MTA-STS record missing

Markdown-backed fix guides for Amhost Labs audit findings.

What is it?

MTA-STS is a mail security mechanism that tells external mail servers your domain expects inbound SMTP delivery over TLS. This finding means the DNS policy discovery record is missing.

Why does it matter?

Without MTA-STS, many senders will still use opportunistic TLS, but they have less protection against downgrade or interception attacks during SMTP delivery. MTA-STS is most useful for domains that receive important mail and want stricter transport guarantees.

How to fix it?

Publish the DNS TXT record and host the HTTPS policy file.

_mta-sts.example.com. 3600 IN TXT "v=STSv1; id=2026070901"

https://mta-sts.example.com/.well-known/mta-sts.txt

Example policy:

version: STSv1
mode: testing
mx: mail.example.com
max_age: 86400

Start with mode: testing, verify reports and MX names, then move to mode: enforce when delivery is stable.