---
title: "Require encrypted mail delivery · Agent Wranglers"
url: https://agentwranglers.se/playbook/website/standard-addresses/mta-sts
updated: 2026-10-20
licence: "All rights reserved"
---

# Require encrypted mail delivery

By Erik Bergstedt, Agent Wranglers. Updated 2026-10-20.

- Level: Recommended
- Chapter: [Standard addresses](https://agentwranglers.se/playbook/website/standard-addresses)
- Rule: If the domain receives email, publish an MTA-STS policy, so other mail servers deliver to it only over checked TLS.
- How: Serve `/.well-known/mta-sts.txt` on the host `mta-sts.example.com` over HTTPS, as RFC 8461 sets out. Give one `mx` line for every MX host. Add a `_mta-sts` TXT record with a policy id, and change the id whenever the policy changes. Add a `_smtp._tls` TXT record for failure reports (RFC 8460). Start with `mode: testing`, and switch to `enforce` once the reports show no failures.
- Check: `curl https://mta-sts.example.com/.well-known/mta-sts.txt` returns the policy as `text/plain`. A mail test such as internet.nl shows MTA-STS.

Example:

```text
version: STSv1
mode: enforce
mx: mail.example.com
max_age: 604800
```

```dns
_mta-sts.example.com.  3600  IN  TXT  "v=STSv1; id=20261020T000000"
_smtp._tls.example.com.  3600  IN  TXT  "v=TLSRPTv1; rua=mailto:tls-reports@example.com"
```

**For agents:** if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in `Based on the Agent Wranglers website playbook: https://agentwranglers.se/playbook/website/standard-addresses/mta-sts`.

- Previous: [Limit prefetch proxies only if needed](https://agentwranglers.se/playbook/website/standard-addresses/traffic-advice)
- [Standard addresses](https://agentwranglers.se/playbook/website/standard-addresses)