# MTA-STS and TLS-RPT: what they do and how to set them up

SPF, DKIM and DMARC are about who may send email **as** you. MTA-STS is
about mail sent **to** you: it tells other mail servers that your mail
servers support encryption, so they should refuse to deliver over an
unencrypted or unverified connection.

Without it, server-to-server encryption (STARTTLS) is opportunistic. An
attacker who can tamper with the connection can strip the encryption, or
point the sender at the wrong server, and the sender carries on in plain
text. MTA-STS closes that gap. TLS-RPT is the reporting half: senders tell
you when they couldn't connect securely.

## The three pieces

1. **A TXT record** saying you have a policy, with an ID that changes
   whenever the policy does:

   ```
   _mta-sts.example.com  TXT  "v=STSv1; id=20261031T120000;"
   ```

2. **A policy file** served over HTTPS at a fixed address:
   `https://mta-sts.example.com/.well-known/mta-sts.txt`

   ```
   version: STSv1
   mode: testing
   mx: mail.example.com
   max_age: 604800
   ```

3. **A TLS-RPT record** saying where reports go:

   ```
   _smtp._tls.example.com  TXT  "v=TLSRPTv1; rua=mailto:tlsrpt@example.com"
   ```

## The policy file, line by line

- **`mode`**: `testing` (report failures but deliver anyway), `enforce`
  (don't deliver if the connection can't be secured) or `none` (turn the
  policy off).
- **`mx`**: one line per mail server allowed to receive for you. Only the
  leftmost label may be a wildcard: `*.example.net` matches
  `mail.example.net` but not `a.b.example.net`.
- **`max_age`**: how long senders cache the policy, in seconds, up to
  31557600 (a year). Google asks for at least 86400 (a day).

The `mta-sts.` host needs a valid public certificate, must answer with
HTTP 200 (senders don't follow redirects), and should serve the file as
`text/plain`.

### What to put in `mx`

List exactly the hosts in your MX records.

**Microsoft 365** documents this policy for domains whose MX points at
Exchange Online:

```
version: STSv1
mode: enforce
mx: *.mail.protection.outlook.com
max_age: 604800
```

Microsoft notes that the wildcard is right only for Exchange Online. If
you've turned on inbound DNSSEC and DANE, your MX moves to a host ending
`mx.microsoft`, and that host replaces this line.

**Google Workspace** doesn't publish a recommended list. Use your MX
records: `smtp.google.com` for newer setups, or `aspmx.l.google.com` and
the `alt*.aspmx.l.google.com` hosts for older ones. Google's own policy
for google.com lists `smtp.google.com`, `aspmx.l.google.com` and
`*.aspmx.l.google.com`.

## Rolling it out safely

1. **Publish TLS-RPT first**, so you see problems from day one.
2. **Host the policy in `testing` mode**, publish the `_mta-sts` record,
   and leave it for about two weeks (Google's advice). Read the reports:
   failures mean a sender couldn't verify one of your MX hosts.
3. **Fix what the reports show**: a missing `mx` line, a backup MX without
   a valid certificate, a filtering service in front of your mail.
4. **Switch to `enforce`** and **change the `id`** in the TXT record, or
   senders keep the cached testing policy.

Every later change works the same way: edit the file, then change the
`id`. When you change mail providers, update the policy **before** you
change MX, or enforcing senders will refuse to deliver to the new
servers.

## Hosting the policy file

It's a tiny static file. Common options: your web host or CDN on the
`mta-sts` subdomain, a static site service, or a Cloudflare Worker.
Microsoft and Google don't host it for you. Many DMARC report services
offer hosted MTA-STS.

## Who checks it

- **Gmail** follows recipients' MTA-STS policies in enforce mode when
  sending.
- **Exchange Online** checks every outbound message against the
  recipient's MTA-STS policy, always on. In enforce mode, failures bounce
  with 5.4.8 (MX doesn't match) or 5.7.5 (certificate failure).
- Exchange Online also sends TLS-RPT reports, in JSON. Reports cover a
  day, usually arrive gzip-compressed, and are easiest to read through a
  report service.

## MTA-STS or DANE?

DANE does the same job using DNSSEC instead of certificate authorities.
Exchange Online supports DANE in both directions (inbound needs DNSSEC
turned on for your domain). Both can run together; MTA-STS needs no
DNSSEC, which makes it the easier start for most domains.

## Check your domain

The [free scan](/#scan) checks your MX, SPF and DMARC records. Get those
right first: [DMARC from none to reject](/guides/dmarc-none-to-reject) is
the bigger win against spoofing; MTA-STS is the next layer.

## Sources

- [RFC 8461: SMTP MTA Strict Transport Security (MTA-STS)](https://www.rfc-editor.org/rfc/rfc8461)
- [RFC 8460: SMTP TLS Reporting](https://www.rfc-editor.org/rfc/rfc8460)
- [Microsoft: Enhancing mail flow with MTA-STS](https://learn.microsoft.com/en-us/purview/enhancing-mail-flow-with-mta-sts)
- [Microsoft: How SMTP DANE works](https://learn.microsoft.com/en-us/purview/how-smtp-dane-works)
- [Google Workspace: About MTA-STS and TLS reporting](https://knowledge.workspace.google.com/admin/gmail/advanced/about-mta-sts-and-tls-reporting)
- [Google Workspace: Create an MTA-STS policy](https://knowledge.workspace.google.com/admin/gmail/advanced/create-an-mta-sts-policy)
- [Google Workspace: Turn on MTA-STS and TLS reporting](https://knowledge.workspace.google.com/admin/gmail/advanced/turn-on-mta-sts-and-tls-reporting)
- [Google: MTA-STS policy for google.com](https://mta-sts.google.com/.well-known/mta-sts.txt)

---
Source: https://nameward.app/guides/mta-sts-tls-rpt (updated 2026-10-31)