MTA-STS policy file

This is the half senders actually enforce. The policy is a plain-text file served over HTTPS from https://mta-sts.<domain>/.well-known/mta-sts.txt, and this check fetches it and grades it: that it parses, that it declares a valid mode, that it names at least one mx host, that it covers the MX records the domain actually publishes, and that its max_age is present and long enough to be worth anything.

The failure this check exists for is invisible from DNS. A TXT record announcing a policy that cannot be fetched, cannot be parsed, or names the wrong hosts is MTA-STS switched on in name only — senders fall straight back to opportunistic TLS, which is the exact thing the record claims to have fixed. The usual causes are a missing address record for the mta-sts hostname, a certificate that does not cover it, and a file that was never uploaded.

An MX missing from an enforcing policy is graded as a failure rather than a nit. A sender honouring the policy will not deliver to a host the policy does not name, so mail routed to that MX bounces: it does not arrive unencrypted, it does not arrive. In testing mode the same gap produces reports instead, which is precisely what testing mode is for.

Two details of the fetch are deliberate. Redirects are not followed, because RFC 8461 §3.3 forbids a sender from following one — a redirected body is not a policy anyone honours — and the check requires the response to be text/plain, which RFC 8461 §3.3 asks senders to demand. Both also keep this from being a way to make our server fetch and store arbitrary content from an address nobody asked it about.

Deploy in this order: publish TLS-RPT, create the mta-sts hostname with A and AAAA records, get a certificate that covers it, upload the policy in testing mode, publish the TXT record, then read reports for a few weeks before switching mode to enforce. Every step is reversible until the last one.

List every MX host the domain publishes, and re-check the policy whenever the MX set changes. A wildcard is allowed only as the entire leftmost label and matches exactly one label — *.example.net covers mail.example.net, and covers neither example.net nor a.b.example.net.

Set max_age to two weeks or more. The protection comes from senders holding the policy in cache: an attacker able to block a single policy fetch is otherwise free to strip STARTTLS on the delivery that follows, and a short value narrows that cached window to almost nothing. The ceiling is 31557600 seconds.

To withdraw a policy, publish mode: none and leave it up for at least the previous max_age before removing anything. Deleting the file or the record instead leaves senders enforcing a cached policy you can no longer change.