# How to set up MTA-STS and TLS reporting

> MTA-STS makes other servers deliver your mail over verified encryption; TLS-RPT reports when they cannot. One DNS record and one small file each.

Security · HTML version: https://getreport.app/learn/mta-sts

## MTA-STS

Passing looks like: MTA-STS passes.

**Why it matters.** Without MTA-STS, an attacker on the network can strip encryption from mail on its way to your server. The policy tells senders to insist on TLS with a valid certificate.

**How to fix it.**

1. Publish a TXT record at _mta-sts.yourdomain (v=STSv1; id=1) and the policy file at https://mta-sts.yourdomain/.well-known/mta-sts.txt, starting in testing mode.

## TLS reporting (TLS-RPT)

Passing looks like: TLS reporting (TLS-RPT) passes.

**Why it matters.** TLS-RPT sends you daily reports when other servers could not deliver mail to you securely, so you notice certificate or MTA-STS problems before mail is lost.

**How to fix it.**

1. Add a TXT record at _smtp._tls.yourdomain with v=TLSRPTv1; rua=mailto:tlsrpt@yourdomain.

Check your own page: https://getreport.app/