webzod
account

Publish an MTA-STS policy, starting in testing mode

email.mta_sts.missing · effort: a project

Why it matters

Without MTA-STS, servers sending mail to you cannot insist on an encrypted connection, so an attacker on the network can downgrade it to plaintext. MTA-STS tells senders to require TLS to your mail servers, and it is rolled out in testing mode first so nothing is lost if it is misconfigured.

Staged change. Do this in stages and check each one before the next, so a mistake does not break your site or your mail.

The fix

  1. Check first that every mail server in your MX records supports TLS (STARTTLS) with a certificate from a public authority that matches the MX hostname. Mail providers such as Google Workspace and Microsoft 365 already do; self-hosted servers need checking.
  2. Serve the policy file over HTTPS at https://mta-sts.yourdomain/.well-known/mta-sts.txt. Create a DNS record for mta-sts.yourdomain (A, AAAA or CNAME) pointing at a web host that has a valid certificate for that exact name. The file must answer directly with status 200 and content-type text/plain; redirects are not followed.
  3. Write the policy with mode: testing and one mx: line for each MX hostname you publish. Replace the mx lines in the snippet with your own MX host names, written exactly as they appear in your MX records (look them up with a DNS tool or read them from your mail provider's setup page); a pattern such as *.example.com covers exactly one extra label. Never copy host names from an example. Use max_age: 86400 (one day) for testing.
  4. Last, add the _mta-sts TXT record with an id. The id is any string of letters and digits (up to 32) and must change every time you change the policy. Publish the policy file before the TXT record, so senders never see the new id without a policy to match.
  5. Add the TLS-RPT record (see the TLS-RPT fix) so you receive reports of failures. After a few weeks without failures, change mode to enforce, change the id, and later raise max_age to a week or more.
text 
# 1. DNS record for the policy host (an address or CNAME for your web host; the target below is only an example)
mta-sts.example.com.  IN CNAME  your-web-host.example.

# 2. Policy file, served at https://mta-sts.example.com/.well-known/mta-sts.txt
#    one "key: value" per line; replace the mx lines with your own MX host names
version: STSv1
mode: testing
mx: YOUR-MX-HOST.example
mx: *.YOUR-MX-DOMAIN.example
max_age: 86400

# 3. TXT record, published after the policy file works; change the id on every policy change
_mta-sts.example.com.  IN TXT  "v=STSv1; id=2026100501"

The examples use example.com. Replace it with your own domain.

Read the documentation (opens in a new tab)

Related

Scan your domain to see whether this applies to you.