MTA-STS failure

Hi @ MP-9510 

Welcome to our forum!

Please kindly understand that the Outlook tag here we mainly focus on general issues about Outlook desktop client.  Looks like your issue is more related to Microsoft Purview. To better solve your problem, I will add Microsoft Purview tag for you.  

Thanks for your support and understanding! 

@MP-9510 Thanks for using Microsoft Q&A forum and posting your query.

It sounds like you’re encountering an issue where Microsoft’s servers are unable to fetch your MTA-STS policy. Here are a few steps you can take to troubleshoot and resolve this problem:

Check Policy URL and DNS Configuration:

• Ensure that your MTA-STS policy is hosted at the correct URL: https://mta-sts.<your-domain>/.well-known/mta-sts.txt.
• Verify that your DNS TXT record for _mta-sts.<your-domain> is correctly configured with the appropriate policy ID.

Policy Validity and Accessibility:

• Double-check that your MTA-STS policy file is accessible over HTTPS and that there are no SSL/TLS certificate issues.
• Use tools like curl or online validators to confirm that the policy file can be fetched without errors.

Policy Content:

• Ensure that the policy file is correctly formatted and adheres to the MTA-STS specification. The policy should look something like this:

    version: STSv1
    mode: enforce
    mx: <your-mail-server>
    max_age: 86400
    
  

Microsoft-Specific Considerations:

• According to Microsoft, their outbound MTA-STS implementation respects the recipient domain’s policy1. If there’s an issue with the policy fetch, it could be due to a temporary network issue or a misconfiguration on the recipient’s side.
• Make sure that your policy is not in “testing” mode if you want it to be enforced.

Logs and Reports:

• Review your server logs for any errors related to MTA-STS policy fetch attempts.
• Check the detailed reports from your DMARC provider for any additional clues.

If you’ve verified all the above and the issue persists, please do let us know

Dear @phemanth

Thank you for your reply. I checked everything you mentioned, but did not find anything which might cause this problem.

My policy is: valid, enforcing, can be accessed, and is used by other mailservers, including Gmail and Yahoo.

Can you think of a reason why this problem only occurs with incoming mail sent from Microsoft?

@MP-9510

It’s great to hear that you’ve thoroughly checked your MTA-STS policy and confirmed its validity and accessibility. Given that other mail servers like Gmail and Yahoo are successfully using your policy, the issue with Microsoft servers might be due to a few specific factors:

1. Temporary Network Issues

• Intermittent Connectivity: There could be temporary network issues or intermittent connectivity problems between Microsoft’s servers and your MTA-STS policy URL. These issues might not affect other providers.

2. Microsoft-Specific Implementation

• Strict Validation: Microsoft’s implementation of MTA-STS might have stricter validation checks compared to other providers. This could include more rigorous checks on SSL/TLS certificates or DNS configurations.

3. Caching Issues

• Policy Caching: Microsoft servers might be caching an outdated version of your MTA-STS policy. Ensure that the id in your DNS TXT record is updated whenever you make changes to the policy to force a re-fetch.

4. Certificate Chain Issues

• Certificate Validation: Ensure that the SSL/TLS certificate used for your MTA-STS policy URL is correctly chained to a trusted root Certificate Authority. Any issues in the certificate chain might cause Microsoft’s servers to reject the policy.

5. Firewall or Security Settings

• Blocking Traffic: Check if there are any firewall or security settings that might be blocking traffic from Microsoft’s servers to your MTA-STS policy URL.

6. Detailed Logs and Reports

• Review Logs: Examine detailed logs and reports from your DMARC provider and your own server logs for any specific error messages or patterns that might provide more insight into the issue.

If these steps don’t resolve the issue, please do let us know

Dear @phemanth I would like to contact Microsoft and send them my domain name and MTA-STS link, so they can check the factors you mentioned.

What is the best way to contact Microsoft for this purpose?