Setup & Records

Hosted MTA-STS: require encrypted delivery to your domain

Mail between servers is normally encrypted only if both sides happen to agree to it, which leaves room for an attacker to force it back to plain text. MTA-STS lets you publish a rule that says "always use encryption when delivering to me". DMARCS hosts the rule so you don't need to run a web server for it.

Where to find it

Setup & Records → Hosted MTA-STS

Time needed

5 minutes

You will need

Your MX hostnames (the mail servers that receive your email)

Set it up

1. Pick the domain
2. Choose a policy mode
   • Testing: receivers report problems but still deliver. Start here.
   • Enforce: receivers refuse to deliver without valid TLS. Switch to this once TLS Reports show a clean run.
   • None: policy published but switched off.
3. Set Max Age

   How long receivers cache your policy. The default of one day is fine while testing; raise it once you're in Enforce.

4. List your allowed MX patterns

   One per line. These are the hostnames of the servers that receive your mail, for example *.mail.protection.outlook.com for Microsoft 365. Wildcards are allowed.

5. Publish to DNS

   Click Publish to DNS. DMARCS writes both records MTA-STS needs (a CNAME for the mta-sts host pointing at DMARCS, plus the TXT discovery record) and hosts the policy file itself.

Reading the status card

• Live and active. Receivers can fetch your policy.
• DNS lookup failed. Usually a temporary resolver hiccup, not a broken setup. Click retry.
• Not configured. Nothing published yet.

Pair it with TLS Reports

MTA-STS on its own is a rule with no feedback. TLS Reports show you whether receivers are actually managing to deliver to you over TLS, and which ones are failing, so you know it's safe to move from Testing to Enforce. That needs one more TXT record (_smtp._tls), which is not part of what Hosted MTA-STS publishes; the TLS Reports article has the exact value.