MTA-STS Explained

Mail Transfer Agent Strict Transport Security (MTA-STS) mandates that incoming email must be sent using TLS.

Records

MTA-STS has two parts:
  • DNS Record: announcing the current policy version
  • Policy File: the MTA-STS policy

DNS Record

The DNS record is a DNS TXT record at _mta-sts.yourdomain.com.
v=STSv1; id=20260624T000000
An Example MTA-STS DNS record
The above MTA-STS record just announced that a policy file is available, and the current version is 20260624T000000. Usually a date is used as the ID field.

Policy File

The policy file can be found at https://mta-sts.yourdomain.com/.well-known/mta-sts.txt.
version: STSv1
mode: enforce
mx: mail.example.com
max_age: 604800
An example MTA-STS policy that requires TLS for mail delivered to mail.example.com.
The policy lists the mail servers allowed to receive email for the domain and specifies whether senders should enforce TLS.

Policy Modes

  • testing: Senders should report policy failures but can still deliver mail.
  • enforce: Senders must use TLS with a valid certificate and deliver only to the listed mail servers.

Recommended Articles