Fix the certificate on the MTA-STS policy host on Cloudflare

Why it matters

Senders refuse to fetch the policy over a certificate they cannot verify, so MTA-STS protects nothing until it is fixed. The certificate must be valid for the mta-sts hostname and not expired.

The fix

1. If the mta-sts record is proxied (orange cloud), Cloudflare presents its own Universal certificate. It covers the zone apex and first-level hostnames only, such as mta-sts.example.com; it does not cover mta-sts.sub.example.com when your mail domain is a subdomain. Check in SSL/TLS > Edge Certificates that it is active, and for a deeper name use a Worker Custom Domain or order an Advanced Certificate Manager certificate that lists the exact hostname.
2. If you use DNS only, the web host behind it must present a valid certificate for mta-sts.yourdomain.
3. For a Worker custom domain, Cloudflare issues the certificate automatically; check the domain shows as active under Settings > Domains & Routes.

The examples use example.com. Replace it with your own domain.

Read the documentation ↗(opens in a new tab)

Related

• Reported by the MTA-STS and TLS-RPT check
• Publish an MTA-STS policy, starting in testing mode
• Nothing to do for MTA-STS on a domain that accepts no mail
• Fix the MTA-STS TXT record
• Make the MTA-STS policy file reachable
• Fix the MTA-STS policy file
• Switch MTA-STS from testing to enforce
• Turn MTA-STS back on
• Make the MTA-STS policy cover every MX host
• Raise the MTA-STS max_age
• Publish a TLS-RPT record
• Fix the TLS-RPT record