tls.mtasts.lookup_error
MTA-STS DNS Lookup Failed
What we check
We query DNS for the _mta-sts.<domain> TXT record. This finding is emitted when the lookup returns a transient error (SERVFAIL, timeout) instead of a definitive answer.
What this finding means
The DNS query for the MTA-STS record failed with a transient error. We cannot determine whether an MTA-STS configuration exists.
Why it matters
- Incomplete assessment. Without a successful DNS lookup, we cannot evaluate MTA-STS status.
- Possible DNSSEC issue. SERVFAIL can indicate a broken DNSSEC chain.
- No delivery impact. Senders treat a lookup failure the same as a missing record — they use opportunistic TLS.
How to fix
- Check DNS health for the domain, particularly DNSSEC if enabled.
- Re-run the scan after resolving DNS issues.
How it's graded
An MTA-STS DNS lookup error is an informational finding with no grading penalty. See Grading Methodology for the full scoring model.
Evidence example
$ dig +short TXT _mta-sts.example.com
;; connection timed out
MTA-STS DNS lookup failed — status indeterminate