In setting up SMTP MTA Strict Transport Security (RFC 8461) for my domain, I've noticed some contradictory advice and practice: although the maximum value for the max_age policy value is around one year and the RFC states that "implementers SHOULD prefer policy "max_age" values to be as long as is practical" to mitigate MITM attacks, most of the policies I've found in the wild use relatively short values, such as Gmail (one day), Outlook (one week), or the UK National Cyber Security Centre (two weeks). The longest value I've found in the wild is Soverin's, at approximately four months. The standard recommendation online seems to be "at least one or two weeks" and vague or no indication about a recommended value above that (e.g. Mailhardener, OnDMARC, NCSC), which seems short compared to the 1-2 years frequently used with HTTP Strict Transport Security.
My understanding is that as the policy is supposed to be refreshed on a regular basis, the _mta-sts record is used to signal updates, and you can always manually override a policy as long as you retain control of the domain (including to explicitly disable MTA-STS), the only realistic risk of a long max_age is that if you become unable to serve the policies over DNS/HTTPS for the long term, you can't disable MTA-STS. (But presumably at that point you have other problems, as it implies you've lost control over your domain? Indeed, the RFC explicitly says that the none mode is there to allow recovery after compromise by an attacker publishing an unwanted policy with a long max_age.)
The only failure mode worse than this I can imagine is if your SMTP TLS is broken or you need to update your MX records, and a sending MTA doesn't follow the SHOULD recommendation to refresh the policy around once per day; then you could have deliverability issues until your old policy expires. But this involves a sender ignoring the RFC best practices and not even bothering to check a single DNS TXT value for updates, even though they have to check the MX regardless; in fact, it's unclear to me from the RFC whether not checking the _mta-sts record when delivering mail is compliant, even if you don't proactively refresh policies at other times.
So if you're the kind of person to use a 1-2 year max-age for your HSTS headers and add your domain to the preload list, are there any practical downsides to using an MTA-STS max_age value in the months to a year range?
