In setting up SMTP MTA Strict Transport Security (RFC 8461) for my domain, I've noticed some contradictory advice and practice: although the maximum value for the
max_age policy value is around one year and the RFC states that "implementers SHOULD prefer policy "
max_age" values to be as long as is practical" to mitigate MITM attacks, most of the policies I've found in the wild use relatively short values, such as Gmail (one day), Outlook (one week), or the UK National Cyber Security Centre (two weeks). The longest value I've found in the wild is Soverin's, at approximately four months. The standard recommendation online seems to be "at least one or two weeks" and vague or no indication about a recommended value above that (e.g. Mailhardener, OnDMARC, NCSC), which seems short compared to the 1-2 years frequently used with HTTP Strict Transport Security.
My understanding is that as the policy is supposed to be refreshed on a regular basis, the
_mta-sts record is used to signal updates, and you can always manually override a policy as long as you retain control of the domain (including to explicitly disable MTA-STS), the only realistic risk of a long
max_age is that if you become unable to serve the policies over DNS/HTTPS for the long term, you can't disable MTA-STS. (But presumably at that point you have other problems, as it implies you've lost control over your domain? Indeed, the RFC explicitly says that the
none mode is there to allow recovery after compromise by an attacker publishing an unwanted policy with a long
The only failure mode worse than this I can imagine is if your SMTP TLS is broken or you need to update your
MX records, and a sending MTA doesn't follow the SHOULD recommendation to refresh the policy around once per day; then you could have deliverability issues until your old policy expires. But this involves a sender ignoring the RFC best practices and not even bothering to check a single DNS
TXT value for updates, even though they have to check the
MX regardless; in fact, it's unclear to me from the RFC whether not checking the
_mta-sts record when delivering mail is compliant, even if you don't proactively refresh policies at other times.
So if you're the kind of person to use a 1-2 year
max-age for your HSTS headers and add your domain to the preload list, are there any practical downsides to using an MTA-STS
max_age value in the months to a year range?