MTA-STS has three parts that all must be right: the _mta-sts TXT record, a policy file served over HTTPS at https://mta-sts.yourdomain.com/.well-known/mta-sts.txt, and a valid TLS certificate on that host. A failure in any one silently drops enforcement.
The TXT record at _mta-sts.yourdomain.com must contain v=STSv1; id=…. The policy file must be reachable over HTTPS at the .well-known path, list your MX hosts, and set mode: enforce. The mta-sts subdomain must have a valid, non-expired certificate.
Use mode: testing plus TLS-RPT first; you’ll get reports of what would fail before you switch to enforce.
Confirm it exists:
$ dig TXT _mta-sts.yourdomain.com +shortCheck your MTA-STS record now
Open the free MTA-STS checker →Usually the policy file isn’t reachable over HTTPS, the certificate is invalid, or the id in the TXT record wasn’t updated after you changed the policy. All three must be consistent.
