MTA-STS policy is still in testing mode
What this check looks for
Your policy is published but asks senders only to report problems, not to act on them. Mail can still be delivered unencrypted.
Why it matters
Testing mode is the right place to start and the wrong place to stay. Until it is set to enforce, the policy provides reporting but no protection.
When the check passes, your report says: “The MTA-STS policy is enforcing, not merely reporting”.
What it costs your score
When this check fails it removes 4 points from your Email transport score, before the status, confidence and repeat multipliers are applied. Email transport carries a weight of 8 in the overall score.
It shares the email-transport.mta-sts family ceiling of 25 points: however many findings that family produces, together they cannot remove more than that from Email transport. One underlying problem showing up in several places is still one problem.
- Severity
- low
- Default confidence
- confirmed
- Status when triggered
- warn
- Deduction
- 4 points
- Family cap
- email-transport.mta-sts · 25
- Category
- Email transport
- Module
- Email mta sts
- Fix owned by
- user
- In the ruleset since
- 2026.09
How to fix it
Move the policy to mode: enforce once TLS-RPT reports are clean.
In testing mode a downgrade attack still succeeds; it is merely reported.
Check TLS-RPT reports for two to four weeks and confirm no legitimate sender is failing.
Confirm the
mx:list still matches your live MX hosts.Change
mode: testingtomode: enforceand update the policyidin the DNS record.
How to confirm it worked
curl -s https://mta-sts.‹domain›/.well-known/mta-sts.txt — expect mode: enforce
A named slot like ‹domain› — and the braces left in the configuration below — is filled in with your own values when this rule appears on a report.
Technical detail
The policy at https://mta-sts.‹domain›/.well-known/mta-sts.txt sets mode: testing. Per RFC 8461 §5, a sender in testing mode reports failures through TLS-RPT but still delivers the message, including over an unauthenticated connection.
Standards and references
Test this on your domain
Run the check that produces this finding, on its own, against any domain.