All fixes

Publish an MTA-STS policy

mta-sts-missing

SMTP falls back to plaintext when TLS fails, so an attacker on the path can strip encryption. MTA-STS tells senders to refuse that downgrade.

Why this matters

There's no MTA-STS policy. Without it, an attacker on the network could downgrade email delivery to plaintext.

Cloudflare

  1. 1 Add a TXT record for _mta-sts.yourdomain.com
  2. 2 Host a policy file at https://mta-sts.yourdomain.com/.well-known/mta-sts.txt
# DNS record:
Type: TXT
Name: _mta-sts
Content: v=STSv1; id=20260101T000000Z

# Policy file at /.well-known/mta-sts.txt:
version: STSv1
mode: enforce
mx: mail.yourdomain.com
max_age: 604800
Cloudflare docs

Does your app still have this?

Scan your domain