We are getting mails from Salesforce (the company) warning that incoming or outgoing mails to/from Salesforce (the system) are still using TLS 1.0. The warning is not more explicit, it says incoming or outgoing. Support for TLS 1.0 will be stopped at March 6, one month from now.

So we checked outgoing (that is easy) and incoming (a bit more difficult) mails, using test messages. Both are using TLS 1.2, I have the logging and mail headers to prove it.

I cannot find a report that tells us which mail clients still send TLS 1.0 mails. We would like to know, of course. Does anybody have any suggestions?

  • You checked if your customers are still using TLS 1.0? You may have a customer that you either send email to or receive email from that is using TLS 1.0
    – Sean
    Feb 7, 2018 at 17:19
  • @Sean We have a lot of customers. Asking them to find out which TLS version they are using would be too difficult for 98% of them. And we don't want to bother all of them, while maybe only one of them may be the problem. Feb 8, 2018 at 7:36

1 Answer 1


For Apex email services, you can update your Messaging.InboundEmailHandler class(es) to extract the X-SFDC-TLS-VERSION header from the Messaging.InboundEmail and log it somewhere, e.g.

global class EmailHandler implements Messaging.InboundEmailHandler {
   global Messaging.InboundEmailResult handleInboundEmail(Messaging.InboundEmail email, Messaging.InboundEnvelope envelope) {
      Messaging.InboundEmailResult result = new Messaging.InboundEmailresult();
      for (Messaging.InboundEmail.Header h : email.headers) {
         if (h.name == 'X-SFDC-TLS-VERSION' && h.value == 'TLSv1') {
            result.message += 'Upgrade your MTA, dude.\n';
      return result;

swaks is a useful tool for testing:

swaks -t [email protected] -f [email protected] --tls --tls-protocol tlsv1
  • Thanks. Indeed we have several email handlers that we made ourselves. But there is also the standard Salesforce feature, with the very long email address, that users can use to forward mails to Salesforce (for association with Accounts, Contacts, Opp's). I don't know how I can check those mails. Feb 8, 2018 at 7:38

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .