tls.version.no_tls12

TLS 1.2 Not Supported

What we check

We attempt a TLS 1.2 handshake with each MX IP. This finding is emitted when the server does not support TLS 1.2 — it only offers older versions (TLS 1.0 and/or 1.1).

What this finding means

The mail server cannot negotiate TLS 1.2 — the minimum protocol version considered secure by current standards. The server may still offer TLS 1.0 or 1.1, but those versions are deprecated (RFC 8996) and provide inadequate security.

Why it matters

Below the security floor. TLS 1.2 has been the minimum acceptable version since the deprecation of TLS 1.0/1.1. Not supporting it means the server cannot meet any current compliance requirement.
Interoperability risk. Sending servers configured to require TLS 1.2+ (the recommended setting) will refuse to negotiate, potentially falling back to plaintext.
MTA-STS incompatible. MTA-STS requires TLS 1.2 or higher. A server without TLS 1.2 cannot satisfy any MTA-STS enforce policy.

How to fix

Enable TLS 1.2. For Postfix, update the protocol configuration:
```
# /etc/postfix/main.cf
smtpd_tls_protocols = >=TLSv1.2
```
This enables TLS 1.2 and 1.3 while disabling the deprecated versions.
Update OpenSSL if necessary. TLS 1.2 requires OpenSSL 1.0.1 or later (released 2012). If the server's OpenSSL is older, the entire TLS stack needs upgrading.

Reload and verify:

postfix reload
openssl s_client -starttls smtp -connect mail.example.com:25 \
    -tls1_2 2>/dev/null | grep "Protocol"
# Expected: Protocol  : TLSv1.2

How it's graded

Not supporting TLS 1.2 carries a 30-point deduction in the TLS category — the highest protocol-version penalty. See Grading Methodology for the full scoring model.

Evidence example

Server offered protocols: TLSv1.0, TLSv1.1
TLS 1.2 handshake: FAILED
Server does not support the minimum acceptable TLS version