DNSprobe
CPU: --
MEM: --
Uptime: --
Temp: --

DNSprobe Wiki - Email

MTA-STS and TLS-RPT

MTA-STS helps domains require TLS for inbound SMTP delivery, while TLS-RPT lets them receive reports about TLS failures.

Without MTA-STS, a sending server may fall back to unencrypted SMTP delivery when TLS fails. With a published policy in enforce mode, compatible senders refuse MX hosts that do not satisfy the policy.

TLS-RPT complements MTA-STS by sending aggregate reports when senders encounter certificate, TLS negotiation, or policy compliance problems.

On this page

1. Overview

A complete MTA-STS setup contains an _mta-sts TXT record with v=STSv1 and id=, plus an HTTPS policy file at https://mta-sts.example.com/.well-known/mta-sts.txt.

The policy file contains version: STSv1, mode, max_age, and one or more mx: lines describing the authorized mail exchangers.

2. What DNSprobe checks

DNSprobe checks both DNS records and attempts to fetch the HTTPS policy file.

  • Presence of a single valid _mta-sts TXT record with v=STSv1 and a non-empty id.
  • HTTPS availability of the MTA-STS policy file and presence of version, mode, mx, and max_age fields.
  • Presence of a TLS-RPT _smtp._tls TXT record with a valid rua=mailto: destination.

3. Interpreting results

A high score means compatible senders can discover and enforce the transport policy.

  • Pass: the policy is published, fetchable, in enforce mode, and has suitable MX and max_age values.
  • Warn: the policy exists but is still in testing, or TLS-RPT/max_age needs improvement.
  • Fail: DNSprobe cannot find a usable policy or the HTTPS policy file is missing.

4. Best practices

  • Deploy in testing mode first and review TLS-RPT reports.
  • Move to mode: enforce after certificates and MX hosts are stable.
  • Change the _mta-sts TXT id value whenever the policy file changes.
  • Use max_age of at least 604800 seconds once the setup is validated.

5. Manual tests

Replace example.com with your domain.

dig TXT _mta-sts.example.com +short
dig TXT _smtp._tls.example.com +short
curl -I https://mta-sts.example.com/.well-known/mta-sts.txt
curl https://mta-sts.example.com/.well-known/mta-sts.txt

The file must be served over HTTPS with a valid certificate for mta-sts.example.com.

⚙️ Configuration