MTA-STS and TLS-RPT explained: enforcing TLS for inbound mail

MTA-STS (RFC 8461) lets your domain publish a policy saying that senders should deliver mail only over authenticated TLS to your listed mail servers. TLS-RPT (RFC 8460) gives you reports on delivery failures. Together they defend against downgrade attacks on mail in transit, which SPF, DKIM and DMARC do not address.

The problem

SMTP encryption through STARTTLS is opportunistic. RFC 8461 explains that an attacker who can delete the "250 STARTTLS" response, or redirect the session by overwriting the resolved MX record, can perform downgrade or interception attacks. The sender usually falls back to plaintext without anyone noticing.

MTA-STS lets the receiving domain say in advance: expect TLS with a valid certificate on these hosts, and here is what to do if it cannot be negotiated.

The two pieces of an MTA-STS policy

A DNS TXT record at _mta-sts.yourdomain, which carries a policy id:

_mta-sts.example.com.  IN TXT  "v=STSv1; id=20261019T000000Z"

A policy file served over HTTPS at https://mta-sts.yourdomain/.well-known/mta-sts.txt:

version: STSv1
mode: testing
mx: mail.example.com
max_age: 604800

The mx lines list allowed mail hosts. The max_age is how long senders may cache the policy, in seconds, with a maximum of 31557600. The RFC expects it to be in the range of weeks or more. Change the id in DNS whenever you change the file so senders refetch it.

The three modes

• none: senders treat the domain as having no active policy. The RFC uses this mode when you remove MTA-STS.
• testing: senders that implement TLS-RPT report failures but still deliver mail.
• enforce: senders must not deliver the message if TLS with a valid certificate cannot be established to a listed host.

Start in testing. Move to enforce when reports are clean.

Adding TLS-RPT

TLS-RPT is a TXT record at _smtp._tls.yourdomain naming where reports go:

_smtp._tls.example.com.  IN TXT  "v=TLSRPTv1; rua=mailto:tls-reports@example.com"

RFC 8460 says the schema covers failures in routing, DNS resolution and STARTTLS negotiation, plus policy validation errors for both DANE and MTA-STS. Reports also work as a heartbeat showing that TLS negotiates as expected.

Rollout plan

1. Confirm every MX host presents a valid, unexpired certificate whose name matches the host.
2. Publish TLS-RPT first and watch reports for a week.
3. Publish the MTA-STS policy in testing mode with a modest max_age.
4. Read reports, fix any certificate or hostname problems.
5. Switch to enforce, and raise max_age once stable.
6. Add certificate expiry monitoring. An expired certificate under enforce means delayed or bounced mail.

MTA-STS only helps if sending servers support it. It protects mail from senders that check, not from every sender.

Quick check

Sources

• RFC 8461, SMTP MTA Strict Transport Security
• RFC 8460, SMTP TLS Reporting

Last reviewed: 19 October 2026.