validation-failure

How it appears in a report

"result-type": "validation-failure"

What it means

The connection to your server failed during TLS negotiation for a reason that does not fit the more specific categories — a protocol version mismatch, no shared cipher, or a handshake cut short.

Could be either end. This can originate at either end, so the failure reason and your own configuration are both worth checking.

Worth being clear about the direction, because it is easy to get backwards: you publish TLS-RPT for your own domain, and senders report the failures they hit while delivering to you. So policy-domain and receiving-mx-hostname in your reports are yours, and sending-mta-ip belongs to whoever sent the report.

Why it happens

This is the catch-all, and it is most often a version or cipher mismatch after one side hardens its configuration. If you drop TLS 1.0 and 1.1 on your MX you will start collecting these from older senders; if a large sender raises its own floor, you will collect them until you raise yours.

How to fix it

1. Read the failure-reason-code field where the reporter supplied one — it frequently names the real cause when the result-type cannot.
2. Compare the TLS versions and cipher suites your MX accepts against what modern senders offer.
3. Look for a recent hardening change at either end; this type appears suddenly rather than gradually.
4. Check for network equipment interfering with the handshake, which produces truncated sessions that look like this.