Fix the certificate on the MTA-STS policy host
Why it matters
Senders refuse to fetch the policy over a certificate they cannot verify, so MTA-STS protects nothing until it is fixed. The certificate must be valid for the mta-sts hostname and not expired.
The fix
- Issue a certificate from a public authority (for example Let's Encrypt) that covers mta-sts.yourdomain exactly; a certificate for only the bare domain or www does not.
- Install the full chain (leaf plus intermediate certificates) on the web host, and renew it before it expires; set up automatic renewal.
- Open https://mta-sts.yourdomain/.well-known/mta-sts.txt in a browser and check there is no warning.
Related
- Reported by the MTA-STS and TLS-RPT check
- Publish an MTA-STS policy, starting in testing mode
- Nothing to do for MTA-STS on a domain that accepts no mail
- Fix the MTA-STS TXT record
- Make the MTA-STS policy file reachable
- Fix the MTA-STS policy file
- Switch MTA-STS from testing to enforce
- Turn MTA-STS back on
- Make the MTA-STS policy cover every MX host
- Raise the MTA-STS max_age
- Publish a TLS-RPT record
- Fix the TLS-RPT record
Scan your domain to see whether this applies to you.