tls.mtasts.mx_mismatch
MTA-STS MX Patterns Incomplete
What we check
We compare the mx: patterns in the MTA-STS policy file against the domain's actual MX hostnames. Every MX hostname must match at least one mx: line in the policy (exact match or wildcard).
What this finding means
The MTA-STS policy exists and is valid, but its mx: patterns do not cover all of the domain's MX hostnames. MX targets not listed in the policy are effectively unprotected — a sending server enforcing MTA-STS will refuse to deliver to MX hosts that do not match a policy pattern.
Why it matters
- Partial protection. Only MX hosts matching a policy pattern get TLS enforcement. Unlisted MX hosts are either skipped by strict senders or fall back to opportunistic TLS.
- Delivery failures possible. If a sender enforces MTA-STS and the preferred MX does not match a policy pattern, delivery may fail or be deferred to a less-preferred MX.
- Usually an oversight. This typically happens when MX records change (a new mail server, a provider migration) but the MTA-STS policy is not updated to include the new hostname.
How to fix
List all MX hostnames in the policy file. Use wildcards for provider patterns:
version: STSv1 mode: enforce mx: mail.example.com mx: *.example.com max_age: 604800Update the DNS record's
idto signal the policy change:_mta-sts.example.com. IN TXT "v=STSv1; id=20260819T000001Z"
How it's graded
Incomplete MX patterns carry an 8-point deduction in the Bonus category. See Grading Methodology for the full scoring model.
Evidence example
MX hostnames: mail.example.com, backup.example.net
Policy mx: patterns: mail.example.com
Missing: backup.example.net — not covered by any mx: pattern