MTA-STS and TLS-RPT

Mail servers usually encrypt connections between each other with STARTTLS. Without further measures, that’s optional: an attacker on the network can suppress STARTTLS and the mail goes through unencrypted. MTA-STS prevents this. With it, your domain publishes a policy telling sending servers: only deliver to these mail servers over valid TLS. TLS-RPT adds reports when a delivery fails because of TLS.

The MTA-STS und TLS-RPT tool in the Mail category checks both. It requires a license.

How MTA-STS is built

MTA-STS has two parts:

Part	Location	Example
TXT record	_mta-sts.<domain>	v=STSv1; id=20260115
policy file	https://mta-sts.<domain>/.well-known/mta-sts.txt	see below

The policy file looks something like this:

version: STSv1
mode: enforce
mx: mail.example.com
mx: *.example-backup.com
max_age: 604800

The id in the TXT record must change whenever the policy file changes, or senders won’t notice the new policy.

How to check

Enter the domain and click Prüfen (check). The app queries both TXT records and the MX records, fetches the policy file and compares it with the actual mail servers. The Records table shows the TXT records found, MTA-STS-Policy the fields of the policy file. The full HTTP response is under Rohdaten (raw data).

MTA-STS findings

Finding (as shown in the app)	Meaning and what to do
Kein MTA-STS	Warning: TLS between mail servers can be switched off. Create the record and the policy file.
MTA-STS-Record ohne gültige id	id= must contain 1 to 32 letters or digits.
Policy liefert HTTP …	The file must be reachable with status 200 and without redirects. The app deliberately doesn’t follow redirects.
Policy: keine Antwort nach 10 s	The web server for mta-sts.<domain> is missing or not responding. It needs a valid certificate for exactly that name.
Content-Type „…“	The file must be served as text/plain.
Policy: version muss „STSv1“ sein	Fix the version line.
Policy: mode muss enforce, testing oder none sein	Fix the mode field.
Policy: max_age …	Missing, not a number or over a year is an error. Under a day gives a warning; weeks are recommended, for example 604800.
Policy: Keine mx-Zeile	An mx line is mandatory in enforce and testing modes.
Modus „enforce“	OK: delivery only over valid TLS.
Modus „testing“	Warning: failures are only reported, not prevented. Switch to enforce after the test phase.
Modus „none“	MTA-STS is switched off.
MX … fehlt in der Policy	One of the domain’s mail servers matches no mx line. Senders using MTA-STS won’t deliver to it. In enforce mode this is an error.

A wildcard like *.example.com covers exactly one label, so mx1.example.com but not a.mx.example.com.

TLS-RPT findings

The TLS-RPT record lives at _smtp._tls.<domain>, for example v=TLSRPTv1; rua=mailto:tls-reports@example.com.

Finding	Meaning
Kein TLS-RPT	Note: you won’t learn when senders can’t deliver because of TLS problems.
TLS-RPT-Berichte an …	OK.
TLS-RPT ohne rua	rua= is missing; it says where reports go.
TLS-RPT: ungültiges Ziel	Only mailto: and https: are allowed.

Order of setup

1. Create the TLS-RPT record so you receive reports.
2. Publish the policy file with mode: testing and all MX hosts, plus the _mta-sts record.
3. Analyze reports for a few weeks.
4. Switch to mode: enforce and change the id in the TXT record.

Use the SMTP test beforehand to verify that every mail server offers STARTTLS with a valid certificate. Otherwise, with enforce, senders stop delivering to it.

In the browser

In the web version, CORS usually blocks fetching the policy file. The app reports this as a note. The desktop app checks the file fully.