Skip to content
Hookgap
Get started

MTA-STS in 10 minutes for Microsoft 365 and Google Workspace

· 6 min read

When another company's mail server sends email to your domain, encryption in transit is optional by default. An attacker in the middle can strip it. MTA-STS (RFC 8461) lets you publish a policy that says "only deliver to my real mail servers, and only over a verified encrypted connection". TLS-RPT (RFC 8460) sends you reports when delivery to you fails that test.

You need three things: a policy file, a DNS record announcing it, and (strongly recommended) a reporting record.

1. Write the policy file

For Microsoft 365, whose MX looks like yourdomain-com.mail.protection.outlook.com:

version: STSv1
mode: testing
mx: *.mail.protection.outlook.com
max_age: 604800

For Google Workspace, list the MX hosts your domain actually uses. Older setups use aspmx.l.google.com and its alt hosts; newer ones use smtp.google.com:

version: STSv1
mode: testing
mx: smtp.google.com
mx: aspmx.l.google.com
mx: *.aspmx.l.google.com
max_age: 604800

Check your real MX records first. Every MX host must match an mx: line, and a wildcard matches exactly one label (*.aspmx.l.google.com matches alt1.aspmx.l.google.com, not aspmx.l.google.com).

2. Host it over HTTPS

The file must be served at exactly:

https://mta-sts.yourdomain.com/.well-known/mta-sts.txt

with a valid, publicly trusted certificate for mta-sts.yourdomain.com, as text/plain, and without redirects. Any static host with HTTPS and a custom domain works:

  • A small Cloudflare Worker or Pages project (free)
  • GitHub Pages with a custom domain
  • Azure Static Web Apps (Microsoft documents this route)
  • Your existing website host, if it can serve a subdomain

3. Publish the DNS records

_mta-sts.yourdomain.com     TXT  "v=STSv1; id=20261018"
_smtp._tls.yourdomain.com   TXT  "v=TLSRPTv1; rua=mailto:tlsrpt@yourdomain.com"

The id can be any short string. Change it every time you change the policy file. Senders only re-fetch the policy when the id changes.

4. Test, then enforce

  1. Leave mode: testing for one to two weeks. Mail is delivered as before, and TLS-RPT reports show whether any sender would have failed.
  2. If the reports are clean, switch to mode: enforce, raise max_age (for example to 31557600, one year), and update the id in the TXT record.
  3. If you ever change mail provider, update the policy (and id) before you switch MX records. An enforced policy listing old MX hosts will make senders refuse to deliver.

Check your work

Run a free Hookgap check on the domain. The Email security section shows the MTA-STS mode it found and whether TLS reporting is enabled.

Keep reading