How to set up MTA-STS and TLS reporting
Security1 min readFixes 2 checks email-mta-sts, email-tls-rpt
MTA-STS makes other servers deliver your mail over verified encryption; TLS-RPT reports when they cannot. One DNS record and one small file each.
Check your own domain
Our Email & DNS health tool runs these 2 checks and writes the record to add, free, in seconds.
What a passing site looks like
- MTA-STS: passesinfo onlyeffort M
- TLS reporting (TLS-RPT): passesinfo onlyeffort S
1. No MTA-STS policy, so mail to you can be sent unencrypted
Why it matters. Without MTA-STS, an attacker on the network can strip encryption from mail on its way to your server. The policy tells senders to insist on TLS with a valid certificate.
How to fix it.
- Publish a TXT record at _mta-sts.yourdomain (v=STSv1; id=1) and the policy file at https://mta-sts.yourdomain/.well-known/mta-sts.txt, starting in testing mode.
2. No TLS-RPT record, so delivery failures stay invisible
Why it matters. TLS-RPT sends you daily reports when other servers could not deliver mail to you securely, so you notice certificate or MTA-STS problems before mail is lost.
How to fix it.
- Add a TXT record at _smtp._tls.yourdomain with v=TLSRPTv1; rua=mailto:tlsrpt@yourdomain.