Self-hosted server

You can serve the MTA-STS policy from any web server with HTTPS. You need four things: a DNS name, a certificate, the policy file and two TXT records.

If you prefer not to maintain any of this, use Hosted MTA-STS. If you run Kubernetes, the Helm chart does it for you.

1. Point `mta-sts.<domain>` to your server

Create an A, AAAA or CNAME record for mta-sts.example.com that reaches your web server.

2. Get a certificate

The certificate must come from a publicly trusted authority and cover mta-sts.example.com. With Let's Encrypt:

sudo certbot certonly --nginx -d mta-sts.example.com

With an expired certificate, senders cannot download the policy. They keep their cached copy and, when it expires, they stop applying MTA-STS: your mail loses the protection and nothing warns you. Renew the certificate automatically.

3. Publish the policy file

Create /var/www/mta-sts/mta-sts.txt:

version: STSv1
mode: testing
mx: aspmx.l.google.com
mx: *.aspmx.l.google.com
max_age: 604800

List all your MX servers in mx. On Microsoft 365 it is *.mail.protection.outlook.com. The RFC separates lines with CRLF; most senders also accept LF.

Serve it at https://mta-sts.example.com/.well-known/mta-sts.txt. With nginx:

server {
    listen 443 ssl;
    server_name mta-sts.example.com;

    ssl_certificate     /etc/letsencrypt/live/mta-sts.example.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/mta-sts.example.com/privkey.pem;

    location = /.well-known/mta-sts.txt {
        alias /var/www/mta-sts/mta-sts.txt;
        default_type text/plain;
    }

    location / {
        return 404;
    }
}

The answer must be a direct 200 with Content-Type: text/plain. Senders do not follow redirects when they download the policy.

4. Publish the TXT records

Name	Type	Value
`_mta-sts.example.com`	TXT	`v=STSv1; id=20261115093000`
`_smtp._tls.example.com`	TXT	`v=TLSRPTv1; rua=mailto:<your-reporting-address>`

The id is a string of 1 to 32 letters or digits. A date and time such as 20261115093000 is easy to maintain.

The second record is TLS-RPT. Copy your reporting address from the DNS Records tab of the domain in DMARC Examiner, under TLS-RPT record.

Change the policy

Edit the policy file.
Change the id of the _mta-sts TXT record.

Do it in this order. If you change the id first, a sender can download the old policy with the new id and keep it for max_age.

If you forget to change the id, senders keep their cached copy until it expires.

Switch to enforce and withdraw

Follow the steps in What is MTA-STS: start in testing, review the TLS reports, switch to enforce and, to withdraw, publish mode: none for a whole max_age before you delete the records.

Common errors

Symptom on the MTA-STS card	Usual cause
Not configured	The `_mta-sts` TXT record is missing or does not start with `v=STSv1`.
Policy not reachable	The certificate does not cover `mta-sts.<domain>`, it expired, or the URL answers with a redirect or an error.
Invalid policy	The file has no `version: STSv1` or no `mode`.

Check

dig +short TXT _mta-sts.example.com
curl -sv https://mta-sts.example.com/.well-known/mta-sts.txt

The email compliance checker checks the TXT record, the file and its certificate in one go.