sts-policy-fetch-error
Your MTA-STS policy could not be fetched
By Jose Pollman · Published
How it appears in a report
"result-type": "sts-policy-fetch-error"What it means
You advertise MTA-STS in DNS, but senders could not retrieve the policy file from its well-known HTTPS location — so the policy is not being applied to mail sent to you.
Your mail server. This is your own receiving setup. The report describes senders failing to reach your MX, so the certificate, policy or DNS record at fault is yours to fix.
Worth being clear about the direction, because it is easy to get backwards: you publish TLS-RPT for your own domain, and senders report the failures they hit while delivering to you. So policy-domain and receiving-mx-hostname in your reports are yours, and sending-mta-ip belongs to whoever sent the report.
Why it happens
The DNS record and the policy file are separate things maintained in separate places, so having one without the other is easy. The usual causes are a missing file at the well-known path, an expired certificate on the policy host, or a redirect — the policy must be served directly, and senders do not follow redirects.
How to fix it
- Fetch https://mta-sts.<your-domain>/.well-known/mta-sts.txt yourself and see what happens.
- Confirm it returns 200 directly, with no redirect, and Content-Type text/plain.
- Check the certificate on the mta-sts host — it is a separate hostname and is routinely forgotten at renewal.
- Confirm the _mta-sts TXT record and the policy file agree on the policy id.