What is MTA-STS

MTA-STS (RFC 8461) makes the mail you receive travel encrypted and reach your own mail servers, not someone else's.

Between servers, SMTP encrypts with STARTTLS only if both sides offer it. If an attacker on the network strips the STARTTLS offer, the server writing to you delivers the message in clear text. It does not check the certificate of your server either, so it does not notice a fake server. MTA-STS closes both gaps: your domain publishes which servers receive its mail and requires TLS with a valid certificate.

What it protects and what it does not

  • It protects the mail that others send to your domain. The servers that write to you apply it, such as Gmail and Microsoft 365.
  • It does not change the mail you send. For that, the MTA-STS policy of the recipient domain applies.
  • It does not replace DMARC, SPF or DKIM. They authenticate the sender. MTA-STS protects the transport to your servers.

How it works

MTA-STS has two parts:

Part Where Example
TXT record _mta-sts.<domain> v=STSv1; id=20261115093000
Policy file https://mta-sts.<domain>/.well-known/mta-sts.txt see below 
version: STSv1
mode: testing
mx: aspmx.l.google.com
mx: *.aspmx.l.google.com
max_age: 604800

When a server is about to deliver a message to you:

  1. It looks up the _mta-sts.<domain> TXT record.
  2. If it has no cached policy, or the id changed, it downloads the file over HTTPS. The certificate of mta-sts.<domain> must be valid.
  3. It keeps the policy for max_age seconds.
  4. It delivers only to the MX servers that match an mx line, over TLS and with a valid certificate for their name.

Policy fields

Field Values
mode testing: reports failures and delivers anyway. enforce: does not deliver if TLS fails or the MX does not match. none: withdraws the policy.
mx One MX server per line. *. replaces only the first label: *.aspmx.l.google.com matches alt1.aspmx.l.google.com.
max_age Seconds that the sender keeps the policy. At most 31557600 (one year).

The id of the TXT record must change every time the policy changes. If it does not, senders keep their cached copy until it expires.

MTA-STS and TLS-RPT

TLS-RPT (RFC 8460) is the _smtp._tls.<domain> TXT record. With it, senders send you a daily report with the TLS connections they opened to your servers and the failures they found.

Always publish both. In testing mode, the TLS reports are the only way to know whether enforce would block mail. See TLS Reports (TLS-RPT).

How to roll it out without losing mail

  1. Start in testing with TLS-RPT published.
  2. Review the TLS reports for one or two weeks. They must come from several senders and show no failures.
  3. Switch to enforce.
  4. If you change your mail provider, add the new MX hosts to the policy before you change the MX records. Senders keep the old list for max_age.
  5. To withdraw it, publish mode: none and keep it for a whole max_age. Then delete the records. If you delete them earlier, senders keep applying their cached copy.

Your MX servers need a valid certificate for their name. Google Workspace and Microsoft 365 already have one. If you run your own mail server, check it before you switch to enforce.

Three ways to publish it

Hosted by DMARC Examiner Helm chart Self-hosted server
What you do Create 2 CNAME records Install the chart in your cluster Serve the file and publish the TXT
HTTPS certificate We issue it cert-manager in your cluster You manage it
Policy id Automatic Automatic You change it on every change
TLS-RPT record You create it (shown in the DNS Records tab) The chart publishes it You publish it
MX changes We detect them every hour You edit values.yaml You edit them
Enforce suggestion Yes, from your TLS reports No No
Plan From Basic All (open source, MIT license) All

All three work with the MTA-STS card and the TLS reports of DMARC Examiner.

How to check it

  • In DMARC Examiner: the MTA-STS card in the Overview of each domain shows the published mode and warns you if the policy cannot be downloaded or is not valid.
  • Without an account: the email compliance checker checks the TXT record, the policy file and its certificate.
  • From the terminal:
dig +short TXT _mta-sts.example.com
curl -s https://mta-sts.example.com/.well-known/mta-sts.txt
Previous Saved Filters (My Reports) Next Hosted MTA-STS