How to Configure MTA-STS

MTA-STS (RFC 8461) tells other mail servers: 'When sending mail to me, only use TLS, only to these MX hostnames, and reject the connection if validation fails.' It prevents man-in-the-middle TLS downgrade attacks that have been demonstrated against major mail providers.

Try our Email checker

1. Publish the MTA-STS DNS record

Add a TXT record at _mta-sts. with value: v=STSv1; id=. The id changes whenever you update the policy file so receivers know to re-fetch it.

2. Host the policy file over HTTPS

Serve a plain-text file at https://mta-sts./.well-known/mta-sts.txt with content like: version: STSv1\nmode: enforce\nmx: *.your-mail-host.com\nmax_age: 604800. The host mta-sts. must have a valid TLS certificate.

3. Start in testing mode

Set mode: testing for the first week. Pair with TLS-RPT (separate guide) to receive failure reports without breaking inbound mail. Once reports look clean switch to mode: enforce.

4. Enforce

Update the policy file to mode: enforce bump max_age to 604800 (1 week) and bump the id in the DNS record. Now any sending server that supports MTA-STS will refuse to deliver mail over plaintext.

Want to verify your setup?

Run the check now