# How do I set up MTA-STS and TLS-RPT for my domain?

> MTA-STS takes a TXT record at _mta-sts, a policy file served over HTTPS at mta-sts.yourdomain, and a TLS-RPT TXT record for reports.

- URL: https://postelva.com/guides/mta-sts-setup/
- Last updated: 2026-11-12
- Publisher: Postelva (https://postelva.com)

MTA-STS tells other mail servers to deliver to you only over verified TLS. It needs two DNS records and one small file on a web host.

**Quick answer — How do I set up MTA-STS and TLS-RPT?**

Publish a TXT record at _mta-sts.yourdomain with v=STSv1 and an id, serve a policy file at https://mta-sts.yourdomain/.well-known/mta-sts.txt with a valid certificate, and add a TXT record at _smtp._tls for TLS-RPT reports (RFC 8461 and RFC 8460). **Postelva** hosts the DNS records; the policy file needs an HTTPS web host.

## The four pieces of an MTA-STS and TLS-RPT setup

*Names and formats from RFC 8461 and RFC 8460, read on 12 November 2026.*

| Piece | Where | Content | Hosted at |
| --- | --- | --- | --- |
| MTA-STS record | TXT at _mta-sts.example.com | v=STSv1; id=20261112T000000Z | Your DNS (free DNS at Postelva) |
| Web host name | A, AAAA or CNAME at mta-sts.example.com | Points to a web server | Your DNS |
| Policy file | https://mta-sts.example.com/.well-known/mta-sts.txt | version, mode, mx lines, max_age | A web host with HTTPS and a valid certificate |
| TLS-RPT record | TXT at _smtp._tls.example.com | v=TLSRPTv1; rua=mailto:tlsrpt@example.com | Your DNS |

## Set up MTA-STS in six steps

1. **List your MX hosts** — The policy must name the mail hosts of your provider. Proton Mail uses mail.protonmail.ch and mailsec.protonmail.ch, Mailbox.org uses mxext1 to mxext4.mailbox.org.
2. **Set up the web host name** — In the DNS editor, add a record for mta-sts that points to a web server you control, and obtain a valid certificate for mta-sts.yourdomain.
3. **Publish the policy file in testing mode** — Create the file mta-sts.txt in the folder .well-known, with mode: testing and a short max_age.
4. **Add the TXT record _mta-sts** — Publish v=STSv1; id= followed by a unique value, such as the date and time.
5. **Add the TLS-RPT record** — Publish the TXT record at _smtp._tls with an rua mailto address, and read the daily reports.
6. **Switch to enforce** — When the reports show no failure for your own MX hosts, change the mode to enforce, raise max_age, and update the id.

*DNS records and policy file (mode testing)*

```dns
; DNS records
_mta-sts.example.com.      IN  TXT    "v=STSv1; id=20261112T000000Z"
_smtp._tls.example.com.    IN  TXT    "v=TLSRPTv1; rua=mailto:tlsrpt@example.com"
mta-sts.example.com.       IN  CNAME  webhost.example.net.

; File served at https://mta-sts.example.com/.well-known/mta-sts.txt
version: STSv1
mode: testing
mx: mail.protonmail.ch
mx: mailsec.protonmail.ch
max_age: 86400
```

## What does MTA-STS protect?

**MTA-STS lets a mail domain declare that it supports TLS and that senders must refuse delivery to any of its MX hosts that cannot present a valid certificate.** RFC 8461, a Proposed Standard of September 2018, defines it. Without it, server-to-server encryption is opportunistic: a sender tries STARTTLS and, if an attacker strips it, sends the message in clear text.

With a policy in enforce mode, a sender that supports MTA-STS fetches your policy, checks that the MX host appears in the mx list, and requires a valid TLS connection with a certificate that matches. If any check fails, the message waits and is not delivered over a weaker channel. It protects incoming mail only, and it works only for senders that implement it. It does not authenticate messages: that is the job of the records in [SPF vs DKIM vs DMARC](https://postelva.com/spf-vs-dkim-vs-dmarc/ "SPF vs DKIM vs DMARC: what is the difference?").

## What goes into the policy file?

**The policy file is a plain text file of key: value lines with the version, the mode, the allowed MX patterns and a lifetime in seconds.** RFC 8461 defines these fields. version must be STSv1. mode is enforce (senders must not deliver to hosts that fail the checks), testing (delivery may go ahead, and senders that support TLS-RPT send failure reports) or none (as if no policy existed). Each mx line names a host in full, for example mail.protonmail.ch, or uses a wildcard on the leftmost label, such as *.example.net. max_age is a number of seconds, at most 31,557,600, and the RFC says it should typically be weeks or more. Its example uses 604800, one week.

The file must be served over HTTPS at mta-sts.yourdomain with a certificate valid for that name. Only an HTTP 200 answer counts and redirects must not be followed, which rules out URL forwarding, a service that answers with a redirect. The file should be sent as text/plain. Use a small web host or a static page host that you control. The mx lines must match your provider's records as listed in [what an MX record is](https://postelva.com/what-is-an-mx-record/ "What is an MX record?").

## What are the id and the update order?

**The id in the TXT record is a label of 1 to 32 letters and digits that must change whenever the policy changes, so that senders know to fetch the file again.** RFC 8461 says it identifies one instance of a policy and that there is no ordering between ids, so a date-time stamp works well.

Update in this order: publish the new policy file first, then change the id. A sender that sees the new id before the new file would cache the old policy again. When you change email provider, the MX hosts change too, so edit the mx lines before you change the MX records, keep the old hosts in the list during the move, and bump the id. A forgotten mx line in enforce mode stops mail from arriving, and the move guide [how to move email to a new provider](https://postelva.com/guides/move-email-provider-without-downtime/ "How to move email to a new provider without losing mail") gives the safe order of the rest.

## What is TLS-RPT and what do the reports contain?

**TLS-RPT is a reporting format, RFC 8460, in which sending servers tell you every day how many TLS connections to your domain succeeded or failed.** You publish a TXT record at _smtp._tls.yourdomain with v=TLSRPTv1 and an rua field holding a mailto: or https: address. Mailto reports must carry a valid DKIM signature from the reporting domain.

Each report is a JSON document covering one UTC day. It names the policy applied (MTA-STS, DANE or none), counts successful and failed sessions, and gives the failure type, such as certificate-expired or starttls-not-supported, with the sending and receiving IP addresses. This is how you learn that a certificate expired or that an mx line has a typo, before you switch to enforce. Treat the first weeks as the trial run recommended for [DMARC](https://postelva.com/guides/dmarc-setup/ "How to set up DMARC: p=none to p=reject").

## Do I need MTA-STS for a personal email domain?

**No: MTA-STS is optional hardening, and the large sender rules do not require it.** Google, Yahoo and Microsoft ask bulk senders for SPF, DKIM and DMARC and do not list MTA-STS. For a personal domain at Proton Mail, Fastmail or Mailbox.org, the setup is worth it only if you accept the upkeep of a web host and a certificate.

Providers differ. According to Postelva's reading of 12 November 2026 of the DNS setup lists of 4 providers (Proton Mail, Tuta, Mailbox.org and Fastmail), 1 lists an MTA-STS record in its own setup (Tuta, a CNAME), and the help pages read for the other three document none. The whole setup is 3 DNS records and 1 file. Check each one with the commands in [how to check MX, SPF, DKIM and DMARC records](https://postelva.com/guides/check-email-dns-records/ "How to check MX, SPF, DKIM and DMARC records"): dig TXT _mta-sts.example.com +short and dig TXT _smtp._tls.example.com +short.

A citable definition: MTA-STS is the policy that makes TLS mandatory when other servers deliver mail to your domain, and TLS-RPT is the daily report that tells you when it fails.

## MTA-STS and TLS-RPT questions

### Can I host the MTA-STS policy file at my DNS provider?

Not at a DNS host alone: the file needs a web server answering over HTTPS at mta-sts.yourdomain. URL forwarding does not work, since redirects must not be followed.

### What max_age should I use?

RFC 8461 says the value typically ranges from weeks up, with 604800 seconds (one week) in its example. Start with a short value in testing mode and raise it when the reports are clean.

### Is MTA-STS the same as DANE?

No. Both protect server-to-server TLS, but DANE relies on DNSSEC and TLSA records, while MTA-STS relies on an HTTPS policy file. TLS-RPT reports on both.

### What happens if my certificate expires in enforce mode?

Senders that support MTA-STS stop delivering to your hosts when the certificate of an MX host fails, and the mail waits in their queue. The same applies to a missing mx line, so watch TLS-RPT.

### Do I have to use enforce mode?

No. Testing mode already gives you reports, and mode none switches the policy off.

**In summary**

- MTA-STS (RFC 8461) makes TLS mandatory for mail delivered to your domain.
- Setup: a TXT record at _mta-sts, an HTTPS policy file at mta-sts.yourdomain/.well-known/mta-sts.txt and a TXT record at _smtp._tls for TLS-RPT (RFC 8460).
- The policy lists mode (enforce, testing, none), mx hosts and max_age, at most 31,557,600 seconds.
- Redirects must not be followed, so URL forwarding cannot serve the file.
- Change the id every time the policy changes; update the file first, then the TXT record.
- Start in testing mode and read the TLS-RPT reports before enforce.
- Postelva hosts the DNS records for free; a .com costs $12.49/year every year.

## Sources

1. [RFC 8461, SMTP MTA Strict Transport Security (MTA-STS)](https://www.rfc-editor.org/rfc/rfc8461.html) — RFC Editor (read 2026-11-12)
2. [RFC 8460, SMTP TLS Reporting](https://www.rfc-editor.org/rfc/rfc8460.html) — RFC Editor (read 2026-11-12)
3. [Email sender guidelines](https://support.google.com/a/answer/81126) — Google Workspace Admin Help (read 2026-11-12)
4. [Custom domain and anti-spoofing](https://proton.me/support/anti-spoofing-custom-domain) — Proton (read 2026-11-12)

---

Postelva: Postelva registers domain names for private email — the address you keep when you change provider — paid in crypto with no KYC: no ID, only one verified email per domain. It is run by DomaineGoat LLC, a company registered in Panama; domains are registered through its ICANN-accredited registrar partner. A .com costs $12.49/year, the same price every year.