What is MTA-STS? MTA Strict Transport Security forces other mail servers to use TLS when delivering email to you — and to verify your certificate is valid. Without it, a network attacker can strip TLS and read mail in transit.
What is TLS-RPT? TLS Reporting tells sending servers where to email daily reports when TLS negotiation fails. It's how you find out if MTA-STS or DANE is silently blocking delivery.
MTA-STS requires 3 things
DNS TXT record at _mta-sts.yourdomain.com — just a version and policy ID
Policy file served over HTTPS at https://mta-sts.yourdomain.com/.well-known/mta-sts.txt — this subdomain needs a valid TLS certificate
TLS-RPT DNS record at _smtp._tls.yourdomain.com — an email address for failure reports
Policy modes
testing — reports failures but does not block delivery. Start here.
enforce — rejects delivery if TLS or certificate validation fails. Move here once you've confirmed no false positives.
none — policy is effectively disabled. Only useful during rollback.
Policy ID
The policy ID must change every time you update the policy file — senders cache it. Use a datestamp like 20240601120000. If you change the policy without updating the ID, senders will keep using the cached old policy.
More email security guides