13 FOCUSED PLAYBOOKS
Transport security
Check the policy, certificates and reports that determine how mail is encrypted between servers.
Transport encryption protects a connection between mail systems. It is different from message authentication and does not imply end-to-end encryption. Investigate the receiving MX hostname, the TLS session and the applicable policy separately before deciding which system needs a change.
Check domain health →MTA-STS TXT exists but the policy file is missing
MTA-STS needs a discoverable TXT record and an HTTPS policy file at the expected host and path.
Read the playbook →DIAGNOSTIC PLAYBOOKMTA-STS policy does not cover the current MX servers
An enforcing MTA-STS policy can prevent supporting senders from delivering to an MX hostname that is not covered by the policy.
Read the playbook →DIAGNOSTIC PLAYBOOKMTA-STS testing mode reports failures: what to check
MTA-STS testing mode is intended to surface policy problems without requiring enforcement of those failures.
Read the playbook →DIAGNOSTIC PLAYBOOKMTA-STS changes are not immediate: understand policy caching
Supporting senders can cache an MTA-STS policy for its max_age period.
Read the playbook →DIAGNOSTIC PLAYBOOKChanged an MTA-STS file? Update its discovery identifier
The MTA-STS DNS identifier signals that the policy has changed.
Read the playbook →DIAGNOSTIC PLAYBOOKThe MTA-STS HTTPS certificate is invalid
The policy host's HTTPS certificate must validate independently of the mail server's SMTP certificate.
Read the playbook →DIAGNOSTIC PLAYBOOKSMTP TLS certificate does not match the MX hostname
A mail server can negotiate TLS while presenting a certificate for a different name.
Read the playbook →DIAGNOSTIC PLAYBOOKExpired SMTP certificate: confirm every receiving endpoint
An expired SMTP certificate can disrupt mail from senders that enforce certificate validation.
Read the playbook →DIAGNOSTIC PLAYBOOKA receiving server no longer advertises STARTTLS
A server that does not advertise STARTTLS cannot upgrade that SMTP session using the extension.
Read the playbook →DIAGNOSTIC PLAYBOOKTLS-RPT reports are missing: inspect discovery and delivery
A TLS-RPT record requests transport reports but does not guarantee every sender will produce them.
Read the playbook →DIAGNOSTIC PLAYBOOKTLS-RPT certificate failures and policy failures need different fixes
TLS reports distinguish failure categories that can arise at different parts of delivery.
Read the playbook →DIAGNOSTIC PLAYBOOKDANE TLSA exists but DNSSEC validation fails
DANE for SMTP relies on DNSSEC-authenticated TLSA information.
Read the playbook →DIAGNOSTIC PLAYBOOKTLS passes but DKIM fails: separate the security layers
TLS and DKIM protect different parts of email delivery.
Read the playbook →