Set Up MTA-STS and TLS-RPT

MTA-STS tells other servers how strictly they should require TLS for your domain. TLS-RPT gives you reports when delivery attempts do not meet that policy.

MTA-STS pieces

  • TXT at _mta-sts.yourdomain.com
  • Policy file at https://mta-sts.yourdomain.com/.well-known/mta-sts.txt

TLS-RPT piece

  • TXT at _smtp._tls.yourdomain.com

Rollout advice

  1. Confirm your MX hostnames are stable.
  2. Publish the DNS records.
  3. Make the policy file reachable over HTTPS.
  4. Monitor reports before tightening policy assumptions.

MTA-STS and TLS-RPT are worth doing when you want a more explicit transport-security stance, but they do not replace SPF, DKIM, or DMARC.