Configuring MTA-STS and TLS-RPT (Inbound)
Updated 3 days ago
by
admin
What is MTA-STS?
MTA-STS stands for Mail Transfer Agent Strict Transport Security, an email security standard that encrypts by enforcing TLS inbound emails to your domain. It works by requiring external servers to send emails to our system only if the connection is encrypted with TLS 1.2 or higher and a valid public certificate which EMS uses.
What is TLS-RPT?
TLS-RPT or TLS reporting is a standard that allows Remote parties to report any issues via email, specifically the likes of delivery failures, during the TLS encryption process.
Effects of having an incorrect configuration
If you do not have the correct MX records listed or do not update the id this can mean that some domains will not send to you like Google and Hotmail. Therefore, it is critically important that you fully understand the process and configure the standard correctly.
How to configure MTS-STS and TLS-RPT
The steps to create a Policy for MTA-STS are below:
- Create a text file to publish to your URL
To create the text file, you will need several parameters that will make up the policy.
Parameter | Value(s) | Description |
version: | STSv1 | Must be the first line and must contain value STSv1 for this policy file to be valid. |
mode: | testing, enforce, none | testing - monitoring mode, MTA-STS is used, but the sending sever can fall back to plain text in case of TLS failure. A report will be sent if TLS-RPT is enabled. |
enforce - enforced mode meaning TLS 1.2 or above must be used. A report will be sent if TLS-RPT is enabled. | ||
none - Used to disable mta-sts, this is covered later in this document. | ||
mx: | <your domain mx records> | mx: list your mail hosts, one on each line of the file, for example, mx: mta01.scanscope.net. |
max_age: | <number of seconds> | This field in seconds is the maximum permissible time that a sending email service can cache the policy. We recommend this be set to 24 hours when in testing mode (i.e. 86400) and no more than 2 weeks in enforced mode (i.e. 1209600) |
An example entry would be:
version: STSv1
mode: enforce
mx: mta01.scanscope.net
mx: mail3.scanscope.net
mx: mail2.scascnope.net
mx: mail1.scanscope.net
max_age: 1209600
Once the text file has been created it is needed to be published to a specific URL.
https://mta-sts.<your domain>/.well-known/mta-sts.txt
- Create and publish a _mta-sts.<yourdomain.tld> DNS entry
To complete the full mta-sts policy you will need to create a txt record in your DNS.
This is a TXT record for _mta-sts.<yourdomain.tld> and the value contains two parameters. v=STSv1 is a required parameter, but id needs to be a value from 1 to 32 characters.
The ID= entry is a policy file version and is critical to update the number if a change is made. This help inform senders that your record has been updated and they should refer to the record rather than relying on the cached version.
It is common to see the date of the entry in the format of YYYYMMDD.
An example entry would be:
v=STSv1; id=20240101
Once published to the DNS, mta-sts will be configured and will start to function.
Steps to create a TLS-RPT or TLS reporting are as follows.
To create and publish a DNS entry for _smtp._tls. <yourdomain>
As an email administrator you should publish a DNS record at _smtp._tls. <yourdomain> which is a TXT record. You will require the parameter v=TLSRPTv1 and a rua= parameter which contains an email address you want reports sent to, for example:
v=TLSRPTv1;rua=mailto:tls-rua@<yourdomain>
When an MTA-STS ‘testing’ or ‘enforce’ policy is present, you will receive reports from services that have sent you email. When testing, the reports show how your email service will handle email traffic inbound to your domain. Once you are confident that no normal mail flow will be affected you can move to an enforce policy. It is similar in concept to DMARC reporting.
Updating/Moving to Email Security for MTS-STS
If you are moving to the Email Security product you need to update your MTA-STS policies once your MX records are changed.
- Edit the mta-sts.txt which is published on your URL o add EMS mx records.
An example format would be:
version: STSv1
mode: enforce
mx: mta01.scanscope.net
mx: mail3.scanscope.net
mx: mail2.scascnope.net
mx: mail1.scanscope.net
max_age: 1209600
Once the file has been published to the web site you need to update your DNS _mta-sts.<yourdomain> entry.
An example entry would be:
v=STSv1; id=20241230
Removing/Disabling MTS-STS
- Set MTA-STS Mode to 'None': Begin by adjusting the MTA-STS mode to 'none' in the text file hosted by your web site.
- Update the DNS Assertion Record: Modify the TXT record located at _mta-sts.<yourdomain> to notify senders of the policy alteration. Essentially you need to update and increment the TXT record the ID= entry and increase the number or version of the policy. This help inform senders that your record has been updated and they should refer to the record rather than relying on the cached version.
- Maintain MTA-STS Policy Service: Ensure that the MTA-STS policy service remains active for the duration specified in the max_age parameter of your MTA-STS policy. This is typically recommended as a 2-week period.
- Remove DNS Entries for MTA-STS: After the max_age cooldown period has elapsed, you can safely delete the DNS entries for MTA-STS, which include _mta-sts.<yourdomain>.