DIAGNOSTIC PLAYBOOK
The MTA-STS HTTPS certificate is invalid
The policy host's HTTPS certificate must validate independently of the mail server's SMTP certificate. A healthy certificate on one endpoint does not fix a failure on the other.
HealthCheck Email editorial team · · Examples are illustrative
How to investigate
- Check the certificate served for the exact mta-sts hostname, including name coverage and chain validity.
- Inspect hosting renewals, SNI configuration and certificate deployment on that web endpoint.
- Repair the HTTPS certificate and refetch the policy with normal validation enabled.
What this looks like
ILLUSTRATIVE EXAMPLE
The MX server's TLS certificate is valid, but the policy website's certificate expired. Supporting senders can encounter a policy retrieval problem.
A mistake to avoid
Do not disable certificate validation to declare the policy healthy. The validation failure is part of the condition receivers need resolved.
Keep the result in context
Transport encryption protects a connection between mail systems. It is different from message authentication and does not imply end-to-end encryption. Investigate the receiving MX hostname, the TLS session and the applicable policy separately before deciding which system needs a change.
Take the next step
Use the related check to gather evidence, then compare it with the affected message or service. Keep the result and time with your notes so a later change can be distinguished from the original problem.
Sources and further reading
The protocol references below explain the underlying behavior. Your sending or DNS provider supplies the account-specific settings for its service.