DIAGNOSTIC PLAYBOOK

MTA-STS TXT exists but the policy file is missing

MTA-STS needs a discoverable TXT record and an HTTPS policy file at the expected host and path. A DNS-only check cannot establish that the policy can be fetched and parsed.

HealthCheck Email editorial team · · Examples are illustrative

How to investigate

  1. Inspect the _mta-sts TXT record on the receiving domain.
  2. Fetch the well-known policy path on its mta-sts hostname with certificate validation enabled.
  3. Verify the successful response contains a valid policy rather than an HTML error page or application shell.

What this looks like

ILLUSTRATIVE EXAMPLE

The domain publishes the version and policy identifier in DNS, but the web deployment never includes the policy file. Discovery succeeds while retrieval fails.

A mistake to avoid

Do not treat a working homepage on the policy host as a successful policy check. The exact HTTPS endpoint matters.

Keep the result in context

Transport encryption protects a connection between mail systems. It is different from message authentication and does not imply end-to-end encryption. Investigate the receiving MX hostname, the TLS session and the applicable policy separately before deciding which system needs a change.

Take the next step

Use the related check to gather evidence, then compare it with the affected message or service. Keep the result and time with your notes so a later change can be distinguished from the original problem.

Sources and further reading

The protocol references below explain the underlying behavior. Your sending or DNS provider supplies the account-specific settings for its service.