All systems operationalReal-time DNS, email and infrastructure monitoring
SupportAPIContactSign in
Sign in Start free
Home/Knowledge Base/MTA-STS and TLS-RPT: enforcing encrypted mail delivery
GUIDE

MTA-STS and TLS-RPT: enforcing encrypted mail delivery

Make sure mail to your domain is delivered over verified TLS, and get reports when it is not.

SMTP encryption (STARTTLS) is opportunistic and easily downgraded. MTA-STS lets you publish a policy (a DNS record plus an HTTPS-hosted text file) that tells senders your MX hosts must be reached over TLS with a valid certificate. TLS-RPT gives senders an address to report failures to.

Steps

  1. Publish _smtp._tls.yourdomain.com TXT "v=TLSRPTv1; rua=mailto:tls@yourdomain.com".
  2. Host https://mta-sts.yourdomain.com/.well-known/mta-sts.txt with mode testing.
  3. Publish _mta-sts.yourdomain.com TXT "v=STSv1; id=2026091601".
  4. Review reports, then switch to enforce.

Use the MTA-STS Check and generator.