dotvitals

MTA-STS policy is still in testing mode

LowConfirmedemail.mta-sts.mode-testing

What this check looks for

Your policy is published but asks senders only to report problems, not to act on them. Mail can still be delivered unencrypted.

Why it matters

Testing mode is the right place to start and the wrong place to stay. Until it is set to enforce, the policy provides reporting but no protection.

When the check passes, your report says: “The MTA-STS policy is enforcing, not merely reporting”.

What it costs your score

When this check fails it removes 4 points from your Email transport score, before the status, confidence and repeat multipliers are applied. Email transport carries a weight of 8 in the overall score.

It shares the email-transport.mta-sts family ceiling of 25 points: however many findings that family produces, together they cannot remove more than that from Email transport. One underlying problem showing up in several places is still one problem.

Severity
low
Default confidence
confirmed
Status when triggered
warn
Deduction
4 points
Family cap
email-transport.mta-sts · 25
Category
Email transport
Module
Email mta sts
Fix owned by
user
In the ruleset since
2026.09

How the whole score is calculated

How to fix it

Move the policy to mode: enforce once TLS-RPT reports are clean.

In testing mode a downgrade attack still succeeds; it is merely reported.

  1. Check TLS-RPT reports for two to four weeks and confirm no legitimate sender is failing.

  2. Confirm the mx: list still matches your live MX hosts.

  3. Change mode: testing to mode: enforce and update the policy id in the DNS record.

How to confirm it worked

  • curl -s https://mta-sts.‹domain›/.well-known/mta-sts.txt — expect mode: enforce

A named slot like ‹domain› — and the braces left in the configuration below — is filled in with your own values when this rule appears on a report.

Technical detail

The policy at https://mta-sts.‹domain›/.well-known/mta-sts.txt sets mode: testing. Per RFC 8461 §5, a sender in testing mode reports failures through TLS-RPT but still delivers the message, including over an unauthenticated connection.

Standards and references

Test this on your domain

Run the check that produces this finding, on its own, against any domain.

Open the email mta sts checkerBuild the fix

Other email mta sts checks