MTA-STS record missing: how to set it up

What the error means

Encryption between mail servers (STARTTLS) is optional by default: if a connection can't be encrypted, the sender delivers in plain text. MTA-STS lets a domain say “only deliver to my listed mail servers, with a valid certificate”. Senders find it through a TXT record at _mta-sts.<domain>, then fetch the policy file it announces.

We raise this when there's no such record, or when there's more than one. RFC 8461 says that if the number of records starting v=STSv1 isn't exactly one, senders must assume there's no policy.

Why it matters

Without MTA-STS, an attacker who can sit between two mail servers can strip the STARTTLS offer from the conversation, and the sender falls back to plain text without telling anyone. Or they can answer DNS with a mail server of their own. Either way your incoming email can be read or changed in transit.

How to confirm it

Look up TXT records at _mta-sts.<domain>. You should see exactly one, and the policy file should load at https://mta-sts.example.com/.well-known/mta-sts.txt (with your domain in place of example.com).

How to fix it

Publish the policy file first, in testing mode, then the TXT record. The order matters: a record pointing at a missing file is an error of its own.

version: STSv1
mode: testing
mx: mail.example.com
max_age: 604800

v=STSv1; id=20261007T090000

id

Up to 32 letters and digits. Change it every time the policy file changes.

mode

testing to start, enforce once reports are clean.

max_age

How long senders cache the policy, in seconds. A week is a fair start.