TLS version or cipher is weak
Your mail server negotiated TLS 1.0, 1.1, or a weak cipher. Modern receivers accept the connection but downgrade trust.
Impact — Medium impact
Gmail and Microsoft 365 now require TLS 1.2 minimum for inbound. TLS 1.0/1.1 connections may be refused outright or heavily penalized. Compliance frameworks (PCI-DSS, HIPAA) also require 1.2+.
What causes it
- Your mail server's OpenSSL is old and defaults to weaker protocols.
- You explicitly configured TLS 1.0 to support ancient clients.
- A middlebox (firewall, SMTP proxy) is downgrading the TLS handshake.
How to fix it
Step 1: Update OpenSSL / mail server
Modern Postfix 3.6+ and Exim 4.95+ enable TLS 1.3 by default. Make sure your packages are current.
Step 2: Set a minimum TLS version
For Postfix: smtp_tls_mandatory_protocols = TLSv1.2 TLSv1.3 and smtpd_tls_mandatory_protocols = same. Disable SSLv2, SSLv3, TLSv1, TLSv1.1 explicitly.
Step 3: Verify with testssl.sh
Run ./testssl.sh --starttls smtp yourhost:25 and review the output. Fix any FAIL or WEAK findings.
Fixed it? Run a fresh test to confirm.
Test my inbox →