Skip to main content

Hosted MTA-STS

The Hosted MTA-STS page lets you configure MTA-STS (Mail Transfer Agent Strict Transport Security) for your domain through Palisade. MTA-STS enforces TLS encryption for inbound email, preventing downgrade attacks where a man-in-the-middle could intercept mail delivered in plaintext.

note

Hosted MTA-STS requires DMARC monitoring to be set up first. Enable it from the gear menu on the Domain Overview page.

How It Works​

MTA-STS works by publishing a policy file at https://mta-sts.<yourdomain>/.well-known/mta-sts.txt along with a DNS TXT record at _mta-sts.<yourdomain>. When Hosted MTA-STS is active, Palisade hosts the policy file and manages the DNS records via CNAME delegation.

DNS Setup​

Palisade provides two CNAME records to add to your DNS:

  1. A CNAME for mta-sts.<yourdomain> — points to the Palisade-hosted policy file
  2. A CNAME for _mta-sts.<yourdomain> — points to the Palisade-managed TXT record

TLS Reporting (TLS-RPT)​

Once the policy is in place, the page also shows a TLS Reporting (TLS-RPT) panel with a third record: a TXT record at _smtp._tls.<yourdomain>. This is what tells sending servers where to report their TLS connection results.

Add it. Without it, senders enforce your policy but never tell you whether they succeeded, which leaves you with no evidence to justify moving from Testing to Enforce. Reports arrive within 24 to 48 hours and appear on the TLS Reports page.

Policy Configuration​

Mode​

  • Testing — report-only mode. Sending servers will still deliver in plaintext if TLS fails, but will send TLS-RPT reports. Use this initially to verify your mail servers support TLS.
  • Enforce — strict mode. Sending servers must use TLS or the message will not be delivered.
  • None — disables the policy.
warning

Always start in Testing mode. Enforce mode will cause mail delivery failures if any sending server cannot negotiate a TLS connection with your mail servers. Run in Testing for at least a week and review the TLS Reports page to confirm all inbound mail is arriving over TLS before switching to Enforce.

Max Age​

Controls how long sending servers cache the policy. Options:

  • 1 day — useful during testing or when making frequent changes
  • 1 week — a good balance for active configuration
  • 30 days — recommended for stable configurations
  • 1 year — maximum caching for stable, long-term policies

MX Hosts​

The list of mail server hostnames that are authorized to receive mail for your domain. Palisade auto-populates this from your MX records.

Domain Status​

A status badge at the top shows:

  • Active — MTA-STS is live and verified
  • Verifying — waiting for DNS propagation
  • Error — DNS verification failed
  • Inactive — MTA-STS is not enabled

Disabling Hosted MTA-STS​

To disable MTA-STS, click Disable and confirm the action. You should also remove the CNAME records from your DNS provider.