DIAGNOSTIC PLAYBOOK
MTA-STS TXT exists but the policy file is missing
MTA-STS needs a discoverable TXT record and an HTTPS policy file at the expected host and path. A DNS-only check cannot establish that the policy can be fetched and parsed.
HealthCheck Email editorial team · · Examples are illustrative
How to investigate
- Inspect the _mta-sts TXT record on the receiving domain.
- Fetch the well-known policy path on its mta-sts hostname with certificate validation enabled.
- Verify the successful response contains a valid policy rather than an HTML error page or application shell.
What this looks like
ILLUSTRATIVE EXAMPLE
The domain publishes the version and policy identifier in DNS, but the web deployment never includes the policy file. Discovery succeeds while retrieval fails.
A mistake to avoid
Do not treat a working homepage on the policy host as a successful policy check. The exact HTTPS endpoint matters.
Keep the result in context
Transport encryption protects a connection between mail systems. It is different from message authentication and does not imply end-to-end encryption. Investigate the receiving MX hostname, the TLS session and the applicable policy separately before deciding which system needs a change.
Take the next step
Use the related check to gather evidence, then compare it with the affected message or service. Keep the result and time with your notes so a later change can be distinguished from the original problem.
Sources and further reading
The protocol references below explain the underlying behavior. Your sending or DNS provider supplies the account-specific settings for its service.