Probing TLS endpoints...

SMTP TLS Posture Check for yandex.ru — Relaymetry

STARTTLS extends SMTP with opportunistic encryption. A mail server advertises STARTTLS during the EHLO handshake, and sending systems can negotiate TLS for the message body. Modern operators expect TLS 1.2 minimum; TLS 1.0 / 1.1 are deprecated.

SMTP TLS Posture Check for yandex.ru

TLS configured with non-fatal issues.

Computed 51 seconds ago

Outbound submission TLS posture

TLS configuration looks healthy.

via SRV `_submission._tcp.yandex.ru`

Submission (port 587 / STARTTLS)

TLS configuration looks healthy.

TLS version: TLSv1.3
Cipher: TLS_AES_256_GCM_SHA384

Certificate

Subject: CN=smtp.yandex.ru,O=YANDEX LLC,L=Moscow,ST=Moscow,C=RU
SAN: smtp.yandex.ru, smtp.yandex.com.tr, smtp.ya.ru, smtp.yandex.kz, smtp.yandex.com, smtp.yandex.by
Issuer: CN=GlobalSign RSA OV SSL CA 2018,O=GlobalSign nv-sa,C=BE
Valid from: 2026-05-06T05:58:06.000Z
Valid to: 2026-11-03T20:59:59.000Z
Expires in: 164 days
Fingerprint: 5E:A8:A4:AD:71:F4:2F:11…

Untrusted CA chain

SMTPS (port 465 / Implicit TLS)

TLS configuration looks healthy.

TLS version: TLSv1.3
Cipher: TLS_AES_256_GCM_SHA384

Certificate

Subject: CN=smtp.yandex.ru,O=YANDEX LLC,L=Moscow,ST=Moscow,C=RU
SAN: smtp.yandex.ru, smtp.yandex.com.tr, smtp.ya.ru, smtp.yandex.kz, smtp.yandex.com, smtp.yandex.by
Issuer: CN=GlobalSign RSA OV SSL CA 2018,O=GlobalSign nv-sa,C=BE
Valid from: 2026-05-06T05:58:06.000Z
Valid to: 2026-11-03T20:59:59.000Z
Expires in: 164 days
Fingerprint: 5E:A8:A4:AD:71:F4:2F:11…

Untrusted CA chain

Inbound MX TLS posture (announced)

TLS configured with non-fatal issues.

MTA-STS policy

MTA-STS not published

TLS-RPT (reporting)

TLS-RPT not published

The result above probes the domains primary MX hosts on ports 25 + 587 (or whichever the domain uses) and reports the TLS version negotiated, certificate validity, SAN match status, and whether MTA-STS / TLS-RPT policies are published.

Configure TLS 1.2 minimum; aim for TLS 1.3 where possible. Ensure the certificate SAN includes the MX hostname (not just the apex domain). Publish MTA-STS to enforce TLS for inbound traffic and TLS-RPT to receive failure reports — both are zero-cost upgrades that meaningfully harden mail-in-transit security.