← All checks

MTA-STS policy not found or invalid: how to set it up

MTA-STS medium Email transport · 5 of 100 points

What it inspects

The TXT record at _mta-sts.<domain> (v=STSv1; id=...) and the policy at https://mta-sts.<domain>/.well-known/mta-sts.txt (fetched with no redirects, 64 KB limit, content type text/plain). Verdicts: PASS for mode: enforce, max_age of at least 86400 and mx lines covering every MX host. WARN when MTA-STS is missing (adoption is still low), mode is testing or none, or max_age is below 86400. FAIL when the TXT record exists but the policy is unreachable or invalid, there is more than one TXT record, or the mx patterns do not cover a real MX host. Not applicable if the domain does not receive mail.

Why it matters

MTA-STS makes sending servers insist on verified TLS to your MX hosts, stopping downgrade and impersonation attacks on mail in transit. A published record with a broken policy is worse than none: compliant senders may defer or bounce your mail.

How to verify by hand

# bash
dig +short TXT _mta-sts.example.com

# PowerShell
Resolve-DnsName -Name _mta-sts.example.com -Type TXT | Select-Object -ExpandProperty Strings

# the policy file
curl -s https://mta-sts.example.com/.well-known/mta-sts.txt
(Invoke-WebRequest https://mta-sts.example.com/.well-known/mta-sts.txt).Content

How to fix

Serve a policy file over HTTPS at the mta-sts subdomain, publish the TXT record, start in testing mode, then switch to enforce.

  1. Publish the TXT record (change the id whenever the policy changes):

    _mta-sts.example.com.  IN  TXT  "v=STSv1; id=20261022T000000"

  2. Serve this at https://mta-sts.example.com/.well-known/mta-sts.txt with a valid certificate and content type text/plain:

    version: STSv1
mode: testing
mx: mail.example.com
max_age: 86400

  3. After a week without TLS-RPT problems, change mode to enforce and update the id in the TXT record.

References

Scan your domain free