How do I set up MTA-STS and TLS-RPT for my domain?

What does MTA-STS protect?

MTA-STS lets a mail domain declare that it supports TLS and that senders must refuse delivery to any of its MX hosts that cannot present a valid certificate. RFC 8461, a Proposed Standard of September 2018, defines it. Without it, server-to-server encryption is opportunistic: a sender tries STARTTLS and, if an attacker strips it, sends the message in clear text.

With a policy in enforce mode, a sender that supports MTA-STS fetches your policy, checks that the MX host appears in the mx list, and requires a valid TLS connection with a certificate that matches. If any check fails, the message waits and is not delivered over a weaker channel. It protects incoming mail only, and it works only for senders that implement it. It does not authenticate messages: that is the job of the records in SPF vs DKIM vs DMARC.

What goes into the policy file?

The policy file is a plain text file of key: value lines with the version, the mode, the allowed MX patterns and a lifetime in seconds. RFC 8461 defines these fields. version must be STSv1. mode is enforce (senders must not deliver to hosts that fail the checks), testing (delivery may go ahead, and senders that support TLS-RPT send failure reports) or none (as if no policy existed). Each mx line names a host in full, for example mail.protonmail.ch, or uses a wildcard on the leftmost label, such as *.example.net. max_age is a number of seconds, at most 31,557,600, and the RFC says it should typically be weeks or more. Its example uses 604800, one week.

The file must be served over HTTPS at mta-sts.yourdomain with a certificate valid for that name. Only an HTTP 200 answer counts and redirects must not be followed, which rules out URL forwarding, a service that answers with a redirect. The file should be sent as text/plain. Use a small web host or a static page host that you control. The mx lines must match your provider's records as listed in what an MX record is.

What are the id and the update order?

The id in the TXT record is a label of 1 to 32 letters and digits that must change whenever the policy changes, so that senders know to fetch the file again. RFC 8461 says it identifies one instance of a policy and that there is no ordering between ids, so a date-time stamp works well.

Update in this order: publish the new policy file first, then change the id. A sender that sees the new id before the new file would cache the old policy again. When you change email provider, the MX hosts change too, so edit the mx lines before you change the MX records, keep the old hosts in the list during the move, and bump the id. A forgotten mx line in enforce mode stops mail from arriving, and the move guide how to move email to a new provider gives the safe order of the rest.

What is TLS-RPT and what do the reports contain?

TLS-RPT is a reporting format, RFC 8460, in which sending servers tell you every day how many TLS connections to your domain succeeded or failed. You publish a TXT record at _smtp._tls.yourdomain with v=TLSRPTv1 and an rua field holding a mailto: or https: address. Mailto reports must carry a valid DKIM signature from the reporting domain.

Each report is a JSON document covering one UTC day. It names the policy applied (MTA-STS, DANE or none), counts successful and failed sessions, and gives the failure type, such as certificate-expired or starttls-not-supported, with the sending and receiving IP addresses. This is how you learn that a certificate expired or that an mx line has a typo, before you switch to enforce. Treat the first weeks as the trial run recommended for DMARC.

Do I need MTA-STS for a personal email domain?

No: MTA-STS is optional hardening, and the large sender rules do not require it. Google, Yahoo and Microsoft ask bulk senders for SPF, DKIM and DMARC and do not list MTA-STS. For a personal domain at Proton Mail, Fastmail or Mailbox.org, the setup is worth it only if you accept the upkeep of a web host and a certificate.

Providers differ. According to Postelva's reading of 12 November 2026 of the DNS setup lists of 4 providers (Proton Mail, Tuta, Mailbox.org and Fastmail), 1 lists an MTA-STS record in its own setup (Tuta, a CNAME), and the help pages read for the other three document none. The whole setup is 3 DNS records and 1 file. Check each one with the commands in how to check MX, SPF, DKIM and DMARC records: dig TXT _mta-sts.example.com +short and dig TXT _smtp._tls.example.com +short.

A citable definition: MTA-STS is the policy that makes TLS mandatory when other servers deliver mail to your domain, and TLS-RPT is the daily report that tells you when it fails.