Three parts, one policy
MTA-STS consists of a TXT record at _mta-sts.your-domain.com that only carries a version and an id, and a text file served at https://mta-sts.your-domain.com/.well-known/mta-sts.txt. The file holds mode, allowed MX hosts and lifetime. Whenever the file changes, the DNS record needs a new id, otherwise sending servers keep using their old copy. The generator derives the id from the current timestamp.
testing before enforce
In testing mode sending servers evaluate the policy but still deliver on violations and report them via TLS-RPT. Only enforce rejects connections that offer no valid TLS or go to an unlisted MX. Start with testing and a short max_age, read the TLS-RPT reports for two weeks, then switch to enforce with a max_age of at least one week.
Listing the MX hosts correctly
The policy lists the host names of the MX records, not the domain itself. For Microsoft 365 that is *.mail.protection.outlook.com, for Google Workspace smtp.google.com, for your own servers their host names. A wildcard such as *.mail.protection.outlook.com covers exactly one label. Every listed host needs a valid certificate matching its name, otherwise delivery fails in enforce mode.
Serve the file and check
The policy file must be reachable over HTTPS on the host mta-sts.your-domain.com, with a valid certificate for exactly that name and Content-Type text/plain. Static web space or a Cloudflare Worker route is enough. Then publish the two TXT records and use the MTA-STS checker to confirm DNS record, file and MX hosts match.
Frequently asked questions
- What if I forget an MX?
- In enforce mode sending servers reject mail to that MX. That is why testing comes first: there the error only shows up in the TLS-RPT report.
- Does the id need a particular format?
- No, only unique and made of letters and digits. The generator timestamp satisfies that and makes the change traceable.
- Is TLS-RPT mandatory?
- Not for the mechanism to work, but without reports you never learn whether servers fail the policy. The generator provides the record alongside.