Skip to content
notspoofed.comSPF · DKIM · DMARC

sts-webpki-invalid: your MTA-STS policy host certificate is not trusted

By · Published · Updated

sts-webpki-invalid means the HTTPS certificate on your mta-sts subdomain failed validation, so senders could not trust your MTA-STS policy and did not apply it. Check the certificate on mta-sts.yourdomain specifically, including its full chain, renew it if it has expired, and add that hostname to your certificate expiry monitoring.

MTA-STSYour mail serverDelivered unencrypted

How it appears in a report

"result-type": "sts-webpki-invalid"

What it means

Your policy file was served over HTTPS with a certificate that failed validation, so senders could not trust the policy and did not apply it.

Your mail server. This is your own receiving setup. The report describes senders failing to reach your MX, so the certificate, policy or DNS record at fault is yours to fix.

Worth being clear about the direction, because it is easy to get backwards: you publish TLS-RPT for your own domain, and senders report the failures they hit while delivering to you. So policy-domain and receiving-mx-hostname in your reports are yours, and sending-mta-ip belongs to whoever sent the report.

Why it happens

The mta-sts subdomain is a web host, and it is almost always the forgotten one: set up once, certificate issued, then left outside whatever monitoring covers the main site. It expires with nobody watching, and your MTA-STS protection quietly stops applying.

How to fix it

  1. Check the certificate on mta-sts.<your-domain> specifically, not on your main domain.
  2. Confirm the full chain is served — a missing intermediate fails here exactly as it does for SMTP.
  3. Add this hostname to certificate expiry monitoring; it is the one nobody remembers.
  4. Until it is fixed, senders fall back to unencrypted delivery, which is quietly worse than it looks.

Related