MTA-STS policy mode is none
What this check looks for
Your published policy explicitly tells senders to ignore any previous policy for your domain. It provides no protection at all.
Why it matters
mode: none exists to withdraw a policy cleanly. Left in place, it is indistinguishable from having nothing, while looking configured.
When the check passes, your report says: “The policy mode tells senders to enforce it”.
What it costs your score
When this check fails it removes 8 points from your Email transport score, before the status, confidence and repeat multipliers are applied. Email transport carries a weight of 8 in the overall score.
It shares the email-transport.mta-sts family ceiling of 25 points: however many findings that family produces, together they cannot remove more than that from Email transport. One underlying problem showing up in several places is still one problem.
- Severity
- medium
- Default confidence
- confirmed
- Status when triggered
- fail
- Deduction
- 8 points
- Family cap
- email-transport.mta-sts · 25
- Category
- Email transport
- Module
- Email mta sts
- Fix owned by
- user
- In the ruleset since
- 2026.09
How to fix it
Set the mode to testing, then enforce — or remove MTA-STS entirely.
mode: none provides no protection; keeping it published only creates the appearance of one.
If you are decommissioning MTA-STS, leave
mode: noneuntil the longestmax_agehas elapsed, then delete both the file and the_mta-stsrecord.Otherwise set
mode: testing, update theid, and ramp toenforce.
How to confirm it worked
curl -s https://mta-sts.‹domain›/.well-known/mta-sts.txt — expect mode: testing or enforce
A named slot like ‹domain› — and the braces left in the configuration below — is filled in with your own values when this rule appears on a report.
Technical detail
The policy at https://mta-sts.‹domain›/.well-known/mta-sts.txt sets mode: none. RFC 8461 §5 defines this as an instruction to senders to discard any cached policy for the domain — the intended way to decommission MTA-STS without stranding senders on an old cached policy.
Standards and references
Test this on your domain
Run the check that produces this finding, on its own, against any domain.