MTA-STS and TLS reporting

Optional DNS and web records that make other mail servers insist on encrypted delivery to your custom domain, and report failures.

MTA-STS tells other mail servers to deliver to your domain only over a verified encrypted connection. TLS-RPT sends you reports when that fails. Both are optional. They protect mail sent to your domain, not mail you send.

Before you start#

  • Your domain is verified in SipherMail and its MX record points to mail.siphermail.com. See Custom domains.
  • You can host one small text file over HTTPS on mta-sts. plus your domain, with a valid certificate. SipherMail does not host this file for custom domains.
  • You have a mailbox on your own domain to receive reports.

The records#

  1. Publish a TXT record at _smtp._tls on your domain with the value v=TLSRPTv1; rua=mailto: followed by your report mailbox.
  2. Serve the policy file at https://mta-sts.yourdomain/.well-known/mta-sts.txt:
version: STSv1
mode: testing
mx: mail.siphermail.com
max_age: 86400
  1. Publish a TXT record at _mta-sts on your domain with the value v=STSv1; id= followed by a number such as the date, 20261101. Change the id every time you change the policy file.

Testing first#

mode: testing asks senders to report problems but still deliver mail. Leave it for at least two weeks and read the reports. They are JSON files that list sending servers and any failures.

When there are no failures from real senders:

  1. Change mode to enforce.
  2. Raise max_age to a longer value, for example 604800 (one week).
  3. Change the id in the _mta-sts record so senders fetch the new policy.

To back out, set mode: none, change the id, and wait out the old max_age before removing the records.

Check it#

The Email authentication checkup on your domain in the Org Panel shows whether the MTA-STS and TLS-RPT records are published. It does not read the policy file, so open the policy URL in a browser to confirm it loads.

Last updated 1 November 2026