Sign inMonitor a domain

Do senders have to use encryption when they deliver to me?

By default, servers delivering mail to you use TLS only if it’s offered and don’t check the certificate, so an attacker in the path can downgrade it. MTA-STS publishes a policy that says “always use verified TLS to these MX hosts”; TLS-RPT gets you daily reports when that fails.

Setting up MTA-STS

  1. Publish a policy file at https://mta-sts.yourdomain/.well-known/mta-sts.txt, served as text/plain with a valid certificate (redirects aren’t allowed). List every MX host and start with mode: testing.
  2. Add a TXT record at _mta-sts: v=STSv1; id=20261005. Change the id whenever the policy changes, so senders refetch it.
  3. Add TLS-RPT at _smtp._tls: v=TLSRPTv1; rua=mailto:tls-reports@yourdomain, and read the reports for a couple of weeks.
  4. When the reports are clean, switch the policy to mode: enforce and bump the id.

Is it worth it?

It protects mail coming to you, not mail you send, and only from sending servers that support MTA-STS. It is optional, so the Domain Health grade doesn’t count a missing policy against you, but a published policy that is broken costs a few points, because senders that honour it may refuse to deliver.

Sources

  1. RFC 8461: SMTP MTA Strict Transport Security · checked 5 Oct 2026
  2. RFC 8460: SMTP TLS Reporting · checked 5 Oct 2026

Related tools

Domain Health Report Everything at once, graded, with the fixSPF checker Include tree and the 10-lookup limitDMARC checker RFC 9989 tree walk and policyDKIM checker Common selectors or yoursDMARC report reader Parsed in your browserDNS lookup Any record, with TTLs explainedWHOIS / RDAP Registrar, expiry, status codes