MTA-STS Hosting

Requires: Pro plan, a verified domain, and the owner or admin role.

MTA-STS needs a policy file served over HTTPS at mta-sts.yourdomain.com. MailShield can serve that file for you, so you don't need a web server or a certificate for it. You add two DNS records:

mta-sts.yourdomain.com.   CNAME  mta-sts.mailshield.app.
_mta-sts.yourdomain.com.  TXT    "v=STSv1; id=YOUR-POLICY-ID"

MTA-STS applies to domains that receive email, so the MTA-STS page only appears for domains set to Sends and receives or Only receives. Learn more about MTA-STS →

Set Up Hosting

1. Open the domain and go to Checks → MTA-STS.

2. In Configure MTA-STS Policy, turn on Enable MTA-STS.

3. Set the policy:

   Setting	What it does
   Policy Mode	Testing reports TLS failures but still delivers. Enforce makes senders refuse delivery when TLS fails. None tells senders to stop applying the policy, for when you turn MTA-STS off. Start with Testing.
   Allowed MX Hosts	Your mail server host names. Click Add current MX servers to copy them from your MX records. A wildcard such as *.example.com matches one label: mx1.example.com, but not a.mx1.example.com.
   Max Age	How long senders cache the policy, in seconds: from 86400 (1 day) to 31557600 (1 year). The default is 604800 (1 week).

4. Under How would you like to deploy your policy?, choose Hosted by MailShield.

5. Click Save Configuration. MailShield generates the Policy ID.

6. Add the CNAME and TXT records shown under DNS Configuration at your DNS provider. The TXT record must contain the saved Policy ID.

7. Click Check DNS Configuration. It confirms that mta-sts.yourdomain.com points to MailShield and that the TXT record has the saved Policy ID.

DNS Propagation

DNS changes can take up to 48 hours to propagate. If a check fails right after you add the records, wait and try again.

Changing Your Policy

Senders cache your policy for up to its max age. They only fetch it again when the id in your _mta-sts TXT record changes. MailShield gives the policy a new Policy ID whenever you save a change to the mode, MX hosts or max age.

So after every policy change:

1. Change the settings and click Save Configuration. The confirmation shows the new Policy ID.
2. Update the _mta-sts TXT record with the new Policy ID.
3. Click Check DNS Configuration.

To make senders fetch the policy again without changing it, click Rotate ID. It saves your settings right away with a new ID; then update the TXT record. Policy IDs are 1 to 32 letters and digits. If an older ID contains other characters, MailShield flags it: rotate it and update the record.

Moving to Enforce

1. Add a TLS-RPT record with your Reporting address, so sending servers report TLS failures to MailShield.
2. Run in Testing mode for a few weeks and watch the TLS reports under Reports → TLS.
3. Fix any failures, such as a certificate that doesn't match an MX host name.
4. Switch Policy Mode to Enforce, save, and update the TXT record with the new Policy ID.

Turning MTA-STS Off

Senders that cached an enforce policy keep enforcing it until its max age runs out, even after you delete the records. To turn MTA-STS off safely:

1. Switch Policy Mode to None, save, and update the TXT record with the new Policy ID. Senders that fetch the new policy stop applying MTA-STS.
2. Keep both records in place for at least the previous max age, so every sender's cached policy is replaced or has expired.
3. Remove the _mta-sts TXT record and the mta-sts CNAME, then turn off Enable MTA-STS and save.

Monitoring

MailShield checks MTA-STS every 2 hours, like your other records. With DNS changes alerts on, you're told when the record is removed or becomes invalid, the mode changes, or the policy file can no longer be fetched. See Alerts.

Troubleshooting

Check DNS Configuration reports what it found for each record.

CNAME

Message	Fix
"CNAME points to ..., expected mta-sts.mailshield.app"	Point the mta-sts CNAME at exactly mta-sts.mailshield.app
"No CNAME, A, or AAAA records found for mta-sts subdomain"	Create the CNAME, or wait for DNS to propagate
"Found A/AAAA records but no CNAME"	Replace the A/AAAA records for mta-sts with the CNAME

TXT Record

Message	Fix
"No TXT record found at _mta-sts.yourdomain.com."	Create the TXT record. Note the underscore in _mta-sts
"The TXT record at _mta-sts.yourdomain.com doesn't start with v=STSv1."	Use the full value, v=STSv1; id=YOUR-POLICY-ID. v=STSv1 is case-sensitive
"Found 2 MTA-STS records at _mta-sts.yourdomain.com."	Remove all but one: senders ignore MTA-STS while there are several
"Save the configuration first to generate a policy ID."	Click Save Configuration first
"The TXT record has id=OLDID. Change it to id=NEWID."	Update the record with the Policy ID shown in MailShield
"The TXT record has no id."	Add id= with the Policy ID shown in MailShield

If a lookup fails, the check says so ("Couldn't check: the DNS lookup failed.") rather than guessing. Try again in a few minutes.

Senders Can't Fetch the Policy

1. Check that Enable MTA-STS is on and Hosted by MailShield is selected.
2. Check that the CNAME points to mta-sts.mailshield.app.
3. Click Check DNS Configuration to diagnose.

Moving From Self-Hosting

1. Configure the same policy in MailShield and choose Hosted by MailShield.
2. Click Save Configuration and note the Policy ID.
3. Point the mta-sts host name at mta-sts.mailshield.app with a CNAME, and update the TXT record with the new Policy ID.
4. Click Check DNS Configuration.
5. Shut down your old policy server once DNS has propagated.