MTA-STS and TLS-RPT (email transport security)What it checks and how to fix it

What it checks

Skips domains without an MX record. Otherwise looks for the _mta-sts TXT record, the policy file at https://mta-sts.<domain>/.well-known/mta-sts.txt and the _smtp._tls TLS-RPT record. Passes when all three are present, warns when only some are, fails when none are, and reports inconclusive when the TXT record exists but the policy host cannot be reached.

Why it matters

Mail servers encrypt SMTP only opportunistically, so an attacker on the network path can strip STARTTLS and read or alter incoming mail. MTA-STS tells sending servers to insist on a valid TLS connection to your MX hosts. TLS-RPT sends you daily reports when deliveries fail that requirement, so a misconfiguration shows up before mail is lost.

How to fix it

MTA-STS takes three pieces.

1. A policy file served at https://mta-sts.example.com/.well-known/mta-sts.txt with a valid certificate for mta-sts.example.com. List every MX host; start with mode: testing:

version: STSv1
mode: testing
mx: aspmx.l.google.com
mx: *.aspmx.l.google.com
max_age: 86400

Any static HTTPS host works (GitHub Pages, Cloudflare Pages or a Worker, an S3 bucket behind a CDN). With nginx:

server {
  listen 443 ssl;
  server_name mta-sts.example.com;

  location = /.well-known/mta-sts.txt {
    default_type text/plain;
    alias /var/www/mta-sts/mta-sts.txt;
  }
}

2. DNS records, including one for the policy host:

_mta-sts.example.com.    3600  IN  TXT    "v=STSv1; id=20261030000000"
_smtp._tls.example.com.  3600  IN  TXT    "v=TLSRPTv1; rua=mailto:tls-reports@example.com"
mta-sts.example.com.     3600  IN  CNAME  your-static-host.example.net.

Change the id every time you edit the policy file, or senders keep the cached copy.

3. Enforce. Once the TLS reports come back clean, switch to mode: enforce and raise max_age to a week or more (604800).

dig +short TXT _mta-sts.example.com
curl https://mta-sts.example.com/.well-known/mta-sts.txt