MTA-STS and TLS-RPT Checker

Set up MTA-STS in four steps

You need two DNS records and one small text file on a web server. Replace example.com with your domain and the mx lines with your own MX hosts.

1. 1. Publish the policy file

   Serve it at exactly https://mta-sts.example.com/.well-known/mta-sts.txt with HTTP 200 and a text/plain content type. The certificate must be valid for mta-sts.example.com. Senders must not follow redirects, so a redirect to www or to another host means no policy.

   version: STSv1
   mode: testing
   mx: mail.example.com
   mx: *.mail.example.net
   max_age: 86400

   One mx line per host or pattern. *.mail.example.net covers a.mail.example.net but not a.b.mail.example.net: the wildcard is one label.

2. 2. Publish the _mta-sts TXT record

   _mta-sts.example.com.  TXT  "v=STSv1; id=20261030T1200"

   The id is 1 to 32 letters and digits. Change it every time you change the policy file, and update the file first: RFC 8461 section 8.1 warns that the other order lets senders cache the old policy under the new id.

3. 3. Turn on TLS reporting

   _smtp._tls.example.com.  TXT  "v=TLSRPTv1; rua=mailto:[email protected]"

   rua takes mailto: or https: addresses, comma separated. Reports are JSON and summarise successful and failed TLS sessions per sending organisation.

4. 4. Move from testing to enforce

   In testing, senders that support TLS-RPT report failures and deliver anyway. In enforce, RFC 8461 says they “MUST NOT deliver the message to hosts that fail MX matching or certificate validation or that do not support STARTTLS.” Switch once the reports are clean, then raise max_age. The RFC expects “weeks or greater”, and caps it at 31557600 seconds. Change the id again so senders fetch the new file.

If your mail provider hosts the policy

RFC 8461 section 8.2 allows delegation: point _mta-sts at the provider with a CNAME, and serve mta-sts.example.com from the provider or a reverse proxy. The certificate still has to be valid for mta-sts.example.com, not for the provider's host name.

Turning it off safely

Do not just delete the records. Senders keep a cached policy for up to max_age. Publish mode: none with a short max_age such as one day, change the id, wait until every older policy has expired, and only then remove the TXT record and the file (RFC 8461 section 8.3).

Sources: RFC 8461 (MTA-STS), RFC 8460 (SMTP TLS Reporting). Checked 30 October 2026.