No qualifying MTA-STS TXT record observed after enforcing DMARC
ShipReady observed an enforcing DMARC policy but no TXT record beginning with v=STSv1 at _mta-sts for the organisational domain.
Why it matters
MTA-STS is optional transport-policy hardening for inbound email. This finding helps an owner decide whether it fits the domain's mail-delivery strategy; it does not demonstrate a transport attack or a failure of existing delivery.
How ShipReady detects it
What it inspects
ShipReady uses the selected DMARC policy and queries TXT records at _mta-sts for the organisational domain.
What triggers a finding
The rule triggers only when the selected DMARC policy is quarantine or reject, the MTA-STS TXT lookup completes, and no TXT value begins with v=STSv1. A DNS lookup failure or non-enforcing DMARC suppresses the finding.
What the evidence shows
No qualifying MTA-STS TXT record was observed at the supported location after ShipReady observed an enforcing DMARC policy.
Limits of this check
ShipReady does not send email, inspect sender support, test SMTP TLS, test downgrade behavior, or establish whether a particular mailbox provider would apply MTA-STS.
How to fix it
Confirm MTA-STS fits the inbound mail design
Review the domain's actual MX hosts and mail-provider support before publishing an MTA-STS policy.
Publish the DNS record and policy together
If MTA-STS is appropriate, follow the provider and RFC guidance for both the _mta-sts TXT record and the HTTPS policy file.
How to verify the change
Verify the DNS record and policy endpoint
After deployment, query _mta-sts and request the policy URL from an independent environment.
Expected: The intended TXT record and policy file are both available and match the planned mail configuration.