Switch MTA-STS from testing to enforce on Cloudflare

Why it matters

In testing mode senders report TLS problems but still deliver, so a downgrade attack is not blocked. Enforce mode makes senders refuse to deliver over an insecure connection.

Staged change. Do this in stages and check each one before the next, so a mistake does not break your site or your mail.

The fix

1. Read the TLS-RPT reports and confirm all MX hosts support valid TLS before enforcing.
2. Update the policy file (the Worker code, or your web host) so it says mode: enforce, and deploy it. Keep your own MX host names in the mx lines.
3. Then in DNS > Records edit the TXT record named _mta-sts and change the id to a new value. Keep max_age at 86400 for the first week, then raise it.

Type:     TXT
Name:     _mta-sts.example.com
Content:  v=STSv1; id=2026101001

The examples use example.com. Replace it with your own domain.

Read the documentation ↗(opens in a new tab)

Related

• Reported by the MTA-STS and TLS-RPT check
• Publish an MTA-STS policy, starting in testing mode
• Nothing to do for MTA-STS on a domain that accepts no mail
• Fix the MTA-STS TXT record
• Make the MTA-STS policy file reachable
• Fix the certificate on the MTA-STS policy host
• Fix the MTA-STS policy file
• Turn MTA-STS back on
• Make the MTA-STS policy cover every MX host
• Raise the MTA-STS max_age
• Publish a TLS-RPT record
• Fix the TLS-RPT record