Fix the MTA-STS policy file on Cloudflare

Why it matters

Senders ignore a policy file they cannot parse or that sits behind a redirect, so MTA-STS has no effect. The file is a short list of key and value lines.

The fix

1. Fix the file text as described and make sure no Cloudflare Redirect Rule, Page Rule or Bulk Redirect applies to the mta-sts hostname (Rules > Overview).
2. Replace the mx lines in the snippet with your own MX host names, written exactly as they appear in your MX records.
3. If a Worker serves the file, check it returns the text unchanged with content-type text/plain, not an HTML page.
4. Change the id in the _mta-sts TXT record afterwards (DNS > Records).

version: STSv1
mode: testing
mx: YOUR-MX-HOST.example
mx: *.YOUR-MX-DOMAIN.example
max_age: 86400

Read the documentation ↗(opens in a new tab)

Related

• Reported by the MTA-STS and TLS-RPT check
• Publish an MTA-STS policy, starting in testing mode
• Nothing to do for MTA-STS on a domain that accepts no mail
• Fix the MTA-STS TXT record
• Make the MTA-STS policy file reachable
• Fix the certificate on the MTA-STS policy host
• Switch MTA-STS from testing to enforce
• Turn MTA-STS back on
• Make the MTA-STS policy cover every MX host
• Raise the MTA-STS max_age
• Publish a TLS-RPT record
• Fix the TLS-RPT record