Question 1

What is the difference between testing and enforce mode?

Accepted Answer

testing tells senders to report policy failures without refusing delivery. enforce means non-compliant MX paths should not receive mail. Use testing until this checker shows matching MX hosts and a reachable policy, then raise max_age and switch to enforce.

Question 2

What should the max_age value be?

Accepted Answer

RFC 8461 allows up to 31557600 seconds (~1 year). Operationally, many domains use one to several weeks so senders cache the policy but still refresh. Extremely short max_age increases refresh load and attack surface at refresh time.

Question 3

Can MTA-STS break my incoming email?

Accepted Answer

Yes - if you set mode=enforce while MX certificates or hostnames do not match the policy, compliant senders may defer or fail delivery. Validate TXT, HTTPS policy, and MX matches here before enforce.

MTA-STS Checker & Policy Validator