[ Quick answer ]
MTA-STS (Mail Transfer Agent Strict Transport Security) forces other mail servers to deliver email to your domain over encrypted, certificate-validated TLS. You publish a _mta-sts TXT record and a policy file at https://mta-sts.yourdomain.com/.well-known/mta-sts.txt. It is defined in RFC 8461.
Key facts
- ›DNS record: _mta-sts.yourdomain.com TXT v=STSv1; id=<unique id>.
- ›Policy file lists version, mode, mx and max_age.
- ›Modes: none, testing, enforce.
- ›Policy must be served over HTTPS with a valid certificate.
- ›Change the id value whenever you update the policy.
Reviewed by the EmailAuth research team
SMTP encryption with STARTTLS is opportunistic: if an attacker strips the STARTTLS offer, mail falls back to plain text and nobody notices. MTA-STS lets your domain declare that senders must use TLS with a valid certificate, or not deliver at all.
How to set up MTA-STS
- 1
Create the policy file
Host https://mta-sts.yourdomain.com/.well-known/mta-sts.txt containing version: STSv1, mode: testing, one mx: line per mail server and max_age: 604800.
- 2
Publish the DNS record
Add a TXT record at _mta-sts.yourdomain.com with v=STSv1; id=20261102.
- 3
Add TLS-RPT
Publish _smtp._tls.yourdomain.com with v=TLSRPTv1; rua=mailto:tls@yourdomain.com to get failure reports.
- 4
Move to enforce
After reports show clean delivery, change mode to enforce and update the id.
Hosting is the hard part
The policy needs an HTTPS host with a valid certificate. EmailAuth hosts MTA-STS for you via a CNAME.
Frequently asked questions
What is MTA-STS?
A standard that tells sending servers your domain requires TLS encryption with a valid certificate, preventing downgrade and man-in-the-middle attacks on inbound mail.
Is MTA-STS necessary?
It is not required for delivery, but without it STARTTLS encryption can be silently stripped. It is recommended by security frameworks and supported by Gmail, Microsoft and Yahoo.
How do I set up MTA-STS?
Host the policy file at mta-sts.yourdomain.com over HTTPS, publish the _mta-sts TXT record, add TLS-RPT for reporting, start in testing mode and move to enforce.
What does MTA-STS policy is missing: STSFetchResult.NONE mean?
Microsoft's checks could not find a valid MTA-STS record or policy file for the domain. Publish both and make sure the policy URL is reachable over HTTPS.
What is the MTA-STS DNS record?
A TXT record at _mta-sts.yourdomain.com with the value v=STSv1; id=20261102 (any unique id).
[ MTA-STS guide ]
Enterprise provenance
Why top financial institutions and governments retired their email security dashboards.
Traditional email authentication platforms sell you a dashboard and ask your engineers to do the labour. In high-stakes environments, manual oversight means delayed enforcement, configuration drift and unmonitored shadow domains.
EmailAuth is the agentic email provenance platform. Our agents enforce p=reject, keep third-party senders aligned and move your domains to full RFC 9989 compliance, the new DMARC standard,, with human-in-the-loop auditability.
SaaS · Dedicated tenancy · Air-gapped on-prem · BYOK encryption