Encryption between mail servers is opportunistic. If someone in the middle strips out the offer of encryption, mail falls back to plain text and nobody notices. MTA-STS lets your domain say "deliver to me over TLS, to these servers, or not at all", and TLS-RPT asks senders to report when they couldn't. Both protect mail coming to you. Neither changes whether your outgoing mail lands in spam.
The two DNS records
| Type | Name (host) | Value |
|---|---|---|
| TXT | _mta-sts | v=STSv1; id=20261107 |
| TXT | _smtp._tls | v=TLSRPTv1; rua=mailto:tls-reports@yourcompany.com |
The id can be any string. Change it whenever you change the policy file, so senders fetch the new one.
The policy file
Serve a plain text file at https://mta-sts.yourcompany.com/.well-known/mta-sts.txt, with a valid HTTPS certificate:
version: STSv1mode: testingmx: mx1.yourmailhost.examplemx: mx2.yourmailhost.examplemax_age: 86400
- List each MX host exactly as it appears in your MX records. A wildcard such as
*.yourmailhost.examplecovers one label only. max_ageis in seconds. Start at a day, and raise it to a few weeks once you're in enforce mode.- Any static host works (Cloudflare Pages, GitHub Pages with a custom domain, your web host) as long as the
mta-stssubdomain has its own certificate.
Testing, then enforce
Run mode: testing for two weeks and read the TLS reports. If no failures show up, switch to mode: enforce and change the id. If you move mail provider later, update the mx: lines before changing your MX records, or senders holding the old policy will refuse to deliver.
Questions people ask
Do small businesses need MTA-STS?
It's optional. It's worth it if you receive sensitive mail, such as contracts or financial or health information. Get SPF, DKIM and DMARC right first.
Does Google Workspace or Microsoft 365 do this for me?
No. Both deliver under MTA-STS when other domains publish it, but you publish the policy for your own domain.
Related guides
- Gmail, Yahoo and Outlook sender requirements, in plain English What Gmail, Yahoo and Outlook.com enforce, as a checklist.
- SPF, DKIM and DMARC on Cloudflare DNS Cloudflare DNS, DMARC reports and Email Routing.
DNS only shows part of the picture. If mail is still landing in spam with every record right, the deliverability audit looks at the rest: blocklists, reputation, bounces, content and the sending setup.