tls.not_tested
TLS Not Tested (No SMTP Session)
What we check
We attempt to establish SMTP sessions with each MX IP to test TLS capabilities. This finding is emitted when MX targets exist and resolve, but no host produced a usable TLS result — all SMTP sessions were unavailable (connection refused, timed out, or immediately closed).
What this finding means
The domain has MX records pointing to resolvable hosts, but we could not complete an SMTP session with any of them. Without a session, STARTTLS negotiation and TLS testing cannot proceed. The TLS score is capped at a low grade because TLS status is unknown.
Common causes: all mail servers were down during the scan, a firewall blocked port 25 from the scanner's IP range, or the servers are configured to reject connections from unfamiliar sources.
Why it matters
- TLS status unknown. The servers may have perfect TLS configurations, but we cannot verify it without a session.
- Delivery likely affected. If the scanner cannot connect, other sending servers may experience the same problem.
- Significant score impact. The inability to test TLS results in a substantial deduction because TLS quality cannot be demonstrated.
How to fix
Check that your mail servers accept connections on port 25 from external sources:
telnet mail.example.com 25 # Expected: 220 mail.example.com ESMTPReview firewall rules to ensure port 25 is not blocked for legitimate sending servers.
Verify server availability — ensure the mail server processes are running and accepting connections.
Re-run the scan after resolving availability issues.
How it's graded
Untested TLS (due to unavailable sessions) carries a 40-point deduction in the TLS category. See Grading Methodology for the full scoring model.
Evidence example
MX targets: mail.example.com (192.0.2.1), mail2.example.com (192.0.2.2)
Session results:
192.0.2.1: connection timed out
192.0.2.2: connection refused
TLS not tested — no SMTP session could be established