+VERS-TLS1.3.

  3. Reload the server and re-test. Raising the floor can cut off a very old sender, so check the logs for handshake failures for a day afterwards.

How to confirm it worked

  • openssl s_client -starttls smtp -connect ‹mx host›:25 -tls1_1 — expect the handshake to be refused.

The configuration to publish
# Postfix (main.cf)
smtpd_tls_protocols = >=TLSv1.2
smtpd_tls_mandatory_protocols = >=TLSv1.2

A named slot like ‹domain› — and the braces left in the configuration below — is filled in with your own values when this rule appears on a report.

Remediation by platform

Postfix
smtpd_tls_protocols = >=TLSv1.2
smtpd_tls_mandatory_protocols = >=TLSv1.2
Technical detail

‹mx host› negotiated ‹protocol›. RFC 8996 deprecates TLS 1.0 and TLS 1.1 and requires that they no longer be used; ‹minimum protocol› is the floor, and TLS 1.3 should be offered alongside it.

Standards and references

Test this on your domain

Run the check that produces this finding, on its own, against any domain.

Open the email smtp tls checker

Other email smtp tls checks