How to set up MTA-STS and TLS-RPT

SPF, DKIM and DMARC authenticate who sent mail — MTA-STS (RFC 8461) protects mail in transit to you: it tells sending servers your domain requires TLS delivery to verified MX hosts, closing off downgrade and man-in-the-middle attacks. TLS-RPT (RFC 8460) gets you daily reports on delivery failures, so you can see problems before enforcing.

Set up TLS-RPT first, then MTA-STS in testing mode — the order Google recommends — so reports exist before any policy can affect delivery.

1. TLS-RPT: one TXT record

Publish at _smtp._tls.yourdomain.com (exactly one record — senders ignore TLS-RPT entirely if more than one valid record exists):

_smtp._tls  TXT  "v=TLSRPTv1; rua=mailto:tls-reports@yourdomain.com"

Any mailbox works — unlike DMARC, TLS-RPT needs no authorization record for external destinations, and reporters must deliver reports even when TLS itself is broken, so a same-domain address is safe.

2. MTA-STS: a TXT record + a policy file

The TXT record at _mta-sts.yourdomain.com just signals that a policy exists — the id (1–32 letters/digits) must change every time you change the policy; a timestamp is the convention:

_mta-sts  TXT  "v=STSv1; id=20260717T120000"

The policy itself is a plain-text file served at exactly https://mta-sts.yourdomain.com/.well-known/mta-sts.txt — HTTPS with a certificate valid for the mta-sts subdomain; redirects are not followed:

version: STSv1
mode: testing
mx: mail.yourdomain.com
mx: *.yourprovider.example
max_age: 604800

• ·List every MX host pattern your domain uses — a *. wildcard matches only the entire left-most label.
• ·Start in mode: testing with a 1–2 week max_age (604800–1209600), watch the TLS-RPT reports for ~2 weeks, then switch to mode: enforce and raise max_age (up to ~1 year).
• ·When changing the policy: update the file first, then the TXT record's id (RFC 8461's ordering).

Hosting the policy file

Any static host works — the requirements are only the mta-sts subdomain, the .well-knownpath, and a trusted certificate. If Cloudflare Email Routing handles your mail, Cloudflare's doc describes a two-part setup: a _mta-sts CNAME (which delegates only the TXT record) plus a small Worker that serves the policy file at mta-sts.yourdomain.com — the CNAME alone advertises a policy that is never served. Note their hosted policy is enforce-mode from day one, skipping the testing phase above. The UK government's security guidance (security.gov.uk) has a solid vendor-neutral walkthrough. Gmail honors enforced MTA-STS policies when sending to your domain.

Facts verified against RFC 8461, RFC 8460, and Google Workspace's MTA-STS documentation on 2026-07-17.