Make the MTA-STS policy file reachable

Why it matters

The MTA-STS TXT record exists but the policy file cannot be fetched, so senders that do not already have it cached deliver mail without MTA-STS protection. The policy must be served over HTTPS on the mta-sts subdomain.

The fix

1. Read the reason in the finding (no such host, connection refused, TLS failure, an HTTP error). Each one has a different cause.
2. No such host or no address: add a DNS record (A, AAAA or CNAME) for mta-sts.yourdomain pointing at the web host that serves the policy.
3. Connection refused or TLS failure: the web host must listen on port 443 with a valid certificate for exactly mta-sts.yourdomain; request one for that name.
4. An HTTP error such as 404: the file must exist at /.well-known/mta-sts.txt on that host and return status 200 with content-type text/plain.
5. Test it in a browser: open https://mta-sts.yourdomain/.well-known/mta-sts.txt and check you see the policy text with no redirect and no certificate warning.

mta-sts.example.com.  IN CNAME  your-web-host.example.
# Then serve the policy at https://mta-sts.example.com/.well-known/mta-sts.txt

The examples use example.com. Replace it with your own domain.

Read the documentation ↗(opens in a new tab)

Related

• Reported by the MTA-STS and TLS-RPT check
• Publish an MTA-STS policy, starting in testing mode
• Nothing to do for MTA-STS on a domain that accepts no mail
• Fix the MTA-STS TXT record
• Fix the certificate on the MTA-STS policy host
• Fix the MTA-STS policy file
• Switch MTA-STS from testing to enforce
• Turn MTA-STS back on
• Make the MTA-STS policy cover every MX host
• Raise the MTA-STS max_age
• Publish a TLS-RPT record
• Fix the TLS-RPT record