Question 1

What records are required for MTA-STS?

Accepted Answer

You need a DNS TXT record at _mta-sts.your-domain.com with values like v=STSv1; id=, and a policy file hosted over HTTPS at https://mta-sts./.well-known/mta-sts.txt. Your MX servers must support STARTTLS with a valid certificate.

Question 2

Where do I host the MTA-STS policy file?

Accepted Answer

Serve a plain-text file at https://mta-sts.your-domain.com/.well-known/mta-sts.txt over HTTPS with a trusted certificate. It should be directly accessible without authentication and return a 200 OK.

Question 3

Will enabling MTA-STS break email delivery?

Accepted Answer

Not if you stage it correctly. Start with mode=testing to verify DNS, HTTPS policy hosting, and certificate alignment. Switching to mode=enforce without resolving issues (e.g., no STARTTLS or certificate mismatch) can cause sending servers to defer or fail delivery.

Question 4

What's the difference between testing and enforce modes?

Accepted Answer

mode=testing asks senders to fetch and evaluate your policy but not enforce it; issues can be monitored (often via TLS-RPT). mode=enforce requires TLS to your listed MX hosts with valid certificates—non-compliant connections are refused by senders.

Question 5

How do I update or rotate my MTA-STS policy safely?

Accepted Answer

Edit the policy file, increase max_age if appropriate, and change the id value in the _mta-sts.your-domain.com TXT record to trigger refetch by senders. Confirm your MX endpoints and certificates are ready before moving to mode=enforce.

Question 6

How long do changes take to apply?

Accepted Answer

DNS changes apply after TTL expiry. Senders cache the policy up to the policy's max_age; a new TXT id prompts them to refetch sooner. In practice, expect propagation within minutes to a few hours, depending on TTL and sender caching.

Question 7

Do I need TLS-RPT with MTA-STS?

Accepted Answer

TLS-RPT (SMTP TLS Reporting) isn't required but is highly recommended. It provides daily reports from senders about TLS negotiation and MTA-STS policy application so you can detect issues before switching to enforce.

Check Your MTA-STS Policy in Seconds

Enter Domain to Test

Frequently Asked Questions