# MTA-STS record

MTA-STS tells other mail servers to always use an encrypted, verified connection when delivering to you, and to refuse to deliver if they can't. It has two parts: a TXT record at _mta-sts announcing the policy, and a small policy file served over HTTPS.

- Record type: TXT (MTA-STS is carried in TXT records)
- Lives at: _mta-sts
- Used for: Email
- How common: Common
- Defined in: RFC 8461

## Format

```
_mta-sts <ttl> IN TXT "v=STSv1; id=<policy id>"
```

| Field | What it means | Accepted values |
| --- | --- | --- |
| v=STSv1 | Marks the record. | `STSv1` |
| id= | Changes whenever the policy file changes, so senders fetch it again. | 1 to 32 letters and digits, such as a date `20261024`. |

## Examples

### The DNS record

```
_mta-sts 3600 IN TXT "v=STSv1; id=20261024"
```

Announces that a policy exists.

### The policy file

```
version: STSv1
mode: enforce
mx: smtp.google.com
max_age: 604800
```

Served at https://mta-sts.example.com/.well-known/mta-sts.txt with a valid certificate. Start with mode: testing.

## Setting it up

- Publish a [TLS-RPT](https://lemon.domains/dns-records/tls-rpt) record first, so you get reports.
- Host the policy file at https://mta-sts.yourdomain/.well-known/mta-sts.txt, with mode: testing and an mx: line for each MX host.
- Add the _mta-sts TXT record.
- After a week or two of clean reports, switch to mode: enforce and change the id.

## TTL

3600.

## Common mistakes

- Changing the policy file without changing id=, so senders keep the old one until max_age runs out.
- Leaving out an MX host from the policy, so mail via that host is refused in enforce mode.
- Serving the policy over plain http or with an invalid certificate.

## At your DNS host

- Any DNS host: a TXT record at _mta-sts. The policy file needs a web host for mta-sts.yourdomain.

## Questions

### Do I need MTA-STS?

It protects mail sent to you from being read or diverted on the way. It's optional but recommended for business domains, and easy with a static host for the policy file.

## Related

- [TLS-RPT record](https://lemon.domains/dns-records/tls-rpt.md)
- [MX record](https://lemon.domains/dns-records/mx.md)
- [TLSA record](https://lemon.domains/dns-records/tlsa.md)
- [DMARC record](https://lemon.domains/dns-records/dmarc.md)

Interactive version with a record checker and live lookup: https://lemon.domains/dns-records/mta-sts