MTA-STS Setup Guide: How to Enforce TLS for Your Mail Server

Without MTA-STS, STARTTLS encryption for email is opportunistic — it can be stripped by an attacker performing a man-in-the-middle attack. The sending server would then deliver the email in plaintext.

MTA-STS (Mail Transfer Agent Strict Transport Security) solves this by publishing a policy over HTTPS that tells sending servers: 'You MUST use TLS to deliver to my mail servers, and here are the servers you should connect to.' Since the policy is fetched over HTTPS (protected by certificate authorities), it can't be stripped or faked.

Before implementing MTA-STS, ensure: - Your mail server(s) support STARTTLS with a valid, unexpired TLS certificate - Your TLS certificate is from a publicly trusted CA (not self-signed) - You can host a static file at https://mta-sts.yourdomain.com/.well-known/mta-sts.txt - Your mail server hostnames match the certificate's Subject Alternative Names

Create a text file with the following content (adapt to your setup):

version: STSv1 mode: enforce mx: mail.yourdomain.com mx: mail2.yourdomain.com max_age: 604800

version: STSv1 — required mode: — 'testing' (report only) or 'enforce' (require TLS) mx: — list all your MX hostnames (repeat for each) max_age: — how long (seconds) senders should cache the policy. 604800 = 1 week.

Start with mode: testing before switching to enforce.

The policy file must be served at: https://mta-sts.yourdomain.com/.well-known/mta-sts.txt

Requirements: - Must be HTTPS (valid certificate required) - Content-Type: text/plain - No redirects (file must be at the exact path) - Accessible without authentication

You'll need to create the mta-sts subdomain and configure web hosting for it. A simple static site or even a redirect-capable CDN works fine.

Add a TXT record at _mta-sts.yourdomain.com: v=STSv1; id=20260312000000

The id value must be updated each time you change your policy (so sending servers know to re-fetch it). Use a date-based format for easy tracking.

Also add TLS-RPT to receive reports about TLS failures: _smtp._tls.yourdomain.com TXT "v=TLSRPTv1; rua=mailto:tls-reports@yourdomain.com"

After testing for a few weeks with mode: testing and reviewing TLS-RPT reports for errors, switch to mode: enforce in your policy file and update the id.

1. 1

   Verify TLS certificate on mail server

   Ensure your mail server has a valid certificate from a trusted CA covering all MX hostnames. Self-signed certificates won't work with MTA-STS.

2. 2

   Create the MTA-STS policy file

   Create a plain text file with version, mode (testing first), mx hostnames, and max_age. Start with mode: testing to collect data without enforcing.

3. 3

   Host the policy file via HTTPS

   Serve the file at https://mta-sts.yourdomain.com/.well-known/mta-sts.txt. Must be HTTPS with a valid cert, no redirects, and accessible without authentication.

4. 4

   Add the MTA-STS DNS record

   Add TXT record at _mta-sts.yourdomain.com: v=STSv1; id=YYYYMMDDHHMMSS. The id must be updated whenever the policy file changes.

5. 5

   Add TLS-RPT DNS record

   Add TXT record at _smtp._tls.yourdomain.com: v=TLSRPTv1; rua=mailto:tls-reports@yourdomain.com. This receives delivery failure reports.

6. 6

   Monitor TLS-RPT reports for 2–4 weeks

   Review reports for any TLS delivery failures. Fix certificate or configuration issues before switching to enforce mode.

7. 7

   Switch to mode: enforce

   Update policy file to mode: enforce and increment the id in the DNS record. Sending servers will now require valid TLS to deliver to your mail server.

# File location: https://mta-sts.yourdomain.com/.well-known/mta-sts.txt
# Content-Type: text/plain

version: STSv1
mode: enforce
mx: mail.yourdomain.com
mx: mail2.yourdomain.com
max_age: 604800

# version: STSv1        — required, must be first line
# mode: testing|enforce — use 'testing' initially; switch to 'enforce' after validating
# mx:                   — list ALL your MX hostnames (one per line)
# max_age:              — seconds to cache policy (604800 = 1 week, 31557600 = 1 year)

# DNS records to add:
# _mta-sts.yourdomain.com    TXT  "v=STSv1; id=20260312000000"
# _smtp._tls.yourdomain.com  TXT  "v=TLSRPTv1; rua=mailto:tls-reports@yourdomain.com"