What is a TXT record?

`TXT` TXT Record: MTA-STS

MTA-STS prevents email from being delivered over unencrypted connections. Learn the DNS TXT record, the policy file, and how to deploy it.

Published May 10, 2026 · Last verified August 7, 2026 · Maintained by TamingDNS

Record Type
TXT

Category
Authentication (TXT)

RFC
RFC 8461

Email Relevant
Yes

Format
TXT "v=STSv1; id=<policy-id>"

Example
TXT "v=STSv1; id=20240101120000Z"

TTL Guidance
3600 s; bump the id value and lower TTL before publishing a new policy

💬 What This Record Does

MTA-STS (Mail Transfer Agent Strict Transport Security) prevents email from being delivered to your servers over unencrypted or invalid-TLS connections. It works in two parts: a TXT record at _mta-sts.example.com signals that a policy exists, and a policy file hosted at https://mta-sts.example.com/.well-known/mta-sts.txt describes the policy (enforce, testing, or none) and which MX hosts it applies to. Sending servers that support MTA-STS will refuse to deliver mail if they can't establish a valid TLS connection.

Common Uses

Preventing SMTP downgrade attacks that strip TLS from inbound connections
Enforcing TLS for inbound email alongside DANE/TLSA for defence in depth
Meeting security compliance requirements for encrypted email transport

⚠️ Watch Out For

The "enforce" policy will cause mail to bounce if your MX servers have invalid TLS certificates. Test with "testing" mode first.
The policy file must be served over HTTPS on the exact subdomain mta-sts.<yourdomain>.
Pair with TLS-RPT (SMTP TLS Reporting) to receive alerts when delivery fails due to TLS issues.

📋 Complete Example Records

Whole records in zone-file form: name, TTL, class, type, then the data. Most DNS panels ask for the pieces separately. Look them up live with the DNS Lookup tool.

_mta-sts.example.com.  3600  IN  TXT  "v=STSv1; id=20160831085700Z;"

The record from RFC 8461 §3.1. It is only a pointer: the policy itself is fetched over HTTPS from mta-sts.example.com.

_mta-sts.example.com.  3600  IN  TXT  "v=STSv1; id=20260806143000Z;"

The same record after a policy change. Senders compare the id against the one they cached, so it MUST change whenever the policy file does.

mta-sts.example.com.  3600  IN  CNAME  example-com.mta-sts.provider.example.net.

This is the second half of the setup. The name has to serve the policy file over valid HTTPS, and it is a separate host from the _mta-sts TXT record.

_smtp._tls.example.com.  3600  IN  TXT  "v=TLSRPTv1; rua=mailto:tlsrpt@example.com"

TLS-RPT, a different record that often gets confused with this one. Publish it alongside MTA-STS so a failed TLS delivery is reported to you rather than passing unnoticed.