MTA-STS lets a domain tell sending mail servers to deliver only over TLS with a valid certificate, and to refuse delivery rather than fall back to plaintext.
_mta-sts.gmail.com. 249 IN TXT "v=STSv1; id=20190429T010101;"
; MTA-STS policy announced; the id changes whenever the policy file changes
_mta-sts.google.com. 300 IN TXT "v=STSv1; id=20210803T010101;"
; MTA-STS policy announced; the id changes whenever the policy file changes
_mta-sts.microsoft.com. 3600 IN TXT "v=STSv1; id=20190225000000Z;"
; MTA-STS policy announced; the id changes whenever the policy file changes
SMTP encryption (STARTTLS) is opportunistic: an attacker who can strip the STARTTLS offer or present any certificate can read mail in transit. MTA-STS closes that gap. The TXT record at _mta-sts.<domain> announces that a policy exists, and the policy itself is served over HTTPS from https://mta-sts.<domain>/.well-known/mta-sts.txt, which ties it to the web PKI rather than to DNS alone.
Senders cache the policy for max_age seconds and re-fetch it when the id in the TXT record changes. In enforce mode they deliver only to MX hosts that match an mx: line and present a valid certificate for that name.
_mta-sts.example.com. 3600 IN TXT "v=STSv1; id=20261110T000000"
# https://mta-sts.example.com/.well-known/mta-sts.txt
version: STSv1
mode: enforce
mx: mx1.example.com
mx: *.mail.example.net
max_age: 604800Wire format: A TXT record plus a text/plain file over HTTPS. Redirects on the policy URL must not be followed.
| Field | Meaning |
|---|---|
| v | STSv1. |
| id | 1-32 letters/digits; change it on every policy update. |
| mode | enforce, testing (report only) or none (withdraw). |
| mx | Allowed MX host; *. matches exactly one leftmost label. Repeat for each host. |
| max_age | Cache lifetime in seconds, up to 31557600 (one year). |
mta-sts.<domain>.id, so senders keep using their cached copy.