Guides · Updated 2026-10-11

What are MTA-STS and TLS-RPT?

SMTP encryption between servers is opportunistic by default, so an attacker on the network path can strip it. MTA-STS (RFC 8461) lets you publish a policy telling senders to only deliver over valid TLS to your listed MX hosts.

Setup

1. Host a policy file at https://mta-sts.yourdomain.com/.well-known/mta-sts.txt, e.g. version: STSv1, mode: testing, mx: *.mail.protection.outlook.com, max_age: 86400.
2. Publish TXT _mta-sts.yourdomain.com: v=STSv1; id=20261011 (change the id whenever the policy changes).
3. Publish TLS-RPT (RFC 8460) at _smtp._tls.yourdomain.com: v=TLSRPTv1; rua=mailto:[email protected].
4. After reports look clean, switch mode to enforce.

Sources

• RFC 8461: MTA-STS
• RFC 8460: SMTP TLS Reporting

This guide is general information, not legal or professional advice. Provider screens change; always confirm the exact values shown in your own account.