InfoInfrastructure · usually info
MTA-STS is not configured
The domain does not publish an MTA-STS policy. This is optional but worth having.
Check your own domain
What causes this
SMTP encryption is opportunistic by default: a sending server offers TLS, and if the handshake fails it may simply deliver in the clear. MTA-STS lets you state that mail to your domain must be delivered over TLS to a mail exchanger whose certificate matches your policy, which closes off downgrade attacks. It requires a TXT record plus a policy file served over HTTPS at a fixed URL.
What it breaks
No immediate problem. Without it, a network attacker positioned between a sender and your mail server can strip TLS and read mail in transit.
How to fix it
Publish an MTA-STS policy file and the accompanying TXT record.
- Serve a policy file at https://mta-sts.yourdomain.com/.well-known/mta-sts.txt listing your MX hostnames.
- Start the policy in testing mode so failures are reported but mail is not blocked.
- Publish a TXT record at _mta-sts.yourdomain.com with a version and a unique id.
- Once TLS reports show no failures, change the policy mode to enforce.
Specification: RFC 8461 — MTA-STS
Related problems
- No email configuration of any kind was foundNo MX, SPF or DMARC records exist for this domain.
- MTA-STS record published but the policy file is unreachableThe DNS record announces a policy that cannot be fetched.
- An MX host does not resolve to an addressA mail exchanger is published but its hostname has no A or AAAA record.
- An MX record points at an aliasMX targets must be hostnames with address records, not CNAMEs.
- No MX records foundThis domain publishes no mail exchangers, so it cannot receive email.