MTA-STS: encrypted mail delivery

Mail servers encrypt mail between them with STARTTLS, but plain STARTTLS can be stripped or redirected by anyone on the network path. MTA-STS (RFC 8461) lets a domain publish a policy that says "mail for me must go to these servers, over TLS, with a valid certificate". Mailocity works with MTA-STS in both directions.

Your domain's policy

Every hosted domain gets a policy, served at https://mta-sts.<your-domain>/.well-known/mta-sts.txt. It names the Mailocity mail host as the only mail server for your domain. The certificate for mta-sts.<your-domain> is issued automatically the first time another server asks for the policy.

Two records in your DNS checklist turn it on:

Type	Name	Value
CNAME	`mta-sts.<your-domain>`	the Mailocity mail host
TXT	`_mta-sts.<your-domain>`	`v=STSv1; id=<id>`

The settings are on each domain's page under MTA-STS (encrypted delivery), in the admin panel and in a team's domain admin panel, or PATCH /v1/tenants/{id}/domains/{domain} (corpsuite domain set TENANT DOMAIN mtaStsMode=enforce):

Setting	Default	What it does
`mtaStsMode`	`testing`	`testing` asks other servers to report problems but still deliver; `enforce` asks them to refuse to deliver unless TLS checks pass; `none` withdraws the policy.
`mtaStsMaxAge`	604800 (one week)	How long, in seconds, other servers may remember the policy. Between 86400 (a day) and 31557600 (a year).
`mtaStsId`	set for you	Changes whenever the mode or max age changes. Copy the new TXT record into your DNS after a change so other servers fetch the new policy.

The mode is Testing (report problems, still deliver), Enforce (strict) (deliver only over verified TLS to this server) or Off.

Check from outside on the same card (corpsuite domain mta-sts check TENANT DOMAIN) looks the TXT record up and fetches the policy the way other servers do, and says what is wrong: no record, an old id, a policy that cannot be fetched, another mode, or a policy that does not name this server.

Platform defaults

Under Settings → MTA-STS (corpsuite mta-sts set):

New domains start in a mode (Testing by default; Enforce or Off) with a max age. Existing domains keep their own.
Mail sent to domains with a policy: Follow each policy (the default, as RFC 8461 asks), Testing (deliver anyway and log what would have been refused, for sorting out delivery problems) or Ignore policies.

Moving to enforce

Publish the CNAME and TXT records with the default testing mode.
Check that your MX record points at the Mailocity mail host only. In enforce mode, servers will not deliver to any MX the policy does not name.
Set mtaStsMode to enforce and update the TXT record with the new id.

Turning it off

Servers that already have your policy keep it until it expires, even if the DNS records go away. To withdraw an enforce policy safely, set mtaStsMode to none first, publish the new TXT id, and keep the records in place for at least the old mtaStsMaxAge before removing them. Lower mtaStsMaxAge ahead of time if you plan to move your mail elsewhere.

Mail you send to other domains

Before delivering to another domain, Mailocity looks up its _mta-sts TXT record and, when the id is new, fetches its policy over HTTPS with a verified certificate. Policies are kept for their max_age and refreshed when the id changes.

enforce: mail goes only to MX hosts the policy names, only over STARTTLS, and only when the server's certificate is valid for its name. When none qualifies, the message stays in the queue and is retried like any temporary failure; after five days the sender gets a failure notice.
testing: the same checks run, problems are written to the server log, and mail is delivered anyway.
**No policy, or none:** opportunistic STARTTLS as before.

If a policy cannot be fetched (the web server is down, the certificate is wrong, the file is not valid), a previously fetched policy that has not expired keeps applying. Without one, mail is delivered as if the domain had no policy, as RFC 8461 requires.

Not yet

TLS-RPT: daily reports to domains about TLS failures, and collecting the reports other servers send about your domains.
DANE (TLSA records), the DNSSEC-based alternative.