MTA-STS lets a receiving domain publish an HTTPS policy that tells supporting senders to require TLS and use approved MX hosts. The domain advertises that policy with a TXT record at _mta-sts, while the policy file lives at https://mta-sts.example.com/.well-known/mta-sts.txt. TLS-RPT uses a separate TXT record at _smtp._tls to request aggregate reports.
These records protect inbound transport to the domain; they do not repair SPF, DKIM, or DMARC for outbound mail. An MTA-STS policy can also disrupt delivery if its MX patterns do not match the domain's real receiving hosts or if the HTTPS endpoint is unavailable. The DNS advertisement, certificate, policy file, MX records, and mode have to agree.
What the record changes
Begin with testing mode and a valid TLS-RPT destination, confirm that the policy endpoint returns the required plain-text format over trusted HTTPS, and review reports before moving to enforce. Update the policy id when the file changes so supporting senders refetch it. Keep the policy's max_age and MX patterns with the mail-routing change record.
- RFC 8461 defines SMTP MTA Strict Transport Security and the HTTPS policy path used by supporting senders.
- RFC 8460 defines SMTP TLS aggregate reporting and the _smtp._tls TXT policy used to request reports.
- MTA-STS and TLS-RPT concern transport security for inbound delivery, while SPF, DKIM, and DMARC solve different authentication questions.
How to use this answer
An authentication check reads the domain's published SPF, DKIM, DMARC, MX, TLS reporting, MTA-STS, and related records, then validates syntax and relationships. The fix block contains proposed records for the customer's actual provider and order of operations. A domain can pass these checks and still reach spam, because reputation, volume, content, consent, and list quality live outside DNS.
- Check the visible From domain, sending service, return path, and DKIM signing domain before changing any record.
- Read the existing DNS, count SPF evaluation terms, find DKIM selectors, and evaluate DMARC alignment and reporting addresses.
- Apply one reviewed change at a time, wait for DNS propagation, and validate the published result before tightening policy.
Where the service stops
Reality Contact, LLC reads public DNS and public blocklist responses. We never log into your DNS, mail server, or sending platform, and we never send from your domain. You paste the proposed records. The scope is authentication-ready, not inboxing. List quality, content, volume, and sender reputation are outside what DNS can show. This is not legal advice, and mail-law compliance remains yours.
Sources: RFC 8461: MTA-STS; RFC 8460: SMTP TLS Reporting; Google MTA-STS and TLS reporting help.