How to set up MTA-STS for your domain
MTA-STS makes servers that send you email insist on an encrypted connection instead of falling back to plain text. It only matters if the domain receives email.
You need both the DNS record and a policy file served over HTTPS from the mta-sts subdomain — the record alone does nothing. Start in mode: testing.
How to fix it
DNS registrar + web host
Where: your DNS provider, and a web host for the mta-sts. subdomain
1) DNS Type: TXT Name: _mta-sts Value: "v=STSv1; id=20260101" 2) DNS point mta-sts.yourdomain.com at a host that serves HTTPS with a valid certificate 3) File https://mta-sts.yourdomain.com/.well-known/mta-sts.txt : version: STSv1 mode: testing mx: mail.yourdomain.com max_age: 86400
MTA-STS makes servers that send you email insist on encryption. List every MX host of yours on its own 'mx:' line, start in mode: testing, switch to mode: enforce once TLS-RPT reports are clean, and change the id whenever the policy changes.
How to confirm: Check with an MTA-STS validator (e.g. mxtoolbox.com/mta-sts).
Not sure your site needs this fix? A scan checks this and dozens of other things and shows what yours is missing.
Scan your site free