How to set up MTA-STS and TLS-RPT

MTA-STS tells sending mail servers that your MX hosts support TLS with a valid certificate, so they refuse to deliver over an unencrypted or intercepted connection. TLS-RPT asks them to report when that fails.

1. Host the policy file

Serve this over HTTPS at https://mta-sts.example.com/.well-known/mta-sts.txt, with a valid certificate for mta-sts.example.com:

version: STSv1
mode: testing
mx: example-com.mail.protection.outlook.com
max_age: 86400

• Add one mx: line per MX host, matching your MX records. A wildcard covers one label, for example mx: *.mail.protection.outlook.com.
• Check your MX hosts with dig +short MX example.com, and confirm each one presents a valid certificate for its own name.

2. Publish the TXT record

_mta-sts.example.com.  TXT  "v=STSv1; id=20261020T120000"

The id is any string up to 32 letters and digits. Change it every time you change the policy file, or senders keep the cached copy.

3. Add TLS-RPT

_smtp._tls.example.com.  TXT  "v=TLSRPTv1; rua=mailto:[email protected]"

Receiving servers that support it send a daily JSON report of successful and failed TLS connections to your domain.

4. Move to enforce

When the reports show no failures for your real MX hosts, change the policy to mode: enforce, raise max_age (for example 604800, one week), and update the id in the TXT record.

Before you change MX hosts or mail provider later, add the new hosts to the policy (and update the id) first, and wait out the old max_age.