Agent Wranglers

Standard addresses Optional

Require encrypted mail delivery

If the domain receives email, publish an MTA-STS policy, so other mail servers deliver to it only over checked TLS.

By Erik Bergstedt, Agent Wranglers. Updated .

How to do it

Serve /.well-known/mta-sts.txt on the host mta-sts.example.com over HTTPS, as RFC 8461 sets out. Add a _mta-sts TXT record with a policy id, and change the id whenever the policy changes. Add a _smtp._tls TXT record for failure reports (RFC 8460). Start with mode: testing.

Example

version: STSv1
mode: enforce
mx: mail.example.com
max_age: 604800
_mta-sts.example.com.  3600  IN  TXT  "v=STSv1; id=20261020T000000"
_smtp._tls.example.com.  3600  IN  TXT  "v=TLSRPTv1; rua=mailto:tls-reports@example.com"

How to check

curl https://mta-sts.example.com/.well-known/mta-sts.txt returns the policy as text/plain. A mail test such as internet.nl shows MTA-STS.

For agents: if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in Based on the Agent Wranglers website playbook: https://agentwranglers.se/playbook/website/standard-addresses/mta-sts.