MTA-STS & TLS-RPT

Included with Email Authentication Plus ($12/month) and above.

1. What This Feature Does

MTA-STS (RFC 8461) tells other mail servers to deliver mail to your domain only over a verified, encrypted connection — and to hold the message rather than fall back to plain text. It has three parts, and CertaDNS runs all of them:

• A policy file served over HTTPS at https://mta-sts.<your domain>/.well-known/mta-sts.txt, listing your mail servers and the mode.
• A certificate for mta-sts.<your domain>, issued and renewed for you.
• A TXT record at _mta-sts.<your domain> carrying the current policy id, so senders know when to fetch the policy again.

TLS-RPT (RFC 8460) is the companion. A record at _smtp._tls.<your domain> asks sending servers to report back when they could not deliver to you securely. CertaDNS receives those reports and shows them under Reporting > TLS Reports.

2. When You Should Use It

• You want mail sent to your domain to require encryption, so it cannot be silently downgraded to plain text in transit.
• You want to hear when senders fail to reach your mail servers securely — an expired certificate or a name mismatch — before a customer tells you.
• You would rather not run a web host and certificate renewal just to serve one small policy file.

3. When You Should Not Use It

• The domain does not receive mail. MTA-STS and TLS-RPT only govern mail delivered to you. They are not available on parked domains for this reason.
• mta-sts.<your domain> is already in use — for example, you already serve your own MTA-STS policy. There can only be one policy host.
• Your mail servers cannot yet present a valid certificate. Start in testing mode and read the TLS reports before enforcing.
• You are on the Free tier. Hosted MTA-STS, TLS-RPT and TLS Reports start at Plus.

4. Prerequisites

• Email Authentication Plus or above.
• The domain added under Email Authentication > Add Domains and active. A parked domain gets DMARC and DKIM only; activate it in Email Authentication > Manage Domains to use a slot from your plan. Managed DNS is not required.
• MX records for the domain. The policy lists the servers that receive your mail.
• If your DNS is hosted elsewhere: access to add CNAME records at your DNS host. On Managed DNS, CertaDNS publishes everything in your zone and you add nothing.

5. How It Works (Brief)

Where the records live depends on where your DNS is hosted:

The exact names and targets for your domain are under Email Authentication > Manage Domains: click the edit (pencil) icon on the domain to open its DNS setup.

Certificate. For a domain whose DNS is hosted elsewhere, the certificate can only be issued once mta-sts.<your domain> points at CertaDNS, so create that CNAME first. Until it resolves, the policy shows Needs your DNS and is checked again automatically. Once issued, the certificate is renewed automatically before it expires.

Policy changes. Changing the mode, MX hosts or max_age gives the policy a new id and updates the _mta-sts record, which is what tells senders to fetch the new policy. Senders holding the old one keep using it until they see the new id or their copy reaches its max_age.

6. How to Use It

Set up MTA-STS

In Email Authentication > Hosted Services > Hosted MTA-STS:

1. Click Add MTA-STS and choose the domain.
2. Choose a Mode. Testing is the recommended start.
3. Leave max_age at one week (604800 seconds), or shorten it while testing.
4. Enter your MX hosts, one per line or comma-separated. On Managed DNS you can leave this blank and it is filled from the MX records at your domain's apex. For a domain whose DNS is hosted elsewhere, enter them yourself.
5. Click Create MTA-STS config.
6. If your DNS is hosted elsewhere, the policy shows Needs your DNS. Click See the records to create, open the domain's DNS setup with the edit (pencil) icon, create the MTA-STS policy host CNAME, then the MTA-STS policy record CNAME, and click Check again.
7. Wait for Ready. The certificate is then in place and the policy is being served.

Turn on TLS reporting

1. Go to Email Authentication > Reporting > TLS Reports and select the domain.
2. Leave Use CertaDNS managed reporting (recommended) ticked and click Publish TLS-RPT record. Reports then arrive in this view. To send them to your own mailbox instead, untick it and enter the address; they then go only there and do not appear in CertaDNS.
3. If your DNS is hosted elsewhere, create the TLS reporting CNAME shown in the domain's DNS setup under Manage Domains.

Move to enforce

Once the TLS reports show your mail servers being reached securely, change Mode on the policy to enforce. The change is saved as soon as you pick it.

Edit the MX hosts or max_age

Click the edit (pencil) icon on the policy, change the values, and click Save policy. List only the MX records of the domain itself — MX records on subdomains are never consulted. In enforce mode, leaving out a server that really receives your mail causes senders to refuse delivery to it.

Remove MTA-STS

Click the delete (bin) icon and confirm Delete policy. CertaDNS withdraws the records it publishes. If your DNS is hosted elsewhere, delete the two MTA-STS CNAMEs at your DNS host yourself. Senders that cached your policy keep applying it until its max_age runs out. To stop enforcement without deleting, set the mode to none first.

7. Inputs and Settings

8. Outputs and Results

Each MTA-STS policy shows

• The domain, its status, the current policy id and when the records were last published.
• The mode, max_age (in seconds and days) and the MX hosts.
• Status: Needs your DNS (waiting for your CNAME), Pending, Issuing cert, Retrying, Ready or Failed, with the reason where there is one.

TLS Reports shows

• Reported sessions for the last 30 days, the number of reports, and the success rate.
• Successful and Failed session counts.
• Top Failure Types, Top Failing Sending MTAs (by IP), Sessions by Policy Type and Recent Reports by reporting organisation.

Alerts

Which alerts a domain sends is set under Email Authentication > Manage Domains, in the domain's Alert monitoring panel. How they reach you is in Settings > Notifications, under Email authentication.

• An MTA-STS certificate is close to expiry — renewal has not completed. On in every preset except None.
• A published record stopped being served — for example, a CNAME was removed at your DNS host.
• A receiver reported a TLS delivery failure — on in the Comprehensive preset. Choosing individual alerts is included with Enterprise.

9. How to Interpret Results

Normal

• The policy Ready, and TLS Reports showing a success rate at or near 100%.
• No reports for the first day or two. Receivers typically start sending them within 24–48 hours of the record being published.

Worth investigating

• Certificate failure types (expired, not trusted, host mismatch) — the problem is on your mail server's certificate, not on the MTA-STS policy.
• STS policy fetch error or STS policy invalid — senders could not fetch or read your policy. Check that the mta-sts CNAME is still in place and the policy is Ready.
• Failures concentrated on one MX host — that server's certificate or configuration; or a host missing from the policy's MX list.

Common mistakes

• Enforcing before reading reports. In enforce mode, a sender that cannot verify your mail server holds the mail instead of delivering it.
• Changing MX records without updating the policy. A new mail server not in the list fails under enforce.

10. Common Issues and Explanations

"Needs your DNS" does not clear

mta-sts.<your domain> does not resolve yet, or resolves somewhere other than CertaDNS. The message on the policy says which. Create or correct the CNAME; it is picked up automatically. After 30 days of waiting the policy moves to Failed.

"Zone … has no MX records — publish MX before configuring MTA-STS…"

The MX hosts field was left blank and none could be filled in. Enter your MX hosts yourself — this is expected for a domain whose DNS is hosted elsewhere.

"MTA-STS configuration already exists for this zone."

A domain has one policy. Edit the existing one.

"Hosted MTA-STS needs … to be an active domain"

The domain is parked. Activate it under Manage Domains. The same applies to Hosted TLS-RPT.

Status is Failed

Certificate issuance failed after its automatic retries, or the CNAME never appeared. Fix the cause shown on the policy and click the retry icon. If your domain has a CAA record, it must allow Let's Encrypt to issue for mta-sts.<your domain>.

"Saved, but _mta-sts… could not be updated"

The policy change is saved, but senders have not been told to fetch it. Click the republish icon once the cause is fixed.

"A policy with no mx hosts tells senders that no server is authorised to receive your mail."

You cleared every MX host while editing. Enter at least one, set the mode to none, or delete the policy.

TLS Reports says the record is published but no reports arrive

If your DNS is hosted elsewhere, check that the TLS reporting CNAME exists and shows Live in the domain's DNS setup.

11. Limits and Constraints

12. Related Features

• DMARC Reporting — who sends mail as your domain.
• Hosted DKIM and SPF Flattening — authentication for the mail you send.
• BIMI — your logo beside your messages.
• The free MTA-STS checker — look up any domain's MTA-STS record, policy file and TLS-RPT record.

13. Updates and Behavior Changes

• 30 September 2026. This article now describes domains whose DNS is hosted elsewhere, where you create CNAMEs for the policy host, the policy record and TLS-RPT; earlier versions said CertaDNS published every record, which is true only on Managed DNS. MX hosts are filled in automatically only for Managed DNS domains.
• MTA-STS and TLS-RPT are included from the Plus tier up.