MTA-STS & TLS-RPT

What it is

SMTP encryption with STARTTLS is opportunistic: an attacker on the network can strip it or present a fake certificate, and the sender silently falls back to plaintext.

MTA-STS (SMTP MTA Strict Transport Security) lets you publish a policy over HTTPS saying "only deliver to these MX hosts, and only over TLS with a valid certificate". TLS-RPT adds daily reports about TLS failures.

How it works

• A TXT record at _mta-sts.<domain> announces the policy and its id (v=STSv1; id=…). Change the id whenever the policy changes.
• The policy is served at https://mta-sts.<domain>/.well-known/mta-sts.txt with a valid certificate.
• mode: testing reports failures without blocking; mode: enforce refuses to deliver insecurely; mode: none withdraws the policy.
• mx: lines list the allowed MX host names (wildcards like *.example.net are allowed).
• max_age (seconds) controls how long senders cache the policy. One week (604800) or more is typical.
• TLS-RPT is a TXT record at _smtp._tls.<domain> with v=TLSRPTv1; rua=mailto:… or https://….

Examples

v=STSv1; id=20261102T000000

version: STSv1
mode: enforce
mx: mx1.example.com
mx: mx2.example.com
max_age: 604800

v=TLSRPTv1; rua=mailto:[email protected]

Common mistakes

• MX hosts missing from the policy

  In enforce mode, senders will refuse to deliver to any MX not listed.

• Forgetting to bump the id

  Senders keep using the cached policy until max_age expires.

• Invalid certificate on mta-sts host

  The policy host needs a publicly trusted certificate covering mta-sts.<domain>.

• Wrong content type or line endings

  Serve text/plain; the file is key: value lines.

• Going straight to enforce

  Start with mode: testing plus TLS-RPT, review reports, then enforce.

Specifications

• RFC 8461 (MTA-STS)
• RFC 8460 (TLS-RPT)