MTA-STS and TLS-RPT: Encrypt Mail Between Servers
MTA-STS publishes a policy that requires TLS for inbound SMTP. TLS-RPT reports delivery failures. Learn policy hosting, DNS records, and how this layer complements DMARC without replacing it.
MTA-STS (Mail Transfer Agent Strict Transport Security) lets a domain publish a policy that receiving MTAs should use TLS when delivering mail to you. TLS-RPT (SMTP TLS Reporting) gives senders a place to report failures when that policy cannot be met. Together they harden the hop between mail servers — a different problem from SPF, DKIM, and DMARC, which authenticate the message and From domain.
Use this guide after your DMARC setup is healthy. MTA-STS does not replace DMARC; it closes a transport gap DMARC never covered.
What you publish
- DNS TXT at
_mta-sts.example.compointing receivers at your policy identity. - HTTPS policy file at
https://mta-sts.example.com/.well-known/mta-sts.txtwith mode, MX list, and max age. - DNS TXT at
_smtp._tls.example.comwith arua=mailbox for TLS-RPT JSON reports.
version: STSv1 mode: testing mx: mail.example.com max_age: 604800
Modes: testing vs enforce
Start in testing so senders report problems without refusing delivery. Move to enforce only when TLS-RPT shows clean deliveries to every MX you listed and your certificates on those hosts stay valid. A wrong MX name or expired cert under enforce turns into delayed or bounced mail.
List every MX that should receive mail. Forgotten backup hosts are a common reason enforce mode hurts you.
TLS-RPT without drowning
TLS-RPT reports arrive as JSON (often gzipped) to your rua address. Triage by failure type: certificate name mismatch, expired cert, and policy fetch errors. Fix the host before you blame the sender. Keep reporting after you enforce so new MX changes surface quickly.
How this fits PatchPings scans
A PatchPings DNS health scan and the DMARC checker focus on SPF, DKIM, and DMARC. MTA-STS is a separate HTTPS + DNS policy for SMTP TLS. After you publish it, verify the policy host serves HTTPS cleanly and confirm _mta-sts and _smtp._tls TXT records resolve — then keep watching MX certificate expiry under monitoring.
- 1Inventory MX hostnames and confirm each has a valid certificate.
- 2Publish the policy host and TXT records in
testingmode. - 3Watch TLS-RPT for a full mail cycle.
- 4Switch to
enforceand keep reports forever.
MTA-STS makes opportunistic SMTP TLS policy-backed. Pair it with strong DMARC and honest certificate hygiene so mail is both authenticated and delivered over TLS when peers support the policy.
