Fix the MTA-STS policy file

Why it matters

Senders ignore a policy file they cannot parse or that sits behind a redirect, so MTA-STS has no effect. The file is a short list of key and value lines.

The fix

1. The file must be plain text, one key: value pair per line, with version: STSv1, mode (enforce, testing or none), max_age in whole seconds (at most 31557600) and at least one mx: line for each MX hostname.
2. Replace the mx lines in the snippet with your own MX host names, written exactly as they appear in your MX records. Keep your current mode: line unless it is the thing that is wrong.
3. Serve the file directly. Senders do not follow redirects, so no http-to-https redirect, no www redirect and no redirect to another path may apply to this URL.
4. After changing the file, change the id in the _mta-sts TXT record so senders fetch the new policy.

version: STSv1
mode: testing
mx: YOUR-MX-HOST.example
mx: *.YOUR-MX-DOMAIN.example
max_age: 86400

Read the documentation ↗(opens in a new tab)

Related

• Reported by the MTA-STS and TLS-RPT check
• Publish an MTA-STS policy, starting in testing mode
• Nothing to do for MTA-STS on a domain that accepts no mail
• Fix the MTA-STS TXT record
• Make the MTA-STS policy file reachable
• Fix the certificate on the MTA-STS policy host
• Switch MTA-STS from testing to enforce
• Turn MTA-STS back on
• Make the MTA-STS policy cover every MX host
• Raise the MTA-STS max_age
• Publish a TLS-RPT record
• Fix the TLS-RPT record