How to set up MTA-STS and TLS reporting
MTA-STS makes other servers deliver your mail over verified encryption; TLS-RPT reports when they cannot. One DNS record and one small file each.
Step by step, with screenshots: SPF, DKIM and DMARC: set up email authentication in the right order →
Check your own domain
Our DMARC checker (email & DNS) tool runs these 2 checks and writes the record to add, free, in seconds.
What it is
MTA-STS (Mail Transfer Agent Strict Transport Security, RFC 8461) lets your domain tell other mail servers to deliver email to you only over encrypted connections with a valid certificate. Without it, encryption between mail servers is opportunistic, and an attacker on the network path can strip it and read mail in transit.
It has two parts: a TXT record at _mta-sts.yourdomain and a policy file served over HTTPS at mta-sts.yourdomain/.well-known/mta-sts.txt. The companion TLS-RPT record (RFC 8460) at _smtp._tls.yourdomain asks senders to email you daily reports when they could not connect securely. getReport checks for both. You are protected when the policy is in enforce mode and the reports show no failures.
What a passing site looks like
- MTA-STS: passesinfo onlyeffort M
- TLS reporting (TLS-RPT): passesinfo onlyeffort S
1. No MTA-STS policy, so mail to you can be sent unencrypted
Why it matters. Without MTA-STS, an attacker on the network can strip encryption from mail on its way to your server. The policy tells senders to insist on TLS with a valid certificate.
- Publish a TXT record at _mta-sts.yourdomain (v=STSv1; id=1) and the policy file at https://mta-sts.yourdomain/.well-known/mta-sts.txt, starting in testing mode.
2. No TLS-RPT record, so delivery failures stay invisible
Why it matters. TLS-RPT sends you daily reports when other servers could not deliver mail to you securely, so you notice certificate or MTA-STS problems before mail is lost.
- Add a TXT record at _smtp._tls.yourdomain with v=TLSRPTv1; rua=mailto:tlsrpt@yourdomain.
Questions people ask
What is an MTA-STS record?
It is a TXT record at _mta-sts.example.com with a value such as v=STSv1; id=20260901. It tells sending servers that your domain has an MTA-STS policy and which version it is. Change the id whenever you change the policy file, so senders fetch the new policy instead of using their cached copy.
What goes in an MTA-STS policy file?
The file at https://mta-sts.example.com/.well-known/mta-sts.txt lists version: STSv1, a mode (testing, enforce or none), one mx: line for each of your mail servers, and max_age in seconds, such as 604800 for a week. It must be served over HTTPS with a valid certificate for the mta-sts subdomain, or senders ignore it.
What does "MTA-STS policy is missing: STSFetchResult.NONE" mean?
It is a checker message meaning no MTA-STS policy was found for the domain, usually because the _mta-sts TXT record does not exist. It is not an error in your mail flow: mail still arrives, just without enforced encryption. Publishing the TXT record and the policy file resolves it.
How do I set up MTA-STS?
Publish a TLS-RPT record first so you receive reports, then host the policy file on the mta-sts subdomain with mode: testing and add the _mta-sts TXT record. Read the reports for a couple of weeks, and when no failures appear, switch the policy to mode: enforce and update the id. Some DNS and email security services host the policy file for you.