Where you saw it: TLS reports from senders, an MTA-STS validator flagging the policy, or inbound mail failing from senders that honor the standard.
Why it happens
- The policy lists MX hostnames that no longer match your DNS, usually after a provider change.
- The policy file is not served over HTTPS at the exact path, which must be /.well-known/mta-sts.txt on the mta-sts subdomain.
- The web server hosting the policy has its own certificate problem, so the fetch fails before the policy is read.
- The id value in the TXT record was not changed after the policy file was updated, so senders keep using a cached old version.
- Mode was set to enforce before testing, which turns every mismatch into a delivery failure.
The fix, in order
Fetch the policy the way a sender does
Request https://mta-sts.yourdomain.com/.well-known/mta-sts.txt in a browser or with curl. If that does not return the file over valid HTTPS, nothing else matters.
Compare the mx lines against real DNS
Run dig +short MX yourdomain.com and check every host appears in the policy. A wildcard such as *.protection.outlook.com covers a family, and a missing entry breaks that route.
Check the TXT record and its id
Query _mta-sts.yourdomain.com. The id must change whenever the policy file changes, or senders serve a cached copy indefinitely.
Drop back to testing mode while you fix it
Setting mode to testing keeps mail flowing and still generates TLS reports, which is where the diagnosis comes from.
Set up TLS reporting
Publish a TLSRPT record so senders send you daily reports on connection failures. Without it, an MTA-STS problem is invisible until someone tells you their mail bounced.
version: STSv1
mode: testing
mx: mail.example.com
max_age: 604800Testing mode reports failures without causing them.
How to know it worked
The short version
- The policy file loads over HTTPS with a valid certificate.
- Every MX host in DNS appears in the policy.
- TLS reports show successful connections and no policy failures.
- A validator reports the policy as valid before you return to enforce.
Questions people ask
What does MTA-STS do?
It lets a receiving domain tell senders that mail to it must use TLS with a valid certificate on a listed MX host. Without it, an attacker can strip encryption from an opportunistic connection.
Is enforce mode safe?
Once the policy matches reality and TLS reports are clean, yes. Starting in enforce mode is how domains cause their own inbound outage.
Do I need MTA-STS?
It is optional and increasingly expected of organizations that handle sensitive mail. If you publish one, keep it in step with your MX records.