Guides › Requirements

MTA-STS and TLS-RPT: enforce TLS for inbound mail

MTA-STS (RFC 8461) tells sending servers to deliver to you only over valid TLS, which protects against downgrade attacks. It needs a TXT record and an HTTPS-hosted policy file:

_mta-sts.example.com  TXT  v=STSv1; id=20261019

https://mta-sts.example.com/.well-known/mta-sts.txt:
version: STSv1
mode: enforce
mx: aspmx.l.google.com
mx: *.aspmx.l.google.com
max_age: 604800

Start with mode: testing. Change the id every time you update the policy.

TLS-RPT (RFC 8460) sends you daily reports on TLS failures:

_smtp._tls.example.com  TXT  v=TLSRPTv1; rua=mailto:tls-reports@example.com

The checker shows whether both TXT records exist.

Related