Hosted MTA-STS

MTA-STS tells the servers that send you email to use TLS with a valid certificate. To use it you need a _mta-sts TXT record and an HTTPS server that serves the policy at https://mta-sts.<domain>/.well-known/mta-sts.txt.

With hosted MTA-STS, DMARC Examiner publishes and maintains both. You only create two CNAME records. If you are new to MTA-STS, start with What is MTA-STS.

Plan availability

Hosted MTA-STS is available from the Basic plan. On the Free plan, the Hosted records tab of the domain shows an upgrade button.

It does not count towards the hosted domain limit of the Enterprise plan.

Activate hosting

  1. Open the domain and go to the Hosted records tab.
  2. On the MTA-STS policy card, click Activate.

The domain must be verified and have MX records. Any member who can edit domains can activate it. A member with the viewer role sees the card but cannot activate it.

DMARC Examiner creates the policy as follows:

  • If you already publish an MTA-STS policy, it imports it. Its mode, MX hosts and max_age stay the same.
  • If you publish none, or it cannot be read, it creates one in testing mode with your current MX records. The card explains why the previous policy could not be imported.

Create the two CNAME records

The card shows the two records to create at your DNS provider:

Name Type Value
mta-sts.<domain> CNAME policies.dmarcexaminer.com
_mta-sts.<domain> CNAME <domain>.<token>.sts.dmarcexaminer.com

Copy the exact values from the card: the token is different for each domain.

DMARC Examiner checks the records every hour. Each record shows Detected or Not detected yet. When both point to DMARC Examiner, the status changes to Delegated and the policy starts working. The HTTPS certificate of mta-sts.<domain> is issued automatically.

If you already have a _mta-sts TXT record

A DNS name cannot have a TXT record and a CNAME record at the same time. Delete your _mta-sts TXT record before you create the CNAME. The card warns you when it detects your own TXT record.

If you do not create the records

DMARC Examiner sends a reminder after 3 days and another after 14. After 30 days without both CNAME records, it cancels the hosting and sends an email. You can activate it again at any time.

Statuses

Status Meaning
Waiting for delegation At least one of the two CNAME records is missing.
Delegated Both CNAME records point to DMARC Examiner and the policy works.
Delegation removed One of the CNAME records no longer points to DMARC Examiner. Senders cannot read the policy until you fix it.
Retiring The hosting is being retired. See the Stop hosting section.

Modes and max_age

Click Change mode to choose the mode and the max_age:

  • Testing — Senders report TLS failures but still deliver the mail. Always start here.
  • Enforce — Senders do not deliver the mail if they cannot use valid TLS to your MX hosts.
  • None — Senders forget the policy. It is used when you stop hosting.

The max_age is how long senders keep the policy, from 1 day to 1 year. The default is 7 days. Each change publishes a new policy ID, so senders download the policy again.

Only owners and admins can change the mode, apply MX changes and stop hosting. Other members see these buttons disabled.

When to switch to enforce

The card shows Ready for enforce when all three conditions are true:

  • The policy has been in testing mode for at least 14 days.
  • At least two senders sent TLS reports in those 14 days.
  • Those reports show no failures.

If a condition is missing, the card says which one. Hosting does not create the TLS-RPT record: publish it yourself from the DNS Records tab, as TLS Reports explains. Without it no reports arrive and the suggestion never shows.

Changes to your MX records

DMARC Examiner compares your MX records with the policy every hour:

  • In testing mode, it applies the changes automatically and records them in the history.
  • In enforce mode, it does not apply them automatically, because an MX host missing from the policy can make senders refuse mail. The card shows the new MX hosts and DMARC Examiner creates an alert. Review the list and click Apply MX changes.

Stop hosting

Click Stop hosting. DMARC Examiner publishes mode none for one max_age so that senders forget the policy. Then it deletes the TXT record and sends you an email. You can then delete the two CNAME records.

During the retirement you can click Activate again. The same CNAME records keep working.

Plan downgrade

If your organization moves to a plan without hosted MTA-STS, the policy is frozen for 14 days. It keeps working, but you cannot change it. The owners receive an email with the affected domains and the date.

If you move back to a plan with hosted MTA-STS within those 14 days, the policy is unfrozen. Otherwise, the retirement with mode none starts.

History

The card shows the latest changes to the policy: activation, import, mode and max_age changes, MX changes, freeze and retirement. Each change shows who made it, or Automatic if DMARC Examiner made it.

MSP organizations

An MSP account can activate, change the mode, apply MX changes and stop hosting the MTA-STS of several client domains at once. After an activation, it can download a CSV with the two CNAME records of each domain. See Bulk Operations.

Previous What is MTA-STS Next Helm chart for Kubernetes