Testing and enforce use the same MTA-STS policy checks but attach different delivery consequences. Testing is an observation stage. Enforce tells supporting senders not to deliver to MX hosts that fail the policy's host, STARTTLS or certificate checks. Neither mode replaces SPF, DKIM or DMARC.
Establish what testing can reveal
References: RFC 8461 §5, RFC 8460 §3.
Publish a valid testing policy that lists the intended receiving MX hosts, and enable TLS-RPT with an owned reporting destination. Senders implementing both mechanisms can report policy failures while still delivering as though no MTA-STS validation failure occurred. Successful inbox delivery in testing therefore does not prove that the same route will work in enforce.
Record the current MX set, certificate names, expiration dates, supported TLS configuration and fallback routes. Inspect each candidate host, including higher-preference-number backups that may receive little normal traffic. Reports describe participating senders' observations, not every message and not an exhaustive internet-wide health scan.
Resolve failures by their actual cause
References: RFC 8461 §3.3, RFC 8461 §4.1, RFC 8461 §4.2.
An MX-pattern mismatch calls for checking the intended routing inventory and policy. A certificate-name failure calls for checking the exact MX hostname against its presented certificate. A policy-fetch error belongs to the HTTPS host. Do not respond to all three by broadening the wildcard or turning off authentication elsewhere.
For each issue, preserve reporter, period, affected host and evidence before making the smallest approved change. Confirm the repair with an explicit probe and later reporting where available. Lack of new reports alone is not proof of repair, particularly for low-volume or intermittently used backup routes.
Work through an enforce rehearsal
References: RFC 8461 §5, RFC 8461 §5.1.
Use a synthetic domain whose policy permits mx1.example.net and mx2.example.net. Give mx1 valid STARTTLS and a matching trusted certificate; configure the lab's mx2 to present an unrelated certificate. In testing, the second route represents a reportable policy failure but MTA-STS does not require withholding delivery. In enforce, a supporting sender must not deliver to that failing candidate and may try another candidate.
Repeat with both candidates invalid and inspect the sender queue and retry logs. RFC 8461 recommends treating these failures as transient and requires checking for an updated policy before permanently failing delivery. This is a reproducible lab procedure; no live MTA execution or queue observation was performed for this article.
Define a promotion and reversal decision
References: RFC 8461 §8.1, RFC 8461 §8.3.
Promote only with owned evidence for all legitimate routes, a functioning reporting path, a documented support escalation and a tested policy-edit workflow. Publish the HTTPS body before changing the DNS id. Account for both DNS caching and the previously published policy max_age. A new testing policy does not instantly replace every cached enforce policy, so restoring compliant service may be the fastest recovery action.
Retained historical evidence and remaining scope
The following is the retained 7 November 2026 lab record, inspected but not rerun as a network experiment for this review. New offline fixture execution is recorded separately.
The executed loopback trace queried _mta-sts.example.test TXT over UDP and received v=STSv1; id=A1 with TTL 300. A separate MX query returned mx.old.example.test. HTTPS then returned a 200 policy body in testing mode, and an SMTP EHLO advertised STARTTLS. The first handshake succeeded with TLS 1.3 and a certificate trusted through the disposable lab CA. Replacing the SMTP certificate with one for wrong.example.test produced a hostname-verification failure. The restricted mode-decision fixture allowed the testing case and withheld the enforce candidate. No email was transmitted, and no actual MTA queue was exercised. This proves the controlled DNS, policy-fetch and TLS boundary, while production route coverage and sender implementation testing remain pending.