What MTA-STS and TLS-RPT do

How it works

Mail servers mostly encrypt between each other voluntarily. An attacker in the network can suppress the encryption or redirect mail. With MTA-STS (Mail Transfer Agent Strict Transport Security) you define: delivery only with a valid TLS certificate and only to the servers named.

MTA-STS has two parts. A TXT record at _mta-sts.<your domain> announces the policy:

v=STSv1; id=20261002

The policy itself is a file at https://mta-sts.<your domain>/.well-known/mta-sts.txt:

version: STSv1
mode: testing
mx: mail.your-domain.example
max_age: 604800

TLS-RPT (TLS Reporting) is another TXT record, at _smtp._tls.<your domain>. Sending servers report to the address in it when encrypted delivery fails:

v=TLSRPTv1; rua=mailto:tlsrpt@your-domain.example

What matters

• A new id with every change. Sending servers only reload the policy when the id changes.
• A valid certificate for mta-sts. The subdomain must be reachable over https with a valid certificate.
• Every mail server under mx. Each server from your MX records must match; wildcards like *.provider.example are allowed.
• mode: enforce in the end. With testing failures are only reported, nothing is enforced.

How to set it up

1. Put the policy file with mode: testing on the subdomain mta-sts. Usually whoever runs your website does this.
2. Enter the MTA-STS record and the TLS-RPT record in the DNS settings of your domain.
3. If the reports stay clean for a few weeks, switch to mode: enforce and raise the id.