The DNS record
A single TXT record at _mta-sts.yourdomain with a valid id. More than one record, or no id, and senders ignore the policy.
Free tool
MTA-STS checker
Check whether senders must deliver your email over an encrypted, verified connection — and whether your policy would actually let them deliver at all.
Nothing is stored. Works with any domain, not just ours.
What it checks
What the checker tests
MTA-STS has two halves — a DNS record and a policy file on a web server — and both have to agree with your MX records.
The policy file
Fetched from https://mta-sts.yourdomain/.well-known/mta-sts.txt over a valid certificate, with no redirects, and checked for version, mode and max_age.
Your mail servers
Every MX record must match an mx: line in the policy. In enforce mode, a server left out will stop receiving mail from senders that honour MTA-STS.
TLS reporting
A TLS-RPT record at _smtp._tls.yourdomain gets you daily reports of secure deliveries that failed, so you can fix problems before enforcing.
What MTA-STS does
Mail servers encrypt email between themselves with STARTTLS, but only opportunistically: if someone in the middle strips the encryption offer, or presents the wrong certificate, the sending server usually delivers the message in plain text anyway. MTA-STS (Mail Transfer Agent Strict Transport Security) lets you publish a policy saying “only deliver to these servers, and only over a verified, encrypted connection”. Large senders, including Gmail and Microsoft 365, check for it before delivering.
The three modes
- testing — senders report problems through TLS-RPT but still deliver. Start here.
- enforce — senders that support MTA-STS refuse to deliver unless the connection is encrypted and the server matches your policy.
- none — switches a previous policy off.
Setting it up
- Publish a TLS-RPT record so you will see problems: a TXT record at
_smtp._tlssuch asv=TLSRPTv1; rua=mailto:tls-reports@yourcompany.co.uk. - Serve a policy file at
https://mta-sts.yourcompany.co.uk/.well-known/mta-sts.txt, on a web server with a valid certificate for that exact name, listing each MX host on its ownmx:line, withmode: testingand amax_age. - Publish the TXT record at
_mta-sts:v=STSv1; id=followed by a value you change every time you edit the policy. - Read the TLS reports for a few weeks. When they are clean, change the mode to
enforceand update the id.
Changing email provider later? Update the policy’s mx: lines before you change your MX records,
or senders that cached the old policy will refuse to deliver to your new servers. Our
MX lookup shows the servers your policy needs to list.
Questions
About MTA-STS
Where does the MTA-STS policy file have to be?
At https://mta-sts.yourdomain/.well-known/mta-sts.txt — on its own subdomain, served over HTTPS with a valid certificate for that name, as plain text, with no redirects. Any web server or static hosting service can serve it.
What is the difference between testing and enforce?
In testing mode, senders report failed secure deliveries but still deliver the mail. In enforce mode, senders that support MTA-STS refuse to deliver unless the connection is encrypted and the receiving server matches the policy.
What is TLS-RPT?
SMTP TLS Reporting. A TXT record at _smtp._tls.yourdomain asks senders to email you daily summaries of connections to your mail servers that failed to encrypt or verify. It is how you find problems before switching MTA-STS to enforce.
Why does the id need to change?
Senders cache your policy for up to max_age seconds and only fetch it again when the id in the DNS record changes. If you edit the policy file without changing the id, senders keep using the old version.
Is MTA-STS worth setting up for a small business?
It is a small, one-off job that protects your incoming mail from being read or redirected in transit, and it costs nothing beyond somewhere to host one text file. Start in testing mode with TLS-RPT so there is no risk to delivery.
Related tools and guides
Rather have it done for you?
SPF, DKIM and DMARC are set up and monitored for every MyExchangeServer customer. Or send us your results for a second opinion from an engineer.
- Free assisted migration
- No set-up fee, no minimum term
- UK data centres, UK engineers