Raise the MTA-STS max_age on Cloudflare

Why it matters

Senders cache the policy for max_age seconds, so a very short value means they re-check often and leave short windows with no protection. A week or more is usual once the policy is stable.

The fix

1. Update only the max_age line in the policy file (Worker code or web host), keeping your current mode and mx lines, deploy it, then edit the _mta-sts TXT record in DNS > Records and change the id.

Type:     TXT
Name:     _mta-sts.example.com
Content:  v=STSv1; id=2026100504

The examples use example.com. Replace it with your own domain.

Read the documentation ↗(opens in a new tab)

Related

• Reported by the MTA-STS and TLS-RPT check
• Publish an MTA-STS policy, starting in testing mode
• Nothing to do for MTA-STS on a domain that accepts no mail
• Fix the MTA-STS TXT record
• Make the MTA-STS policy file reachable
• Fix the certificate on the MTA-STS policy host
• Fix the MTA-STS policy file
• Switch MTA-STS from testing to enforce
• Turn MTA-STS back on
• Make the MTA-STS policy cover every MX host
• Publish a TLS-RPT record
• Fix the TLS-RPT record