feat: add mta-sts posture checks

docs/milestones.md

@@ -214,12 +214,12 @@ Exit criteria:
 
 ## Milestone 13: Email Security Posture (Beyond DMARC)
 
-Status: Backlog
+Status: In Progress
 
 Goal: turn DMARQ into a broader email authentication posture console (still privacy-first and self-hostable).
 
 Planned:
-- MTA-STS posture: DNS record evaluation + policy fetch validation (plus optional helper tooling).
+- MTA-STS posture: delivered cached `_mta-sts` TXT checks, HTTPS policy validation, domain-detail evidence, and operator guidance for missing, invalid, or non-enforcing policies. Optional helper tooling remains a future enhancement.
 - TLS reporting posture: ingest and summarize TLS report data (where available) with actionable failure grouping.
 - BIMI posture: record validation + readiness checks + operator guidance.
 - Extended DNS checks that support the posture surface (e.g., MX/BIMI; optional DANE/TLSA where relevant).

docs/user_guide/domains.md

@@ -59,9 +59,18 @@ DMARQ provides a health check feature for each domain:
    - SPF record validation
    - DKIM selector verification
    - DMARC record syntax check
+   - MTA-STS TXT and HTTPS policy validation
    - MX record confirmation
    - BIMI record validation (if applicable)
 
+### MTA-STS Posture
+
+The domain detail page checks `_mta-sts.<domain>` and fetches the policy from `https://mta-sts.<domain>/.well-known/mta-sts.txt`.
+
+DMARQ marks the check healthy when the TXT record contains `v=STSv1` with an `id`, the HTTPS policy is reachable, and the policy includes `version`, `mode`, `mx`, and `max_age`. Findings include the DNS record, policy URL, mode, MX patterns, and actionable guidance for missing records, fetch failures, invalid policies, or non-enforcing `testing`/`none` modes.
+
+MTA-STS posture uses the same cached DNS refresh behavior as the existing DNS health checks. Use the DNS refresh action when you publish or update a policy and need DMARQ to re-check immediately.
+
 ## Domain Groups
 
 If you manage multiple domains, you can organize them into groups:
@@ -86,4 +95,4 @@ To remove a domain from DMARQ:
 4. Select **Remove Domain**
 5. Confirm the removal
 
-Note that removing a domain will delete all stored DMARC reports for that domain.
+Note that removing a domain will delete all stored DMARC reports for that domain.