Invalid MTA-STS policy
Published MTA-STS policy is malformed or incomplete.
Problem summary
Published MTA-STS policy is malformed or incomplete.
Symptoms
- MTA-STS validators reject policy content
- Missing version/mode/mx fields
- Policy mode/max_age inconsistent with intent
Possible causes
- Malformed policy text at https://mta-sts...//.well-known/mta-sts.txt
- MX names in policy do not match real MX
- Wrong line endings or extra HTML from a CMS
How to diagnose
- Fetch the policy over HTTPS and inspect raw text
- Compare mx: lines to live MX records
How to fix
- Publish a minimal valid policy (example fields): version: STSv1, mode, max_age, mx patterns
- Serve plain text from the MTA-STS host — not a web app HTML page
- Start with mode testing before enforce
How to verify
- STS validators accept the policy document
- MX patterns cover all active MX hostnames
Prevention
- Include MTA-STS policy in MX change tickets
- Validate after every MX cutover
When to escalate
- Production mail is failing for a material share of recipients after remediation attempts