What this check inspects
Shipwork resolves the MTA-STS record and fetches its policy file, the TLS-RPT record, the BIMI record and any CAA records for the domain. It reports the MTA-STS mode when the policy file is valid, and flags an MTA-STS record whose policy file is missing or malformed.
What a failure means
An MTA-STS record with no valid policy file is a warning: the record exists but asserts nothing, so mail can still be downgraded. Everything else is informational, because these records are optional, but their absence means a protection is not in place.
How to fix it
- If you publish an MTA-STS record, also publish the policy file at the well-known path and make sure it parses.
- Add TLS-RPT so you receive reports when inbound TLS fails.
- Add CAA records naming the certificate authorities you actually use, which stops others issuing for your domain.
- BIMI needs a logo in the right format and a DMARC enforcement policy, so treat it as a later step.
A typical failure, worked through
The setupA team adds the MTA-STS TXT record but publishes the policy file at /mta-sts.txt instead of the required well-known path.
What the check reportsThe check finds the record, then reports that the policy file could not be fetched from https://mta-sts.example.com/.well-known/mta-sts.txt, so the record is inert.
The pointA DNS record that points at a missing file is worse than none, because it looks configured. The well-known path is part of the specification.