The three parts
- A TXT record at _mta-sts on your domain, announcing that a policy exists.
- The policy itself: a small text file served over HTTPS at mta-sts.yourdomain, with a valid certificate.
- A TLS-RPT record, so sending servers report to you when encrypted delivery fails.
1. The DNS records
_mta-sts.example.com. TXT "v=STSv1; id=20261012"
_smtp._tls.example.com. TXT "v=TLSRPTv1; rua=mailto:tls-reports@example.com"The id can be anything, but it must change every time you change the policy file. A date works well.
2. The policy file
Serve this at https://mta-sts.example.com/.well-known/mta-sts.txt. The mta-sts subdomain needs a valid, trusted certificate, or the policy is ignored.
version: STSv1
mode: testing
mx: mail.example.com
max_age: 604800- List every MX host. Wildcards like *.example.com are allowed.
- max_age is in seconds. 604800 is one week.
3. From testing to enforce
In testing mode nothing is blocked, but TLS-RPT reports show what would have failed. When the reports are clean for a week or two, change mode to enforce and change the id in DNS.
Gmail and Microsoft both honour MTA-STS when they send to you, so this protects the bulk of the mail you receive.
Check yours in twenty seconds.
Free, no account, nothing stored. It says in plain words what to fix.
Check your domain's mail setup