MTA-STS policy file cannot be fetched

HighHigh confidenceemail.mta-sts.policy-unreachable

What this check looks for

Your domain announces an MTA-STS policy but the policy file itself cannot be downloaded. Senders that cannot fetch it fall back to unencrypted delivery.

Why it matters

The record makes it look protected; it is not. This is the most common MTA-STS failure and it is invisible unless something checks the file.

When the check passes, your report says: “The MTA-STS policy file downloads over HTTPS”.

What it costs your score

When this check fails it removes 12 points from your Email transport score, before the status, confidence and repeat multipliers are applied. Email transport carries a weight of 8 in the overall score.

It shares the email-transport.mta-sts family ceiling of 25 points: however many findings that family produces, together they cannot remove more than that from Email transport. One underlying problem showing up in several places is still one problem.

Severity: high
Default confidence: high
Status when triggered: fail
Deduction: 12 points
Family cap: email-transport.mta-sts · 25
Category: Email transport
Module: Email mta sts
Fix owned by: user
In the ruleset since: 2026.09

How the whole score is calculated

How to fix it

Serve the policy file over HTTPS at the exact URL, with a certificate covering mta-sts.<domain>.

A policy that cannot be fetched provides no protection while looking as though it does.

Confirm mta-sts.‹domain› resolves and has a certificate valid for that name.
Serve the file at /.well-known/mta-sts.txt with Content-Type text/plain and no redirect.
Check any WAF or bot rule is not blocking the fetch.

How to confirm it worked

curl -sI https://mta-sts.‹domain›/.well-known/mta-sts.txt — expect HTTP 200 and text/plain

A named slot like ‹domain› — and the braces left in the configuration below — is filled in with your own values when this rule appears on a report.

Technical detail

_mta-sts.‹domain› exists, but fetching https://mta-sts.‹domain›/.well-known/mta-sts.txt failed: ‹fetch error›. RFC 8461 §3.3 requires the file to be served over HTTPS with a certificate valid for mta-sts.<domain>, with no redirect, and with Content-Type text/plain. A certificate covering only the apex and www will not cover this hostname.

Standards and references

RFC 8461 §3.3 — HTTPS Policy Fetching § 3.3

Test this on your domain

Run the check that produces this finding, on its own, against any domain.

Open the email mta sts checker Build the fix