sus.botdocs

Security finding

The MTA-STS policy is in testing mode, broken, misses a mail host, or has no TLS reporting

Security Warning Severity: Medium

Part of the audit Email authentication records. Finding id: security.emailMtaSts.

What it costs you

MTA-STS tells sending servers to use an encrypted, verified connection to your mail hosts. When it is broken, in testing mode or out of date, that protection is not there.

What to do

Fix the policy and keep it in step with the MX records.

What it checks

  • Secure email policy in test mode or invalid
  • Secure email policy omits a mail server
  • No reports on secure email delivery problems

How to fix it

Fix the MTA-STS policy

  1. Serve https://mta-sts.[domain]/.well-known/mta-sts.txt as text/plain with HTTP 200 and no redirect, from a host with a valid certificate for mta-sts.[domain].
  2. Give it the lines version: STSv1, mode: (testing first, enforce when the reports are clean), one mx: line per mail host in your MX records (a *. pattern covers one label), and max_age: in seconds, at most 31557600.
  3. After every change to the file, change the id in the TXT record at _mta-sts.[domain], which starts with v=STSv1.

How to check: dig +short TXT _mta-sts.[domain]; dig +short MX [domain]; curl -s https://mta-sts.[domain]/.well-known/mta-sts.txt

Publish a TLS-RPT record

  1. At the DNS host, create a TXT record at _smtp._tls.[domain] with the value v=TLSRPTv1; rua=mailto: followed by a mailbox that receives the reports.
  2. Read the reports, or have a report service read them, before moving the MTA-STS policy to enforce.

How to check: dig +short TXT _smtp._tls.[domain]