Raise the MTA-STS max_age

Why it matters

Senders cache the policy for max_age seconds, so a very short value means they re-check often and leave short windows with no protection. A week or more is usual once the policy is stable.

The fix

1. Change only the max_age line; keep your current mode: and mx: lines exactly as they are.
2. Set max_age to at least 86400 (one day); 604800 (one week) or more is typical once the policy has been working in enforce mode. The largest allowed value is 31557600.
3. Keep it short while you are still testing, so a mistake expires quickly.
4. Change the id in the _mta-sts TXT record after editing the file.

# change only max_age; keep your current mode and mx lines
version: STSv1
mode: testing
mx: YOUR-MX-HOST.example
mx: *.YOUR-MX-DOMAIN.example
max_age: 604800

Read the documentation ↗(opens in a new tab)

Related

• Reported by the MTA-STS and TLS-RPT check
• Publish an MTA-STS policy, starting in testing mode
• Nothing to do for MTA-STS on a domain that accepts no mail
• Fix the MTA-STS TXT record
• Make the MTA-STS policy file reachable
• Fix the certificate on the MTA-STS policy host
• Fix the MTA-STS policy file
• Switch MTA-STS from testing to enforce
• Turn MTA-STS back on
• Make the MTA-STS policy cover every MX host
• Publish a TLS-RPT record
• Fix the TLS-RPT record