Skip to content
ZeroHook | SecurityTools

What is / Full version

MTA-STS

The TXT record at _mta-sts is the policy id. The policy file is fetched over HTTPS. mode is testing, enforce, or none.

Short answer

Two publishes

Sending servers discover the policy id in a TXT record named _mta-sts at the domain. For example.com the name is _mta-sts.example.com. The example in the RFC is v=STSv1; id=20160831085700Z;.

The id is how a sender tells that a cached policy is stale without fetching the file. When the id changes, the policy changed.

The policy file

The file is served at the well-known path .well-known/mta-sts.txt on the policy host. The RFC's example URL is https://mta-sts.example.com/.well-known/mta-sts.txt.

mode is testing, enforce, or none. enforce means sending servers must not deliver to an MX that fails the policy. testing is for detecting failures without that block. none is how a domain tells senders to drop a policy they have cached.