[ Transport security ]
Serverless MTA-STS hosting: assess availability and change control
Assess a documented Azure Static Web Apps policy-host route for exact path delivery, custom-domain TLS, routing behavior and cache-aware releases.
By the EmailAuth research team · 8 min read
[ Key points ]
- A default cloud URL is not the required custom MTA-STS endpoint.
- Verify policy bytes and routing behavior, not just HTTP availability.
- Coordinate HTTPS releases and discovery updates while retaining policy-cache history.
[ Takeaway ]
Treat the serverless host as a managed public policy service with verified artifacts, hostname binding, semantic monitoring and an accountable release process.
[ By role ]
What this means for you
Choose your role for practical next steps.
IT / Mail Admin
Validate the exact policy endpoint
A successful homepage request may conceal a missing or rewritten policy file.
Next steps
- Inspect the build output for the exact well-known path.
- Fetch the custom hostname without following redirects.
- Compare policy content and MX patterns with approved intent.
CISO / SecOps
Review the public route narrowly
Authentication rules and fallback behavior can violate the policy-fetch contract.
Next steps
- Separate policy-host and SMTP certificate checks.
- Review anonymous access scope and domain validation method.
- Track cached-policy behavior during failures and retirement.
Founder / Non-technical
Assign hosting and mail-policy owners
Serverless hosting still depends on deployment and certificate lifecycle management.
Next steps
- Name release, alert and recovery owners.
- Require per-domain content checks.
- Avoid treating platform availability as complete mail assurance.
[ FAQs ]
Frequently asked questions
Can I publish only at the autogenerated Static Web Apps URL?
No. The required policy-domain hostname and well-known path must serve the document with valid HTTPS. The provider hostname is a deployment target, not a substitute policy URL.
What build settings determine which files are deployed?
Azure documents app_location and output_location, with different app_location meaning when skip_app_build is enabled. Verify the actual output contains the policy at the intended root-relative path.
Can a 200 response still be wrong?
Yes. Navigation fallback can return HTML instead of the policy. Validate status, content type, exact body and parsed policy rather than status alone.
Can the policy path require login or redirect?
It must be retrievable under the MTA-STS HTTPS contract. A login dependency or redirect is not a valid replacement for the direct successful policy response; senders must not follow redirects.
Do all Static Web Apps variants use CNAME-only validation?
No. The current custom-domain overview requires TXT-token validation for new Enterprise Grade Edge custom domains. Confirm the actual product variant and issued values.
What does automatic certificate renewal depend on?
The cited Microsoft overview states that the custom domain must resolve to the static web app over the public Internet. Retain this operational dependency and verify the actual certificate.
Does an HTTPS outage cancel already cached enforcement?
No. A sender with a valid unexpired cached policy must still apply it when a live policy cannot be obtained. No-cache senders follow the specification’s distinct fetch-failure behavior.
Should discovery id change before the new deployment is verified?
RFC 8461 recommends publishing the new HTTPS body before updating the discovery record. Verify the deployed bytes first so a new signal does not lead senders to old content.
[ Sources ]
Sources
- RFC 8461: SMTP MTA Strict Transport Security
Sections §3. Policy Discovery · §3.2 MTA-STS Policies · §3.3 HTTPS Policy Fetching · §3.4 Policy Selection for Smart Hosts and Subdomains · §4.1 MX Host Validation · §4.2 Recipient MTA Certificate Validation · §5. Policy Application · §8.1 Policy Updates · §8.2 Policy Delegation · §8.3 Removing MTA-STS · §8.4 Preserving MX Candidate Traversal
- RFC 8460: SMTP TLS Reporting
Sections §3. Reporting Policy · §4. Reporting Schema · §5. Report Delivery
- Microsoft: Configure Azure Static Web Apps
Sections Routes · Authorization · Navigation fallback · Custom MIME types
- Microsoft: Custom domains with external providers
Sections Get your static web app URL · Create a CNAME record · Enter the domain
- Microsoft: Static Web Apps build configuration
Sections Build configuration settings · Build configuration · Skip building front-end app
- Microsoft: Custom domains with Azure Static Web Apps
Sections Custom domains with Azure Static Web Apps · Domain validation · Certificate renewal
[ Glossary ]
Glossary
- Policy host
- The required HTTPS hostname serving the MTA-STS policy for a policy domain.
- Navigation fallback
- A hosting feature that can serve a fallback page when a requested resource is not available.
- Deployment artifact
- The reviewed static output actually supplied to the hosting deployment process.
- Semantic check
- A proposed check that the served policy means what the approved route inventory requires, beyond simple uptime.
Enterprise provenance
Why top financial institutions and governments retired their email security dashboards.
Traditional email authentication platforms sell you a dashboard and ask your engineers to do the labour. In high-stakes environments, manual oversight means delayed enforcement, configuration drift and unmonitored shadow domains.
EmailAuth is the agentic email provenance platform. Our agents enforce p=reject, keep third-party senders aligned and move your domains to full RFC 9989 compliance, the new DMARC standard,, with human-in-the-loop auditability.
SaaS · Dedicated tenancy · Air-gapped on-prem · BYOK encryption