Guide

How to set up MTA-STS and TLS-RPT

Stop attackers stripping TLS from email sent to your domain. Publish an MTA-STS policy in testing mode, collect TLS-RPT reports, then enforce.

Mail servers encrypt with STARTTLS when they can, and fall back to plaintext when they cannot. An attacker who can interfere with the connection can make it "cannot". MTA-STS (RFC 8461) closes that gap, and TLS-RPT (RFC 8460) tells you when it bites.

1. Publish TLS-RPT first

_smtp._tls.example.com.  TXT  "v=TLSRPTv1; rua=mailto:tls-reports@example.com"

From now on, senders such as Google and Microsoft send a daily report of TLS successes and failures delivering to you. It costs nothing and is the only way you will learn that a policy is blocking mail.

2. Host the policy file

Serve this as text/plain at https://mta-sts.example.com/.well-known/mta-sts.txt, with a valid certificate for mta-sts.example.com:

version: STSv1
mode: testing
mx: mx1.example.com
mx: *.mail.example.net
max_age: 604800
  • One mx: line per MX host, or a wildcard covering one label. If your mail is hosted, use the names your provider gives you.
  • max_age is how long senders cache the policy, in seconds, up to a year. A week is a sensible start.
  • The server must not redirect: senders do not follow redirects.

3. Publish the DNS record

_mta-sts.example.com.  TXT  "v=STSv1; id=20261028T000000"

The id is how senders know the policy changed. Change it every time you edit the policy file.

4. Read the reports, then enforce

After a couple of weeks of clean TLS-RPT reports in testing mode, change mode: testing to mode: enforce and update the id. Senders that support MTA-STS will now refuse to deliver over a connection without valid TLS.

Keeping it working

  • When you change mail provider or add an MX host, update the policy before the MX records.
  • Certificate expiry on mta-sts. stops senders refreshing the policy; on an MX host, it stops delivery. Monitor both.
  • If your DNS is DNSSEC-signed, DANE offers the same protection without depending on certificate authorities.

Check your MTA-STS policy

More guides

  • SPF, DKIM and DMARC explained How the three email authentication standards fit together, what each one proves, and which you need to stop people sending email as your domain.
  • How to create an SPF record Build a correct SPF record step by step: find every service that sends as you, add the right includes, pick between -all and ~all, and avoid the common mistakes.
  • Fixing "SPF PermError: too many DNS lookups" Why SPF stops at 10 DNS lookups, how the count is worked out across nested includes, and four ways to bring a record back under the limit.
  • Moving DMARC from p=none to p=reject A safe rollout plan for DMARC: start monitoring, read the aggregate reports, fix legitimate senders, and step up to quarantine and reject without losing mail.
  • What DKIM is and how to set it up How DKIM signatures work, where the public key lives in DNS, what a selector is, and how to turn DKIM on for the services that send your mail.
  • How to secure a domain that sends no email Parked and website-only domains are easy targets for spoofing. Three DNS records — null MX, a deny-all SPF record and DMARC reject — lock them down.
  • DMARCbis: what changed in DMARC in 2026 (RFC 9989) DMARC was revised in May 2026 as RFC 9989, 9990 and 9991. What is new, what was removed — pct, rf and ri — and what to change in your record.
  • DKIM2: the next version of DKIM, explained DKIM2 is an IETF draft that chains signatures across every hop, records how intermediaries change a message, and stops DKIM replay. What it does and where it stands.