What is MTA-STS?
MTA-STS (Mail Transfer Agent Strict Transport Security, RFC 8461) declares that mail to your domain may only be delivered over encrypted, certificate-verified connections. Without MTA-STS, STARTTLS between mail servers is opportunistic: the sending server tries encryption but falls back to plain text if it fails. An attacker on the network path can strip the STARTTLS announcement and read the mail unencrypted.
With an MTA-STS policy in enforce mode the sending server refuses delivery when TLS fails or the MX certificate does not match the host name. Google, Microsoft and other large providers honour MTA-STS when sending. It is the pragmatic route to mandatory transport encryption without DNSSEC, which DANE would require.
The two parts: DNS record and policy file
MTA-STS consists of a TXT record and a text file. The record at _mta-sts.example.com only signals that a policy exists and carries an id that must change whenever the policy changes. The policy itself lives at https://mta-sts.example.com/.well-known/mta-sts.txt and must be served with a valid certificate for exactly that host name.
_mta-sts.example.com. IN TXT "v=STSv1; id=20250901T120000"
# https://mta-sts.example.com/.well-known/mta-sts.txt
version: STSv1
mode: enforce
mx: mail.example.com
mx: *.mx.example.com
max_age: 604800How to read the result
The checker shows the record, the policy and the comparison with the MX records:
- Mode enforce: senders must use TLS and verify the certificate. The goal.
- Mode testing: senders report failures via TLS-RPT but still deliver. The right start for the first weeks.
- Mode none: a policy exists but has no effect. Only useful to retire a policy in an orderly way.
- max_age: how long senders cache the policy, in seconds. At least one day (86400), one to four weeks recommended.
- MX covered: every MX host of the domain must match an mx entry in the policy, either exactly or via a wildcard pattern like *.mx.example.com. If an MX is missing from the policy, senders in enforce mode refuse delivery to that server.
- TLS-RPT: without a reporting address you never learn whether senders have trouble with your policy.
Common mistakes
- Policy file unreachable: the host mta-sts.example.com has no A record, no certificate, or the certificate only covers example.com.
- Wrong content type or HTML instead of text: the file must be served as text/plain, without a redirect to a login or error page.
- id not changed: after a policy change senders keep the old version until max_age expires.
- MX changed, policy not: after switching mail providers the mx entries no longer match. In enforce mode, mail from Google and Microsoft stops arriving.
- Started with enforce right away: without a testing phase and TLS-RPT, configuration errors stay hidden until mail goes missing.
Rollout in three steps
First create the TLS-RPT record, then publish the policy in testing mode with a short max_age and read reports for one or two weeks. If no failures show up, switch to enforce and raise max_age to one or more weeks. Whenever you change mail providers, update the policy first, then the MX records.
Monitor MTA-STS continuously
An MTA-STS policy in enforce mode is a promise to every sender. If the certificate of the policy site expires or someone changes the MX records without the policy, mail gets stuck. DomainWarn checks the record, the policy file and the MX comparison of all client domains regularly and reports deviations before senders refuse delivery.
Frequently asked questions
- Do I need MTA-STS with Microsoft 365 or Google Workspace?
- Both providers support MTA-STS for inbound mail but do not set it up for your domain automatically. You must publish the DNS record and the policy file yourself. The mx entries are in the provider's documentation.
- What is the difference between MTA-STS and DANE?
- Both enforce TLS on delivery. DANE publishes certificate information in DNS and requires DNSSEC. MTA-STS uses HTTPS and normal certificate validation and works without DNSSEC. Both can run in parallel.
- Where do I host the policy file?
- On any web server or CDN reachable at mta-sts.example.com with a valid certificate. A static host such as GitHub Pages, Cloudflare Pages or a small Nginx is enough. The file rarely changes.