Skip to content

Guides · Email and DMARC

MTA-STS and TLS-RPT: what they do and how to set them up

MTA-STS makes other mail servers use encrypted, verified connections to yours; TLS-RPT reports when that fails. Records, policy file and rollout.

Updated 31 October 2026 · 4 min read

SPF, DKIM and DMARC are about who may send email as you. MTA-STS is about mail sent to you: it tells other mail servers that your mail servers support encryption, so they should refuse to deliver over an unencrypted or unverified connection.

Without it, server-to-server encryption (STARTTLS) is opportunistic. An attacker who can tamper with the connection can strip the encryption, or point the sender at the wrong server, and the sender carries on in plain text. MTA-STS closes that gap. TLS-RPT is the reporting half: senders tell you when they couldn't connect securely.

The three pieces

  1. A TXT record saying you have a policy, with an ID that changes whenever the policy does:

    _mta-sts.example.com  TXT  "v=STSv1; id=20261031T120000;"

  2. A policy file served over HTTPS at a fixed address: https://mta-sts.example.com/.well-known/mta-sts.txt

    version: STSv1
mode: testing
mx: mail.example.com
max_age: 604800

  3. A TLS-RPT record saying where reports go:

    _smtp._tls.example.com  TXT  "v=TLSRPTv1; rua=mailto:[email protected]"

The policy file, line by line

  • mode: testing (report failures but deliver anyway), enforce (don't deliver if the connection can't be secured) or none (turn the policy off).
  • mx: one line per mail server allowed to receive for you. Only the leftmost label may be a wildcard: *.example.net matches mail.example.net but not a.b.example.net.
  • max_age: how long senders cache the policy, in seconds, up to 31557600 (a year). Google asks for at least 86400 (a day).

The mta-sts. host needs a valid public certificate, must answer with HTTP 200 (senders don't follow redirects), and should serve the file as text/plain.

What to put in mx

List exactly the hosts in your MX records.

Microsoft 365 documents this policy for domains whose MX points at Exchange Online:

version: STSv1
mode: enforce
mx: *.mail.protection.outlook.com
max_age: 604800

Microsoft notes that the wildcard is right only for Exchange Online. If you've turned on inbound DNSSEC and DANE, your MX moves to a host ending mx.microsoft, and that host replaces this line.

Google Workspace doesn't publish a recommended list. Use your MX records: smtp.google.com for newer setups, or aspmx.l.google.com and the alt*.aspmx.l.google.com hosts for older ones. Google's own policy for google.com lists smtp.google.com, aspmx.l.google.com and *.aspmx.l.google.com.

Rolling it out safely

  1. Publish TLS-RPT first, so you see problems from day one.
  2. Host the policy in testing mode, publish the _mta-sts record, and leave it for about two weeks (Google's advice). Read the reports: failures mean a sender couldn't verify one of your MX hosts.
  3. Fix what the reports show: a missing mx line, a backup MX without a valid certificate, a filtering service in front of your mail.
  4. Switch to enforce and change the id in the TXT record, or senders keep the cached testing policy.

Every later change works the same way: edit the file, then change the id. When you change mail providers, update the policy before you change MX, or enforcing senders will refuse to deliver to the new servers.

Hosting the policy file

It's a tiny static file. Common options: your web host or CDN on the mta-sts subdomain, a static site service, or a Cloudflare Worker. Microsoft and Google don't host it for you. Many DMARC report services offer hosted MTA-STS.

Who checks it

  • Gmail follows recipients' MTA-STS policies in enforce mode when sending.
  • Exchange Online checks every outbound message against the recipient's MTA-STS policy, always on. In enforce mode, failures bounce with 5.4.8 (MX doesn't match) or 5.7.5 (certificate failure).
  • Exchange Online also sends TLS-RPT reports, in JSON. Reports cover a day, usually arrive gzip-compressed, and are easiest to read through a report service.

MTA-STS or DANE?

DANE does the same job using DNSSEC instead of certificate authorities. Exchange Online supports DANE in both directions (inbound needs DNSSEC turned on for your domain). Both can run together; MTA-STS needs no DNSSEC, which makes it the easier start for most domains.

Check your domain

The free scan checks your MX, SPF and DMARC records. Get those right first: DMARC from none to reject is the bigger win against spoofing; MTA-STS is the next layer.

Sources

Free scan

No signup. Only scan domains you own or manage.

More in Email and DMARC