MTA-STS Hosting

MailShield can host your MTA-STS policy, simplifying the deployment of strict transport security for email.

What is MTA-STS?

MTA-STS (Mail Transfer Agent Strict Transport Security) is a security standard that:

• Enforces TLS encryption for email delivery
• Prevents downgrade attacks
• Protects against man-in-the-middle attacks
• Requires certificates to be valid

Learn more about MTA-STS →

Why Use MailShield Hosting?

Without MailShield

To deploy MTA-STS yourself, you need:

1. A DNS TXT record at _mta-sts.yourdomain.com
2. A web server at mta-sts.yourdomain.com
3. Valid HTTPS certificate
4. Policy file at /.well-known/mta-sts.txt
5. Ongoing maintenance and monitoring

With MailShield

MailShield handles:

• ✅ Policy file hosting
• ✅ Automatic HTTPS certificates
• ✅ High availability infrastructure
• ✅ Policy validation
• ✅ Continuous monitoring and alerts

You only add 2 DNS records:

mta-sts.yourdomain.com    CNAME   mta-sts.mailshield.app
_mta-sts.yourdomain.com   TXT     "v=STSv1; id=YOUR-POLICY-ID"

Setting Up MTA-STS Hosting

Step 1: Configure Your Policy

1. Navigate to Domains → [Your Domain] → MTA-STS
2. Enable MTA-STS if not already enabled
3. Configure your policy settings:

Option	Description
Mode	testing (report issues) or enforce (require TLS)
MX Hosts	Your mail server hostnames
Max Age	How long senders cache the policy (seconds)

4. Toggle Hosted by MailShield to enable hosted mode
5. Click Save Configuration

Step 2: Copy Your Policy ID

After saving, MailShield generates a unique Policy ID for your domain. You'll see:

• The Policy ID displayed (e.g., 20240115120000)
• A Rotate ID button to generate a new ID when needed

TIP

The Policy ID changes whenever your policy is updated. Always update your DNS TXT record when the ID changes.

Step 3: Add DNS Records

Add these two DNS records at your domain registrar:

CNAME Record (for the policy file):

mta-sts.yourdomain.com.  CNAME  mta-sts.mailshield.app.

TXT Record (to signal MTA-STS is enabled):

_mta-sts.yourdomain.com.  TXT  "v=STSv1; id=YOUR-POLICY-ID"

Replace YOUR-POLICY-ID with the Policy ID shown in MailShield.

Step 4: Verify Configuration

1. Click Check DNS Configuration in MailShield
2. MailShield verifies:
   • ✓ CNAME record points to mta-sts.mailshield.app
   • ✓ TXT record contains correct policy ID
3. Both checks should show green checkmarks when configured correctly

DNS Propagation

DNS changes can take up to 48 hours to propagate. If checks fail immediately after adding records, wait and try again.

Managing Your Policy

Updating Policy Settings

When you change your MTA-STS policy (mode, MX hosts, or max age):

1. Update settings in MailShield and save
2. Click Rotate ID to generate a new policy ID
3. Update your DNS TXT record with the new ID
4. Click Check DNS Configuration to verify

Rotating the Policy ID

The Rotate ID button generates a new policy ID. Use this when:

• You've changed your policy settings
• You want to force senders to re-fetch your policy
• You're troubleshooting caching issues

After rotating:

1. Copy the new Policy ID
2. Update your _mta-sts TXT record
3. Wait for DNS propagation
4. Verify with Check DNS Configuration

DNS Check Results

The Check DNS Configuration button verifies:

Check	What It Validates
CNAME/IP	mta-sts. subdomain points to MailShield
TXT Record	_mta-sts. contains correct v=STSv1; id=...

Each check shows:

• ✅ Green checkmark: Correctly configured
• ❌ Red X: Configuration issue (with details)

Policy Options

Mode

Mode	Behavior
testing	Senders report failures but still deliver mail
enforce	Senders must use TLS or reject delivery

Recommended approach:

1. Start with testing mode
2. Configure TLS-RPT to receive failure reports
3. Monitor for 2-4 weeks
4. Fix any issues discovered
5. Switch to enforce mode

MX Hosts

List all mail servers that receive email for your domain:

mail.yourdomain.com
mail2.yourdomain.com
*.mail.yourdomain.com

Important:

• Include all hosts from your MX records
• Wildcards are supported (*.example.com)
• Hosts must have valid TLS certificates

Max Age

How long senders cache your policy:

Duration	Seconds	Use Case
1 day	86400	Testing, frequent changes
1 week	604800	Standard operation
1 month	2592000	Stable configuration

Recommendation: Start with 1 day during testing, increase after stabilization.

How It Works

When a sending mail server wants to deliver email to your domain:

1. Sender queries _mta-sts.yourdomain.com TXT
   → Gets: v=STSv1; id=20240115120000

2. Sender fetches https://mta-sts.yourdomain.com/.well-known/mta-sts.txt
   → Your CNAME redirects to mta-sts.mailshield.app
   → MailShield serves your policy

3. Sender reads policy:
   → mode: enforce
   → mx: mail.yourdomain.com
   → max_age: 604800

4. Sender connects to your mail server with TLS
   → Verifies certificate matches MX host
   → Delivers email securely

Monitoring

MailShield continuously monitors your MTA-STS configuration:

Automatic Checks (Every 2 Hours)

• DNS record exists and is correct
• Policy file is accessible
• Policy ID matches DNS record
• MX hosts in policy match your MX records

Alerts

Get notified when:

• DNS stops pointing to MailShield
• Policy ID mismatch detected
• MX hosts don't match DNS records
• Configuration changes unexpectedly

TLS-RPT Integration

For complete visibility, also configure TLS-RPT:

_smtp._tls.yourdomain.com.  TXT  "v=TLSRPTv1; rua=mailto:YOUR-ID@reports.mailshield.app"

This enables:

• Reports on TLS connection attempts
• Failure notifications from sending servers
• Statistics on MTA-STS effectiveness

Learn more about TLS-RPT →

Troubleshooting

CNAME Check Failing

"CNAME points to wrong target"

• Verify CNAME value is exactly mta-sts.mailshield.app
• Remove any trailing dots if your registrar adds them automatically

"No CNAME, A, or AAAA records found"

• DNS record not created or hasn't propagated
• Wait up to 48 hours for propagation
• Verify at your registrar that the record exists

TXT Record Check Failing

"TXT record has wrong ID"

• Update the TXT record with the current Policy ID from MailShield
• Make sure to include the full value: v=STSv1; id=YOUR-ID

"TXT record missing v=STSv1"

• Ensure the record format is correct
• Check for typos or extra spaces

"No TXT record found"

• Create the TXT record at _mta-sts.yourdomain.com
• Note the underscore prefix

Policy Not Loading

If sending servers can't fetch your policy:

1. Verify CNAME is correctly pointing to MailShield
2. Ensure Hosted by MailShield is enabled
3. Check that MTA-STS is enabled
4. Click Check DNS Configuration to diagnose

Migrating to MailShield Hosting

If you're currently self-hosting MTA-STS:

1. Configure your policy in MailShield (same settings)
2. Enable Hosted by MailShield
3. Note the new Policy ID
4. Update DNS:
   • Add CNAME for mta-sts. pointing to MailShield
   • Update TXT record with new Policy ID
5. Remove your old web server after DNS propagates
6. Verify with Check DNS Configuration

Best Practices

1. Start in testing mode to identify issues before enforcing
2. Configure TLS-RPT for visibility into connection failures
3. Monitor reports for 2-4 weeks before switching to enforce
4. Keep MX hosts updated when changing mail servers
5. Use reasonable max_age - 1 week is a good default
6. Rotate Policy ID whenever you change settings
7. Verify DNS after any changes using the Check DNS button