A live MX host is not listed in the MTA-STS policy
What this check looks for
One of your mail servers is missing from the policy. If the policy is enforcing, senders will refuse to deliver to that server and mail to your domain bounces.
Why it matters
This is the one MTA-STS mistake that loses mail rather than merely failing to protect it. It usually happens when MX records change and the policy file is not updated.
When the check passes, your report says: “Every live MX host is listed in the MTA-STS policy”.
What it costs your score
When this check fails it removes 12 points from your Email transport score, before the status, confidence and repeat multipliers are applied. Email transport carries a weight of 8 in the overall score.
It shares the email-transport.mta-sts family ceiling of 25 points: however many findings that family produces, together they cannot remove more than that from Email transport. One underlying problem showing up in several places is still one problem.
- Severity
- high
- Default confidence
- confirmed
- Status when triggered
- fail
- Deduction
- 12 points
- Family cap
- email-transport.mta-sts · 25
- Category
- Email transport
- Module
- Email mta sts
- Fix owned by
- user
- In the ruleset since
- 2026.09
How to fix it
Add every live MX host to the policy file and bump the policy id.
Under an enforcing policy, mail to an unlisted host is rejected rather than downgraded.
List your current MX hosts and compare them with the
mx:lines in the policy.Add the missing host, or a wildcard covering your provider's hosts such as
*.‹mx suffix›.Change the
idin_mta-sts.‹domain›so senders refetch the policy immediately.
How to confirm it worked
dig +short MX ‹domain› and compare with the mx: lines in the policy — every host must match
A named slot like ‹domain› — and the braces left in the configuration below — is filled in with your own values when this rule appears on a report.
Technical detail
MX host ‹mx host› is published for ‹domain› but matches no mx: pattern in the policy. RFC 8461 §4.1 requires the certificate name of the receiving host to match one of the policy's mx: patterns; a host that does not match is not a valid destination under an enforcing policy, and the sender fails delivery rather than falling back.
Standards and references
Test this on your domain
Run the check that produces this finding, on its own, against any domain.