sts-webpki-invalid
Your MTA-STS policy host certificate is not trusted
By Jose Pollman · Published
How it appears in a report
"result-type": "sts-webpki-invalid"What it means
Your policy file was served over HTTPS with a certificate that failed validation, so senders could not trust the policy and did not apply it.
Your mail server. This is your own receiving setup. The report describes senders failing to reach your MX, so the certificate, policy or DNS record at fault is yours to fix.
Worth being clear about the direction, because it is easy to get backwards: you publish TLS-RPT for your own domain, and senders report the failures they hit while delivering to you. So policy-domain and receiving-mx-hostname in your reports are yours, and sending-mta-ip belongs to whoever sent the report.
Why it happens
The mta-sts subdomain is a web host, and it is almost always the forgotten one: set up once, certificate issued, then left outside whatever monitoring covers the main site. It expires with nobody watching, and your MTA-STS protection quietly stops applying.
How to fix it
- Check the certificate on mta-sts.<your-domain> specifically, not on your main domain.
- Confirm the full chain is served — a missing intermediate fails here exactly as it does for SMTP.
- Add this hostname to certificate expiry monitoring; it is the one nobody remembers.
- Until it is fixed, senders fall back to unencrypted delivery, which is quietly worse than it looks.