The MTA-STS policy has a max_age below one day.

MTASTS_LOW_MAX_AGE · Severity: Warning

• WarningMTASTS_LOW_MAX_AGE

  The MTA-STS policy has a max_age below one day.

  Senders cache the policy for max_age seconds. A short lifetime leaves gaps in which an attacker can block the policy fetch; RFC 8461 suggests weeks.

  Recommendation: Use a max_age of at least 86400 seconds, typically one or more weeks.

Reported by

• Domain health check
• MTA-STS and TLS-RPT check

Available through the API

• Domain health check API
• MTA-STS and TLS-RPT check API

Related findings

• Error MTASTS_INVALID_POLICY The MTA-STS policy file is not valid.
• Error MTASTS_INVALID_RECORD The MTA-STS record has invalid syntax.
• Info MTASTS_MODE_NONE The MTA-STS policy is in mode none.
• Warning MTASTS_MODE_TESTING The MTA-STS policy is in testing mode.
• Error MTASTS_MULTIPLE_RECORDS More than one MTA-STS record is published.
• Error MTASTS_MX_NOT_COVERED An MX host is not covered by the enforced MTA-STS policy.

All findings