MTA-STS (Mail Transfer Agent Strict Transport Security) helps ensure that inbound email to your domain is delivered securely over TLS, protecting against downgrade and man-in-the-middle attacks. With Valimail Enforce, you can simplify MTA-STS deployment by using Valimail’s hosted policy feature, eliminating the need to stand up and maintain your own HTTPS endpoint for the policy file.
Note: Before setting up your MTA-STS policy, we recommend first publishing the TLS-RPT record. Having this reporting in place ensures you can safely monitor and validate your MTA-STS deployment. Set up TLS reporting following the instructions here.
MTA-STS hosting is available exclusively in Valimail Enforce and is not supported in Valimail Monitor. If you are using Monitor, you’ll need to host your MTA-STS policy externally.
Before configuring your MTA-STS policy in Valimail Enforce, you’ll first need to publish a couple of DNS records to enable policy discovery and direct senders to Valimail’s hosted policy service.
Create the MTA-STS discovery CNAME
Create the MTA-STS discovery CNAME
This allows sending servers to discover your MTA-STS policy ID via DNS.
Host/Name:
_mta-sts.<yourdomain>Type: CNAME
Target:
<yourdomain>._mta-sts.vali.emailTTL: 3600
Point mta-sts.<domain> to Valimail for hosted policy
Point mta-sts.<domain> to Valimail for hosted policy
This ensures that requests for your policy file are routed to Valimail’s hosted service.
Host/Name:
mta-sts.<yourdomain>Type: CNAME
Target:
policy.mta-vali.emailTTL: 3600
After the CNAME records above are published in the DNS, you'll need to configure the MTA-STS policy following these steps:
1. Open Enforce and log in.
2. Go to DOMAINS in the side menu.
3. Click on the domain you want to configure the MTA-STS policy for.
4. Click on the MTA-STS Policy.
5. Select Policy Mode.
Testing - Recommended when first setting up MTA-STS. Sending MTAs that also implement the TLSRPT (TLS Reporting) specification send a report indicating policy application failures (as long as TLSRPT is also implemented by your domain); in any case, messages may be delivered as though there were no MTA-STS validation failure.
Enforce - Sending MTAs MUST NOT deliver the message to hosts that fail MX matching or certificate validation or that do not support STARTTLS.
None - Sending MTAs should treat the Policy Domain as though it does not have any active policy. No TLS reports will be generated.
6. Add the MX Hosts. In case your Domain has multiple MX hosts, they all need to be added one by one.
7. Set Max Age.
8. Click SAVE.