What MTA-STS protects
Mail between servers is encrypted with STARTTLS — opportunistically. An attacker on the path can strip the encryption offer or present a fake certificate, and the sender will usually fall back to plain text. MTA-STS (RFC 8461) lets you publish a policy saying: deliver to these MX hosts only, only over TLS with a valid certificate. It protects mail coming to you; it doesn't affect deliverability of mail you send.
The three pieces
1. A TXT record announcing the policy. Change id whenever you change the policy.
- Type
- TXT
- Host / name
- _mta-sts
- Value
- v=STSv1; id=20261028
2. A policy file at exactly https://mta-sts.yourdomain/.well-known/mta-sts.txt, served as text/plain with a valid certificate for mta-sts.yourdomain:
| Line | Meaning |
|---|---|
version: STSv1 | Required |
mode: testing | Report problems but still deliver. Start here. |
mode: enforce | Refuse to deliver without valid TLS to a listed host. |
mx: *.mail.protection.outlook.com | One line per allowed MX host or wildcard (one label). |
max_age: 604800 | Seconds senders cache the policy (max 31557600). |
3. TLS-RPT, so you get daily reports about failures
- Type
- TXT
- Host / name
- _smtp._tls
- Value
- v=TLSRPTv1; rua=mailto:tls-reports@example.com
Common mistakes
- Policy file returns a redirect — RFC 8461 forbids following redirects.
- Certificate on
mta-sts.yourdomainmissing or expired. - An MX host not listed in the policy (often after changing providers). In enforce mode, senders will refuse to deliver there.
- Changing the policy without changing
id, so senders keep the old one for up to max_age.
Why this check uses our server
The DNS lookups run in your browser. The policy file is on your web server, which doesn't allow other sites to read it, so our server fetches that one URL (built from your domain, never from user input) and passes it back unchanged.
Questions
Does MTA-STS improve deliverability?
Not of the mail you send. It secures mail sent to you. It's a security improvement that some audits and agencies look for, and it's optional under the Gmail, Yahoo and Outlook sender rules.
Should I start with testing or enforce?
Testing, with TLS-RPT enabled. Read the reports for a couple of weeks; when they show no failures, switch to enforce and change the id in the TXT record.
Can I host the policy file on a CDN or GitHub Pages?
Yes, as long as it's served at https://mta-sts.yourdomain/.well-known/mta-sts.txt with a valid certificate and no redirect.
What's DANE and do I need it too?
DANE achieves something similar using DNSSEC instead of a web-hosted policy. Microsoft 365 and some providers support it. MTA-STS is easier to deploy if your DNS isn't signed.
Sources
Last reviewed: