tls.mtasts.mode_none

MTA-STS Disabled (mode=none)

What we check

We fetch the MTA-STS policy file and read its mode: field. This finding is emitted when the mode is none — the policy explicitly disables MTA-STS enforcement.

What this finding means

An MTA-STS policy file exists, but its mode is set to none. This tells sending servers that MTA-STS is not active — they should not enforce TLS requirements based on this policy. The practical effect is the same as not having MTA-STS at all.

mode: none is intended for decommissioning an MTA-STS policy: it signals senders to stop caching and enforcing a previously published policy. Left in place indefinitely, it provides no protection.

Why it matters

• No TLS enforcement. mode: none means senders do not enforce certificate verification or require TLS based on this policy. Downgrade attacks remain possible.
• Usually a transition artifact. This mode is meant to be temporary — used when disabling MTA-STS or transitioning between configurations. If left permanently, it signals an incomplete setup.

How to fix

1. If MTA-STS should be active, change the mode to testing or enforce:

   version: STSv1
   mode: enforce
   mx: mail.example.com
   mx: *.example.com
   max_age: 604800
   

2. Update the DNS record's id to trigger a policy re-fetch by senders.

3. If MTA-STS is being decommissioned permanently, remove both the DNS record and the policy file after senders' cached policies expire (wait for max_age from the last active policy).

How it's graded

mode: none carries an 8-point deduction in the Bonus category. See Grading Methodology for the full scoring model.

Evidence example

$ curl -s https://mta-sts.example.com/.well-known/mta-sts.txt
version: STSv1
mode: none
mx: mail.example.com
max_age: 86400
MTA-STS is explicitly disabled — no TLS enforcement

References

• RFC 8461 — SMTP MTA Strict Transport Security (MTA-STS)