What are common MTA-STS setup issues?
Still have a question, spotted an error, or have a better explanation or a source we should cite?
You're setting up MTA-STS and something's broken. Here are the traps everyone falls into.
Wrong file path. You've uploaded your policy file, but not to the right place. It needs to live exactly at `https://mta-sts.yourdomain.com/.well-known/mta-sts.txt`. Putting it anywhere else means sending servers won't find it. Check your web server config and make sure that path works in a browser.
HTTPS isn't working. Your policy file is there, but the certificate's expired, self-signed, or misconfigured. Sending servers won't fetch from an insecure endpoint. Get a valid certificate (Let's Encrypt is free) and test it.
DNS record is wrong. The TXT record has to be at `_mta-sts.yourdomain.com`, not just `mta-sts.yourdomain.com`. The underscore matters. Check your DNS provider's UI and verify the record's exactly right.
Policy file format errors. Your policy syntax is off (typos, wrong field names, or line-ending issues). Some servers are picky about CRLF vs LF. Use a free validator to spot syntax problems.
Enforce mode too early. You turned on 'enforce' mode before testing. Now mail's bouncing. Switch back to 'testing' mode, fix the underlying issue, and stay in 'testing' for a week before moving to 'enforce'.
max_age is too short. You set it to an hour or less. Now other mail servers are constantly re-fetching your policy, hammering your HTTPS endpoint. Use at least 86,400 seconds (one day).
Next step: Run our SOS Hotline to get a full audit of your setup.
Contributors
Who worked on this answer
Every name links to their profile. Every company links to their site. Real people, real accountability.
