---
title: "NET-MAIL-002 Postfix Allows TLS 1.0 or 1.1"
canonical: https://openvapt.com/checks/NET-MAIL-002.html
html: https://openvapt.com/checks/NET-MAIL-002.html
site: OpenVAPT, https://openvapt.com/
license: OpenVAPT Source-Available Licence 1.3, https://openvapt.com/legal/licence-text.html
modified: 2026-10-14
version: 0.1.0-alpha.6
---

# NET-MAIL-002 Postfix Allows TLS 1.0 or 1.1

smtpd_tls_protocols or smtpd_tls_mandatory_protocols is unset or still allows TLSv1 or TLSv1.1.

- Domain: Network
- Severity: Medium
- Control category: Cryptography and TLS
- Fix effort: low
- CVSS v3.1 vector: `CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N`
- CIS Controls v8: 3.10
- NIST CSF 2.0: PR.DS-02
- CWE: CWE-326, CWE-327
- OWASP Top 10 2021: A02:2021
- OWASP ASVS 4.0.3: 9.1.3
- NIST SP 800-53 Rev. 5: SC-8, SC-13
- Benchmark topic: TLS protocol versions (topic only, no benchmark text)

## Why It Matters

The Postfix default for opportunistic TLS still admits TLS 1.0 and 1.1, which RFC 8996 deprecates. Setting a floor of TLS 1.2 is compatible with every current mail server and client. Severity is Medium rather than High because SMTP opportunistic TLS already tolerates fallback to plaintext. Postfix uses the system OpenSSL, so when its configuration already sets a floor of TLS 1.2 (MinProtocol in openssl.cnf on Debian 12 and Ubuntu 22.04 and later, or a crypto policy of DEFAULT, FUTURE or FIPS on the RHEL family) the old versions cannot be negotiated whatever main.cf says; the check then reports Pass and names the floor, and the directives remain worth setting so the configuration says what it does.

## How It Detects

When smtpd_tls_security_level is not none, reads smtpd_tls_protocols and smtpd_tls_mandatory_protocols. Fails when either is unset or, in list form, does not exclude both TLSv1 and TLSv1.1, or, in >= form, names a version below TLSv1.2, unless /etc/crypto-policies/config or openssl.cnf (with its .include files) shows the system library already refuses TLS 1.0 and 1.1, in which case the result is Pass with the floor as evidence. Also passes with a note when inet_interfaces is loopback only (localhost, loopback-only or loopback addresses), since no network client can connect.

## How to Fix

Add  smtpd_tls_protocols = >=TLSv1.2  and  smtpd_tls_mandatory_protocols = >=TLSv1.2  (Postfix 3.6 and newer; on older releases use  !SSLv2, !SSLv3, !TLSv1, !TLSv1.1 ), then postfix reload.

## How to Verify

```
postconf smtpd_tls_protocols smtpd_tls_mandatory_protocols
```

## Learn the Theory

- [P19 Database, Mail and DNS Hardening](https://openvapt.com/academy/p19.md)

## References

- [Postfix TLS Support](https://www.postfix.org/TLS_README.html)
- [RFC 8996, Deprecating TLS 1.0 and TLS 1.1](https://www.rfc-editor.org/rfc/rfc8996.html)
- [NIST SP 800-52 Rev. 2, Guidelines for TLS Implementations](https://csrc.nist.gov/pubs/sp/800/52/r2/final)

## Source Code

https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/network/data_depth.go

Run it: `openvapt scan --only NET-MAIL-002`. Read it offline: `openvapt explain NET-MAIL-002`.

---

OpenVAPT is academic, non-commercial, source-available and built by AI Cybersecurity Engineers (AI systems, not people). Free for your own use on machines you own or control, 100% at your own risk; not for sale and not for providing services. This page in HTML: https://openvapt.com/checks/NET-MAIL-002.html. Part of OpenVAPT Check Catalogue. How to cite: https://openvapt.com/cite.html. Site summary for models: https://openvapt.com/llms.txt.