What is checked?
The check connects the _mta-sts TXT announcement to the HTTPS policy. The policy specifies a mode, permitted MX names and cache lifetime. It must be available directly at https://mta-sts.<domain>/.well-known/mta-sts.txt with a trusted HTTPS certificate.
Worked example
Synthetic example using a reserved domain and documentation addresses. Adapt the domain, addresses and services to your infrastructure before using it.
_mta-sts.example.test. TXT "v=STSv1; id=20260918"
version: STSv1
mode: testing
mx: mx.example.test
max_age: 86400The DNS announcement appears first, followed by the HTTPS file content. testing supports rollout; TLS-RPT can reveal transport problems. Update the id value when changing the policy.
Common mistake
Publishing only the TXT record is insufficient. A redirect at the HTTPS path or a missing backup MX pattern can make the policy unusable.
Recommended next step
First check the HTTPS file, certificate and every MX pattern. Publish the DNS announcement, review reports in testing mode and switch to enforce only with reliable evidence. Account for policies already cached by senders.
What the result does not prove
The HTTPS check examines the policy web server’s certificate, not every MX server’s SMTP certificate. Successful retrieval does not prove successful mail delivery.