MTA-STS & TLS-RPT
STARTTLS can be stripped by anyone in the path. MTA-STS closes that hole — if the record, the policy file and your MX records all agree.
DNS record
missing
Policy file
missing
Mode
—
TLS-RPT
missing
Errors
- No MTA-STS recordNothing at _mta-sts.github.com begins with v=STSv1. Without it senders never look for a policy, so STARTTLS stays strippable.
Warnings
- No TLS-RPT recordWithout _smtp._tls.github.com you get no reports of TLS failures, so a policy problem shows up as mail that quietly stops arriving. Publish this before switching MTA-STS to enforce.
MX coverage
Every host that accepts your mail has to match an mx: pattern in the policy. In enforce mode, one that doesn’t is mail that will not be delivered.
| Priority | Host | Covered by policy |
|---|---|---|
| 0 | github-com.mail.protection.outlook.com | no policy to compare |
Also check this domain’s DMARC & SPF, DKIM keys or the certificates its mail servers present.