MTA-STS policy

A DNS record telling sending servers to insist on TLS with a valid certificate for mail to this domain. Optional — without it, mail can be downgraded to plain text on the way.

• Help center

SMTP between mail servers encrypts opportunistically: if anything on the path strips the STARTTLS offer or presents a bogus certificate, the sending server falls back to plain text and delivers anyway. MTA-STS (RFC 8461) closes that gap. It tells sending servers that your domain always accepts mail over TLS with a valid certificate, and that they should refuse to deliver otherwise.

How SiteScan checks

This row appears only if the domain has MX records. The scan looks for a TXT record at _mta-sts.example.com starting with v=STSv1. It is optional, so "Missing" is shown as a neutral fact. Note that the TXT record is only half of the setup: SiteScan does not fetch the policy file itself.

How to set it up

• Publish the policy at https://mta-sts.example.com/.well-known/mta-sts.txt with a valid certificate. It contains version: STSv1, mode: testing (later enforce), one mx: line per mail host and max_age: 604800.
• Add the TXT record _mta-sts.example.com TXT "v=STSv1; id=20260101", and change the id whenever the policy changes.
• Start in testing mode and add TLS-RPT so you see failures before enforcing.

Many mail providers document the exact MX values; see also email authentication.