Skip to content

Domain has MX records but no MTA-STS policy (~3% adoption industry-wide)

MTA-STS (Mail Transfer Agent Strict Transport Security) is a setting that tells other mail servers they must use encrypted connections when delivering email to you. Your domain has email records but no MTA-STS policy was found. Other audit tools often report this finding as "MTA-STS policy is missing (STSFetchResult.NONE)".

Why this matters

Without it, email being delivered to your domain could be intercepted through a "downgrade attack" where an attacker tricks the sending server into using an unencrypted connection. MTA-STS closes this gap.

How to fix it

Publish an MTA-STS policy by adding a DNS TXT record and hosting a small policy text file at a specific URL on your domain. Your email provider documentation will have the exact steps, and several free guides walk through it in under 15 minutes.

Turn website findings into an action plan

Create an account to start a Full Audit of your website, with supporting evidence and a prioritised action plan.

Start Full Audit