tls.mtasts.policy_error

MTA-STS Policy Unreadable

What we check

We fetch the MTA-STS policy file from https://mta-sts.<domain>/.well-known/mta-sts.txt and parse it according to RFC 8461. This finding is emitted when the DNS record exists (signaling MTA-STS intent) but the policy file is malformed or fails to parse.

What this finding means

The domain advertises MTA-STS via its DNS record, but the policy file is broken — it may have invalid syntax, missing required fields (version, mode, mx, max_age), or content that does not conform to the RFC 8461 format.

Why it matters

No effective protection. A broken policy file means senders cannot parse or enforce MTA-STS, despite the DNS signal. The domain gets neither the protection nor the bonus-score benefit.
Sender behavior varies. Some senders treat a malformed policy as absent (fall back to opportunistic TLS); others may defer delivery while retrying the policy fetch.
Easy to fix. Policy files are plain text with a simple format — syntax errors are usually a misplaced line or wrong field name.

How to fix

Check the policy file format. It must be served at exactly https://mta-sts.<domain>/.well-known/mta-sts.txt with Content-Type: text/plain:
```
version: STSv1
mode: enforce
mx: mail.example.com
mx: *.example.com
max_age: 604800
```
Verify all required fields are present: version, mode, at least one mx, and max_age.
Check HTTPS — the policy must be served over a valid HTTPS connection (valid certificate, no redirects to HTTP).

How it's graded

An unreadable MTA-STS policy carries a 6-point deduction in the Bonus category. See Grading Methodology for the full scoring model.

Evidence example

DNS: _mta-sts.example.com → "v=STSv1; id=20260819T000000Z"
Policy: https://mta-sts.example.com/.well-known/mta-sts.txt
Error: missing required field "max_age"

References

RFC 8461 — SMTP MTA Strict Transport Security (MTA-STS)