tls.untestable

TLS Not Testable

What we check

We determine whether TLS testing is possible based on the domain's MX configuration. This finding is emitted when there are no MX hosts to probe — the domain has no usable MX targets (all targets are unresolvable, IP literals, or the domain has no MX records at all).

What this finding means

TLS cannot be tested because there is no mail server to connect to. This is a consequence of the MX configuration, not a TLS problem in itself. The fix is to establish working MX records — once a reachable mail server exists, TLS can be evaluated.

Why it matters

• Complete TLS blackout. No aspect of TLS security can be assessed — protocol version, cipher strength, certificate validity, DANE, MTA-STS are all untestable.
• Reflects MX problems. This finding always appears alongside MX-level findings (mx.missing, mx.no_usable_targets, or similar) that identify the root cause.

How it's graded

Untestable TLS carries a 100-point deduction in the TLS category, reducing the TLS score to zero. See Grading Methodology for the full scoring model.

Evidence example

MX configuration: no usable targets
TLS: not testable — no mail server available to probe

References

This finding is a consequence of MX configuration issues. See the related MX findings for applicable RFCs.