tls.mtasts.policy_unavailable
MTA-STS Policy Temporarily Unavailable
What we check
We fetch the MTA-STS policy file from https://mta-sts.<domain>/.well-known/mta-sts.txt. This finding is emitted when the DNS record exists but the HTTPS fetch returned a transient error (connection timeout, HTTP 5xx, TLS handshake failure on the HTTPS connection).
What this finding means
The MTA-STS DNS record signals that a policy should exist, but the policy file could not be fetched at the time of the scan. This is likely a transient issue — the HTTPS server hosting the policy may be temporarily down or misconfigured.
Why it matters
- Transient gap in protection. Senders that have a cached policy from a previous successful fetch will continue enforcing it until
max_ageexpires. New senders or those with an expired cache cannot fetch the policy and fall back to opportunistic TLS. - HTTPS infrastructure. The
mta-sts.<domain>subdomain needs reliable HTTPS hosting. If it shares infrastructure with the main site, an outage there also disables MTA-STS.
How to fix
Check that
https://mta-sts.<domain>is reachable with a valid TLS certificate:curl -sI https://mta-sts.example.com/.well-known/mta-sts.txt # Expected: HTTP/2 200Verify the DNS points
mta-sts.<domain>to a working web server.Re-run the scan after the hosting issue is resolved.
How it's graded
A temporarily unavailable policy is an informational finding with no grading penalty. The scan result is incomplete rather than negative. See Grading Methodology for the full scoring model.
Evidence example
DNS: _mta-sts.example.com → "v=STSv1; id=20260819T000000Z"
Fetch: https://mta-sts.example.com/.well-known/mta-sts.txt → HTTP 503
Policy temporarily unavailable