What is MTA-STS?

MTA-STS (Mail Transfer Agent Strict Transport Security, RFC 8461) lets your domain declare that other mail servers must deliver email to you over TLS-encrypted connections to mail servers with valid certificates. You publish a DNS TXT record at _mta-sts and a policy file on an HTTPS address under an mta-sts subdomain.

Why it matters

Email between servers is normally encrypted only if both sides agree to it, and an attacker on the network path can try to strip that encryption. MTA-STS tells sending servers that support it to refuse to fall back to plain text and to check that the receiving server's certificate is valid. It protects mail coming to your domain. It does not encrypt the messages you send out.

How to do it

Check that every mail server in your MX records has a valid, current TLS certificate for its host name.
Host a policy file at https://mta-sts.example.com/.well-known/mta-sts.txt. The web server needs its own valid HTTPS certificate. Start with testing mode:

version: STSv1
mode: testing
mx: mail.example.com
max_age: 86400

The mx lines must match your real mail servers, and wildcards such as *.example.com are allowed. The max_age is how long, in seconds, senders may cache the policy.

Publish a TXT record to announce the policy:

_mta-sts.example.com.  TXT  "v=STSv1; id=20261101T000000"

Set up TLS-RPT so you receive reports of failures. In testing mode, senders deliver as normal but report problems.
When the reports are clean, change mode to enforce and raise max_age.
Whenever you change the policy file, change the id value in the TXT record too. Senders use the id to know there is a new policy.

The wider setup is explained in the MTA-STS and TLS-RPT guide.

Crawvix's scan checks "MTA-STS policy is published" for your domain.

Common mistakes

Changing the policy file but not the id, so senders keep using the cached version.
Listing the wrong mx names, which makes enforcing mode reject genuine mail.
Letting the policy web server's certificate expire.
Switching straight to enforce without a testing period.
Assuming MTA-STS replaces DMARC. They do different jobs.

Frequently asked questions

Does every sender support MTA-STS?

No. Support depends on the sending server, and the large mailbox providers support it. Senders without support deliver as before.

Is MTA-STS the same as HTTPS for my website?

No. It uses HTTPS only to fetch the policy file. The protection applies to email delivery between servers.

What are the modes?

There are three. testing reports problems without blocking, enforce makes senders refuse delivery on failure, and none withdraws the policy.

Want a check of your domain's mail setup? Try the free website sample.