Mail to you arrives without MTA-STS
What it is
MTA-STS (RFC 8461) is a policy that tells other mail servers: “deliver mail for this domain only over encryption, and only to these servers”. It has two parts: a _mta-sts TXT record in DNS and a small text file on your web host.
We only looked at public DNS and that public policy file. We cannot see which servers actually send you mail or how they deliver it.
Why it’s a problem
Server-to-server email is encrypted “when possible”. An attacker on the network path can strip the encryption and read or forge the mail. Without MTA-STS the sender cannot tell.
- For a small business that means invoices, contracts and password resets that travel by email.
- Nothing has leaked and mail still works. This is missing protection, not an active exposure, which is why it is a recommendation.
- MTA-STS protects mail coming to you. It does not cover your outgoing mail.
How to fix it
1. Find your MX servers
dig +short MX example.com2. Create the policy file
It must be served at https://mta-sts.example.com/.well-known/mta-sts.txt, with a valid certificate, a 200 response without redirects, and the type text/plain. Start in testing mode:
version: STSv1
mode: testing
mx: mail.example.com
max_age: 604800You can have several mx: lines, one per MX server. A wildcard is allowed only as the first label (*.example.com). max_age is how many seconds a sender remembers the policy. 604800 is one week.
3. Publish the TXT record
_mta-sts.example.com. TXT "v=STSv1; id=20261109T000000"The id is any string. Change it every time the file changes, otherwise senders do not fetch the new version.
4. Move to enforce
After a few weeks without problems (ideally with reports from TLS-RPT), change mode: testing to mode: enforce and change the id.
Other variants of this finding
Testing mode
The policy is deployed, but on a failure the sender still delivers the mail. It does not protect yet. When the reports are clean, switch to enforce.
max_age too short
The policy works, it just expires quickly and senders have to fetch it again and again. Set at least a week (max_age: 604800). We flag values below one day (86400).
MX server missing from the policy
One of your MX servers matches no mx: line. Mail to it stays unprotected, and in enforce mode senders refuse to deliver to it. The mx: lines must cover every server in the dig MX output.
TXT record without a policy
DNS has a _mta-sts record, but the file at mta-sts.example.com could not be fetched or read (missing subdomain or certificate, wrong content type, bad format). Senders then get a broken policy. Fix the file or delete the record.
If the policy host refuses our request (401, 403, 429, 5xx or a CDN or firewall challenge), we do not report the finding. We cannot tell that the policy is missing, so the Watch row stays unmeasured. The file must be publicly readable without login and without bot checks, otherwise mail senders cannot fetch it either.