MediumInfrastructure · usually medium
MTA-STS record published but the policy file is unreachable
The DNS record announces a policy that cannot be fetched.
Check your own domain
What causes this
MTA-STS has two halves: a TXT record that announces a policy exists, and a policy file served over HTTPS. Senders that see the record then fetch the file. When the fetch fails, senders cannot apply the policy — so the configuration provides no protection while appearing to be in place.
What it breaks
MTA-STS gives you no protection. Senders fall back to opportunistic TLS.
How to fix it
Serve the policy file over HTTPS with a valid certificate.
- Confirm https://mta-sts.yourdomain.com/.well-known/mta-sts.txt returns the policy with content type text/plain.
- Confirm the certificate for the mta-sts subdomain is valid and not expired.
- Confirm the mta-sts subdomain has DNS records pointing at the host serving the file.
Specification: RFC 8461 — MTA-STS
Related problems
- No email configuration of any kind was foundNo MX, SPF or DMARC records exist for this domain.
- MTA-STS is not configuredThe domain does not publish an MTA-STS policy. This is optional but worth having.
- An MX host does not resolve to an addressA mail exchanger is published but its hostname has no A or AAAA record.
- An MX record points at an aliasMX targets must be hostnames with address records, not CNAMEs.
- No MX records foundThis domain publishes no mail exchangers, so it cannot receive email.