How to Disable Legacy TLS Versions and Weak Ciphers in Postfix

Secure your Postfix server by disabling obsolete TLS 1.0/1.1 versions and weak cryptographic ciphers.

Last updated: July 2026

In short: To fix Kuveris findings regarding outdated TLS protocols (TLS 1.0/1.1) and weak cipher suites, Postfix requires server-side hardening. By configuring the smtpd_tls_mandatory_protocols and smtpd_tls_mandatory_ciphers directives, you can restrict incoming encrypted connections to modern TLS 1.2+ standards and robust cryptographic options.

Many automated mail server scanners like Kuveris check whether your mail server supports obsolete TLS versions (such as TLS 1.0 and TLS 1.1) or weak cipher suites. These legacy cryptographic configurations are insecure. To resolve these findings, you can harden Postfix so that only modern, secure protocols and ciphers are permitted for enforced TLS connections.

Configuring Minimum TLS Protocols (Enforcing TLS 1.2+)

To prevent the use of weak, outdated protocols like SSLv2, SSLv3, TLS 1.0, and TLS 1.1, you must configure the minimum allowed TLS version.

For newer Postfix installations (Postfix version 3.6 and above), there is a preferred syntax to define a lower boundary for TLS protocols:

smtpd_tls_mandatory_protocols = >=TLSv1.2

For older Postfix versions that do not support the comparison operator syntax, a legacy format is available. This configuration explicitly excludes the undesired protocols using the exclamation mark (!):

smtpd_tls_mandatory_protocols = !SSLv2, !SSLv3, !TLSv1, !TLSv1.1

Both configurations guarantee that any enforced TLS connection will negotiate at least TLS 1.2.

Excluding Weak Cipher Suites

Beyond the protocol versions themselves, the cryptographic algorithms (ciphers) used for encryption must be secured. Postfix organizes cipher strengths into predefined grades. For strong security, the high grade is recommended:

smtpd_tls_mandatory_ciphers = high

To block weak, anonymous, or insecure ciphers (such as anonymous TLS ciphers without server authentication and the deprecated MD5 hashing algorithm), you should set a cipher exclusion list:

smtpd_tls_mandatory_exclude_ciphers = aNULL, MD5

Understanding Mandatory vs. Opportunistic TLS

It is important to note that configuration parameters containing _mandatory_ (such as smtpd_tls_mandatory_protocols) only apply to connections where TLS is strictly required (for example, on the submission port 587, or when smtpd_tls_security_level = encrypt is enabled).

For opportunistic TLS (smtpd_tls_security_level = may), which is used on public inbound mail servers (MX) to maintain compatibility, less restrictive settings apply by default. On public MX hosts, you should generally avoid overly aggressive blocking of legacy protocols and weak ciphers in opportunistic mode to ensure you can still receive emails from legacy sender systems.

Verifying Your Settings

Once you have updated your configuration, reload Postfix (postfix reload). You can verify your TLS hardening using the free Kuveris scanner to ensure that your server no longer accepts weak ciphers or obsolete TLS versions.

Further reading