webzod
account

Make the MTA-STS policy cover every MX host

email.mta_sts.mx_mismatch · effort: about an hour

Why it matters

Some of your mail servers are not named in the policy, so in enforce mode senders refuse to deliver to them and in testing mode they only report it. The mx lines must match the MX records.

Staged change. Do this in stages and check each one before the next, so a mistake does not break your site or your mail.

The fix

  1. List your MX records and compare them with the mx: lines in the policy. The finding names the hosts that are not covered.
  2. Add an mx: line for each missing host, or a wildcard such as mx: *.example.com that covers exactly one extra label (it does not match the bare domain or deeper names). Remove lines for hosts you no longer use. Replace the mx lines in the snippet with your own MX host names, written exactly as they appear in your MX records.
  3. Change the id in the _mta-sts TXT record after changing the file. Upload the file first, then change the TXT.
  4. When you add a new MX host in DNS later, put it in the policy first and change the id; senders may keep using the old policy until they see the new id.
  5. If you are in enforce mode and mail is being refused now, switch to mode: testing as an emergency step while you fix the list, and change the id in the _mta-sts TXT record as well, otherwise senders keep the old policy.
text 
# Policy file https://mta-sts.example.com/.well-known/mta-sts.txt
# One mx line per MX host (or pattern) of your own domain
version: STSv1
mode: testing
mx: YOUR-MX-HOST.example
mx: YOUR-SECOND-MX-HOST.example
mx: *.YOUR-MX-DOMAIN.example
max_age: 86400

# Then change the id
_mta-sts.example.com.  IN TXT  "v=STSv1; id=2026100503"

The examples use example.com. Replace it with your own domain.

Read the documentation (opens in a new tab)

Related

Scan your domain to see whether this applies to you.