Requiring encryption on mail sent to you (MTA-STS)

MTA-STS is a policy you publish that tells every other mail server on the internet how mail addressed to your domain must be delivered: over an encrypted connection, and only to the mail servers you name.

What can go wrong, stated plainly

A policy that requires encryption and names the wrong mail servers makes conforming senders refuse to deliver to you. Not a bounce you can see in Solstral: a rejection at somebody else's server, silently. That is the failure this whole feature is shaped around avoiding, and it is why the steps below are in the order they are.

Step 1 — publish TLS reporting first

TLS reporting is one TXT record on the same page. It asks the servers delivering to you to send a daily report of every connection where encryption failed. It changes nothing about how your mail is handled; it only makes failures visible. It is also the evidence that unlocks step 3, so publishing it is not optional if you intend to get there.

Step 2 — start in testing mode

Open MTA-STS on your domain's page and choose Start in testing mode. Before anything is published you are shown the exact list of mail servers the policy will permit, read from your own MX records. Read that list. You are the person who can tell at a glance whether it looks right — it should be your mail provider's servers, all of them, including the low-priority backups.

Publish the two DNS records shown. One TXT record announces that a policy exists; one CNAME points at us so we can serve the policy file over HTTPS on mta-sts.yourdomain.com. The certificate is issued for you and there is nothing to renew.

In testing mode, a sender that cannot satisfy the policy reports the failure and delivers the message anyway. Nothing can be turned away. That is the entire point of starting here.

Step 3 — require encryption, if and when the reports allow

Require encryption stays disabled until your TLS reports show a clean window: no failed connections, over a real period, with actual traffic behind it. If there is not enough evidence yet, the answer is no and the screen says why. We are deliberately cautious here for the same reason we are cautious about DMARC enforcement — the cost of being wrong lands on somebody else's mail, not on a metric.

There is no automatic promotion to enforcement. It is always a button a person presses.

If you change mail provider

This is the most likely way MTA-STS causes trouble, so it is worth knowing what happens. Your MX records change; a policy still naming the old servers would start turning your mail away. We re-read your MX every day, and when it changes we rebuild the policy and drop back to testing mode — the new list is one nobody has reviewed and no report has covered yet, so we will not keep requiring encryption against it. You get told why, and you can require it again once you have checked the list.

If we cannot look your records up on a given day we leave the policy exactly as it was rather than guessing. And if we go on being unable to confirm your mail servers, enforcement stops on its own and reverts to reporting only — a rule we can no longer check is a rule we stop applying.

You should still open this page after a provider migration and check the list.

Turning it off

Deleting the DNS records does not cancel a policy. A sender that cannot fetch a policy keeps using the one it already has — so removing the records early locks in whatever was last published, for up to a week, with no way for anyone to reach it.

Switch off publishes a withdrawal instead, and the screen tells you the date the records can safely come down. Until that date the Remove button stays disabled. Leave the records up; nothing is being enforced in the meantime.

Do you need this?

It is genuinely optional and it is not a Solstral requirement. It does not affect your campaign delivery, your open rates or your sending reputation — those are all about mail going out. Turn it on if protecting inbound mail from being read in transit matters to your business or your compliance obligations, and leave it off if it does not.