MTA-STS. Enforce TLS for Inbound Mail

What is MTA-STS?

When another mail server delivers email to your domain, it connects to your MX host and asks "do you support encryption?" via the STARTTLS command. If the answer is yes, the connection upgrades to TLS. The problem: that negotiation happens in plaintext. An attacker sitting on the path can simply delete the STARTTLS offer, and the sending server, designed in an era when any delivery beat no delivery, shrugs and sends your customers' password resets and invoices unencrypted.

MTA-STS (Mail Transfer Agent Strict Transport Security, RFC 8461) is your way of saying: don't fall back. You publish a policy declaring that mail to your domain must arrive over TLS 1.2+, with a valid certificate, to a specific list of MX hosts. Compliant senders, which includes Gmail, Outlook, and Yahoo, cache that policy and refuse to deliver if the requirements can't be met.

Why it matters

• It closes a real attack: STARTTLS stripping is trivial for anyone on-path (hostile networks, rogue Wi-Fi, compromised routers) and invisible to both sender and recipient.
• Inbound mail often carries your most sensitive data: password resets, legal documents, customer PII. Opportunistic encryption protects none of it against an active attacker.
• It's a maturity signal: security questionnaires and email-security scanners increasingly check for it. Gmail publishes an enforce-mode policy on gmail.com itself.

How to check it

# 1. Is the policy flag published?
dig +short txt _mta-sts.example.com

# 2. Does the policy file resolve over HTTPS?
curl https://mta-sts.example.com/.well-known/mta-sts.txt

Both must work. A TXT record with no reachable policy file is a no-op; a policy file with no TXT record is never discovered.

Setting it up, step by step

1. Create the policy file and serve it at https://mta-sts.example.com/.well-known/mta-sts.txt with a valid certificate for mta-sts.example.com (Cloudflare Pages, GitHub Pages, or a tiny static bucket all work):

   version: STSv1
   mode: testing
   mx: mx1.example.com
   mx: mx2.example.com
   max_age: 86400

   The mx lines must match your actual MX hostnames (wildcards like *.google.com are allowed). For Google Workspace use mx: *.google.com; for Microsoft 365 use mx: *.mail.protection.outlook.com.
2. Publish the discovery TXT record:

   _mta-sts.example.com.  TXT  "v=STSv1; id=20260610"

   The id is an opaque change marker, a datestamp is the convention. Bump it every time you edit the policy file.
3. Publish TLS-RPT alongside it (see our TLS-RPT guide) so senders tell you when delivery fails against your policy. Don't enforce blind.
4. Watch reports for 2–4 weeks in testing mode. Failures here cost you nothing, mail still flows, but they tell you about cert mismatches or forgotten MX hosts.
5. Flip to mode: enforce, bump the id, and raise max_age (604800, one week, is a sensible production value).

Common mistakes

1. Forgetting to bump id after editing the policy. Senders keep using the cached old policy for up to max_age seconds.
2. MX list drift. You migrate mail providers, update MX records, and forget the policy file. Under enforce mode, the new MX hosts aren't on the list and inbound mail stalls.
3. Serving the policy with a redirect or wrong content type. The file must be served directly, over HTTPS, as plain text. Some senders won't follow redirects.
4. Self-signed or mismatched certs on MX hosts. Fine under opportunistic TLS, fatal under enforce.
5. Jumping straight to enforce without TLS-RPT. You'll have no idea what broke or for whom.

Monitoring MTA-STS going forward

MTA-STS has more moving parts than most DNS-only standards: a TXT record, an HTTPS endpoint, a certificate on that endpoint, certificates on every MX, and a policy file that must stay in sync with your actual MX records. Any one of them can rot independently.

DomainsDoc checks the whole chain continuously: the TXT record, the policy file's reachability and syntax, whether the listed MX hosts match your live MX records, and the certificates involved. The moment something drifts, you get one alert instead of a slow trickle of mysteriously delayed mail. Add your domain to start, and see pricing for plans.