MTA-STS policy file is malformed
What this check looks for
The policy file exists but cannot be understood. Senders discard it and go back to unencrypted delivery.
Why it matters
All of the setup work is done and none of it is having any effect, which is very hard to notice from the outside.
When the check passes, your report says: “The MTA-STS policy file is well formed and readable”.
What it costs your score
When this check fails it removes 12 points from your Email transport score, before the status, confidence and repeat multipliers are applied. Email transport carries a weight of 8 in the overall score.
It shares the email-transport.mta-sts family ceiling of 25 points: however many findings that family produces, together they cannot remove more than that from Email transport. One underlying problem showing up in several places is still one problem.
- Severity
- high
- Default confidence
- confirmed
- Status when triggered
- fail
- Deduction
- 12 points
- Family cap
- email-transport.mta-sts · 25
- Category
- Email transport
- Module
- Email mta sts
- Fix owned by
- user
- In the ruleset since
- 2026.09
How to fix it
Regenerate the policy file and re-upload it.
An unparseable policy is discarded, leaving delivery unprotected.
Regenerate the file with the generator, which emits the required CRLF line endings.
Re-upload it and confirm the served bytes match.
How to confirm it worked
curl -s https://mta-sts.‹domain›/.well-known/mta-sts.txt | cat -A — expect ^M$ at each line end
A named slot like ‹domain› — and the braces left in the configuration below — is filled in with your own values when this rule appears on a report.
Technical detail
Parsing https://mta-sts.‹domain›/.well-known/mta-sts.txt failed: ‹parse error›. RFC 8461 §3.2 defines the file as CRLF-separated key: value lines requiring version: STSv1, a mode, at least one mx, and a max_age. Files edited on a Unix host frequently ship with LF endings, which strict parsers reject.
Standards and references
Test this on your domain
Run the check that produces this finding, on its own, against any domain.