MTA-STS and TLS-RPT: enforcing encrypted mail delivery
Make sure mail to your domain is delivered over verified TLS, and get reports when it is not.
SMTP encryption (STARTTLS) is opportunistic and easily downgraded. MTA-STS lets you publish a policy (a DNS record plus an HTTPS-hosted text file) that tells senders your MX hosts must be reached over TLS with a valid certificate. TLS-RPT gives senders an address to report failures to.
Steps
- Publish
_smtp._tls.yourdomain.com TXT "v=TLSRPTv1; rua=mailto:tls@yourdomain.com". - Host
https://mta-sts.yourdomain.com/.well-known/mta-sts.txtwith modetesting. - Publish
_mta-sts.yourdomain.com TXT "v=STSv1; id=2026091601". - Review reports, then switch to
enforce.
Use the MTA-STS Check and generator.