tls.mtasts.testing
MTA-STS in Testing Mode
What we check
We fetch the MTA-STS policy file and read its mode: field. This finding is emitted when the mode is testing.
What this finding means
The MTA-STS policy is in testing mode. Sending servers will check certificate validity and report failures via TLS-RPT, but they will not refuse delivery when verification fails. Mail continues to flow even if the TLS configuration has problems.
mode: testing is the recommended first step when deploying MTA-STS — it lets you monitor for configuration issues before enabling enforcement.
Why it matters
- Monitoring without enforcement. TLS verification failures are reported (if TLS-RPT is configured) but do not block delivery. This is useful for identifying problems before they cause mail loss.
- Not a permanent state. Testing mode provides visibility but no protection against downgrade attacks. The goal is to resolve any reported issues and advance to
mode: enforce. - Partial credit. Testing mode shows MTA-STS awareness and infrastructure readiness, even though enforcement is not active.
How to fix
Review TLS-RPT reports for any certificate verification failures.
Once clean, advance to
mode: enforce:version: STSv1 mode: enforce mx: mail.example.com mx: *.example.com max_age: 604800Update the DNS record's
idto trigger a policy re-fetch.
How it's graded
Testing mode carries a 4-point deduction in the Bonus category — a smaller penalty than mode: none or missing MTA-STS, reflecting the partial deployment. See Grading Methodology for the full scoring model.
Evidence example
$ curl -s https://mta-sts.example.com/.well-known/mta-sts.txt
version: STSv1
mode: testing
mx: mail.example.com
max_age: 604800
MTA-STS in testing mode — failures reported but not enforced