tls.version.tls10

TLS 1.0 Supported

What we check

We negotiate TLS with each MX IP and record which protocol versions the server supports. This finding is emitted when the server accepts TLS 1.0 connections.

What this finding means

The mail server still supports TLS 1.0, a protocol version formally deprecated by RFC 8996 (2021). TLS 1.0 has known cryptographic weaknesses (BEAST, POODLE, lack of AEAD ciphers) and is no longer considered secure.

Why it matters

Deprecated standard. RFC 8996 explicitly prohibits TLS 1.0. PCI DSS, NIST, and BSI all require TLS 1.2 or higher.
Known attacks. TLS 1.0 is vulnerable to protocol-level attacks that cannot be fully mitigated by configuration — only by disabling the version.
Downgrade risk. As long as TLS 1.0 is offered, a network attacker can force clients to negotiate the weakest available version.
TLS 1.2 is universally supported. Every mail server and client in active use today supports TLS 1.2. Removing 1.0 breaks nothing in practice.

How to fix

Disable TLS 1.0 (and 1.1). For Postfix (3.6+ syntax):

# /etc/postfix/main.cf
smtpd_tls_protocols = >=TLSv1.2
smtpd_tls_mandatory_protocols = >=TLSv1.2

Reload and verify:

postfix reload
openssl s_client -starttls smtp -connect mail.example.com:25 \
    -tls1 2>/dev/null | head -1
# Expected: connection refused or handshake failure

How it's graded

Supporting TLS 1.0 carries a 20-point deduction in the TLS category. See Grading Methodology for the full scoring model.

Evidence example

Negotiated protocol: TLSv1.0
Server accepts deprecated TLS 1.0 connections