Publish MTA-STS

Force other mail servers to use encrypted, certificate-verified delivery to you.

30 min

why this matters

By default, mail delivery falls back to plain text if encryption fails, which allows downgrade attacks. MTA-STS closes that gap and signals to providers that you run a careful mail setup.

Step by step

1
Publish the policy file over HTTPS
It must be served at this exact path on the mta-sts subdomain, as text/plain, with a valid certificate. List every hostname from your MX records.
```
https://mta-sts.example.com/.well-known/mta-sts.txt

version: STSv1
mode: testing
mx: aspmx.l.google.com
mx: alt1.aspmx.l.google.com
max_age: 604800
```
2
Add the DNS record
The id changes whenever you edit the policy — that is how senders know to re-fetch it. A date-stamp works well.
```
Type: TXT
Name: _mta-sts
Value: v=STSv1; id=20260911000000Z
```
3
Add TLS reporting
TLS-RPT sends you reports about failed encrypted deliveries so you can see problems while still in testing mode.
```
Type: TXT
Name: _smtp._tls
Value: v=TLSRPTv1; rua=mailto:tlsrpt@example.com
```
4
Switch to enforce
After a week or two of clean TLS reports, change mode: testing to mode: enforce in the policy file and bump the id.