Make the MTA-STS policy file reachable on Cloudflare

Why it matters

The MTA-STS TXT record exists but the policy file cannot be fetched, so senders that do not already have it cached deliver mail without MTA-STS protection. The policy must be served over HTTPS on the mta-sts subdomain.

The fix

1. Read the reason in the finding. In the Cloudflare dashboard open DNS > Records and check there is an A, AAAA or CNAME record named mta-sts pointing at your policy host; for this web record the proxy (orange cloud) is allowed.
2. If you serve it from a Worker, check the Worker has mta-sts.yourdomain as a Custom Domain (Settings > Domains & Routes) and returns the policy text for /.well-known/mta-sts.txt with content-type text/plain.
3. A 404 usually means the path is wrong; a redirect (for example from a Redirect Rule or Page Rule) must not apply to this hostname.

Type:     CNAME
Name:     mta-sts.example.com
Target:   your-web-host.example
Proxy:    Proxied or DNS only (both work for the policy host)

The examples use example.com. Replace it with your own domain.

Read the documentation ↗(opens in a new tab)

Related

• Reported by the MTA-STS and TLS-RPT check
• Publish an MTA-STS policy, starting in testing mode
• Nothing to do for MTA-STS on a domain that accepts no mail
• Fix the MTA-STS TXT record
• Fix the certificate on the MTA-STS policy host
• Fix the MTA-STS policy file
• Switch MTA-STS from testing to enforce
• Turn MTA-STS back on
• Make the MTA-STS policy cover every MX host
• Raise the MTA-STS max_age
• Publish a TLS-RPT record
• Fix the TLS-RPT record