MTA-STS glossary
What is the mta-sts.txt policy file and where does it live?
By Samuel Chenard · CEO & Co-Founder, Palisade · Reviewed July 15, 2026
mta-sts.txt is the file that holds your actual MTA-STS policy. It's plain text, served at https://mta-sts.<domain>/.well-known/mta-sts.txt with a certificate valid for the mta-sts hostname, and contains four fields: version, mode, one or more mx lines, and max_age. The DNS record only points here — this file is the policy.
mta-sts.txt at a glance | |
|---|---|
| Tag | mta-sts.txt (policy file) |
| Valid values | Key/value lines: version: STSv1 · mode · mx (one line per allowed MX pattern) · max_age |
| Default | Required — MTA-STS does nothing without it; the DNS record only announces that this file exists. |
| Where it goes | Served over HTTPS at https://mta-sts.<domain>/.well-known/mta-sts.txt — directly, not via redirect |
How mta-sts.txt works
MTA-STS announces itself in DNS but delivers its rules over HTTPS, and this file is where they live. The format is deliberately simple plain text: version: STSv1, a mode, one mx line per allowed MX pattern, and a max_age. Wildcards covering one leftmost label are allowed in mx patterns — *.mail.protection.outlook.com is the standard way Microsoft 365 domains match their per-tenant MX host.
The certificate requirement is the whole trick. Serving the policy over HTTPS with a valid certificate for mta-sts.<domain> is what makes it trustworthy where plain DNS is not — so an expired certificate, or one that doesn't cover the mta-sts hostname, makes the file worthless to senders no matter how correct its contents are.
In practice, MTA-STS failures are almost always the hosting, not the syntax: the mta-sts subdomain was never created, the certificate lapsed at renewal, or the web server answers with a redirect or an HTML error page instead of the plain-text file. MTA-STS is the rare email standard whose maintenance burden is a web-hosting problem — and it quietly rots the day a certificate renewal is missed.
Correct record vs common mistake
Correct
version: STSv1
mode: enforce
mx: *.mail.protection.outlook.com
max_age: 1209600A complete Microsoft 365 policy — the wildcard matches the tenant's MX host, and the file is served with a valid certificate for mta-sts.yourdomain.com.
Common mistake
https://yourdomain.com/.well-known/mta-sts.txtWrong host. The file must be served from the mta-sts subdomain — https://mta-sts.yourdomain.com/.well-known/mta-sts.txt — with a certificate for that exact hostname, and redirects don't count.
Troubleshooting mta-sts.txt
| Issue | Likely cause | Fix |
|---|---|---|
| Policy fetch fails outright | The mta-sts.<domain> subdomain was never created or doesn't resolve | Add DNS for mta-sts.<domain> pointing at a host that can serve the file over HTTPS |
| Certificate errors on fetch | Certificate expired, or doesn't cover the mta-sts.<domain> hostname | Issue or renew a certificate for that exact hostname (a *.yourdomain.com wildcard also covers it) — and automate the renewal |
| File loads in a browser but senders reject it | Served via a redirect, or as an HTML page instead of plain text | Serve it directly at the well-known path — status 200, plain text, no redirects |
Why it matters for MSPs
Every client domain needs its own mta-sts subdomain, its own valid certificate, and its own correctly served file — forever. Across 50–200 tenants that's a fleet of tiny websites that must never break, and one lapsed certificate renewal silently kills MTA-STS for that client: no bounce, no alert, nothing.
Trusted by MSPs
“We moved all our clients from EasyDMARC, which gave us so much more clarity about what to do with the remediation option from the agent.”
Jodie Kretzer — VP of Service Management, Invision Technologies
DMARC software that does the work
This is where Palisade differs from every checker on the market: it **hosts the policy file for you** — the `mta-sts` subdomain, the certificate, the renewals, the correct headers — for every client domain. Most vendors tell you the file is broken; Palisade makes sure it never is, so MTA-STS doesn't die of certificate rot.
1 domain free up to 1,000 emails/month
Questions readers ask