How to: Enable MTA-STS & TLS-RPT

How to: Enable MTA-STS & TLS-RPT

When to use this guide

  • Record Status: No Record: no MTA-STS DNS record exists
  • Policy Validation: No Record: no policy file is being served
  • Policy Mode: Missing: the policy file exists but mode is not set
All three MTA-STS checks fail together when MTA-STS is not configured at all, which is the most common situation.
Also use this guide (specifically:  step 4⁠ ) when the TLS-RPT check shows Record Status: No Record.
How urgent is this? MTA-STS protects against SMTP downgrade attacks (forcing email to be sent unencrypted between mail servers). Treat it as medium priority: worth fixing, but not an emergency.

Who does this?

The person holding the  Domains & DNS role  in your organisation.
This requires access to two places:
    The DNS hosting provider to add two TXT records
    A web host to serve the policy file over HTTPS at a subdomain


Background: what does MTA-STS do?

Concept
What it does
MTA-STS policy
Tells other mail servers they must use TLS encryption when delivering email to your domain
Policy file
A text file hosted at https://mta-sts.[yourdomain]/.well-known/mta-sts.txt that defines the policy
TLS-RPT
A companion standard that sends you reports about TLS failures during email delivery
Without MTA-STS, an attacker can in theory force mail servers to deliver email unencrypted (a downgrade attack), even if your mail server supports TLS.


Step 1: Check whether you can host the subdomain

The policy file must be served over HTTPS at mta-sts.[yourdomain]. This requires creating a subdomain and hosting a small text file there. There are two scenarios:
Scenario A — You can add a subdomain at your current hosting provider
The straightforward path. Create the subdomain mta-sts.[yourdomain] in your hosting control panel. Most providers will automatically issue an SSL certificate via Let's Encrypt. You can then upload the policy file via the File Manager or equivalent.
Scenario B — You cannot or don't want to host it at your current provider
Use Cloudflare Pages or another static hosting service to serve the policy file. This is free and requires no changes to the main hosting setup. Point the mta-sts subdomain via a CNAME record in DNS to Cloudflare Pages. Slightly more complex but avoids touching your hosting provider.


Step 2: Create the policy file

Create a file called mta-sts.txt with the following content, replacing the mx: lines with the domain's actual MX records (look these up via  easydmarc.com/tools/dns-record-checker , selecting the MX record type):
version: STSv1
mode: testing
mx: [your-mx-record-1]
mx: [your-mx-record-2]
mx: [your-mx-record-3]
max_age: 604800
Notes:
  • Start with mode: testing — this logs failures without blocking mail. Switch to mode: enforce once you have confirmed no legitimate mail is failing.
  • max_age: 604800 = 7 days. Increase to 31557600 (1 year) once everything is confirmed working.
  • List all MX records for the domain, exactly as they appear in DNS.
Upload the file to the path /.well-known/mta-sts.txt on the subdomain.


Step 3: Add the MTA-STS DNS record

In the DNS settings for the domain, add a TXT record:
  • Name: _mta-sts
  • Value: v=STSv1; id=YYYYMMDDHHMMSS
Replace YYYYMMDDHHMMSS with the current date and time (e.g. 20260623120000). This id must change every time you update the policy file, so receiving mail servers know to fetch a fresh copy.


Step 4: Add TLS-RPT

TLS-RPT sends reports about TLS failures during email delivery. Add a second TXT record:
  • Name: _smtp._tls
  • Value: v=TLSRPTv1; rua=mailto:[monitored-email@yourdomain]
Use an email address that someone at the organisation actually monitors.


Step 5: Switch to enforce mode (after monitoring)

After running in mode: testing for 1–2 weeks with no issues reported, update the policy file:
    Change mode: testing to mode: enforce
    Update the id in the _mta-sts DNS TXT record to a new timestamp
With mode: enforce, receiving mail servers will refuse delivery if TLS cannot be established — this is the recommended end state.


Step 6: Verification

Once DNS has propagated, verify using  easydmarc.com/tools/mta-sts-check . All three fields should show green:
  • Check Mark Button Record Status
  • Check Mark Button Policy Validation
  • Check Mark Button Policy Mode