Make the MTA-STS policy cover every MX host on Cloudflare

Why it matters

Some of your mail servers are not named in the policy, so in enforce mode senders refuse to deliver to them and in testing mode they only report it. The mx lines must match the MX records.

Staged change. Do this in stages and check each one before the next, so a mistake does not break your site or your mail.

The fix

1. In the Cloudflare dashboard open DNS > Records and list the MX records. Update the policy file (Worker code or web host) so every host is covered by an mx: line, using your own MX host names exactly as published.
2. Then edit the _mta-sts TXT record in DNS > Records and change its id so senders re-fetch the policy.
3. If you switch an enforce policy to mode: testing as an emergency step, change the id as well.

Type:     TXT
Name:     _mta-sts.example.com
Content:  v=STSv1; id=2026100503

The examples use example.com. Replace it with your own domain.

Read the documentation ↗(opens in a new tab)

Related

• Reported by the MTA-STS and TLS-RPT check
• Publish an MTA-STS policy, starting in testing mode
• Nothing to do for MTA-STS on a domain that accepts no mail
• Fix the MTA-STS TXT record
• Make the MTA-STS policy file reachable
• Fix the certificate on the MTA-STS policy host
• Fix the MTA-STS policy file
• Switch MTA-STS from testing to enforce
• Turn MTA-STS back on
• Raise the MTA-STS max_age
• Publish a TLS-RPT record
• Fix the TLS-RPT record