MTA-STS policy mode is none

Updated 2026-10-12

MediumConfirmedQuick winemail.mta-sts.mode-none

What this check looks for

Your published policy explicitly tells senders to ignore any previous policy for your domain. It provides no protection at all.

Why it matters

mode: none exists to withdraw a policy cleanly. Left in place, it is indistinguishable from having nothing, while looking configured.

When the check passes, your report says: “The policy mode tells senders to enforce it”.

What it costs your score

When this check fails it removes 8 points from your Email transport score, before the status, confidence and repeat multipliers are applied. Email transport carries a weight of 8 in the overall score.

It shares the email-transport.mta-sts family ceiling of 25 points: however many findings that family produces, together they cannot remove more than that from Email transport. One underlying problem showing up in several places is still one problem.

Severity: medium
Default confidence: confirmed
Status when triggered: fail
Deduction: 8 points
Family cap: email-transport.mta-sts · 25
Category: Email transport
Module: Email mta sts
Fix owned by: user
In the ruleset since: 2026.09

How the whole score is calculated

How to fix it

Set the mode to testing, then enforce — or remove MTA-STS entirely.

mode: none provides no protection; keeping it published only creates the appearance of one.

If you are decommissioning MTA-STS, leave mode: none until the longest max_age has elapsed, then delete both the file and the _mta-sts record.
Otherwise set mode: testing, list every MX host on an mx: line, and keep max_age at a week or more.
Update the id in the _mta-sts.‹domain› TXT record so senders fetch the new policy.
Publish a TLS-RPT record if there is none, and move to enforce once the reports are clean.

How to confirm it worked

curl -s https://mta-sts.‹domain›/.well-known/mta-sts.txt — expect mode: testing or enforce

A named slot like ‹domain› — and the braces left in the configuration below — is filled in with your own values when this rule appears on a report.

Technical detail

The policy at https://mta-sts.‹domain›/.well-known/mta-sts.txt sets mode: none. RFC 8461 §5 defines this as an instruction to senders to discard any cached policy for the domain — the intended way to decommission MTA-STS without stranding senders on an old cached policy.

A sender that reads mode: none drops whatever policy it held for your domain and goes back to opportunistic TLS: it encrypts when your server offers STARTTLS and delivers in the clear when it does not — or when an attacker on the path removes the offer. That is exactly the situation MTA-STS exists to end.

There is one legitimate reason to publish it: retiring MTA-STS. RFC 8461 §8.3 describes publishing a none policy with a new id, waiting until every policy previously served has expired from senders' caches, and only then removing the TXT record and the policy host. If instead you were backing out of an enforce policy that was blocking mail, mode: testing does that job better: senders deliver while still reporting the failures you need to fix.

Outside a retirement, a none policy looks configured to anyone who inspects it and protects nothing, which is why our checker scores it as a failure. It is usually a retirement that was started and never finished, or a policy published before anyone chose a mode. Moving to testing costs nothing in deliverability and starts the reports that make enforce safe.

Standards and references

RFC 8461 §5 — Policy Application § 5

Test this on your domain

Run the check that produces this finding, on its own, against any domain.

Open the email mta sts checker Build the fix