tls.version.tls13
TLS 1.3 Supported
What we check
We attempt a TLS 1.3 handshake with each MX IP. This finding is emitted when the server successfully negotiates TLS 1.3.
What this finding means
The mail server supports TLS 1.3 — the latest version of the TLS protocol. TLS 1.3 is a significant improvement over 1.2: it removes legacy cipher suites, mandates forward secrecy, and reduces the handshake to a single round trip.
This is a positive finding. TLS 1.3 support indicates a modern, well-maintained TLS configuration.
Why it matters
- Strongest available encryption. TLS 1.3 only allows AEAD ciphers with forward secrecy — there are no weak options to negotiate.
- Faster handshakes. The 1-RTT handshake (and 0-RTT resumption) reduces latency for SMTP connections, which matters for high-volume mail flows.
- Simpler, safer design. TLS 1.3 removed the complexity that enabled attacks against earlier versions (renegotiation, compression, CBC padding oracles).
Evidence example
Negotiated protocol: TLSv1.3
Cipher: TLS_AES_256_GCM_SHA384
Server supports TLS 1.3 — the latest protocol version