tls.mtasts.missing

MTA-STS Not Configured

What we check

We query DNS for a _mta-sts.<domain> TXT record and attempt to fetch the MTA-STS policy file at https://mta-sts.<domain>/.well-known/mta-sts.txt. MTA-STS (Mail Transfer Agent Strict Transport Security) tells sending servers to require TLS for connections to your MX hosts and to verify the server's certificate.

What this finding means

No MTA-STS configuration was found — neither the DNS record nor the policy file exists. Without MTA-STS, sending servers use opportunistic TLS: they attempt encryption but fall back to plaintext if the TLS handshake fails. An active network attacker can strip the STARTTLS offer and force plaintext delivery.

Why it matters

• No downgrade protection. Without MTA-STS, a MITM attacker between a sender and your MX can strip STARTTLS and read all mail in transit. MTA-STS prevents this by telling senders to require TLS and reject connections that fail certificate verification.
• Complements DANE. MTA-STS does not require DNSSEC (unlike DANE), making it deployable by any domain with HTTPS hosting. The two mechanisms protect against different attack vectors.
• Major provider support. Gmail, Microsoft 365, and other large senders enforce MTA-STS policies when published.

How to fix

1. Create the policy file at https://mta-sts.<domain>/.well-known/mta-sts.txt:

   version: STSv1
   mode: enforce
   mx: mail.example.com
   mx: *.example.com
   max_age: 604800
   

2. Publish the DNS record:

   _mta-sts.example.com.  IN  TXT  "v=STSv1; id=20260819T000000Z"
   

   Update the id value whenever the policy changes — senders re-fetch the policy when the id changes.

3. Ensure HTTPS works on mta-sts.<domain> with a valid certificate — the policy is fetched over HTTPS.

4. Start with mode: testing to monitor without enforcing, then switch to mode: enforce once confirmed.

How it's graded

Missing MTA-STS carries a 10-point deduction in the Bonus category. See Grading Methodology for the full scoring model.

Evidence example

$ dig +short TXT _mta-sts.example.com
(empty)
$ curl -s https://mta-sts.example.com/.well-known/mta-sts.txt
(not found)
No MTA-STS configuration — opportunistic TLS only

Related guides

• Setting up MTA-STS for Google Workspace
• Setting up MTA-STS for Mailcow (self-hosted)
• Setting up MTA-STS for Microsoft 365

References

• RFC 8461 — SMTP MTA Strict Transport Security (MTA-STS)