MTA-STS policy unreachable
Policy host or HTTPS policy document cannot be fetched.
Problem summary
Policy host or HTTPS policy document cannot be fetched.
Symptoms
- HTTPS policy fetch fails (DNS, TLS, or 404)
- _mta-sts TXT exists but host does not serve the policy
- Certificate name mismatch on the policy host
Possible causes
- mta-sts.<domain> A/AAAA or CDN misconfigured
- Missing /.well-known/mta-sts.txt
- TLS certificate does not cover the policy hostname
How to diagnose
- Resolve mta-sts host and curl the well-known policy URL
- Inspect TLS certificate SANs
- Confirm _mta-sts TXT id/version fields
How to fix
- Fix DNS, TLS, and path so the policy is fetchable over HTTPS
- Bump the _mta-sts TXT id when the policy changes
- Keep mode at testing until fetch is reliable
How to verify
- Policy URL returns 200 text/plain (or correct type) consistently
- External STS checkers can retrieve the policy
Prevention
- Monitor HTTPS availability of the policy host
- Treat STS hosting as production infrastructure
When to escalate
- Production mail is failing for a material share of recipients after remediation attempts