MTA-STS record
MTA-STS tells other mail servers to always use an encrypted, verified connection when delivering to you, and to refuse to deliver if they can't. It has two parts: a TXT record at _mta-sts announcing the policy, and a small policy file served over HTTPS.
| Record type | TXT (MTA-STS is a standard carried in TXT records) |
|---|---|
| Lives at | _mta-sts |
| Used for | |
| How common | Common |
| Defined in | RFC 8461 |
Format
_mta-sts <ttl> IN TXT "v=STSv1; id=<policy id>"
| Field | What it means | Accepted values |
|---|---|---|
| v=STSv1 | Marks the record. | STSv1 |
| id= | Changes whenever the policy file changes, so senders fetch it again. | 1 to 32 letters and digits, such as a date 20261024. |
Check an MTA-STS record
Type or paste a record in zone-file form (name, TTL, type, value) or just its value. Each part is explained as you type.
A valid TXT record (MTA-STS announcement).
| Part | What it means |
|---|---|
| Name_mta-sts | A service name. Underscore names hold records for a protocol (such as _dmarc or _sip._tcp), not a website. |
| TTL3600 | Resolvers may keep this answer for 1 hour before asking again. Changes can take that long to reach everyone. |
| ClassIN | Internet. Every record you'll write uses IN. |
| TypeTXT | Free text: SPF, DKIM, DMARC, verification. |
| Textv=STSv1; id=20261024 | 20 bytes. |
| vv=STSv1 | Must be STSv1. |
| idid=20261024 | Changes whenever the policy file changes, so senders know to fetch it again. 1 to 32 letters and digits; a timestamp works well. |
- NoteThis record only announces the policy. The policy itself is a file at https://mta-sts.<your domain>/.well-known/mta-sts.txt.
Examples
The DNS record
_mta-sts 3600 IN TXT "v=STSv1; id=20261024"
Announces that a policy exists.
The policy file
version: STSv1 mode: enforce mx: smtp.google.com max_age: 604800
Served at https://mta-sts.example.com/.well-known/mta-sts.txt with a valid certificate. Start with mode: testing.
Setting it up
- Publish a TLS-RPT record first, so you get reports.
- Host the policy file at https://mta-sts.yourdomain/.well-known/mta-sts.txt, with mode: testing and an mx: line for each MX host.
- Add the _mta-sts TXT record.
- After a week or two of clean reports, switch to mode: enforce and change the id.
See it on a real domain
TTL
3600. How TTL works
Common mistakes
- Changing the policy file without changing id=, so senders keep the old one until max_age runs out.
- Leaving out an MX host from the policy, so mail via that host is refused in enforce mode.
- Serving the policy over plain http or with an invalid certificate.
At your DNS host
- Any DNS host: a TXT record at _mta-sts. The policy file needs a web host for mta-sts.yourdomain.
Questions
Do I need MTA-STS?
It protects mail sent to you from being read or diverted on the way. It's optional but recommended for business domains, and easy with a static host for the policy file.
This page is also available as Markdown.
Lemon Domains keeps every domain you own in one place, with expiry reminders, change monitoring and DNS editing from your AI assistant. Get started free