MTA-STS max_age is very short
What this check looks for
Your policy asks senders to forget it again after a short time. A short lifetime narrows the window in which the policy actually protects you.
Why it matters
An attacker who can block the policy fetch only has to keep it blocked for the lifetime you set. A longer lifetime makes that attack much harder.
When the check passes, your report says: “The policy lasts long enough to protect between refreshes”.
What it costs your score
When this check fails it removes 3 points from your Email transport score, before the status, confidence and repeat multipliers are applied. Email transport carries a weight of 8 in the overall score.
It shares the email-transport.mta-sts family ceiling of 25 points: however many findings that family produces, together they cannot remove more than that from Email transport. One underlying problem showing up in several places is still one problem.
- Severity
- low
- Default confidence
- confirmed
- Status when triggered
- warn
- Deduction
- 3 points
- Family cap
- email-transport.mta-sts · 25
- Category
- Email transport
- Module
- Email mta sts
- Fix owned by
- user
- In the ruleset since
- 2026.09
How to fix it
Raise max_age to at least 604800 seconds (one week) once the policy is stable.
A short lifetime shortens the window an attacker must suppress to strip your policy.
Confirm the
mx:list is stable and correct.Set
max_age: 604800or higher, and update the policyid.
How to confirm it worked
curl -s https://mta-sts.‹domain›/.well-known/mta-sts.txt — expect max_age of 604800 or more
A named slot like ‹domain› — and the braces left in the configuration below — is filled in with your own values when this rule appears on a report.
Technical detail
The policy sets max_age: ‹max age› seconds. RFC 8461 §3.2 recommends a value on the order of weeks, with a maximum of 31557600 seconds, precisely so that a cached policy survives an attacker suppressing the refetch. A short value is appropriate only during a migration.
Standards and references
- RFC 8461 §3.2 — max_age § 3.2
Test this on your domain
Run the check that produces this finding, on its own, against any domain.