SSL-Tools

SSL check results of zmx.lu

NEW You can also bulk check multiple servers.

Discover if the mail servers for zmx.lu can be reached through a secure connection.

To establish a secure connection a mail server has to offer STARTTLS (SSL), a trustworthy SSL certificate, support for the Diffie-Hellman-Algorithm to guarantee Perfect Forward Secrecy and must not be vulnerable against the Heartbleed attack. Futhermore we recommend using end-to-end encryption with GnuPG.

Summary

JSON Refresh

Report created Sat, 03 Oct 2026 01:53:11 +0000

The mailservers of zmx.lu can be reached through a secure connection.

Servers

Incoming Mails

These servers are responsible for incoming mails to @zmx.lu addresses.

Hostname / IP address Priority STARTTLS Certificates Protocol
mail.tutanota.de
185.205.69.214
 10
supported
mail.tutanota.de
DANE
valid
PFS
supported
Heartbleed
not vulnerable
Weak ciphers
not found
  • TLSv1.2
  • TLSv1.1
  • TLSv1.0
  • SSLv3
1 s
mail.tutanota.de
185.205.69.211
 10
supported
mail.tutanota.de
DANE
valid
PFS
supported
Heartbleed
not vulnerable
Weak ciphers
not found
  • TLSv1.2
  • TLSv1.1
  • TLSv1.0
  • SSLv3
1 s
mail.tutanota.de
185.205.69.213
 10
supported
mail.tutanota.de
DANE
valid
PFS
supported
Heartbleed
not vulnerable
Weak ciphers
not found
  • TLSv1.2
  • TLSv1.1
  • TLSv1.0
  • SSLv3
1 s

Outgoing Mails

We have not received any emails from a @zmx.lu address so far. Test mail delivery

Certificates

First seen at:

CN=mail.tutanota.de

Certificate chain
Subject
Common Name (CN)
  • mail.tutanota.de
Alternative Names
  • mail.tutanota.de
  • www.mail.tutanota.de
Issuer
Country (C)
  • GB
Organization (O)
  • Sectigo Limited
Common Name (CN)
  • Sectigo Public Server Authentication CA DV E36
validity period
Not valid before
2026-09-02
Not valid after
2027-03-19
This certifcate has been verified for the following usages:
  • Digital Signature
  • TLS Web Server Authentication
  • TLS Web Client Authentication
Fingerprints
SHA256
F4:5E:25:09:C8:F9:63:C5:AC:49:9D:3D:78:41:87:6A:17:42:31:36:CE:68:74:66:BE:B0:0D:22:36:A2:83:A5
SHA1
9E:55:03:F0:C3:75:D5:6F:D9:27:55:2C:CF:A3:2A:01:0A:21:5F:1D
X509v3 extensions
authorityKeyIdentifier
  • keyid:17:99:A8:04:C1:6F:E4:2D:70:A8:0A:10:3D:03:D3:E9:1A:B8:26:63
subjectKeyIdentifier
  • 05:FE:CF:48:A2:9D:A3:67:14:FF:E7:19:2F:49:7C:26:CB:C0:4C:61
certificatePolicies
  • Policy: 1.3.6.1.4.1.6449.1.2.2.7
  • CPS: https://sectigo.com/CPS
  • Policy: 2.23.140.1.2.1
authorityInfoAccess
  • CA Issuers - URI:http://crt.sectigo.com/SectigoPublicServerAuthenticationCADVE36.crt
  • OCSP - URI:http://ocsp.sectigo.com
ct_precert_scts
  • Signed Certificate Timestamp:
  • Version : v1 (0x0)
  • Log ID : 59:6E:6C:33:86:94:B2:59:72:A2:56:C8:A0:E8:DD:90:
  • 4A:76:E8:08:3D:DA:87:3B:01:08:38:28:14:3C:EE:59
  • Timestamp : Sep 2 20:33:07.044 2026 GMT
  • Extensions: 00:00:05:00:03:0C:AF:A8
  • Signature : ecdsa-with-SHA256
  • 30:46:02:21:00:D8:62:EF:B6:CB:3A:E9:C9:80:D7:4A:
  • C6:B0:71:63:A5:EC:48:73:4B:E0:94:80:60:11:21:5E:
  • EA:B7:49:A1:62:02:21:00:B9:F4:5A:64:DD:E3:5B:45:
  • 5F:B6:C7:B5:14:0B:8F:0D:51:89:2C:B6:9C:54:E9:B6:
  • 98:17:ED:D3:E1:81:79:1A
  • Signed Certificate Timestamp:
  • Version : v1 (0x0)
  • Log ID : 1C:9F:68:2C:E9:FA:F0:45:69:50:F8:1B:96:8A:87:DD:
  • DB:32:10:D8:4C:E6:C8:B2:E3:82:52:4A:C4:CF:59:9F
  • Timestamp : Sep 2 20:33:06.974 2026 GMT
  • Extensions: none
  • Signature : ecdsa-with-SHA256
  • 30:45:02:20:7C:62:DE:BE:9F:20:AC:E9:B5:86:5C:07:
  • C3:32:DB:B4:DB:4C:74:2C:45:49:39:A7:4A:3D:61:78:
  • 85:37:6D:77:02:21:00:83:8C:EC:95:AD:D4:B4:BC:EC:
  • A6:5A:F0:45:17:98:A2:E3:28:E0:D1:A5:4F:56:57:02:
  • D7:BE:C2:77:D5:6C:B7
  • Signed Certificate Timestamp:
  • Version : v1 (0x0)
  • Log ID : A2:81:00:18:73:4E:17:6E:1D:47:E0:95:40:F3:81:BA:
  • 54:66:97:CD:63:A8:43:50:71:6E:B8:09:4E:DA:F1:0D
  • Timestamp : Sep 2 20:33:07.579 2026 GMT
  • Extensions: 00:00:05:00:0B:9D:23:88
  • Signature : ecdsa-with-SHA256
  • 30:46:02:21:00:8F:A1:1D:1B:87:4A:E6:BC:A9:19:A3:
  • F0:C1:23:96:2F:A6:1B:B3:96:9F:A7:88:18:81:9F:EA:
  • 36:28:76:CC:2F:02:21:00:A4:E3:AB:6C:AE:CF:48:EA:
  • 1E:07:B3:70:95:0D:D1:68:AB:72:C1:1D:A1:2E:D9:37:
  • E8:06:DA:CC:55:29:CC:48

DANE

DNS-based Authentication of Named Entities (DANE) is a protocol to allow X.509 certificates to be bound to DNS using TLSA records and DNSSEC.

Name Options DNSSEC Matches
_25._tcp.mail.tutanota.de
  • DANE-EE: Domain Issued Certificate
  • Use full certificate
  • SHA-256 Hash
valid
—
_25._tcp.mail.tutanota.de
  • DANE-EE: Domain Issued Certificate
  • Use subject public key
  • SHA-256 Hash
valid
valid