Question 1

What is MTA-STS?

Accepted Answer

MTA-STS (RFC 8461) is a mechanism that allows receiving mail domains to declare their ability to receive TLS-secured connections and to specify whether sending servers should refuse to deliver to MX hosts that don't offer TLS with a trusted certificate.

Question 2

How does MTA-STS work?

Accepted Answer

It requires two things: a DNS TXT record at _mta-sts.yourdomain.com declaring the policy version, and a policy file served over HTTPS at https://mta-sts.yourdomain.com/.well-known/mta-sts.txt containing the mode (enforce/testing), MX hosts, and max age.

Question 3

What is the difference between enforce and testing mode?

Accepted Answer

In 'enforce' mode, sending servers must refuse to deliver if TLS negotiation fails. In 'testing' mode, delivery proceeds but failures are reported via TLS-RPT. Start with testing, then switch to enforce once confirmed.

Question 4

Do I need TLS-RPT with MTA-STS?

Accepted Answer

Yes, it's strongly recommended. TLS-RPT lets you know when sending servers encounter TLS problems delivering to your domain. Without it, you're blind to failures especially in testing mode.