cdn.tailwindcss.com

Why it matters

TLS 1.0 and TLS 1.1 use outdated security designs and are no longer accepted by modern standards. Leaving them enabled allows older, weaker connection methods.

What to do

Disable TLS 1.0 and TLS 1.1, support TLS 1.2 securely, and enable TLS 1.3 where possible.

Evidence and check scope

Supported TLS versions:

TLS 1.0, TLS 1.1, TLS 1.2, TLS 1.3

TLS version test outcomes:

TLS 1.0: Accepted, TLS 1.1: Accepted, TLS 1.2: Accepted, TLS 1.3: Accepted

Host requested:

cdn.tailwindcss.com

Resolved IPs tested:

104.26.2.143

IP that returned the observed result:

104.26.2.143

References

Why it matters

A policy of quarantine or reject tells receiving services to move suspicious mail to spam or refuse it. A monitoring-only policy (p=none) records the problem but does not ask receivers to stop spoofed mail.

What to do

After every legitimate sender passes DMARC, move gradually to quarantine and then reject, covering 100% of messages.

Why it matters

Without the nosniff setting, a browser may guess a file's type and treat harmless-looking content as executable code. This can turn an incorrect Content-Type into a security issue.

What to do

Send X-Content-Type-Options: nosniff on every response and return an accurate Content-Type.