Back to Course
Լight modeDark mode

The MTA-STS Policy File

The MTA-STS policy file is essentially a simple text file, which looks like the following:

version: STSv1
mode: enforce
mx: mx1.powerdmarc.com
mx: mx2.powerdmarc.com
mx: mx3.powerdmarc.com
max_age: 604800

Note: The version field must be included at the beginning of the text file while other fields can be incorporated in any order.

The policy file uses key-value pairing with each value encoded on a separate line in the text file as shown above. The size of this file can extend up to 64 KB. The name of the policy file must be mta-sts.txt. Policy files are required to be updated every time you add or alter mail servers in your domain.

Note: Setting MTA-STS in enforcement mode can cause some emails not to be delivered to you. Therefore it is advisable to set the policy mode to testing instead and opt for a low max_age to ensure that everything is working correctly before shifting to enforce the policy. We recommend setting up TLS-RPT for your policy in testing mode as well to get notified in case emails are sent in plaintext.

Publishing the MTA-STS Policy File

In order to publish the MTA-STS policy file, the web server that hosts your file must:
  • Support HTTPS/SSL
  • The server certificate must be signed and validated by a third-party root certificate authority.

In order to publish a policy file for your domain, you should set up a public web server with the subdomain “mta-sts” added to your domain.. The created policy file must be published in the .well-known directory created in the subdomain. The URL for your uploaded MTA-STS policy file might appear something like this:

https://mta-sts.powerdmarc.com/.well-known/mta-sts.txt

MTA-STS DNS Record

A TXT DNS record for MTA-STS is published on the DNS of your domain to specify that your domain supports MTA-STS protocol and to signal for refreshing the cached values in the MTAs in case the policy is altered. The MTA-STS DNS record is placed at subdomain _mta-sts like in: _mta-sts.powerdmarc.com. The TXT record must commence with v=STSv1, and the “id” value can contain up to 32 alphanumeric characters, included in the following way:

 v=STSv1; id=30271001S00T000;

Note: The TXT record id value must be updated to a new value every time you make changes to the policy. 

The MTA-STS DNS Record is used to: 
  • Specify support for MTA-STS for the domain
  • Signal the MTA to re-fetch the policy over HTTPS in case the policy is altered

Note that with the MTA-STS TXT DNS record, the policy file can be stored by MTAs for a longer time period without having to re-fetch the policy unless it has been altered, while still performing a DNS query every time an email is received for the domain.

Configuring MTA-STS for Your Domain

In order to enable MTA-STS for your domain you would be required to:

  • Add a CNAME type DNS record at mta-sts.example.com, directed towards the HTTPS-enabled web server that is hosting the MTA-STS policy file.
 
  • Add a TXT or CNAME type DNS record at _mta-sts.example.com which specifies support for MTA-STS for your domain.

 

  • Set up an HTTPS-enabled web server with a valid certificate
MTA-STS & TLS-RPT Advanced >The MTA-STS Policy File
Course content
Advanced Email Authentication Course