Skip to content
notspoofed.comSPF · DKIM · DMARC

validation-failure: the TLS session failed for another reason

By · Published · Updated

validation-failure is the catch-all: TLS negotiation with your mail server failed for a reason outside the specific types, such as a protocol version mismatch, no shared cipher or a cut-short handshake. Read the report’s failure-reason-code first, then compare the TLS versions and ciphers your MX accepts, and look for a recent hardening change at either end.

NegotiationCould be either endInbound mail refused

How it appears in a report

"result-type": "validation-failure"

What it means

The connection to your server failed during TLS negotiation for a reason that does not fit the more specific categories — a protocol version mismatch, no shared cipher, or a handshake cut short.

Could be either end. This can originate at either end, so the failure reason and your own configuration are both worth checking.

Worth being clear about the direction, because it is easy to get backwards: you publish TLS-RPT for your own domain, and senders report the failures they hit while delivering to you. So policy-domain and receiving-mx-hostname in your reports are yours, and sending-mta-ip belongs to whoever sent the report.

Why it happens

This is the catch-all, and it is most often a version or cipher mismatch after one side hardens its configuration. If you drop TLS 1.0 and 1.1 on your MX you will start collecting these from older senders; if a large sender raises its own floor, you will collect them until you raise yours.

How to fix it

  1. Read the failure-reason-code field where the reporter supplied one — it frequently names the real cause when the result-type cannot.
  2. Compare the TLS versions and cipher suites your MX accepts against what modern senders offer.
  3. Look for a recent hardening change at either end; this type appears suddenly rather than gradually.
  4. Check for network equipment interfering with the handshake, which produces truncated sessions that look like this.

Related